cryptoanarchy.wiki

Arise, you have nothing to lose but your barbed wire fences!

1995-10-10 - Re: java security concerns

Header Data

From: sameer <sameer@c2.org>
To: cmcmanis@scndprsn.Eng.Sun.COM (Chuck McManis)
Message Hash: 0a4592dcba99a79c3458ef8b9b6c2acb5ca0e5bd19e00a72b9b6e7a76216dbd9
Message ID: <199510100051.RAA03799@infinity.c2.org>
Reply To: <9510100030.AA29195@pepper.Eng.Sun.COM>
UTC Datetime: 1995-10-10 00:57:43 UTC
Raw Date: Mon, 9 Oct 95 17:57:43 PDT

Raw message

From: sameer <sameer@c2.org>
Date: Mon, 9 Oct 95 17:57:43 PDT
To: cmcmanis@scndprsn.Eng.Sun.COM (Chuck McManis)
Subject: Re: java security concerns
In-Reply-To: <9510100030.AA29195@pepper.Eng.Sun.COM>
Message-ID: <199510100051.RAA03799@infinity.c2.org>
MIME-Version: 1.0
Content-Type: text/plain


Perry:
>By the way, I suggest that Sun should offer a large money prize for
>the first significant security hole found the Java implementation. Its
>a tiny price to pay for security.


Chuck:
> I don't think the lawyers would let us. 
> 

	This is a shame. What reason would they have for not letting
you? It could well be a very good marketing move. Maybe your marketing
dept can convince the legal dept.

> Would anyone be interested in a Java daemon that one could send arbitrary
> classes to in an attempt to subvert the runtime? I once thought this would
> be a good way to give safe exposure to the system in general. You know sort
> of "here's a program that can feed classes to a Java runtime on a system
> which is known to have a file X on it. Try to return the contents of X."
> 
> It probably wouldn't be to useful beyond that, and it would only validate
> the classes you have access to, not necessarily the full set in a release.
> (hence my not doing it given its utility only in testing the core runtime)
> 

	That, and a cash reward for getting the contents would be even
better. 

-- 
sameer						Voice:   510-601-9777
Community ConneXion				FAX:	 510-601-9734
The Internet Privacy Provider			Dialin:  510-658-6376
http://www.c2.org (or login as "guest")			sameer@c2.org

Thread