3 ms·
It has nothing to do with Oracle's response -- the Java sandbox is simply broken, and has been known to be broken for at least the last 5 years. There's no fixi
by pifflesnort 14y ago
It has nothing to do with Oracle's response -- the Java sandbox is simply broken, and has been known to be broken for at least the last 5 years. There's no fixing it, the approach is fundamentally flawed and fundamental to Java.
This doesn't mean that Java for client-side applications is broken, as long as you don't rely on web based distribution and browser sandboxing.
- tjoff 14y ago"This doesn't mean that Java for client-side applications is broken[...]" I don't know. Java on the desktop requires administrator privileges to be able to notify me that an update is available. Also, it tries to install a virus in the form of "Ask toolbar" every frigging time.
- sp332 14y agoTry installing using http://ninite.com http://ninite.com, and use msconfig to make sure "Java Platform Auto Updater" is disabled from your startup.
- BigBlueSaw 14y agoCan you elaborate on "the approach is fundamentally flawed"? Don't we rely on a similar sort of sandboxing for Javascript in the browser?
- benmmurphy 14y agojava sandbox has a massive surface area. conceivably any class in the jre could create a hole in the sandbox. modern browser sandboxes appear to be stronger because they rely on an unprivileged process which communicates with a broker interface. the broker code is much smaller than the jre code so it is easier to verify. however, there has been sandbox bypasses. the adobe sandbox bypass was a bug in the broker interface and it can be possible to use local kernel exploits to bypass the sandbox as well.