Rantburg: Tomorrows news today!::
Sun 2003-12-07. Archives. 2:WoT Politix 3: I couldve entered my kitchen in the contest. American and French Forces make history with Commando School
http://www.rantburg.com/?D=12/8/03&C=-Short+AtHOME |
Sun Microsystems has asked the developer community to help it attack the new security enforcement component in the upcoming version of Java Platform, Standard Edition (Java SE).
The company launched the "Crack the Verifier" challenge Monday, making Java SE 6.0 binaries and source code available under its Java Research License (JRL) to any interested parties.
The challenge is designed to look for flaws in both the implementation and the specification itself. Work on the technology is currently under way in the Java Community Process (JCP), under Java Specification Request 202 (JSR-202), "Class File Specification Update."
CNN.com - Jude Law and Sadie Frost divorce - Oct. 29, 2003::
Law didnt contest the divorce proceedings. Review: Perfect Man fatally flawed. • CNN/Money: What TVs most popular dads earn
http://edition.cnn.com/2003/SHOWBIZ/Movies/10/29/frost.law.ap/HOME |
News, College of Behavioral and Social Sciences::
Baltimore Sun. Sep 14. Capital Case Flawed. Research of Professor Ray Paternoster cited of 2004 Visualization Contest. Professor Cynthia Moss quoted
http://www.bsos.umd.edu/dean/nclip04.htmlHOME |
Sun developers are looking for two things: whether there are any bugs in the new verifier and whether the whole thing is fundamentally flawed and needs to be scrapped.
Graham Hamilton, vice president and fellow on the Java platform team, said that while he's hoping for the former, the latter means a missed opportunity for the Java community but the ability to replace the new technology with the existing verifier in time to launch Java SE 6.0 next summer.
Schneier on Security: Announcing: Movie-Plot Threat Contest::
Terrorists discover the musical note that will make all listeners release their bowels. the mission until a month into space (on the far side of the sun)
http://www.schneier.com/blog/archives/2006/04/announcing_movi.htmlHOME |
UPDATE: WSJ Gets Giant Scoop -- Karl Rove Quitting::
Baltimore Sun to Unveil Redesign First, he will offer satirists some extra fodder by going hunting for the bird of peace.
http://www.editorandpublisher.com/eandp/news/article_displntent_id=1003624876&imw=YHOME |
There are three ways developers can look for bugs to squash: They can look for a flaw in the type-checking verifier specification within JSR-202; they can look for an ambiguity in the wording of the specification that would lead to an unsafe implementation; or they can find a flaw in the implementation Sun has provided within the snapshot builds of Java SE 6.0, code-named Mustang.
Contest entries will be accepted until Jan. 31, 2006, and judged by a panel of Sun engineers who will determine if the submitted bugs compromise the Java security model.
Those who find a significant flaw in the specification will be brought on stage during the keynote speech at JavaOne next year. Discovered flaws in the implementation will receive acknowledgment on the Java.net Web site.
Sun is fundamentally changing the way Java handles security through its applets (define). Java creates a "sandbox" when applications are executed in, say, the Web browser. While the applet can use some systems resources to run the program, the application doesn't normally have the permissions to write to the hard drive or scan a computer's innards.
In the existing Java code, Sun uses a byte-code verifier that monitors incoming applets and verifies that all the byte codes are structured correctly so it can't break out of the security model, Hamilton said.
The new type-checking verifier, which has been under development for the past three years, handles incoming data very differently, he said. If successful, it will result in about 50 percent performance gains while using less system memory to run the applet.
Sun officials realized that at a time when the company is opting for a more open approach to its software, it might be a good idea to open the security code to the community at large.
Hamilton said the company's first instinct was to keep it a secret, but then reconsidered releasing the source code and decided to ask for help.
"It's kind of scary but if you want people's help in finding holes you have to give them full access," he said.
Originally, the new verifier technology was intended for release in Java 2, Standard Edition 5, but officials felt it wasn't ready for deployment when it came time to launch the updated Java code.
 PHP Users at Risk?
 Open Source ECM Project Launched
| 
Sun Flaws Make Contest Fodder 
PRINT
Add to favorites