> "The runtime isn't written in a managed language, and that's where most of the vulnerabilities happen, right?" At least some of those Java vulnerabilities ar

> "The runtime isn't written in a managed language, and that's where most of the vulnerabilities happen, right?" At least some of those Java vulnerabilities are logic errors in the sandboxing/securitymanager parts that are supposed to prevent applets from accessing privileged APIs, and those checks are usually implemented inside the actual java.* standard library classes, in the Java language.