SUN Microsystems Java and Microsoft’s .NET platforms are no more than programming languages that exploit network potential with the idea that the same software should function on different platforms. Both systems are centered around the principle of running software that doesn’t reside on the client machine to provide greater functionality or faster execution, saving connection time and improving public perception of the server to which the client connects. Read Article
Java and .NET security
About The Author
Eugenia Loli
Ex-programmer, ex-editor in chief at OSNews.com, now a visual artist/filmmaker.
Follow me on Twitter @EugeniaLoli
Because we all know .NOT runs on different platforms.
“same software should function on different platforms”
That’s the theory, in practice this idea is almost abandoned. To make it, sun developers had to create classes like Swing. It has a default crossplatform look that noone really want, and platform-specific looks which are a bit better, but
always feel amateurish. The result is that the amount of desktop applications in pure java is ridiculously small. Perhaps will SWT help, but it seems to late …
For .NET, Microsoft didn’t bother to create some abstraction classes, so that win32 developers felt “at home” (and didn’t bother to provide a full .NET platform for another platform than Win32). The recent articles about Mono and System.forms
(2 years to implement it …) clearly prove that the framework was never supposed to be really cross-platform.
The author really, really needs to do more research. His statement that .NET is an improvement over Java, because the code runs on the server and not the client, like in ActiveX and Java is just plain stupid.
As we all know, Java is not just limited to Applets running in a web browser, but can run applications both on the server and on the client. By making statements like the above, the author is just showing exactly how much he doesn’t know about Java or .NET.
I completely agree. I was disappointed that the article did not mention J2EE – only Java applets. They are completely different animals.
The idea of the paper is to emphasize the security issues of Java and .Net and not to provide information regarding their capabilities. I do agree that Java can run both on Server and on the client (we have Java web server
), but herein the author simply discuss it from the user perspective.
“Perhaps will SWT help, but it seems to late … ”
Tell that to IBM, Borland, MERANT, QNX Software Systems, Red Hat, SuSE, Serena, Sybase, Fujitsu, Hitachi, Instantiations, MontaVista, Scapa Technologies, Telelogic, ETRI, HP, MKS and SlickEdit, Oracle, Catalyst Systems, Flashline, Parasoft, SAP, teamstudio, TimeSys, Object Management Group, Fraunhofer Institute, Ericsson, LogicLibrary, M7 Corpororation, QA Systems, SilverMark Inc, Advanced Systems Concepts, Genuitec, INNOOPRACT Informationssysteme GmbH, CanyonBlue, Ensemble Systems, Intel, Micro Focus, Tensilica and Wasabi.
http://eclipse.org/org/index.html
But then again, what do those companies know about computing…
2 years to implement Mono has nothing to do with how windows-centric .Net is. Microsoft has been working on the CLR at least since 1999, and already Mono is nearly as full featured as the .Net framework.
Yeah, but keep in mind that Microsoft actually had to design everything as they were building it. Granted many of the library APIs are just managed wrappers around the old native stuff, but that doesn’t mean there still wasn’t a ton of design work. ASP.NET, for instance, is a beautiful application of pattern–that took a nontrivial amount of thought to do. Also consider the massive amounts of prototyping that had to be done before they found something they liked. Early version of VB.NET, for example, were supposedly much closer to VB6, but they dumped it when they realized there were some deep conflicts between the VB6 and CLR runtime models.
I’m not trying to say what the Mono team has done isn’t impressive–it is–but it’s naive to infer that Microsoft’s CLR team is more incompetent than the Mono team just because it took them longer. Keep in mind they didn’t have the luxury of ECMA specs to copy off of.
I didn’t get the bit about .Net running remotely on the server? Surely rich applications (not ASP.NET) run locally?
I would suspect that .Net has the bigger problem that it currently relies on a lot of native libraries for functionality. I’m still not convinced that MS will ever release purely managed versions of its applications. The problems of course with native code over managed code is that I thought the former didn’t use the same security controls.
I don’t know how big a problem this is. IMHO MS has generally been a bit of an ostrich about privilege escalation. It will be interesting to see what kind of sandbox MS ends up using for .Net (possibly one that doesn’t allow any/limited native libraries to be used).
Agreed, I don’t think I called MS incompetent in my post, and I realize that MS did most of the groundwork. Just sayin that the core of .NET is not inherrently so tied to Windows that it can cause trouble when creating an implementation.
“But then again, what do those companies know about computing…”
How does it come that aside from eclipse-based IDE, you don’t see any software released by these companies based on SWT ? don’t get me wrong : SWT is nice, but the simple fact that it is not by default in java, and more or less linked to Eclipse is not a good point.
A really bad article. I had been hoping for some kind of comparison, or at least a mention, of the differences between Code Access Security in .NET and the Java2 sandbox. The only comparison being along the lines of:
“Java runs on the client, .NET runs on teh server so java is Sux”
Seeming to forget that Java can run happily on the server and .NET can run on the client as well. The author then goes on to state that all our problems would go away if patchs where pushed to users and installed as soon as they are available. Again seeming to forget that every major desktop operating system has a system for doing this already. But users tend to turn it off as patches have a nasty reputation of breaking applications or even re-opening old holes.
