Tech Off Thread

23 posts

Forum Read Only

This forum has been made read only by the site admins. No new threads or comments can be added.

"Huge security hole in .NET: Java creator"

Back to Forum: Tech Off
  • User profile image
    TomasDeml

    Article on ZDNET

    What do you think about his [Gosling] words?

    I think that there may be only small percent of developers who write their .NET apps in MC++....
    May it be possible to exploit .NET FW using intentionally poorly written MC++ app?

    Thanks.

    EDIT: Read the comments below the article...

  • User profile image
    AndyC

    ha ha ha ha ha ha ha ha ha.

    Talk about completely missing the point. James Gosling I salute your idiocy.

  • User profile image
    Rossj

    The article wrote:
    Sterling also gave the debate a reality check when asked of his personal knowledge of .NET developers actually implementing C or C++ code under a .NET framework. Of the approximately one thousand developers that Sterling knows, he could only recall one directly developing under the C++ code. Whether this indicates an unwillingness on the part of developers to utilise code that is unsafe is notclear.


    That's an interesting question though. Have all the MFC developers jumped ship to another language (possibly C#) or are they just not buying into .Net?

    I've got no problem with Gosling saying that any unmanaged code may not be safe, it's true, but it's not a bug in .Net is it?  More FUD, just to prove it is not all one sided.

  • User profile image
    littleguru

    I really don't get the point of the article. I mean it was for all always clear that unmanaged code is unsafe. Therefore it's also called unsafe code and at least in C# you have to move it in unsafe blocks! In unmanaged C++ you can for sure do whatever you want. It's unmanaged (= unsafe)!

    So what's the point?

    When you read the article you get the sensation that each program in C and C++ is totally unsafe and you should stop executing every application that is written in it...

    No more Open Office, Linux, Windows, Winword, Solitaire, Tux Race, Doom, ...

    I think the JAVA guys are getting a bit nervous about .NET. JAVA is totally miss-designed in my eyes.
    Look at the implementation of generics - terrible!
    Look at the simple types - terrible!
    Look at the runtime doing strange stuff on one platform that it does not on another - terrible!
    Look at the public fields in some classes that ship with JAVA - terrible!

    And I have to code in this language Crying at the university. I like Haskell more, then I ever did JAVA.


    PS: I'm still waiting for the CD with the JDK that I ordered back in 1998 on the CeBIT!!! They told me something about: you will have it in 2 weeks. So, where is it...


    PS the second: Get this comment. That's the truth:
    http://www.zdnet.com.au/news/security/talkback.htm?PROCESS=show&ID=20112944&AT=39179932-2000061744t-10000005c

  • User profile image
    rhm

    littleguru wrote:
    I really don't get the point of the article.


    The point of the article is for Jim Gosling to take a pop at .NET by whatever means available. The whole Java cult and all it's devotees drive me to rage every time I think about it.

    Not that there's too much wrong with the lanague, it's a little bit noddy, but still quite serviceable. And I'm not opposed to the idea of platform independent bytecode. That's an idea that was around a long long time before Java. The goal of creating a 'safe' execution environment where threads in the same process can be kept seperate and the code can actually be verified to make sure it doesn't do anything nefarous, that's useful for reliability and it's essential for some apps that download code from untrusted sources.

    But then lets look at the other side: The flawed, politically motivated, goal of total platform independence at the cost of user interface functionality and familiarity. There's the implicit assumption that Java developers will only ever want to write code in Java (or a handful of other languages that can been bent to fit the way the JVM works) and put up with it's simplistic type model. There's the almost complete lack of support for interop - This is something .NET does so much better than Java it's not funny.

    JNI is a joke, it's the absolute bare minimum the Java class library coders needed to interface with the host OS. Good luck if you've got some serious libraries you need to use from your Java app. .NET lets you, if your security permission allows it, to call native code with very little effort from C# and no effort at all from Visual C++ code. And Gosling thinks that's a bad thing?

    You can see where's he's coming from though. Gosling worked on failed experimental windowing system with a virtual machine - NeWS - that was ignored in favour of a simpler, faster, but fairly ugle hack called X11. Then he worked on a virtual machine project for set-top boxes that would allow executable content to be downloaded and run safely. But the project failed because the VM was too intensive for the hardware. So what is Sun going to do with this technology: push it as a cross-platform dev environment of course. Except that despite the mother of all marketing efforts, UNIX devs aren't interested because they get plenty done with C and C++. Windows devs aren't interested because Java apps have never looked like they belong on Windows. God knows what Mac developers think, but I note that despite a full set of Cocoa bindings for Java, most Cocoa developers still chose Objective-C despite it being the ugliest language known to man.

