and if people ran ruby applets in the browser they would have much worse security :) java client sandbox is a different story than java server side