3 ms·
So, correct me if I'm wrong, but aren't these issues all around the sandbox functionality of applets? So specifically, to exploit these, you write a dodgy appl
by SCdF 13y ago
So, correct me if I'm wrong, but aren't these issues all around the sandbox functionality of applets?
So specifically, to exploit these, you write a dodgy applet, then convince users to run these applets locally (by hijacking websites or whatever), whereby you break out of the sandbox and do bad shit.
So then, in terms of how Java is generally used: on servers, on android, to execute code that runs locally on your box outside of a sandbox anyway (e.g. minecraft) these issues are in fact complete non-issues?
It seems to me that if they just split off the applet part into its own thing the world would be a far better place.
- frozenport 13y agoYou are wrong, the article isn't about the merit of applets, these issues deal with a company that doesn't want to support software that is deployed on millions of PCs.
- SCdF 13y agoWhen I said issues I meant the bugs which Oracle isn't fixing, not the issue that Oracle isn't fixing the issues. But I feel like you already knew that.
- eatmyshorts 13y agoMany of the bugs relate to the functionality of WebStart, which has nothing to do with applets. Basically, if Java is enabled in your browser, visiting a web page can start a full-blown Java application (not an applet) without requiring user interaction. This Java application could escalate privileges to root your system. This type of exploit is included now on a number of exploit systems, like Metasploit, that can be deployed easily by "script kiddies".