    So who uses Java? OO fanatics and web developers mostly. Then along comes Microsoft with .NET. The first thing to notice with .NET is how similar C# is to Java and how they both use bytecodes and JIT compilation. Java fanboys would love to dismiss .NET as a proprietry clone of Java and why would anyone would chose that instead of a system that had multi-platform support, surely there would be no advantage? But there are massive advantages, at least to Windows developers. And even some Unixites see big enough advantages to try and clone .NET for other platforms, not so much for the sake of running Windows apps, but because it could do for them what it does for Windows devs.

    So you can see how Jim Gosling would be a bit bitter.

  • User profile image
    Charles

    I'd recommend that you do a few things to solidify your understanding of unmanaged vs managed code and where C++ fits in to the managed paradigm. So, please watch the first Herb Sutter clip again and listen carefully to the technical parts of the interview.

    VC++ support for writing managed C++ makes it possible for systems programmers who need to interoperate with .NET objects to do so in a very natural way; by writing C++.

    What's the problem, exactly?


    Charles

  • User profile image
    Charles

    Beer28 wrote:
    Charles wrote:I'd recommend that you do a few things to solidify your understanding of unmanaged vs managed code and where C++ fits in to the managed paradigm. So, please watch the first Herb Sutter clip again and listen carefully to the technical parts of the interview.

    VC++ support for writing managed C++ makes it possible for systems programmers who need to interoperate with .NET objects to do so in a very natural way; by writing C++.

    What's the problem, exactly?


    Charles

    OK, as for the point made in the article originally posted here, please refer to the post where I talk about allocating memory and casting. That's a small elaboration on what I believe he was trying to say in not so many words.

    *clr windup at prog termination



    That's not an argument supporting the notion that the advent of C++ language extensions for .NET interoperability is a "huge security flaw in .NET".

    C++ is a systems programming language designed for competent systems engineers. Yes, this means it's intrinsically "unsafe" and dangerous when used by developers who have litte understanding of how a computer works.

    This "argument" presented by Gosling is one of the weakest I've seen in a while.


  • User profile image
    Cairo

    littleguru wrote:

    Look at the runtime doing strange stuff on one platform that it does not on another - terrible!


    On the upside, Java actually runs on multiple platforms, whereas .Net does not. Unless you count the many versions of Microsoft Windows as "different platforms". Even then, .Net runs on only a few of them.

    The .Net team did get the chance to "start over" when they began cloning Java with project COOL ("C-style Object Oriented Language") and learn from the Java community's experiences. But they totally pitched portability at the same time. Of course, from Microsoft's point of view, that was probably one of Java's "mistakes".




  • User profile image
    Cairo

    rhm wrote:

    God knows what Mac developers think, but I note that despite a full set of Cocoa bindings for Java, most Cocoa developers still chose Objective-C despite it being the ugliest language known to man.


    Objective-C rocks! It's C++ that's the abortion.

    [objC retain];
    [Cpp release];

    Apple has made a number of languages first-class citizens on Mac OS X, including:
    • Objective-C
    • C
    • C++
    • Java
    • Python
    • Ruby
    • Perl
    I personally prefer Objective-C and Python, although Ruby has some nice qualities. I've often wished there was a version of Python that had curly braces rather than whitespace block delimitation, and Ruby is some approximation of that.

    Java's there, fully supported -- actually more than fully supported, as Apple goes the extra mile to make Swing look and feel like a native Mac OS X GUI (this has the side benefit of accelerating Swing UI drawing as well).

    It would be interesting and cool if Microsoft and Apple would officially support .Net on OS X. "Rotor" is a lesser version of .Net for FreeBSD, and Mac OS X is built on FreeBSD. I guess when the Office apps acquire a .Net dependency, then Microsoft will ship some version of it for Mac OS X.





  • User profile image
    Charles

    Cairo wrote:
    It would be interesting and cool if Microsoft and Apple would officially support .Net on OS X. "Rotor" is a lesser version of .Net for FreeBSD, and Mac OS X is built on FreeBSD. I guess when the Office apps acquire a .Net dependency, then Microsoft will ship some version of it for Mac OS X


    Interesting.

  • User profile image
    geekling

    Cairo wrote:
    littleguru wrote:
    Look at the runtime doing strange stuff on one platform that it does not on another - terrible!


    On the upside, Java actually runs on multiple platforms, whereas .Net does not. Unless you count the many versions of Microsoft Windows as "different platforms". Even then, .Net runs on only a few of them.

