3 ms·
The Java plugin used to have a lot of security advisories (well maybe not as many as browsers, but still) and Mozilla had to blacklist certain versions: https:/
by edwintorok 12y ago
The Java plugin used to have a lot of security advisories
(well maybe not as many as browsers, but still) and Mozilla had to blacklist certain versions: https://addons.mozilla.org/en-US/firefox/blocked/ https://addons.mozilla.org/en-US/firefox/blocked/
If the Java plugin itself has security vulnerabilities how can we expect a full browser written in Java to have none?
- lmm 12y agoThe Java plugin was trying to do the approximately impossible: run untrusted code that had direct access to all the primitives of a full, first-class programming language. Flaws in the VM security would not compromise the security of a browser written in Java (they might make it hard to e.g. implement a secure plugin system for your browser - but Mozilla doesn't even try to not trust extensions, they rely on signing and allow a signed extension to do anything)
- Lawtonfogle 12y agoThe Java plugin was trying to give the ability to use Java, which could control all aspects of your machine, without them being able to control all those aspects of your machine. I can't create a javascript that installs a C&C silently in the background, but Java by default would allow all sorts of issues as it isn't sandboxed. The Java plugin was the attempt to build a sandbox. The problems occurred because it is vastly easier to build a sandboxed language from the ground up than to sandbox a language with full access.