Web start sandboxing and security

[Andy Lutomirski]

On Dec 7, 2013 9:19 AM, "Fernando Cassia" <fcassia at gmail.com> wrote:
>
> On Sat, Dec 7, 2013 at 1:25 PM, Jacob Wisor <gitne at gmx.de> wrote:
> > What I have always dreamed of for Java apps and applets is something
similar
> > like Android does.
>
> I repeat: why should Java (desktop) apps have something different than
> native (C/C++) apps on the system?
> That only perpetuates the nonsense that Java apps are inherently less
> secure than the arbitrary binary (.exe) downloaded from download.com
> and run by thousands of users daily.
>

Do you mean: why should Java strive to be more secure than native apps?

> A desktop app is a desktop app, period. The dialog asks if you want to
> run it and warns of the dangers. Much like some browsers warn you if
> you download a exe and before you run it.
>
> Adding additional layers of complexity only devaluates the value of
> the JVM ecosystem by inserting FUD into the equation.
>
> The app runs like any other desktop app, with the privileges and
> access given by the user to desktop apps, period. It shouldn't be any
> other way.

I, along with (I suspect) most people who want systems to be secure, cannot
disagree strongly enough.

--Andy

> On a properly configured system, a desktop app run by an
> user doesn't equally mean it's got administrator access, because a
> user account is not the administrator account.
>
> FC
> --
> During times of Universal Deceit, telling the truth becomes a
revolutionary act
> Durante épocas de Engaño Universal, decir la verdad se convierte en un
> Acto Revolucionario
> - George Orwell
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mail.openjdk.java.net/pipermail/distro-pkg-dev/attachments/20131207/482a1332/attachment.html