Oracle to issue huge security patch addressing 36 Java vulnerabilities

Re:Oracle to issue huge security patch addressing 36 Java vu... by 0x0 on Tuesday January 14, 2014 @03:59AM (#7056064)

So now all applets will have to be signed, and users will be trained to accept running the signed applets with that horrible GUI for confirming it. Did you know that popup about running a signed applet also confirms you're OK with running the applet outside the sandbox?

So from now on, all applets will by default run outside the sandbox? How is this an improvement?

[ Parent | on HN ]

Re:Oracle to issue huge security patch addressing 36 Java vu... by brazzy on Tuesday January 14, 2014 @04:59AM (#7056221)

It's an improvement because all applets will by default not run at all, and most users don't need to use any applets and thus will not in fact be trained to agree to run applets.

Basically, it acknowledges that the Java sandbox is as leaky as a sieve and that securitywide, running an applet not much different from downloading and running a regular executable file, so you should only do it if you trust the source.

[ Parent | on HN ]

Re:Oracle to issue huge security patch addressing 36 Java vu... by 0x0 on Tuesday January 14, 2014 @12:20PM (#7058253)

It's a shame if poorly written applets end up being signed cluelessly.

At least the sandbox used to prevent accidents, if not malicious code. Plenty of things like "lights-out" server admin tools seem to ship with semi-dodgy applets for KVM stuff etc.

[ Parent | on HN ]