From: Steve Gibbons <steve@aztech.net>
Date: Thu, 28 Mar 1996 09:39:26 +0800
To: frantz@netcom.com
Subject: Re: WSJ on Big Java Flaw
Message-ID: <0099FEF9.CAF81C60.361@aztech.net>
MIME-Version: 1.0
Content-Type: text/plain


In Article: <199603261814.KAA23974@netcom5.netcom.com>, frantz@netcom.com (Bill Frantz) wrote:
# At 10:58 AM 3/26/96 -0500, John Young wrote:

# >   Java was originally touted by Sun as a secure language. But
# >   at least two other flaws have already been discovered in
# >   the technology, including a less-serious problem uncovered
# >   by the Princeton team last month. Sun's Ms. Mueller said
# >   the problems have been correctable details in the way the
# >   Java code is written, not problems with its basic design.

Actually, I suspected and reported the same bug some weeks before the group at
Princeton.  <URL: http://www.aztech.net/~steve/java/~>.  That said...

# Having worked on a secure OS, with a small security kernel etc. etc. etc. I
# realize that even those systems have bugs.  The Java people will work out
# their bugs.  Others will read their code and find more bugs.  (It is to
# Sun's GREAT credit that they are releasing their source under a not very
# restrictive license.)  Eventually, in several years, Java security will be
# ready for prime time.

This is exactly what I would say.  Sun has released source code for what that
they label as "Beta Software."  I agree with their labeling, and don't fault
them for having buglets in beta software.  I commend them for releasing souce
code.  My biggest gripe is with other companies (no names mentioned) who are
shipping Java, integrated and "turned on" by default in their
"production-level" products.

# Of course, for really valuable things, or the really paranoid, you
# shouldn't connect your computer to a network.  The top dog certificate key
# in SET is handled this way.

Generally good advice.  (SET is an "Alpha Specification" and has its own
problems, that I won't go into here, but again, I commend the principals
involved for allowing "outsiders" to view and comment.)

I'd also add that running uncertified (by the local CA) applications is bad 
voodoo, and should be avoided, but that's an issue that most admins don't have 
much real control over in most environments.

--
Steve@AZTech.Net

[ I thought about adding a P.S., but most of you probably don't care what I do
  for a living, who I work for, nor what I work on, and why.  Send email if
  you're curious. ]