From: "Perry E. Metzger" <perry@piermont.com>
Date: Sun, 8 Oct 95 17:18:01 PDT
To: cypherpunks@toad.com
Subject: Java
Message-ID: <199510090017.UAA00652@jekyll.piermont.com>
MIME-Version: 1.0
Content-Type: text/plain



As long as people are mentioning Java, I just want to make the
prediction, one more time, that at some point someone is going to find
some devistating security holes in HotJava.

In order for HotJava to be completely safe, the Java security model
needs to be perfect (and it is way too complex to prove correct), you
need a perfect implementation of this perfect security model, no code
in the Java implementation outside the security code can adversely
impact the function of the security code, and there has to be no way
that a bug in the code outside the Java implementation can screw with
the internals of the Java implementation in such a way as to get it to
drop its security.

I don't believe that humans can produce something that satisfies all
four criteria given our current state of technology. Java is just too
complex a language for me to believe that it can have been perfectly
specified and implemented.

Enormous risk -- I really mean ENORMOUS risk -- is being taken in
order to add a little convenience in making web applications pretty.
Someday, there is going to be big trouble from this. *BIG* trouble.

You heard it from me first.

You might ask "Perry, what could possibly satisfy your perfectionistic
criteria?" Well, a language that didn't have any I/O or similar
"dangerous" capabilities in it at all, rather than one in which such
capabilities were selectively "restricted", would be one I would feel
much more comfortable trusting. If written in a fairly safe language
where it is hard to pull buffer overflow tricks, the interpreter for
such a language would be very hard to pervert into doing untoward
things. Java isn't like that, though. Its got the full power and glory
of any other language, and the only thing sitting between a HotJava
app and some really nasty viral effect is a paper thin shield -- the
security model. A couple of bits twiddled in the right place and the
shield is gone.

The best things about Java could probably have been achieved without
giving it so much power. Its too late now, though. The bandwagon is
too far along. As a security consultant, I'm of course in a position
to profit from the wreckage, but frankly I don't like that any more
than an aircraft disaster expert wants to see more aircraft accidents.


Perry