Not many Facebook engineers, though, I suspect. And it's worth noting that even less technical users aren't so likely to click through all of the warnings when

Not many Facebook engineers, though, I suspect. And it's worth noting that even less technical users aren't so likely to click through all of the warnings when they're not expecting some kind of interactive game to play. That also reduces the risk. There will always be some people who click the links in their spam or open the fishy attachments, who give permission to anything and everything, and whose computers are so overloaded with malware, trojans, backdoors, etc. that they collapse under the weight. The main trick is to be sure that savvy users can keep themselves safe, and making sure people doing important things on their computers are savvy. I think Java is finally in a state now where it's safe for savvy users.