4 ms·

Could someone explain why Applets/Webstart is so insecure? I know that JRE itself isn't really bad, it's the web-plugin for Java that has security vurnabilities

by Skinney 13y ago

Could someone explain why Applets/Webstart is so insecure? I know that JRE itself isn't really bad, it's the web-plugin for Java that has security vurnabilities. But how so?

logn 13y ago
Because the full power of Java exists in Applets. Browsers do their best to sandbox it and to make sure users give permission before it is allowed outside the sandbox. There are probably other reasons too, but that's afaik the basic reason. I think it's a little unfair how the whole industry has treated Applets vs. Flash. Applets were pretty nice but Sun couldn't really fight it out like Adobe did against the other larger players. Anyhow, I disabled Applets and Flash recently myself too. The web works ok, thanks to Apple I guess, but I still need to flip on Flash occasionally.
- qwerta 13y ago
  Fucked up design, Sun's refusal to put any resources into fixing it.
- throwawaykf 13y ago
  Applets, whenever I used them, were also much, much slower to load than Flash.
Al-Khwarizmi 13y ago
Most of it is politics. Applets aren't fundamentally more insecure than other competing technologies like Flash or Silverlight. They just got a lot of hate, first due to the Microsoft "embrace and extend" attempts in the 90s (shipping its own awful JVM) and now again due to the buyout by Oracle with its horrible PR. It's nonsense that modern browsers treat Java applets as if they were radiactive material, showing lots of warnings and scary dialogs (and even forcing you to update) while they do nothing of the sort with Flash.
teyc 13y ago
Java was invented as a full fledged vm with libraries that provide disk access, start and stop processes, taking screenshots etc. In contrast, Javascript didn't even have these ideas. The only file access it has are through APIs like reading and writing cookies, and file uploads. Another example is Silverlight. Silverlight only provides a limited set of APIs that access the file system. For example, you cannot read any file unless it was initiated through user interaction via OpenFileDialog. Sandboxing, i.e. preventing untrusted code from calling privileged libraries like disk access through walking the call stack and making sure the call originated from a trusted source. This was tricky but it worked. In Java 7, a new object was invented, called the MethodHandle. This is functions as a first class object, and I suspect that when Oracle bought out the Sun, they lost some key engineers and there has been a slew of exploits via MethodHandle. Hopefully, this patch caught all of them.
smackfu 13y ago
If the JRE allows someone to make a system call, it's a feature. If the plugin allows the same call, it's a critical software bug.

by Skinney 13y ago

Could someone explain why Applets/Webstart is so insecure? I know that JRE itself isn't really bad, it's the web-plugin for Java that has security vurnabilities. But how so?

logn 13y ago

Because the full power of Java exists in Applets. Browsers do their best to sandbox it and to make sure users give permission before it is allowed outside the sandbox. There are probably other reasons too, but that's afaik the basic reason. I think it's a little unfair how the whole industry has treated Applets vs. Flash. Applets were pretty nice but Sun couldn't really fight it out like Adobe did against the other larger players. Anyhow, I disabled Applets and Flash recently myself too. The web works ok, thanks to Apple I guess, but I still need to flip on Flash occasionally.

qwerta 13y ago
Fucked up design, Sun's refusal to put any resources into fixing it.
throwawaykf 13y ago
Applets, whenever I used them, were also much, much slower to load than Flash.

Al-Khwarizmi 13y ago

Most of it is politics. Applets aren't fundamentally more insecure than other competing technologies like Flash or Silverlight. They just got a lot of hate, first due to the Microsoft "embrace and extend" attempts in the 90s (shipping its own awful JVM) and now again due to the buyout by Oracle with its horrible PR. It's nonsense that modern browsers treat Java applets as if they were radiactive material, showing lots of warnings and scary dialogs (and even forcing you to update) while they do nothing of the sort with Flash.

teyc 13y ago

Java was invented as a full fledged vm with libraries that provide disk access, start and stop processes, taking screenshots etc. In contrast, Javascript didn't even have these ideas. The only file access it has are through APIs like reading and writing cookies, and file uploads. Another example is Silverlight. Silverlight only provides a limited set of APIs that access the file system. For example, you cannot read any file unless it was initiated through user interaction via OpenFileDialog. Sandboxing, i.e. preventing untrusted code from calling privileged libraries like disk access through walking the call stack and making sure the call originated from a trusted source. This was tricky but it worked. In Java 7, a new object was invented, called the MethodHandle. This is functions as a first class object, and I suspect that when Oracle bought out the Sun, they lost some key engineers and there has been a slew of exploits via MethodHandle. Hopefully, this patch caught all of them.

smackfu 13y ago

If the JRE allows someone to make a system call, it's a feature. If the plugin allows the same call, it's a critical software bug.