However, Java's fantastic potential is mitigated by very serious security concerns.
Security is always an issue when computers are networked together.
Simply by using a web browser, a web surfer can take advantage of Java's cross-platform capability. Of course, the activity of locally running code created and compiled somewhere else has important security implications. The same technology that allows Java applets to liven up once-static web pages also allows unscrupulous applet designers to invade an unsuspecting Java user's machine. This implies that there will always be one more bug, even though bugs will become rarer with time. As McGraw and Felten point out, Java has no formal security policy, which makes analysis of java security difficult.