4 ms·

> Reflections on the Java side. Am I reading this correctly meaning you send a "some_variable_that_i_know_about=deleteAll()" via Javascript and it will just ru

by andirk 3y ago

> Reflections on the Java side. Am I reading this correctly meaning you send a "some_variable_that_i_know_about=deleteAll()" via Javascript and it will just run `deleteAll()` method on a Java applet that has god knows what access it has to things on your machine?

jfoutz 3y ago
Yes. Applets were very slow to load, and more dangerous than flash. I think applet was the first tag removed. But at the time, you could load up excel in a tag with the right com magic. The early web boom was wild.
- DaiPlusPlus 3y ago
  > I think applet was the first tag removed. <applet> was never removed from HTML, but it was deprecated by HTML4.01 - but only because they wanted to use <object> as a single replacement element: https://www.w3.org/TR/html401/struct/objects.html#h-13.4 https://www.w3.org/TR/html401/struct/objects.html#h-13.4 Looks like <applet> was officially obsoleted sometime during the switch from HTML4.01 to the Living Specification version: https://html.spec.whatwg.org/multipage/obsolete.html#other-elements,-attributes-and-apis https://html.spec.whatwg.org/multipage/obsolete.html#other-e... - but the spec still permits using <object> or <embed> for Java applets: https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-object-element https://html.spec.whatwg.org/multipage/iframe-embed-object.h...
tinus_hn 3y ago
If the applet chooses to expose such a method; reflection is about finding out what methods are exposed. And while Java had plenty of security holes applets were definitely not supposed to have a lot of access to your computer.
- vbezhenar 3y ago
  Signed applets had access to your computer. Even just before they were completely removed from the browser, which was just 8 years ago. You had to click "confirm" here and there, but in the end it worked.

4 ms·

> Reflections on the Java side. Am I reading this correctly meaning you send a "some_variable_that_i_know_about=deleteAll()" via Javascript and it will just ru

by andirk 3y ago

jfoutz 3y ago
Yes. Applets were very slow to load, and more dangerous than flash. I think applet was the first tag removed. But at the time, you could load up excel in a tag with the right com magic. The early web boom was wild.
- DaiPlusPlus 3y ago
  > I think applet was the first tag removed. <applet> was never removed from HTML, but it was deprecated by HTML4.01 - but only because they wanted to use <object> as a single replacement element: https://www.w3.org/TR/html401/struct/objects.html#h-13.4 https://www.w3.org/TR/html401/struct/objects.html#h-13.4 Looks like <applet> was officially obsoleted sometime during the switch from HTML4.01 to the Living Specification version: https://html.spec.whatwg.org/multipage/obsolete.html#other-elements,-attributes-and-apis https://html.spec.whatwg.org/multipage/obsolete.html#other-e... - but the spec still permits using <object> or <embed> for Java applets: https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-object-element https://html.spec.whatwg.org/multipage/iframe-embed-object.h...
tinus_hn 3y ago
If the applet chooses to expose such a method; reflection is about finding out what methods are exposed. And while Java had plenty of security holes applets were definitely not supposed to have a lot of access to your computer.
- vbezhenar 3y ago
  Signed applets had access to your computer. Even just before they were completely removed from the browser, which was just 8 years ago. You had to click "confirm" here and there, but in the end it worked.