5 ms·

> … with JavaScript scripts used to modify the properties and behavior of Java objects Something I didn’t know was a consideration in the original spec of Java

> … with JavaScript scripts used to modify the properties and behavior of Java objects Something I didn’t know was a consideration in the original spec of JavaScript: some sort of Java applet interop. I really thought the name was just a nod to it being a curly-brace object-y language! Does anyone know what that looked like? I know of <object> to embed applets into the document, which you could pass arguments to via attributes set by JavaScript, but the wording in this doc sounds like JavaScript could somehow use Java object instances?

skrebbel 3y ago
It was quite a direct and ergonomic interface iirc. The magic term was LiveConnect, do I googled that and got to this amazing piece of history: https://www.oracle.com/java/technologies/javase/liveconnect-docs.html https://www.oracle.com/java/technologies/javase/liveconnect-... The first example is quite illustrative I think. You’d call custom methods on a Java applet the way you call DOM methods on a div.
cyberax 3y ago
Oh wow. A blast from the past. It was called "LiveConnect" and allowed JavaScript to call applet's methods, via reflection on the Java side. Here you go: https://docs.oracle.com/javase/tutorial/deployment/applet/invokingAppletMethodsFromJavaScript.html https://docs.oracle.com/javase/tutorial/deployment/applet/in... I remember using it to implement hardware key security for a website. A Java Applet loaded a JNI library, after exploiting a JRE security bug to escape confinement, which interacted with the hardware key. The JavaScript then handled all the "browsery" stuff like setting cookies. That was in 2001...
- andirk 3y ago
  > Reflections on the Java side. Am I reading this correctly meaning you send a "some_variable_that_i_know_about=deleteAll()" via Javascript and it will just run `deleteAll()` method on a Java applet that has god knows what access it has to things on your machine?
  - jfoutz 3y ago
    Yes. Applets were very slow to load, and more dangerous than flash. I think applet was the first tag removed. But at the time, you could load up excel in a tag with the right com magic. The early web boom was wild.
    - DaiPlusPlus 3y ago
      > I think applet was the first tag removed. <applet> was never removed from HTML, but it was deprecated by HTML4.01 - but only because they wanted to use <object> as a single replacement element: https://www.w3.org/TR/html401/struct/objects.html#h-13.4 https://www.w3.org/TR/html401/struct/objects.html#h-13.4 Looks like <applet> was officially obsoleted sometime during the switch from HTML4.01 to the Living Specification version: https://html.spec.whatwg.org/multipage/obsolete.html#other-elements,-attributes-and-apis https://html.spec.whatwg.org/multipage/obsolete.html#other-e... - but the spec still permits using <object> or <embed> for Java applets: https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-object-element https://html.spec.whatwg.org/multipage/iframe-embed-object.h...
  - tinus_hn 3y ago
    If the applet chooses to expose such a method; reflection is about finding out what methods are exposed. And while Java had plenty of security holes applets were definitely not supposed to have a lot of access to your computer.
    - vbezhenar 3y ago
      Signed applets had access to your computer. Even just before they were completely removed from the browser, which was just 8 years ago. You had to click "confirm" here and there, but in the end it worked.
- 0x0 3y ago
  Was it even an exploit? I seem to recall reading something about code-signed applets being allowed to load native dlls by design. Which is crazy, one single "trust signature" dialog prompt from infecting a system with malware...
  - Xophmeister 3y ago
    > one single "trust signature" dialog prompt Sweet summer child ;)
    - 0x0 3y ago
      I mean I'm sure there were a million exploits that would bypass even the check and prompt, but that doesn't change the fact that it's pretty crazy that native code execution was part of the design with just one small incomprehensible trust dialog.
      - withinboredom 3y ago
