Java creator trying to win the stupidest statement award of the year
-
My friend (pro-Linux) sent this URL to our class mailing list :- Huge security hole in .NET: Java creator [^] This was my reply :- What else would you expect a Java person to say :-) I primarily specialize in C++/CLI (formerly Managed C++) and the reason it's the most powerful .NET language is that it supports 3 compiler modes :- * pure managed (this produces IL is same as what C# or VB.NET or J# will produce and is safe/secure etc) * unmanaged (or native) - does not target the .NET runtime - produces PE executables and native DLLs * mixed mode - has managed and unmanaged code in the same assembly - the managed portions will run under .NET security, while the unmanaged components will run under normal Windows security. What Gosling is trying to say is probably that a mixed mode app/DLL is unsafe because it has portions of code that will run outside the security model of the CLR. But then the developer (when he's using unmanaged code) is taking responsibility for what he's doing. He'll have to make sure his native code blocks don't have any gaping holes. I don't believe any sane person can assume that this is a .NET issue - it's just that C++ offers one the option to shoot yourself in the foot. Java won't let you do that - Java is probably meant for babies and little children***(see below). C++ is targetted at tougher people - or rather tougher programmers. What's more, C# and VB.NET can use .NET code access security features to make sure that unmanaged transitions are disallowed. This means that when a C# program accesses a C++ generated DLL that may contain unmanaged code, the unmanaged code won't be allowed to execute - instead, a security exception gets thrown. I myself always look out for security holes and other issues with .NET and the CLR (since knowing them increases my market potential), but meaningless shit like what this Gosling fellow throws out makes me wanna puke. If he wants to make grand statements like that, he could at least have got the facts right. Nish Regards Nish *** [edit]I replaced
pregnant womenwithlittle childrenas I felt the usage ofpregnant womenwould give the impression that I am looking down upon women.[/edit]Yea, Nish. You tell 'em what-for! (A vote of 5 for you) Jerry He said this was like painstakingly assembling the first layer of a house of cards, then boasting that the next 15,000 layers were a mere formality.--The Code Book, pp. 331 Toasty0.com DotNetGroup.org
-
There's no such thing as an ".NET interpreter". .NET always executes code natively. The IL gets compiled into x86 instructions by the JITter before executing.
A complex system that does not work is invariably found to have evolved from a simpler system that worked just fine. - Murphy's Law of Computing
Yeah that's true, but I thought Java also now has a JIT, so I think the argument that they are semantically similar still holds.
-
[quote]Java won't let you do that - Java is probably meant for babies and pregnant women. C++ is targetted at tougher people - or rather tougher programmers.[/quote] Have u understood the sense of java? Do you think your no.300 clone of tic-tac-toe in your DOSbox means that your rule all those java coders out there? Ever thought of taking the best language in the right situation instead of trying to drag-and-drop your new gui in visual studio? And btw. whats the sense of bytecode if its bound to windows again? Safety? - why? - because of the cute c++ programmers that wont be able to code responsibly?
Is there any possible reasonable response to what you just posted? Jerry He said this was like painstakingly assembling the first layer of a house of cards, then boasting that the next 15,000 layers were a mere formality.--The Code Book, pp. 331 Toasty0.com DotNetGroup.org
-
Not to mention punctuation...
Shog9
I'm not the Jack of Diamonds... I'm not the six of spades. I don't know what you thought; I'm not your astronaut...
Josh, I don't think you should be the one to talk about punctuation. :rolleyes:
Quantum materiae materietur marmota monax si marmota monax materiam possit materiari?
