Could someone explain why Applets/Webstart is so insecure? I know that JRE itself isn't really bad, it's the web-plugin for Java that has security vurnabilities. But how so?
It's nonsense that modern browsers treat Java applets as if they were radiactive material, showing lots of warnings and scary dialogs (and even forcing you to update) while they do nothing of the sort with Flash.
I think it's a little unfair how the whole industry has treated Applets vs. Flash. Applets were pretty nice but Sun couldn't really fight it out like Adobe did against the other larger players.
Anyhow, I disabled Applets and Flash recently myself too. The web works ok, thanks to Apple I guess, but I still need to flip on Flash occasionally.
In contrast, Javascript didn't even have these ideas. The only file access it has are through APIs like reading and writing cookies, and file uploads. Another example is Silverlight. Silverlight only provides a limited set of APIs that access the file system. For example, you cannot read any file unless it was initiated through user interaction via OpenFileDialog.
Sandboxing, i.e. preventing untrusted code from calling privileged libraries like disk access through walking the call stack and making sure the call originated from a trusted source. This was tricky but it worked. In Java 7, a new object was invented, called the MethodHandle. This is functions as a first class object, and I suspect that when Oracle bought out the Sun, they lost some key engineers and there has been a slew of exploits via MethodHandle. Hopefully, this patch caught all of them.