Rickard �berg wrote:
> Arkin wrote:
> > Your argument supports, in my opinion, why IIOP should
> > not be the only protocol. However, your argument assumes
> > an environment that is very favorable to RMI, not very
> > favorable to IIOP: who gets to publish the smart stubs
> > in a distributed system? why would company A allow
> > stubs coming from company B's server?
>
> Why should it not? It could easily use the Java Security
> API if you want to constrain what the stubs can perform
> (if it's security you're worried about).
That's good, but not good enough. To have any code that close to my
enterprise data (we are talking EJB, no?) and able (by definition of being a
stub) to communicate with the outside world makes me cringe. There are
plenty of no-so-fun things rogue code could do that aren't (or can't) be
handled by the Java Security API while still posing as a working stub.
There's got to be much much more security than currently possible before I
allow someone else's code on my enterprise machine.
Jeff
===========================================================================
To unsubscribe, send email to [EMAIL PROTECTED] and include in the body
of the message "signoff EJB-INTEREST". For general help, send email to
[EMAIL PROTECTED] and include in the body of the message "help".
