Hacker News Reader

Comment by graypegg | Hacker News Reader

> … with JavaScript scripts used to modify the properties and behavior of Java objects

Something I didn’t know was a consideration in the original spec of JavaScript: some sort of Java applet interop. I really thought the name was just a nod to it being a curly-brace object-y language! Does anyone know what that looked like? I know of <object> to embed applets into the document, which you could pass arguments to via attributes set by JavaScript, but the wording in this doc sounds like JavaScript could somehow use Java object instances?

View on HN

Oh wow. A blast from the past. It was called "LiveConnect" and allowed JavaScript to call applet's methods, via reflection on the Java side.

Here you go: https://docs.oracle.com/javase/tutorial/deployment/applet/in...

I remember using it to implement hardware key security for a website. A Java Applet loaded a JNI library, after exploiting a JRE security bug to escape confinement, which interacted with the hardware key. The JavaScript then handled all the "browsery" stuff like setting cookies.

That was in 2001...

I wrote the beginnings of a Javascript game that used LiveConnect to connect to the TCP game server.

this video shows netplay between tabs but i also tested it on a lan in a house (physically moving between computers): https://www.youtube.com/watch?v=vcwPOfVXRc0

https://github.com/fuz/jspkmne

the java applet: https://github.com/fuz/jspkmnengine/blob/master/JSPKMNe.html...

netplay code that Java applet calls: https://github.com/fuz/jspkmnengine/blob/master/netplay.js

here's the java applet calling the Javascript of the game: https://github.com/fuz/jspkmnengine/blob/master/server/Clien...

For some reason I typed the repository name wrong

https://github.com/fuz/jspkmnengine is the correct URL to the repository.

> Reflections on the Java side.

Am I reading this correctly meaning you send a "some_variable_that_i_know_about=deleteAll()" via Javascript and it will just run `deleteAll()` method on a Java applet that has god knows what access it has to things on your machine?

Yes. Applets were very slow to load, and more dangerous than flash. I think applet was the first tag removed. But at the time, you could load up excel in a tag with the right com magic.

The early web boom was wild.

> I think applet was the first tag removed.

<applet> was never removed from HTML, but it was deprecated by HTML4.01 - but only because they wanted to use <object> as a single replacement element: https://www.w3.org/TR/html401/struct/objects.html#h-13.4

Looks like <applet> was officially obsoleted sometime during the switch from HTML4.01 to the Living Specification version: https://html.spec.whatwg.org/multipage/obsolete.html#other-e... - but the spec still permits using <object> or <embed> for Java applets: https://html.spec.whatwg.org/multipage/iframe-embed-object.h...

If the applet chooses to expose such a method; reflection is about finding out what methods are exposed. And while Java had plenty of security holes applets were definitely not supposed to have a lot of access to your computer.

Signed applets had access to your computer. Even just before they were completely removed from the browser, which was just 8 years ago. You had to click "confirm" here and there, but in the end it worked.

JavaScript was originally going to be called LiveScript, associated with LiveConnect. It was renamed for marketing reasons, because Java components were seen as the future for code on web pages, and it could script the interaction between different Java components (potentially from different sources).

That fact it could be used equally for components written in other languages, if they were ever supported by object tags in common web UAs is why it had a more generic name initially.

Fun fact: LiveScript is a FP-oriented language which compiles to JavaScript. It's been around for a while now :-)

https://livescript.net/

Was it even an exploit? I seem to recall reading something about code-signed applets being allowed to load native dlls by design. Which is crazy, one single "trust signature" dialog prompt from infecting a system with malware...

> one single "trust signature" dialog prompt

Sweet summer child ;)

I mean I'm sure there were a million exploits that would bypass even the check and prompt, but that doesn't change the fact that it's pretty crazy that native code execution was part of the design with just one small incomprehensible trust dialog.

I don't think there was any dialog at all. IIRC.

At first, people weren't worried about security. It was just a bunch of us nerds on there. You interacted with real people that didn't seem like they were trying to swindle you. The world still used paper checks for anything big, and credit/debit cards were there, but not like today. It wasn't that uncommon to write a check and ask the shop owner to cash it next week, at least in my poor household.

There wasn't "online banking" or "online identities" to steal, so it didn't seem all that important. The worst thing that would happen is you would lose access to a chat handle.

The sad truth is that executables on desktop haven’t inched much closer to security in the following decades (thankfully mobile did).

Nope, I used an actual exploit, a type confusion bug somewhere within the RMI that allowed to escape the applet's ClassLoader. It then allowed it to access COM objects and basically do everything it needed.

The result was a "zero-touch" installation, with seamless login experience. It was a really crazy time.

Wild. So any other website could then do the same thing as you, accessing the hardware key and all...? Did anyone stop to think maybe this wouldn't be the best way to expose a hardware key? I mean, if you care about security at all, which you probably do if you're even bothering with a hardware key...??!?! %-)

> one single "trust signature" dialog prompt from infecting a system with malware

How many dialog prompts are there to launch signed downloaded exe?

At least running an .exe should be somewhat obvious to computer literate people. When I saw those signed applet dialog prompts, even as a developer it was not obvious to me that it also meant granting unsandboxed x86 code execution to a .dll/.so from the internet.

I remember developing an "interactive CD" with an Encyclopedia in 1998, which distributed a customized version of IE 3.2 (IIRC using something called the "Internet Explorer Development Kit"). The search function consisted of Javascript code calling an applet (which did the search using an internal database implemented in pure data structures within the code) and writing the results in the HTML. The database inside the Applet was so big, that I had to split it in two to be able to compile it (or was it for it to run? I don't remember the exact issue). That's 25 years ago. Wow.

It was quite a direct and ergonomic interface iirc. The magic term was LiveConnect, do I googled that and got to this amazing piece of history: https://www.oracle.com/java/technologies/javase/liveconnect-...

The first example is quite illustrative I think. You’d call custom methods on a Java applet the way you call DOM methods on a div.

I designed and implemented LiveConnect. Previous comment here: https://news.ycombinator.com/item?id=1894374

Invoking Applet Methods From JavaScript Code - https://docs.oracle.com/javase/tutorial/deployment/applet/in...

Invoking JavaScript Code From an Applet - https://docs.oracle.com/javase/tutorial/deployment/applet/in...

It depended on a bit of other libraries installed (the live connect specification which really meant "just Netscape" - https://www.oracle.com/java/technologies/javase/plugin2.html... ).

I remember extremely old advice to use java.util.Date from JS, thought I was going crazy but this article from 1996 mentions it: https://www.infoworld.com/article/2077267/new-javascript-fea...

That was a big draw back then, along with the ability to interact with ASF and Real AV objects. We did a lot of really useless sites that did that in the late 90s.

AKA ActiveX in Microsoft land...

Reply on news.ycombinator.com