    The .Net team did get the chance to "start over" when they began cloning Java with project COOL ("C-style Object Oriented Language") and learn from the Java community's experiences. But they totally pitched portability at the same time. Of course, from Microsoft's point of view, that was probably one of Java's "mistakes".


    I can run my code on Linux using Mono just fine. Wink

  • User profile image
    geekling

    geekling wrote:
    I can run my code on Linux using Mono just fine. Wink


    Wow. I hadn't realized how trite it was. I meant to say that Mono makes my applications crossplatform enough, so I don't consider Java's claim to fame, "portability" really that big an argument for it. =D

  • User profile image
    geekling

    Beer28 wrote:
    mono's ok if you don't need any UI, winforms, ect..


    Oh, I must disagree! I find that GTK# works very well for user interface development under Linux *and* Windows using Glade#, and Managed.Windows.Forms is in good enough working order for applications I've already written in Winforms.

    I find that it is very robust and provides all the elements I need for a powerful application development--networking, user interface, filesystem access, rich collection system, etc. Wink

    (edited, because geekling grammar suck muyo bado)

  • User profile image
    geekling

    Beer28 wrote:
    geekling wrote:
    Beer28 wrote:mono's ok if you don't need any UI, winforms, ect..


    Oh, I must disagree! I find that GTK# works very well for user interface development under Linux *and* Windows using Glade#, and Managed.Windows.Forms is in good enough working order for applications I've already written in Winforms.

    I find that it is very robust and provides all the elements I need for a powerful application development--networking, user interface, filesystem access, rich collection system, etc. Wink

    (edited, because geekling grammar suck muyo bado)


    GTK# doesn't seem to work on my stable version. Also, alot of win developers are not going to use GTK#, as GTK# is based on GTK, which is super popular on linux with Gnome that is built on it, but is very obscure on windows. I gather most people are going to opt for winforms over GTK#, that actually use .NET that is.


    That's odd. I've never had a problem with an XCOPY delopyment of any of my GTK# applications. Of course, admittedly, I have not made hundreds of them--3 or 4 at the very max.

    Anyway, I think its great that people can use Windows.Forms for superior integration with Windows, and people who want portability or who want to do heavy Linux/Gnome application development can utilize GTK# to its fullest.

    I think its a blend of the best worlds: deep integration for people whose target is just one platform or superior portability for people who need to reach out and touch someone.

  • User profile image
    Sven Groot

    Beer28 wrote:
    GTK# doesn't seem to work on my stable version.

    You did actually install it I hope? It's not actually part of a default Mono source build (not so sure about the more recent RPMs, though, I've been building it from SVN for a while now).

    And Windows Forms is making great progress. I'm confident that in a few months they'll be able to run most Windows Forms application.

  • User profile image
    geekling

    Beer28 wrote:

    If i had to use GTK on linux, I would and do use GTKmm with Eclipse CDT, because it's my prefered way to interface the GTK libraries. You can use GTK widgets from java as well as mono. Eclipse has both a GTK java version and a motif version, alot of java apps do.


    I don't think I could ever use C++ in a "real" application. I never really got the hang of it, even though I picked up on C# like a duck to water. (I actually picked C# over the fledging D and the then uncontested Java, but that's another story).

    For me, the only viable avenue of creating an application for Linux would be through Mono and GTK# or Managed.Windows.Forms--I'm not really down with the low-level wizardy required to effectively create and maintain a C++ application. Wink

    Not having to recompile your binaries is a real plus, too, with .NET *or* Java -- all you need to do is provide different "zip" archives (tar.gz for Linux, .msi for Windows) for an XCopy deployment and everything is handy-dandy.

  • User profile image
    Charles

    I really like Adi Oltean's perspective on this issue. You should give it a gander.


    Charles

  • User profile image
    rhm

    Yeh, I mentioned JNI in my slightly more scathing post earlier in this thread.

    The difference between JNI and what .NET offers though is that JNI is just the minimum functionality the JVM team could get away with offering the class library writers to interface with the host OS. .NET on the other hand has the goal of making it as easy as possible for the developer to re-use existing unmanaged code they already have.

    Both sides of this battle have similar security issues in that they both offer a way to crash or corrupt the process and they both stop this from happenning unless the code is trusted in some way or other. The difference is on one side you have the sheer arrogance and "I know best" attitude of Java that expects you to write your whole app in Java or suffer the ignominy of being labelled 'impure' and the pain of having to use the braindead JNI mechanism to call your legacy code. And on the other side you have .NET bending over backwards to make your integration as easy as possible.

Conversation locked

This conversation has been locked by the site admins. No new comments can be made.