system
Given the following post, respond as if you're commenting on Reddit:
human
ELI5: Why does Java seem to have a reputation for exploits? Is there something inherently wrong with how Java works?
gpt
Java cumulates being

- a runtime environment for general programs,

- a browser plugin which, admittedly, has poor security because it was made back in a time when the real challenges were not known.

Java is not at all a vulnerable technology, but having browser plugins that can run general purpose programs is a bad idea. Most importantly, for decades now, a plugin as general as the Java plugin was not needed in browsers. Whenever a browser was not able to do something that the Java plugin could, it was for security reasons. Essentially, the correct security policy for the Java plugin would be to not exist or to allow Java to run as JavaScript does (and GWT does that without a plugin.)