-
Java won't let you do that - Java is probably meant for babies and pregnant women. C++ is targetted at tougher people - or rather tougher programmers. (sigh) Do we really have to make our choice of language into some test of manhood? Real men use C++? (I can already hear the assembly language programmers questioning the "toughness" and manliness of C++ programmers.) I'm not a Java programmer, but I fully support making languages that help developers avoid problems, rather than castigating languages as being for the weak-minded when they do this. [Edit] I suppose I should say that I'm a C++/MFC programmer before someone accuses me of using VB. :~ [\Edit] ----------------------------------------------------- Empires Of Steel[^]
Brit wrote: [Edit] I suppose I should say that I'm a C++/MFC programmer before someone accuses me of using VB. [\Edit] Too late. I was just in the restroom down that hall and noticed that someone had already marked one of the stalls with a message claiming you use VB. Sorry, Dude. Jerry He said this was like painstakingly assembling the first layer of a house of cards, then boasting that the next 15,000 layers were a mere formality.--The Code Book, pp. 331 Toasty0.com DotNetGroup.org
-
Josh, I don't think you should be the one to talk about punctuation. :rolleyes:
Quantum materiae materietur marmota monax si marmota monax materiam possit materiari?
-
Java won't let you do that - Java is probably meant for babies and pregnant women. C++ is targetted at tougher people - or rather tougher programmers. (sigh) Do we really have to make our choice of language into some test of manhood? Real men use C++? (I can already hear the assembly language programmers questioning the "toughness" and manliness of C++ programmers.) I'm not a Java programmer, but I fully support making languages that help developers avoid problems, rather than castigating languages as being for the weak-minded when they do this. [Edit] I suppose I should say that I'm a C++/MFC programmer before someone accuses me of using VB. :~ [\Edit] ----------------------------------------------------- Empires Of Steel[^]
Brit wrote: (sigh) Do we really have to make our choice of language into some test of manhood? Real men use C++? (I can already hear the assembly language programmers questioning the "toughness" and manliness of C++ programmers.) I wasn't trying to do a "C++ is for tough people" thing - I was saying that relative to Java, C++ is targetted at a far tougher audience. Nish
-
Yea, Nish. You tell 'em what-for! (A vote of 5 for you) Jerry He said this was like painstakingly assembling the first layer of a house of cards, then boasting that the next 15,000 layers were a mere formality.--The Code Book, pp. 331 Toasty0.com DotNetGroup.org
Toasty0 wrote: Yea, Nish. You tell 'em what-for! (A vote of 5 for you) :-D
-
:-O ...
Shog9
I'm not the Jack of Diamonds... I'm not the six of spades. I don't know what you thought; I'm not your astronaut...
:laugh::laugh::laugh: "If it's Snowbird season, why can't we shoot them?" - Overheard in a bar in Bullhead City
-
Can one block assemblies containing "unsafe" code in .NET? I believe you can block JNI stuff in Java. -- My name in Katakana is ヨルゲン. My name in German is Jörgen. I blog too now[^]
On the "Administrative Tools", you have "Microsoft .NET Framework Configuration". There, you can configure everything about .NET security: you have a great granularity and you can even say how the same assembly should execute when invoked from different assemblies or different sources (disk, network, internet, etc). Yes, even I am blogging now!
-
My friend (pro-Linux) sent this URL to our class mailing list :- Huge security hole in .NET: Java creator [^] This was my reply :- What else would you expect a Java person to say :-) I primarily specialize in C++/CLI (formerly Managed C++) and the reason it's the most powerful .NET language is that it supports 3 compiler modes :- * pure managed (this produces IL is same as what C# or VB.NET or J# will produce and is safe/secure etc) * unmanaged (or native) - does not target the .NET runtime - produces PE executables and native DLLs * mixed mode - has managed and unmanaged code in the same assembly - the managed portions will run under .NET security, while the unmanaged components will run under normal Windows security. What Gosling is trying to say is probably that a mixed mode app/DLL is unsafe because it has portions of code that will run outside the security model of the CLR. But then the developer (when he's using unmanaged code) is taking responsibility for what he's doing. He'll have to make sure his native code blocks don't have any gaping holes. I don't believe any sane person can assume that this is a .NET issue - it's just that C++ offers one the option to shoot yourself in the foot. Java won't let you do that - Java is probably meant for babies and little children***(see below). C++ is targetted at tougher people - or rather tougher programmers. What's more, C# and VB.NET can use .NET code access security features to make sure that unmanaged transitions are disallowed. This means that when a C# program accesses a C++ generated DLL that may contain unmanaged code, the unmanaged code won't be allowed to execute - instead, a security exception gets thrown. I myself always look out for security holes and other issues with .NET and the CLR (since knowing them increases my market potential), but meaningless shit like what this Gosling fellow throws out makes me wanna puke. If he wants to make grand statements like that, he could at least have got the facts right. Nish Regards Nish *** [edit]I replaced
