Ah, yeah, well, as long as Oracle is the steward of the most popular JVM I think we shouldn't let it run non-trusted code.

I was thinking more desktop (non-web) apps, really.