Re: Netscape Software Flaw

[Rick LaRowe <rlarowe@ecii.org>]

Bob Leif referred to an article on Java/Netscape security problems, and then asked:

> Obvious question, would the use of Ada diminish the probabilities of this
> type of problem and increase the security of Internet communication?  If so,
> someone should communicate this to both John Markoff and Thomas Cargill.  I
> would suspect that Ada's strong typing and runtime checking would help in
> the detection of misbehaving programs.

If you are suggesting the use of Ada for writing applets (via Intermetrics'
AppletMagic), then this really doesn't solve anything but accidental errors.
The real concern with Java and Netscape right now is that there are quite a
few security holes that enable clever, malicious folks to "attack" machines
on the net.  Being able to write an applet in Ada isn't going to affect an
attacker, since s/he will write in raw JVM byte codes if necessary.  That said,
it is fairly obvious that security must be enforced at the JVM level.

If what you were referring to was a whole new Java/JVM/Netscape implementation
scheme, then that's an entirely different thing.  And while I think Ada might
help quite a bit in this area, I think that the biggest thing that can be added
to the pot is the use of formal design methods to ensure a secure execution
environment.

Regards,
Rick LaRowe
------------------------------------------------------------------------------
Enterprise Computing Institute                 internet: rlarowe@ecii.org
1 Ash Street                                   phone: (508) 435-1900 x15
Hopkinton, MA 01748                                   (508) 435-2176 (fax)
------------------------------------------------------------------------------