        I don't think there was any dialog at all. IIRC. At first, people weren't worried about security. It was just a bunch of us nerds on there. You interacted with real people that didn't seem like they were trying to swindle you. The world still used paper checks for anything big, and credit/debit cards were there, but not like today. It wasn't that uncommon to write a check and ask the shop owner to cash it next week, at least in my poor household. There wasn't "online banking" or "online identities" to steal, so it didn't seem all that important. The worst thing that would happen is you would lose access to a chat handle.
  - vbezhenar 3y ago
    > one single "trust signature" dialog prompt from infecting a system with malware How many dialog prompts are there to launch signed downloaded exe?
    - 0x0 3y ago
      At least running an .exe should be somewhat obvious to computer literate people. When I saw those signed applet dialog prompts, even as a developer it was not obvious to me that it also meant granting unsandboxed x86 code execution to a .dll/.so from the internet.
- samsquire 3y ago
  I wrote the beginnings of a Javascript game that used LiveConnect to connect to the TCP game server. this video shows netplay between tabs but i also tested it on a lan in a house (physically moving between computers): https://www.youtube.com/watch?v=vcwPOfVXRc0 https://www.youtube.com/watch?v=vcwPOfVXRc0 https://github.com/fuz/jspkmne https://github.com/fuz/jspkmne the java applet: https://github.com/fuz/jspkmnengine/blob/master/JSPKMNe.html#L493 https://github.com/fuz/jspkmnengine/blob/master/JSPKMNe.html... netplay code that Java applet calls: https://github.com/fuz/jspkmnengine/blob/master/netplay.js https://github.com/fuz/jspkmnengine/blob/master/netplay.js here's the java applet calling the Javascript of the game: https://github.com/fuz/jspkmnengine/blob/master/server/ClientThread.java https://github.com/fuz/jspkmnengine/blob/master/server/Clien...
  - samsquire 3y ago
    For some reason I typed the repository name wrong https://github.com/fuz/jspkmnengine https://github.com/fuz/jspkmnengine is the correct URL to the repository.
- dspillett 3y ago
  JavaScript was originally going to be called LiveScript, associated with LiveConnect. It was renamed for marketing reasons, because Java components were seen as the future for code on web pages, and it could script the interaction between different Java components (potentially from different sources). That fact it could be used equally for components written in other languages, if they were ever supported by object tags in common web UAs is why it had a more generic name initially.
  - tentacleuno 3y ago
    Fun fact: LiveScript is a FP-oriented language which compiles to JavaScript. It's been around for a while now :-) https://livescript.net/ https://livescript.net/
throw_m239339 3y ago
AKA ActiveX in Microsoft land...
seu 3y ago
I remember developing an "interactive CD" with an Encyclopedia in 1998, which distributed a customized version of IE 3.2 (IIRC using something called the "Internet Explorer Development Kit"). The search function consisted of Javascript code calling an applet (which did the search using an internal database implemented in pure data structures within the code) and writing the results in the HTML. The database inside the Applet was so big, that I had to split it in two to be able to compile it (or was it for it to run? I don't remember the exact issue). That's 25 years ago. Wow.
bandrami 3y ago
That was a big draw back then, along with the ability to interact with ASF and Real AV objects. We did a lot of really useless sites that did that in the late 90s.
grose 3y ago
I remember extremely old advice to use java.util.Date from JS, thought I was going crazy but this article from 1996 mentions it: https://www.infoworld.com/article/2077267/new-javascript-features-in-navigator-3-0.html https://www.infoworld.com/article/2077267/new-javascript-fea...
nix1996 3y ago
I designed and implemented LiveConnect. Previous comment here: https://news.ycombinator.com/item?id=1894374 https://news.ycombinator.com/item?id=1894374
shagie 3y ago
Invoking Applet Methods From JavaScript Code - https://docs.oracle.com/javase/tutorial/deployment/applet/invokingAppletMethodsFromJavaScript.html https://docs.oracle.com/javase/tutorial/deployment/applet/in... Invoking JavaScript Code From an Applet - https://docs.oracle.com/javase/tutorial/deployment/applet/invokingJavaScriptFromApplet.html https://docs.oracle.com/javase/tutorial/deployment/applet/in... It depended on a bit of other libraries installed (the live connect specification which really meant "just Netscape" - https://www.oracle.com/java/technologies/javase/plugin2.html#LIVECONNECT https://www.oracle.com/java/technologies/javase/plugin2.html... ).

