Java security questions arise Java security questions arise By Peter Coffee , PC Week Labs Java's security model may be fundamentally flawed, according to an academic paper obtained by PC Week Labs that will be presented at the National Information Systems Security Conference in Baltimore next month. Java's considerable lead in ensuring the safety of untrusted code when compared with other active-content technologies such as ActiveX controls.
Corporations are more at risk from within the firewall than from without.
Hostile apps on public Web pages won't generally have the privileges required to mount a successful attack. Corporate developers can protect their systems by using file system permissions, encryption and other tools, rather than relying solely on Java's promised protections, while the issues raised by LaDue remain in dispute. LaDue's paper was scrutinized by a panel of referees before it was accepted for presentation by the conference sponsors, the National Computer Security Center and the National Institute of Standards and Technology. Li Gong, security architect for the JavaSoft business unit of Sun Microsystems Inc., maintained that LaDue's claims depend on bugs in early versions of Java. LaDue asserted that his statements apply to even a completely correct implementation of the current published Java specifications.