Re: Java vs JavaScript

From:

=?ISO-8859-1?Q?Arne_Vajh=F8j?= <arne@vajhoej.dk>

Newsgroups:

comp.lang.java.programmer

Date:

Thu, 01 May 2014 21:16:05 -0400

Message-ID:

<5362f1d6$0$301$14726298@news.sunsite.dk>

On 5/1/2014 4:26 AM, Silvio wrote:

On 05/01/2014 09:52 AM, Chris Uppal wrote:

Stefan Ram wrote:

  So, JavaScript is not mentionend in the press because it is
  a technical details of the browser, while Java is a
  freestanding product, not part of the browser. Because of
  this avoidance of the mentioning of JavaScript, some people
  do believe that JavaScript today has become more secure. But
  you can find the technical details I quoted above if you
  search for them.

I think there's a lot of truth to that. A few years back, JavaScript
was still
viewed with suspicion (justifiably), and as such it was a "live issue"
and so,
when it was involved in security problems, it got mentioned. These
days many
people take it for granted, and are no more likely to think of it as
"contributing to" an exploit where it is used than the surrounding
HTML (if
any) is.

That is because JavaScript IS part of the HTML page and it can not
contain a security hole by definition. Only the browser displaying the
page can.

Today a browser typical comes with distinct:
- layout/render engine
- JavaScript engine

And the two do not necessarily come from the same source.

JS engine is still more tightly coupled with the browser, because
it cannot (as far as I know) be replaced by the user. It may even
be linked into the same executable as the rest. But somewhere
at the source code level it is distinct.

Arne