3 ms·

There are many tools such as ffmpeg, that you might want to run on untrusted input (e.g. file uploads), and in many cases performance is not that important. Ja

There are many tools such as ffmpeg, that you might want to run on untrusted input (e.g. file uploads), and in many cases performance is not that important. Java servlets, Lua and PHP modules cannot be run securely, and there are vulnerabilities for all of them.

fiddlerwoaroof 5y ago
> Java servlets, Lua and PHP modules cannot be run securely, and there are vulnerabilities for all of them The thing is, the JVM was designed with the explicit intention of making it possible to run untrusted code safely: how do we know we got it right this time? The problem really isn't the VM, it's the APIs and authorization model for access to the underlying system's features.
- gpm 5y ago
  Because browsers have a good track record of getting this right, and sufficient funding to get this right, and the server-side work gets to piggy-back on that. Also because the API surface area that server side apps need is really just not big, JVM had a lot of problems because it tried to do too much.