4 ms·
The point of Java is that it has access to things at system level. If you don't need that, use HTML.
by btian 14y ago
The point of Java is that it has access to things at system level. If you don't need that, use HTML.
- cma 14y agoThat is the point of trusted java applets that you opt in to, but not to standard applets that do something like animate a scientific model. Java handles sandboxing, but there is no reason the OS couldn't provide a backup. When something wants to run with elevated permissions you would get a prompt from Java, and then a prompt from the OS/browser. If Java had an exploit bypassing its own prompt, the OS and/or/in-conjunction-with browser would still prompt as soon as it tried to do something that required elevated permissions. Chrome does its own back-up sandboxing for Flash, even though Flash is supposed to do it itself, but Chrome lets other plugins slide (because Chrome doesn't have a notion or interface for user-controlled elevated permissions in its sandbox): http://productforums.google.com/forum/#!topic/chrome/err6mfbFqTs http://productforums.google.com/forum/#!topic/chrome/err6mfb... This is the failure I'm referring to. It is a concious decision and not an unintentional mistake, but it is still full of fail. Chrome used to have a --safe-plugins option that is mentioned in the linked thread and could have attempted to prevent something like this exploit and still allowed something like a Java-animated lava lamp or whatever.