pregnant womenwithlittle childrenas I felt the usage ofpregnant womenwould give the impression that I am looking down upon women.[/edit]Nishant S wrote: Java won't let you do that - Java is probably meant for babies and little children***(see below). C++ is targetted at tougher people - or rather tougher programmers. That's a very arrogant statement from you Nish, and it's perfectly wrong: Java lets you shoot yourself in the foot, but in such a subtle way that you have to understand fully the implications of using a garbage collector. Actually, the same pitfalls exists for (managed) .NET solutions. But, at least in C#, you can get some help from the language. Yes, Java was built with syntax simplicity in mind, but you have to be a baby, or a little child, to think that you can make anything usefull without knowing the possible dangers. And that goes for any language and technology. Nishant S wrote: If he wants to make grand statements like that, he could at least have got the facts right. While I agree, that the guy was comparing apples and oranges, I fail to see where he was actually wrong when he calls use of Unmanaged code a security hole. It is a security hole, isn't it? Anyway, it's actually easily comparable to the Java/JNI situation, so he was either just helpfully pointing out the risks, or purposly ignoring the problems in his own camp. "After all it's just text at the end of the day. - Colin Davies "For example, when a VB programmer comes to my house, they may say 'does your pool need cleaning, sir ?' " - Christian Graus
-
My friend (pro-Linux) sent this URL to our class mailing list :- Huge security hole in .NET: Java creator [^] This was my reply :- What else would you expect a Java person to say :-) I primarily specialize in C++/CLI (formerly Managed C++) and the reason it's the most powerful .NET language is that it supports 3 compiler modes :- * pure managed (this produces IL is same as what C# or VB.NET or J# will produce and is safe/secure etc) * unmanaged (or native) - does not target the .NET runtime - produces PE executables and native DLLs * mixed mode - has managed and unmanaged code in the same assembly - the managed portions will run under .NET security, while the unmanaged components will run under normal Windows security. What Gosling is trying to say is probably that a mixed mode app/DLL is unsafe because it has portions of code that will run outside the security model of the CLR. But then the developer (when he's using unmanaged code) is taking responsibility for what he's doing. He'll have to make sure his native code blocks don't have any gaping holes. I don't believe any sane person can assume that this is a .NET issue - it's just that C++ offers one the option to shoot yourself in the foot. Java won't let you do that - Java is probably meant for babies and little children***(see below). C++ is targetted at tougher people - or rather tougher programmers. What's more, C# and VB.NET can use .NET code access security features to make sure that unmanaged transitions are disallowed. This means that when a C# program accesses a C++ generated DLL that may contain unmanaged code, the unmanaged code won't be allowed to execute - instead, a security exception gets thrown. I myself always look out for security holes and other issues with .NET and the CLR (since knowing them increases my market potential), but meaningless shit like what this Gosling fellow throws out makes me wanna puke. If he wants to make grand statements like that, he could at least have got the facts right. Nish Regards Nish *** [edit]I replaced
pregnant womenwithlittle childrenas I felt the usage ofpregnant womenwould give the impression that I am looking down upon women.[/edit] -
Yeah that's true, but I thought Java also now has a JIT, so I think the argument that they are semantically similar still holds.
I know Java now comes with a JIT too, but the JVM architecture and bytecodes were designed to be interpreted so the have to make several trade-offs to ensure this is possible. On the other hand, .NET was designed from the start to run as native code, using IL as an intermediate step. For these reasons, I don't think that there is a semantic similarity between the JVM and the CLR. Maybe it may help to visualize them as similar, but once you hit the details, there are so many architectural differences that the similarity doesn't hold and just confuses people.
A complex system that does not work is invariably found to have evolved from a simpler system that worked just fine. - Murphy's Law of Computing