Re: > Sandboxed power == More secure???

From:

=?ISO-8859-1?Q?Arne_Vajh=F8j?= <arne@vajhoej.dk>

Newsgroups:

comp.lang.java.programmer

Date:

Wed, 17 Apr 2013 21:39:21 -0400

Message-ID:

<516f4eca$0$32114$14726298@news.sunsite.dk>

On 4/17/2013 9:12 PM, Eric Sosman wrote:

     Things might be different if I were aiming at a particular
system. If I were Hell-bent on breaking into XYZBank, I'd spend
a lot of time studying what XYZBank uses and researching how I
might subvert it. But since

                  THREE BILLION DEVICES RUN JAVA

(according to Oracle's installation splash), if I'm just trolling
for easy marks I'll look for Java. It's a simple matter of balancing
success rate (high) and vulnerability rate (ditto).

     In a sense, it's the same thing that happened to Windows. When
Windows was the only game in town, *everybody* ran it and *everybody*
who wasn't up-to-date with the patch from twenty minutes ago was
dead meat. Microsoft (to much derision, including mine) undertook to
improve Windows' security, and -- to their credit -- they've managed
to raise it to the "Not absolutely pathetic" level.

     Java has not yet attained that lofty standard.

     Java exposed to the Net is, as Mr. Nader might say, "Unsafe at
any speed." Maybe Oracle will apply the resources needed to
resuscitate it, but I sort of think they won't: It's now viewed
as a server-side technology (and it's just fine there, and that's
where Oracle's big investments lie), so its client-side deficiencies
will just sort of sit there and rot.

     And rot. And rot. And rot. And rot. And rot.

     Friends don't let friends run Java in their browsers.

Oracle is not making a cent directly from applet usage.

And I have no doubt that is the reason why applet security
have been let us call it "less than perfect".

But they seem to be focusing strongly on it now.

And for good reasons.

In the public java has been labelled "security problem" and
the general public does not understand the difference between
applets and Java EE.

A lot of the managers authorizing paying millions of dollars for
Java based middleware may not know either.

I think the new interest in security is because the message
from Oracle sales people has been that these applet problems
are hurting general sales.

Arne