Hacker News Reader

Have they been permitting anyone who isn't oracle affiliated to work on the sandbox? I was under the impression that the core development and compiler work was all in house.

View on HN

Are you sure these bugs are new? The Java Applet Sandbox doesn't exactly have a spotless security history.

One of the bugs is fairly old, the other (which is required for the overal exploit) is new-ish (introduced in Java 7), but probably not as new as saosebastiao was implying (as the title of this HN post can be parsed as "the bugs were introduced by the patch attempting to fix the other bugs", which is definitely not the case, AFAICT).

> Issue 51 affects both Java SE 6 and 7. Issue 52 is for Java SE 7 only. Since both issues are required for the attack to succeed, we treat it as Java 7 specific only.

-- http://seclists.org/fulldisclosure/2013/Jan/195

Reply on news.ycombinator.com