3 ms·
AeroFS looks cool but I'm not too keen on having to run Java just to run AeroFS given that I had disabled Java on MacOS due to the recent exploits.
by newman314 14y ago
AeroFS looks cool but I'm not too keen on having to run Java just to run AeroFS given that I had disabled Java on MacOS due to the recent exploits.
- xyzzy123 14y agoI wouldn't worry about it. The Java to be disabling is the Java browser plugin, which allows un-trusted web sites to run applets in a sandbox on your machine. As you know, there have been a lot of issues with Java sandboxing. However, AeroFS runs locally (as far as I understand, I don't have an invite) so should be fine as long as you trust the provenance of the code.
- spartango 14y agoI believe those exploits are Java applets breaking out of the browser-plugin sandbox, which is designed to limit application access to even simple things like files and class loading. To be clear, these aren't strictly JVM vulnerabilities, and more plugin security-model vulnerabilities. Java "desktop" applications don't have such a sandbox and thus they already have access to things that the vulnerabilities enable (such as manipulating system properties). Really, we ought to treat Java desktop apps no differently than native binaries, bounded by the the OS' security model.