Subject: java

From: [email-masked] (Ferenc Molnar)
Date: Wed, 6 Sep 95 11:16:15 +0200

Dear Netters:

David States writes:
> Sun has been promoting a new programming language, java, as a tool
> for creating portable applications on internet.  Instead of constantly
> going back to the host for additional information (a response to a mouse
> click, for example), the applet executes on the local client.

It is really worth to read it again: "... the applet executes(!) on
the local client."
My opinion is, that this is a major security breach!
If you execute unknown applications on your computer, you could
as well announce your password in public. 

Modifying your ".rhosts" file for example would not take too much effort!
On the other hand you open gates for all kinds of viruses,
trojan horses and so on!

The question is, if the concept of java can be changed to be
more secure?

Best regards,

Ferenc

Ferenc Molnar

---------------------------------------------------------------------------
Institut fuer Physikalische und Theoretische Chemie
- Lehrstuhl Prof. Dick -                   Tel.:  (+49) 941 943-4466 /-4486
Universitaet Regensburg                    Fax.:  (+49) 941 943-4488
Universitaetsstrasse 31
D-93053 Regensburg
Deutschland / Germany
---------------------------------------------------------------------------
EMail (SMTP):  [email-masked]
---------------------------------------------------------------------------
:-) ...THE PHYSICISTS HAVE MADE THEIR UNIVERSE, AND IF YOU DO NOT LIKE
 IT, YOU MUST MAKE YOUR OWN.
                               -- E. R. HARRISON IN "COSMOLOGY" (1980)
---------------------------------------------------------------------------

---

From: [email-masked] (Hinsen Konrad)
Date: Wed, 6 Sep 1995 10:10:29 -0400

All programming languages for "remote execution" that I am aware of
include security features to prevent misuse. For example, file access
is very restricted. This is possible because all these languages
are interpreted. In principle this is safe, but of course there
may be bugs in the implementations, and clever crackers will soon
find them. But then this is nothing new; there have been similar
problems with networking software.

-------------------------------------------------------------------------------
Konrad Hinsen                     | E-Mail: [email-masked]
Departement de chimie             | Tel.: +1-514-343-6111 ext. 3953
Universite de Montreal            | Fax:  +1-514-343-7586
C.P. 6128, succ. A                | Deutsch/Esperanto/English/Nederlands/
Montreal (QC) H3C 3J7             | Francais (phase experimentale)
-------------------------------------------------------------------------------

---

From: [email-masked] (David J. States)
Date: Wed, 6 Sep 1995 12:38:56 -0500

On Sep 6, 11:16am, Ferenc Molnar wrote:
> Subject: CCL:java
> as well announce your password in public. ...

On the otherhand, this is something we all do routinely everytime we download a
PostScript graphic or document.  And make no mistake about it, PostScript is
full programming language capable complex behavior and unpredictable
interactions with the host.  At least with java and safe-Tcl, someone thought
about security issues while designing the language.

I agree wholeheartedly with the sentiments expressed regarding the need for
standards, but lets not confuse data communication issues with programming
implementation issues.  A java applet, a Tcl/Tk app, and a C program can all
communicate with each other just fine if they agree on data representation.
And the fact that you and I are both working in XXX programming language,
is no guarantee that our applications will ever  be able to share data.

David

-- 
David J. States
Institute for Biomedical Computing / Washington University in St. Louis