5 ms·
>Does anyone have any examples of Java proper not being secure? What would Java proper being insecure look like. If your code is running in a normal JVM, then
by gizmo686 13y ago
>Does anyone have any examples of Java proper not being secure?
What would Java proper being insecure look like. If your code is running in a normal JVM, then you can already write arbitrary data to a file and simply exec it, trivially giving you arbitrary code execution without breaking any part of the run-time.
- craigching 13y agoYes, I understand. The point being that this article is about the Java browser plugin and security vulnerabilities surrounding that particular part of Java and being conflated to Java in the large. The article does a poor job of pointing this out and seems inflammatory.
- justincormack 13y agoWell there are other uses of the Java sandbox, although not many.
- gohrt 13y agoInsecure networked Java means that (hypothetically, or with that floating point parse bug of ~2011), user input could cause a program to behave in ways not intended by the author. Insecure "local" Java would be something like an equivalent of XSRF , mixing data from multiple sources in unintended ways, or leaking data from your user account/ security context to a place visible by other accounts/roles on the system.