Just simple questions…
Does .NET have something like JAAS?
Does .NET have something like Applet?
(no mention Linux here 😉
Does .NET have something like JWS?
What about unmanageble code?
About “multiplatform”:
.NET is – WRITE ONCE RUN ON WINDOWS, then rewrite for another WINDOWS (WinForms???)
DAO is directly hardered to OLE/ODBC even “pure” net Oracle datasource needs DLLs from Oracle (guess why? 😉
WinForms are just AWT (hello 1995 🙂
SWT is nice, but there are GTK wrappers QT wrappers and so on… I made 1 project with SWT – not bad and I had OLE integration for free (windows), but I definitly prefer Swing.
AVALON for .NET (2007???) is the MS response to SWING (what is the big difference?)
Cheers
First: you should check .Net before asking questions (or at least read the linked article).
>Just simple questions…
Indeed simple.
>Does .NET have something like JAAS?
.Net does not need “another” framework for security, CAS already does that. (You can check the Asp.Net security framework for an implementation example).
>Does .NET have something like Applet?
>(no mention Linux here 😉
This is mentioned in the article.
>Does .NET have something like JWS?
It’s not necesary at all. JWS is a “fix” for Applets. Running .Net programs directly from an URL/Network share does what JWS does.
>What about unmanageble code?
Do you mean badly writed code? Or “native” code?
>About “multiplatform”:
I’d say “Mono/Portable.Net”, but I guess you’d not like it
i’d still prefer coding in java, i don’t need to recode stuff when i change os, i can still use the same codes.
You can prefer coding in Java, there is nothing wrong with that.
But, software development is about choice, and .Net is a very good choice in many situations. What I do not like is often Java programmers does not investigate .Net as another choice, but directly condemn it (for being so and so).
Even in Java, there are many choices:
– AWT,Swing or SWT
– Applet, JSP or JWS
– EJB, Hibernate, pure JBDC or another persistance framework
– DOM, jDOM or SAX, or another Xml parser
Each choice has consequences (good or bad). For my situation (i’ll not disclose it now) I’d prefer .Net, but for another one Java could be better.
“… Java and .NET platforms are no more than programming languages…”
??? Java & C# – agree. JAVA & .NET are PLATFORMS!!!
“…A hacker … could easily … modify content within Java applets and by-pass ‘sandbox’ security…”
??? Yep, and I can write a virus in plain spanish (asci format) which format all NTFS partitions in the world and clear all BIOSes!!!
BTW how many viruses you know written in Java? 😉
What ActiveX has to see with .NET at all?
…
I admit I’m pretty novice in .NET
So CAS is the same as sand-box code-level security in JVM…
As far as I know (forgive my ignorance) there is no PLATFORM security in .NET ASP.NET could use IIS security which is WINDOWS security (ACL). Again IIS is a part of .NET? Where is a Mono port? 😉
JWS is not an Applet *fix* Actually it has nothing to see with Applet – you do not need a browser to run it (nor to install it). It’s just a way to distribute an application.
“URL/Network share” is a new concept to me… Is it like download an exe thru the LAN (ie, e-mule…) and run it locally? 😉 Again what about security?
unmanageable code I mean native code included in application? (I admit, I have no idea how VM handle security in this case).
Mono… Mono… Mono…
Mono has been promised to clarify the legal situation about such an implementation long time ago… Do they have some agreement with Microsoft???
Who control the platform future?
Saying tomorrow Microsoft add 3 patented API and depricate another 3??? What Mono expect to do in this case??? Fork the development??? Who will need INCOMPATIBLE (what is the situation now) Mono??? Whey just have no chance to be compatible. Do they think they can make .NET better then Microsoft??? Imageine we have .NET made by MyGarageInc. from the first place? NO-ONE even considered this bunch of …. as a platform to work with… maybe some students.
Sincerely.
But, software development is about choice, and .Net is a very good choice in many situations. What I do not like is often Java programmers does not investigate .Net as another choice, but directly condemn it (for being so and so).
No, software development is about filling the needs of the user/customer. The problem java programmers have with .net is that it is too similar to java. Some things might be better but in general it is marketed as a java replacement.
For most people,this isn’t good enought to motivate a switch to .net. Most things that can be done in java can be done equally well in .net and vice versa, but who is going to pay you to learn a new language? This is why it is so hard to introduce new programming languages and environments. To be succesful you need to different and offer new things that makes it possible to solve new problems or at least solve old problems at significantly lower cost.
If java hadn’t had its crossplatformness it would probably never been anything but an experiment at Sun or some academic institution once Sun had got tired of it. As I see it .net have no such major advantage. It is just another slightly improved java. But the improvements are not greater than what you could expect to see from one version of java to the next.
http://weblogs.asp.net/michael_howard/archive/2004/10/25/247470.asp…