In ActiveX, in order to draw a fish on your desktop, the object must have all permissions that you have. In Java, in order to draw same fish, the applet only has enough permissions to draw on desktop. ActiveX has all or nothing security model. Java could always do "some or all", and now it can do multilevel permission, depending on where the code comes from and who signed it.