3 ms·
Or in this case, not. https://github.com/ianopolous/JPC https://github.com/ianopolous/JPC
by ianopolous 10y ago
Or in this case, not. https://github.com/ianopolous/JPC https://github.com/ianopolous/JPC
- frou_dh 10y agoWell done. That was "Did you win the Putnam"-esque
- nickpsecurity 10y agoI thought it had to be a safe language rather than a 0-day hoarding platform. :P Least you did your part getting us a start on it. It could be ported to a simpler, safer language and runtime.
- ianopolous 10y agoI'll bite. :-) Java is a perfectly safe language, with one of the best defined specs out there. The JVM, however, has had it's share of vulnerabilities, but that comes with the territory of being installed on 3 billion devices.
- nickpsecurity 10y agoI'll be nice since you are. Java is well-defined language with safety features. Problem was it's written for inefficient abstract machine hard to implement correctly and with much complexity. That and its libraries are written in an unsafe language. Whereas, languages like Modula-3, Ada, or safe variants of C are straight-forward to map to real hardware with small to no runtimes and libraries in same language. Many checks in by default. Two, C subsets and SPARK, can be proven free of common errors. There's a vast difference in safety between such languages and the Java platform. Complexity of compiler/runtime and unsafe libraries are main reasons. Safety-critical, minimal runtimes exist for Java but they're slow and I doubt you paid $$$ for them. ;)
- ianopolous 10y agoWhat's your opinion of the Graal substrate VM? It is 98% implemented in Java, allows you to precompile a VM exactly for your language, and allows you to exclude the entire Java core libraries, for a super lean, but still highly optimized and safe runtime.
- nickpsecurity 10y agoI look at it tonight when I'm off. Already sounds better than regular platform.
- nickpsecurity 10y agoDamn, had I had this link... http://lafo.ssw.uni-linz.ac.at/papers/2015_CGO_Graal.pdf http://lafo.ssw.uni-linz.ac.at/papers/2015_CGO_Graal.pdf ...I could've replied immediately. Graal keeps HotSpot VM, presumably libraries too, while replacing the JIT with an extra-aggressive one (semantic risk) coded in Java (lower code-risk). It's still bad as it barely addresses platform's overall risk. Might make a better, safer JIT for existing platform. The [potentially] better ones are those designed for high-reliability applications such as Aonix's PERC and JamaicaVM. They tend to try to do less with more predictability. There was one implemented on Oberon called Jaos JVM. Also, although JVM itself is orthogonal to this, you can run your Java program on JX Operating System for higher security. http://www4.cs.fau.de/Projects/JX/ http://www4.cs.fau.de/Projects/JX/
- ianopolous 10y agoThanks! JX looks very interesting! I double checked and it appears that almost all of the Java core libraries (rt.jar) are indeed already written in Java. (More a point of information than anything else)
- nickpsecurity 10y agoI thought you'd like it. It's GPL'd, too, with active development. Might be worth contributing to or porting to Xen for containerized apps with better security.
- hacknat 10y agoThat has to feel pretty good. This reminds me of the cpercival exchange way back when. It's funny to see people set themselves up like that in this community. Hello! A good chunk of the users of this site build stuff for a living and for fun!
- cperciva 10y agoThis reminds me of the cpercival exchange way back when. It's funny to see people set themselves up like that in this community. Just to be clear, I didn't set that up. In fact I was rather amazed at that question arriving in my lap.