🚀 go-pugleaf

Hi everyone !
        I think there are two angles to security in Java :
One wherein the code in Java itself is designed to be 
malicious. 
Second wherein the Java source code might not be malicious
but the bytecode generated might be (someone might alter etc).

The restrictions on applets not allowed to open
arbitrary connections etc, try to enforce the first kind of
security while the verifier talked of in the previous class
tries to enforce the second kind of security. The latter
restricts access to fields which are private or 
protected, which has rules for membership of a class under
inheritance etc. There was a bug reported in the way JVM
determines whether two classes are equivalent. It could be
used to cause type confusion between two classes with the 
consequences such as providing access to private variables
(storing my private key ?) !
   A paper which formally discusses this and the bug :
"Security and Dynamic Class Loading in Java: A Formalisation"
can be found at : http:/citeseer.nj.nec.com/jensen98security.html
It also talks of verification of classes in this context. 
  I hope they must have eliminated the bug!
    have a look and enjoy !,
arunesh.



------------------------------------------------------------------
Arunesh Mishra                              First Year PhD Student
Room 4140, A.V. Williams,                       arunesh@cs.umd.edu
College Park, Md 20742.                    www.cs.umd.edu/~arunesh 
University of Maryland                   Dept. of Computer Science
------------------------------------------------------------------

Be what you want to be !