3 ms·

There was the teensy problem of being an unending bag of security vulnerabilities. Java Applets were its only competitor, and Java had the disadvantage of being

by o11c 3y ago

There was the teensy problem of being an unending bag of security vulnerabilities. Java Applets were its only competitor, and Java had the disadvantage of being fundamentally designed without security in mind.

neverdied 3y ago
people making login systems in flash should honestly be ashamed of themselves
lmm 3y ago
> Java had the disadvantage of being fundamentally designed without security in mind. Nonsense. Java is one of very few languages that was designed to handle untrusted code from day 1, and it showed in having far fewer vulnerabilities than Flash. Unfortunately the JVM was slow to start up, so you had an even worse "grey rectangle effect" than Flash, and applets like all plugins were poorly integrated with the rest of the page. Top that off with Java not being particularly great for writing UI or video in (it's fine, but it's not great) whereas Flash had excellent tools for doing vector animations and you can see why Flash was more popular.
- o11c 3y ago
  The very idea of having a `SecurityManager` that runs in the same VM is nonsensical, but that's what Java did. Java was designed - and widely used - as a general-purpose language with full platform capabilities. Flash at least implemented a VM with a fairly minimal surface. It can only blame its quality of implementation.
  - lmm 3y ago
    > The very idea of having a `SecurityManager` that runs in the same VM is nonsensical, but that's what Java did. Lolwhat? It's fine. It worked great. (It had some vulnerabilities in its history, but so does every sandbox/hypervisor/what-have-you out there)
    - cyberax 3y ago
      Not really. The whole SecurityManager thingie was a fiasco from the start. It granted access to _code_, not to the environment. Basically, you declared in the manifest that "com.mycompany.blah.*" wants to have full access rights, and SM granted permissions to that _code_. So it was predictably easy to subvert this, because Java code was not typically written in defensive style, sanitizing all the input data. All the modern sandboxes instead isolate the environment.
strken 3y ago
s/Java had the disadvantage/Flash had the disadvantage/ perhaps?
jcranmer 3y ago
Don't forget stability issues. Flash was (before being banished to a separate process) the single largest contributor of crashes in Firefox, responsible for about ⅓ of them. Even in its dying days, I'd "fix" a slow page by wandering over to a terminal and typing "kill -9 plugin-container" to kill all the Flash instances on the page. I shed tears for the Flash games that were killed off by the demise of Flash. I don't shed any tears for Flash itself.
- Jnr 3y ago
  Just tried the Ruffle demo, it crashed my Firefox. :D
taylorius 3y ago
Back in the day, before flash added 3d I wrote a flash player emulator in a Java Applet, as a "UI System" for our 3D engine. Looking back, I've literally no idea what the hell I was thinking. :-)

by o11c 3y ago

neverdied 3y ago

people making login systems in flash should honestly be ashamed of themselves

lmm 3y ago

> Java had the disadvantage of being fundamentally designed without security in mind. Nonsense. Java is one of very few languages that was designed to handle untrusted code from day 1, and it showed in having far fewer vulnerabilities than Flash. Unfortunately the JVM was slow to start up, so you had an even worse "grey rectangle effect" than Flash, and applets like all plugins were poorly integrated with the rest of the page. Top that off with Java not being particularly great for writing UI or video in (it's fine, but it's not great) whereas Flash had excellent tools for doing vector animations and you can see why Flash was more popular.

o11c 3y ago
The very idea of having a `SecurityManager` that runs in the same VM is nonsensical, but that's what Java did. Java was designed - and widely used - as a general-purpose language with full platform capabilities. Flash at least implemented a VM with a fairly minimal surface. It can only blame its quality of implementation.
- lmm 3y ago
  > The very idea of having a `SecurityManager` that runs in the same VM is nonsensical, but that's what Java did. Lolwhat? It's fine. It worked great. (It had some vulnerabilities in its history, but so does every sandbox/hypervisor/what-have-you out there)
  - cyberax 3y ago
    Not really. The whole SecurityManager thingie was a fiasco from the start. It granted access to _code_, not to the environment. Basically, you declared in the manifest that "com.mycompany.blah.*" wants to have full access rights, and SM granted permissions to that _code_. So it was predictably easy to subvert this, because Java code was not typically written in defensive style, sanitizing all the input data. All the modern sandboxes instead isolate the environment.

strken 3y ago

s/Java had the disadvantage/Flash had the disadvantage/ perhaps?

jcranmer 3y ago

Don't forget stability issues. Flash was (before being banished to a separate process) the single largest contributor of crashes in Firefox, responsible for about ⅓ of them. Even in its dying days, I'd "fix" a slow page by wandering over to a terminal and typing "kill -9 plugin-container" to kill all the Flash instances on the page. I shed tears for the Flash games that were killed off by the demise of Flash. I don't shed any tears for Flash itself.

Jnr 3y ago
Just tried the Ruffle demo, it crashed my Firefox. :D

taylorius 3y ago

Back in the day, before flash added 3d I wrote a flash player emulator in a Java Applet, as a "UI System" for our 3D engine. Looking back, I've literally no idea what the hell I was thinking. :-)