Re:First release of gngr web browser
by _delirium on Friday December 19, 2014 @02:57PM
(#8774158)
> Just having a Java interpretor installed on your system opens you up to untold security threats.
That's not the case at all. A Java interpreter doesn't run with any kind of privileges, so it adds no added security threat above those that already exist when you are able to run code as a user. Having it installed is no more dangerous than having libboost or python installed on your system, if you have any kind of sane setup.
The part of Java with a bad security track record is the applet sandbox, which is supposed to make it safe to run arbitrary code in a browser. The sandbox has turned out to be pretty leaky. So I would not recommend relying on the applet sandbox to run arbitrary untrusted Java code from the internet. But for a local app it's a perfectly reasonable platform (vaguely in the same category as Microsoft's CLR, which is heavily JVM-inspired).
That's not the case at all. A Java interpreter doesn't run with any kind of privileges, so it adds no added security threat above those that already exist when you are able to run code as a user. Having it installed is no more dangerous than having libboost or python installed on your system, if you have any kind of sane setup.
The part of Java with a bad security track record is the applet sandbox, which is supposed to make it safe to run arbitrary code in a browser. The sandbox has turned out to be pretty leaky. So I would not recommend relying on the applet sandbox to run arbitrary untrusted Java code from the internet. But for a local app it's a perfectly reasonable platform (vaguely in the same category as Microsoft's CLR, which is heavily JVM-inspired).