Re:Oracle to issue huge security patch addressing 36 Java vu...
by tptacek on Monday January 13, 2014 @09:31PM
(#7055002)
They are indeed trying to solve a hard problem, and they're shackled to a 1990s design.
But I'm not sure I understand the rest of your comment. The threat model for a Java plugin vulnerability is, if your target has the Java plugin enabled, they can't safely browse the web; any page they visit could end up redirecting them to a page with a malicious applet. That's pretty bad.
But I'm not sure I understand the rest of your comment. The threat model for a Java plugin vulnerability is, if your target has the Java plugin enabled, they can't safely browse the web; any page they visit could end up redirecting them to a page with a malicious applet. That's pretty bad.