Re: Java Security?

2013-01-22 Thread Paul Gilmartin
On Wed, 16 Jan 2013 13:46:03 -0500, David Andrews wrote: On Wed, 2013-01-16 at 13:35 -0500, Paul Gilmartin wrote: Consider the Dartmouth/GE time sharing system, which ran on hardware with no memory protection, relying on array bounds checking by the FORTRAN and BASIC processors. Frustrating.

Bounds Checking [Was Re: Java Security?]

2013-01-17 Thread Tom Ross
If I remember rightly Pascal does bounds checking. Pascal was one of the=20 languages I did at college - and the highest-level one. A bit of a shock=20 to me to discover - in an IBM Systems Engineer training homework=20 assignment - that COBOL didn't. (This was in 1986.) The result was me=20 What

Re: Java Security?

2013-01-16 Thread Martin Packer
Wheeler l...@garlic.com To: IBM-MAIN@listserv.ua.edu, Date: 01/16/2013 05:14 PM Subject:Re: Java Security? Sent by:IBM Mainframe Discussion List IBM-MAIN@listserv.ua.edu re: http://www.garlic.com/~lynn/2013.html#27 Java Security? for a long time the majority of exploits

Re: Java Security?

2013-01-15 Thread Timothy Sipples
Allan Staller writes: It was my impression that the IBM JVM was a port directly from SUN (now ORACLE). I am not sure whether IBM or SUN/ORACLE was doing the porting. Direct port is not a fair description, no. I guess that information was just revealed if you weren't aware of it. :-) Conforming

Re: Java Security?

2013-01-13 Thread Timothy Sipples
I don't see any cause for alarm on servers, including on z/OS. To the extent the applet runtime environment is modified for security reasons I expect the server implementations to get updated for behavioral consistency, but it's no emergency in my view. Unless you make it a habit of affirmatively

Re: Java Security?

2013-01-13 Thread D Gaebler
Yes, Java 7 is available for z/OS. A description about the security issue can be found here: http://www.kb.cert.org/vuls/id/625617 To me (but thats only my opinion), the following reads like only Java applets are affected: The Java JRE plug-in provides its own Security Manager. Typically, a

Re: Java Security?

2013-01-13 Thread Graham Hobbs
: bit.listserv.ibm-main To: IBM-MAIN@LISTSERV.UA.EDU Sent: Sunday, January 13, 2013 7:00 AM Subject: Re: Java Security? I don't see any cause for alarm on servers, including on z/OS. To the extent the applet runtime environment is modified for security reasons I expect the server implementations to get

Re: Java Security?

2013-01-13 Thread John Gilmore
Timothy Sipples wrote: post begins I don't see any cause for alarm on servers, including on z/OS. To the extent the applet runtime environment is modified for security reasons I expect the server implementations to get updated for behavioral consistency, but it's no emergency in my view. Unless

Java Security?

2013-01-12 Thread Paul Gilmartin
There's considerable chatter on the Net about recent Java security exploits: http://www.kb.cert.org/vuls/id/625617 http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/client-security.html I note that the CERT page thwarts IBM's policy of security-by-obscurity by publishing

Re: Java Security?

2013-01-12 Thread Tomasz Rola
On Sat, 12 Jan 2013, Paul Gilmartin wrote: There's considerable chatter on the Net about recent Java security exploits: http://www.kb.cert.org/vuls/id/625617 http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/client-security.html I note that the CERT page thwarts

Re: Java Security?

2013-01-12 Thread Tony Harminc
On 12 January 2013 14:25, John Gilmore jwgli...@gmail.com wrote: I shall be surprised if some toxic Java apps do not make their appearance very soon now. I received a spam email two or three days ago with a redirect to a Russian site that attempted to run a Java program in my browser. Of