From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on polar.synack.me X-Spam-Level: X-Spam-Status: No, score=-1.3 required=5.0 tests=BAYES_00,INVALID_MSGID autolearn=no autolearn_force=no version=3.4.4 X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: 103376,5882b8e137d950f8 X-Google-Attributes: gid103376,public From: Wes Groleau Subject: Re: DII COE bars Ada -> Java compilation Date: 2000/04/14 Message-ID: <38F79103.72EEE575@ftw.rsc.raytheon.com>#1/1 X-Deja-AN: 611286650 Content-Transfer-Encoding: 7bit References: <38EB3482.971747E4@lmco.com> <8cfg7m$qbd$1@nnrp1.deja.com> <38EDE91D.C6A9EC19@ftw.rsc.raytheon.com> <8cm9e5$9el$1@nnrp1.deja.com> X-Accept-Language: en,es,fr,pt Content-Type: text/plain; charset=us-ascii X-Complaints-To: news@ext.ray.com X-Trace: bos-service2.ext.raytheon.com 955748615 151.168.144.162 (Fri, 14 Apr 2000 17:43:35 EDT) Organization: Raytheon Company MIME-Version: 1.0 NNTP-Posting-Date: Fri, 14 Apr 2000 17:43:35 EDT Newsgroups: comp.lang.ada Date: 2000-04-14T00:00:00+00:00 List-Id: > : And in fact, one security report I read described a security hole that > : could be exploited by a byte-code assembler but which was prevented by > : a "correct" Java compiler. > > I suspect this same "security expert" would also say your house was > safe if burglars would use only "approved" breaking and entering tools > . See http://www.cs.princeton.edu/sip/ and decide for yourself how "expert" these guys are. ----------------- > > And in fact, one security report I read described a security > > hole that could be exploited by a byte-code assembler but > > which was prevented by a "correct" Java compiler. > > But that is the function of the byte code verifier. Obviously > unverified code is risky no matter *what* the source. One > certainly has far more faith in the verifier than in *any* > compiler. Correct. My point was: 1. The byte-code verifier apparently is NOT enough for security. 2. For DoD to trust the JVM for security instead of conducting adequate reviews and tests would be just as stupid as claiming Java is the only secure language. -- Wes Groleau http://freepages.genealogy.rootsweb.com/~wgroleau