Hacker News Reader

Comment by AnIdiotOnTheNet | Hacker News Reader

> The Java plugin, like Flash, was a security nightmare

Neither is inherently less secure than javascript running in a web browser.

> and poorly integrated with the rest of the stack.

Yeah, but, so? Maybe I'm too old and curmudgeonly but I preferred it when applications acted like applications and websites acted like websites. Now I have to deal with websites that are half application, without the responsiveness of either and built on a pile of franken-code.

View on HN

> Neither is inherently less secure than javascript running in a web browser

Why do you think that? I’ve heard a lot of vulnerabilities in Java and Flash plugins but JavaScript not so much.

Because they where vulnerabilities in the JS engine of all browsers and they have similar issues. See the browser release notes for the last ten years. e.g. https://chromereleases.googleblog.com/2016/03/stable-channel...

Thing is the browser engines where are not so diligent about CVE's and they are necessary evil, while Java/Flash where optional evil. With the Flash plugin being significantly worse quality than the Java ones.

java plugin was a reputable good security sandbox. Features were added and some subtile security problems were found. Oracle repeatedly failed at fixing these problems because it wanted to avoid breaking old applications. The consequences of this bad management is that the reputation of java plugins is bad and they are prohibited in many enterprises. The problem is only a management problem, there were not technical reasons. The idea of having java application in a safe sandbox is perfectly viable except oracle.

Oracle ended up breaking Applets many times anyway. As someone who worked on a very complex applet during this period, the amount of times they changed security settings was crazy. Even some of those changes that had to be made in the manifests, broke security in the previous jvm version.

perhaps that every single web page malware has been served by javascript?

You know when it is a website, when it takes multiple seconds to load a page of text, that then appears empty because some random JS script from one of the 20+ different domains was blocked from loading ;-)

That, and the way what I'm reading keeps jumping around as images load in and f' up the layout.

Truly this is the progress we all hoped to see in computing in 2018.

Reply on news.ycombinator.com