skrebbel 3y ago

It was quite a direct and ergonomic interface iirc. The magic term was LiveConnect, do I googled that and got to this amazing piece of history: https://www.oracle.com/java/technologies/javase/liveconnect-docs.html https://www.oracle.com/java/technologies/javase/liveconnect-... The first example is quite illustrative I think. You’d call custom methods on a Java applet the way you call DOM methods on a div.

cyberax 3y ago

Oh wow. A blast from the past. It was called "LiveConnect" and allowed JavaScript to call applet's methods, via reflection on the Java side. Here you go: https://docs.oracle.com/javase/tutorial/deployment/applet/invokingAppletMethodsFromJavaScript.html https://docs.oracle.com/javase/tutorial/deployment/applet/in... I remember using it to implement hardware key security for a website. A Java Applet loaded a JNI library, after exploiting a JRE security bug to escape confinement, which interacted with the hardware key. The JavaScript then handled all the "browsery" stuff like setting cookies. That was in 2001...

andirk 3y ago
> Reflections on the Java side. Am I reading this correctly meaning you send a "some_variable_that_i_know_about=deleteAll()" via Javascript and it will just run `deleteAll()` method on a Java applet that has god knows what access it has to things on your machine?
- jfoutz 3y ago
  Yes. Applets were very slow to load, and more dangerous than flash. I think applet was the first tag removed. But at the time, you could load up excel in a tag with the right com magic. The early web boom was wild.
  - DaiPlusPlus 3y ago
    > I think applet was the first tag removed. <applet> was never removed from HTML, but it was deprecated by HTML4.01 - but only because they wanted to use <object> as a single replacement element: https://www.w3.org/TR/html401/struct/objects.html#h-13.4 https://www.w3.org/TR/html401/struct/objects.html#h-13.4 Looks like <applet> was officially obsoleted sometime during the switch from HTML4.01 to the Living Specification version: https://html.spec.whatwg.org/multipage/obsolete.html#other-elements,-attributes-and-apis https://html.spec.whatwg.org/multipage/obsolete.html#other-e... - but the spec still permits using <object> or <embed> for Java applets: https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-object-element https://html.spec.whatwg.org/multipage/iframe-embed-object.h...
- tinus_hn 3y ago
  If the applet chooses to expose such a method; reflection is about finding out what methods are exposed. And while Java had plenty of security holes applets were definitely not supposed to have a lot of access to your computer.
  - vbezhenar 3y ago
    Signed applets had access to your computer. Even just before they were completely removed from the browser, which was just 8 years ago. You had to click "confirm" here and there, but in the end it worked.
0x0 3y ago
Was it even an exploit? I seem to recall reading something about code-signed applets being allowed to load native dlls by design. Which is crazy, one single "trust signature" dialog prompt from infecting a system with malware...
- Xophmeister 3y ago
  > one single "trust signature" dialog prompt Sweet summer child ;)
  - 0x0 3y ago
    I mean I'm sure there were a million exploits that would bypass even the check and prompt, but that doesn't change the fact that it's pretty crazy that native code execution was part of the design with just one small incomprehensible trust dialog.
    - withinboredom 3y ago
      I don't think there was any dialog at all. IIRC. At first, people weren't worried about security. It was just a bunch of us nerds on there. You interacted with real people that didn't seem like they were trying to swindle you. The world still used paper checks for anything big, and credit/debit cards were there, but not like today. It wasn't that uncommon to write a check and ask the shop owner to cash it next week, at least in my poor household. There wasn't "online banking" or "online identities" to steal, so it didn't seem all that important. The worst thing that would happen is you would lose access to a chat handle.
- vbezhenar 3y ago
  > one single "trust signature" dialog prompt from infecting a system with malware How many dialog prompts are there to launch signed downloaded exe?
  - 0x0 3y ago
    At least running an .exe should be somewhat obvious to computer literate people. When I saw those signed applet dialog prompts, even as a developer it was not obvious to me that it also meant granting unsandboxed x86 code execution to a .dll/.so from the internet.
samsquire 3y ago
I wrote the beginnings of a Javascript game that used LiveConnect to connect to the TCP game server. this video shows netplay between tabs but i also tested it on a lan in a house (physically moving between computers): https://www.youtube.com/watch?v=vcwPOfVXRc0 https://www.youtube.com/watch?v=vcwPOfVXRc0 https://github.com/fuz/jspkmne https://github.com/fuz/jspkmne the java applet: https://github.com/fuz/jspkmnengine/blob/master/JSPKMNe.html#L493 https://github.com/fuz/jspkmnengine/blob/master/JSPKMNe.html... netplay code that Java applet calls: https://github.com/fuz/jspkmnengine/blob/master/netplay.js https://github.com/fuz/jspkmnengine/blob/master/netplay.js here's the java applet calling the Javascript of the game: https://github.com/fuz/jspkmnengine/blob/master/server/ClientThread.java https://github.com/fuz/jspkmnengine/blob/master/server/Clien...
- samsquire 3y ago
  For some reason I typed the repository name wrong https://github.com/fuz/jspkmnengine https://github.com/fuz/jspkmnengine is the correct URL to the repository.
dspillett 3y ago
JavaScript was originally going to be called LiveScript, associated with LiveConnect. It was renamed for marketing reasons, because Java components were seen as the future for code on web pages, and it could script the interaction between different Java components (potentially from different sources). That fact it could be used equally for components written in other languages, if they were ever supported by object tags in common web UAs is why it had a more generic name initially.
- tentacleuno 3y ago
  Fun fact: LiveScript is a FP-oriented language which compiles to JavaScript. It's been around for a while now :-) https://livescript.net/ https://livescript.net/

