Hacker News Reader

Comment by lysium | Hacker News Reader

> Neither is inherently less secure than javascript running in a web browser

Why do you think that? I’ve heard a lot of vulnerabilities in Java and Flash plugins but JavaScript not so much.

Because they where vulnerabilities in the JS engine of all browsers and they have similar issues. See the browser release notes for the last ten years. e.g. https://chromereleases.googleblog.com/2016/03/stable-channel...

Thing is the browser engines where are not so diligent about CVE's and they are necessary evil, while Java/Flash where optional evil. With the Flash plugin being significantly worse quality than the Java ones.

java plugin was a reputable good security sandbox. Features were added and some subtile security problems were found. Oracle repeatedly failed at fixing these problems because it wanted to avoid breaking old applications. The consequences of this bad management is that the reputation of java plugins is bad and they are prohibited in many enterprises. The problem is only a management problem, there were not technical reasons. The idea of having java application in a safe sandbox is perfectly viable except oracle.

Oracle ended up breaking Applets many times anyway. As someone who worked on a very complex applet during this period, the amount of times they changed security settings was crazy. Even some of those changes that had to be made in the manifests, broke security in the previous jvm version.

perhaps that every single web page malware has been served by javascript?

Reply on news.ycombinator.com