Re: DII COE bars Ada -> Java compilation

[Wes Groleau <wwgrol@ftw.rsc.raytheon.com>]

> : And in fact, one security report I read described a security hole that
> : could be exploited by a byte-code assembler but which was prevented by
> : a "correct" Java compiler.
>
> I suspect this same "security expert" would also say your house was
> safe if burglars would use only "approved" breaking and entering tools
> <g>.

See http://www.cs.princeton.edu/sip/ and decide for yourself 
how "expert" these guys are.

-----------------

> > And in fact, one security report I read described a security
> > hole that could be exploited by a byte-code assembler but
> > which was prevented by a "correct" Java compiler.
> 
> But that is the function of the byte code verifier. Obviously
> unverified code is risky no matter *what* the source. One
> certainly has far more faith in the verifier than in *any*
> compiler.

Correct.  My point was:

1. The byte-code verifier apparently is NOT enough 
   for security.

2. For DoD to trust the JVM for security instead of
   conducting adequate reviews and tests would be
   just as  stupid as claiming Java is the only
   secure language.


-- 
Wes Groleau
http://freepages.genealogy.rootsweb.com/~wgroleau