Re: Hot Java is here! And it *rocks*
David.Halls@cl.cam.ac.uk
Tue, 4 Apr 1995 18:16:25 +0500
>
> Of course I do those things. Sometimes. When I do I think carefully
> about where I'm getting them from, look at the source, and run them for
> a while under an account I keep for that purpose with no access to
> anything (the reason why I believe that even single user machines need
> multiuser security, but that's another argument). People actually do
> this. I recall a discussion on this very list a few months ago about a
> package who's installation script downloaded another script and
> executed it without warning. People noticed.
Okay. So requirements are:
1. A Safe environment (account). cf. Safe Tcl/Scheme/Python/HotJava etc.
2. Trust that the code is genuine. cf. public-key cryptography.
Now, can anyone explain why they would NEVER download applets or binaries/
bytecodes given these requirements? All I'm trying to say is that a Safe Node
system for getting and executing software is safer (yes, safer) than
current practice, so rabid instance on complete security seems a bit OTT,
though of course completely justified in its own right.
Dave.