throw_m239339 3y ago

AKA ActiveX in Microsoft land...

seu 3y ago

I remember developing an "interactive CD" with an Encyclopedia in 1998, which distributed a customized version of IE 3.2 (IIRC using something called the "Internet Explorer Development Kit"). The search function consisted of Javascript code calling an applet (which did the search using an internal database implemented in pure data structures within the code) and writing the results in the HTML. The database inside the Applet was so big, that I had to split it in two to be able to compile it (or was it for it to run? I don't remember the exact issue). That's 25 years ago. Wow.

bandrami 3y ago

That was a big draw back then, along with the ability to interact with ASF and Real AV objects. We did a lot of really useless sites that did that in the late 90s.

grose 3y ago

I remember extremely old advice to use java.util.Date from JS, thought I was going crazy but this article from 1996 mentions it: https://www.infoworld.com/article/2077267/new-javascript-features-in-navigator-3-0.html https://www.infoworld.com/article/2077267/new-javascript-fea...

nix1996 3y ago

I designed and implemented LiveConnect. Previous comment here: https://news.ycombinator.com/item?id=1894374 https://news.ycombinator.com/item?id=1894374

shagie 3y ago

Invoking Applet Methods From JavaScript Code - https://docs.oracle.com/javase/tutorial/deployment/applet/invokingAppletMethodsFromJavaScript.html https://docs.oracle.com/javase/tutorial/deployment/applet/in... Invoking JavaScript Code From an Applet - https://docs.oracle.com/javase/tutorial/deployment/applet/invokingJavaScriptFromApplet.html https://docs.oracle.com/javase/tutorial/deployment/applet/in... It depended on a bit of other libraries installed (the live connect specification which really meant "just Netscape" - https://www.oracle.com/java/technologies/javase/plugin2.html#LIVECONNECT https://www.oracle.com/java/technologies/javase/plugin2.html... ).