4 ms·

FWIW, I had updated Java to use a capabilities model (before the "SecurityManager" cruft was so rudely shoved into the libraries) that was patterned after Joule

FWIW, I had updated Java to use a capabilities model (before the "SecurityManager" cruft was so rudely shoved into the libraries) that was patterned after Joule (one of the few (if not the only) language that had passed 'red book' security certification). And part of the challenge of building it had been understanding method and class "signatures" which would inform the model. In particular, the challenge was trying to figure out what "side effects" were relevant and which were not[1]. The requirement was to throw IncompatibleClassChangeException when the class had changed and thus the capability was possibly incorrect. We got pretty draconian and went for a "class changes can be "additive" only, so that the capabilities could be forward compatible with new classes. Sadly, politics got in the way of shipping it so I ended up with only a couple of patents and a later Javaworld column out of it and most of work never saw the light of day. [1] For example you might have a File class with a write() method that you wanted to be part of a write capability, but there might also be a update_metadata() method that effectively wrote something to the file so you needed that to be part of the capability, and that method might be looking at static member data of meta data flags, which were also part of the read() capability.

patrec 6y ago
I'm quite intrigued to hear that Java might almost have had a sane security model – what was the political problem that killed it? Anything from your work that you'd like to see used in new languages (those patents must have expired now I assume?).
- ChuckMcM 6y ago
  An influential member of the team didn't understand the code I was checking into the source tree so they deleted it all and added the SecurityManager instead. The manager refused to override that action because "the individual threatened to quit."
  - patrec 6y ago
    How typical was that type of thing? Although on the whole I think Java is better than its reputation, I always thought it a bit underwhelming for the brainpower around at the time; one would kinda assume in addition to yourself people like Guy Steele or Gilad Bracha might also have tried to get a forward looking thing or two in if someone had let them. BTW, the link to your capabilities columns on your home page appears to be be broken: http://www.mcmanis.com/chuck/java/javaworld/index.html http://www.mcmanis.com/chuck/java/javaworld/index.html
    - ChuckMcM 6y ago
      Interesting, Inforworld (presumably copyright owner of Javaworld) moved the article to here: https://www.infoworld.com/article/2076993/take-a-look-inside-java-classes.html https://www.infoworld.com/article/2076993/take-a-look-inside... As to your original question, Sun was a pretty political place in general. Java was a "weird" place because it only existed because Gosling and some other folks were walking out the door and Scott McNealy asked what he could do to keep them. Their response was give them full autonomy to pursue their ideas. That gave birth to "First Person" which was an independent company wholly owned by Sun (I still have my First Person business card :-)). One of the people knew I was "loose in the socket" as they say and wanted to be sure I had an opportunity to participate and brought me over. It made the last 4 years at Sun mostly enjoyable. As the limelight started fading from Sun and they started killing off things that couldn't make a profit, they decided to kill off First Person (couldn't make a business case for it). So the Java team negotiated with them to let us release the sources so that when we were job hunting the person could look at the source to see what we had been doing for the last 4 years. We did a stealth release in January of '95, then an "official" release in March. That put us on the front page of the Mercury News. A couple of us attended the WWW conference in Darmstadt Germany and it was all anyone wanted to talk about (much to SGI's chagrin). At which point the politics REALLY ramped up back at Sun when people figured out it would be a "good" thing to be associated with Java instead of a "loser" thing. This affected different people differently, and some, who had pretty bad case of imposter syndrome, went all out trying to claim credit for everything. It ceased to be "fun" with the hard to get along with folks becoming intolerable.
      - 6y ago
  - jariel 6y ago
    Why would something so existentially important such as a 'security model' be blocked at the code-level, let alone 'code being checked in'? Would that be something discussed long before anyone implements anything? It touches every part of the system and informs the very essence of the product.
    - ChuckMcM 6y ago
      You know that phrase "Reality is complicated"? Smart people tend to over estimate their understanding of complicated subjects, and it irritates them when it appears you are making something more complicated than it "should be." Even though the error is their over estimation, not the complexity of the solution. If you combine that with their ego being unable to accept that something is more complicated than they assume, then you get the situation where they propose a solution that is simple, easy to implement, and wrong. Add to that a measure of "hurt" from feeling like the messenger is getting the credit that you are due. And you get someone who directs their anger at the messenger not the message. Yes, it's broken, yes it's dysfunctional, but it's just business. If you are in that spot you can assuage your hurt feelings by forcing the simple/wrong solution through to "prove" to yourself that you have more power. In all fairness I don't blame the engineer. They fully believed that their simple solution was completely adequate. I do however blame the management that put up with this. They are the ones who should have been looking out for the company/technology and not whose feelings would be hurt by doing the right thing. Several years later James apologized to me for not doing the right thing, and I appreciated that, but I also recognize that while my system was much more secure and would have not had the vulnerabilities that were later found, it was more complicated and thus harder to validate, and it could have just as easily been broken in a different way.
      - jariel 6y ago
        I appreciate the fact that the Security Model may have been 'simple' - and frankly 'simple' is usually better with these things. However - it doesn't abnegate the fact that no matter how you slice it the 'Security Model' is an important thing unquestionably deserving of some open discussion among participants, because there existential consequences. Especially with Security - it's not one of those things that's ever obvious. This is why we have bug bounties, certain kinds of open source - it generally benefits from 'a lot of eyes, and pondering'. It's probably something you might try a few versions of and not even make your mind for a bit. The evidence that 'it's a big deal' is in your own response: the solution was screwed up, and Java paid a big price. The fact that anyone 'right or wrong' was trying to put together a solution and just 'check it in' frankly is a little frightful. Engineers threatening to quit, and decisions made on the basis of that are comical. If this narrative is authentic, then it seems Java Security Model - and probably a bunch of other things were just 'slammed together' by a bunch of smart guys passionately working on it, arguing, playing games' and we're lucky to have what we have today I guess. Imagine what we would have if there was some intelligent social deliberation there.

patrec 6y ago

I'm quite intrigued to hear that Java might almost have had a sane security model – what was the political problem that killed it? Anything from your work that you'd like to see used in new languages (those patents must have expired now I assume?).

ChuckMcM 6y ago
An influential member of the team didn't understand the code I was checking into the source tree so they deleted it all and added the SecurityManager instead. The manager refused to override that action because "the individual threatened to quit."
- patrec 6y ago
  How typical was that type of thing? Although on the whole I think Java is better than its reputation, I always thought it a bit underwhelming for the brainpower around at the time; one would kinda assume in addition to yourself people like Guy Steele or Gilad Bracha might also have tried to get a forward looking thing or two in if someone had let them. BTW, the link to your capabilities columns on your home page appears to be be broken: http://www.mcmanis.com/chuck/java/javaworld/index.html http://www.mcmanis.com/chuck/java/javaworld/index.html
  - ChuckMcM 6y ago
    Interesting, Inforworld (presumably copyright owner of Javaworld) moved the article to here: https://www.infoworld.com/article/2076993/take-a-look-inside-java-classes.html https://www.infoworld.com/article/2076993/take-a-look-inside... As to your original question, Sun was a pretty political place in general. Java was a "weird" place because it only existed because Gosling and some other folks were walking out the door and Scott McNealy asked what he could do to keep them. Their response was give them full autonomy to pursue their ideas. That gave birth to "First Person" which was an independent company wholly owned by Sun (I still have my First Person business card :-)). One of the people knew I was "loose in the socket" as they say and wanted to be sure I had an opportunity to participate and brought me over. It made the last 4 years at Sun mostly enjoyable. As the limelight started fading from Sun and they started killing off things that couldn't make a profit, they decided to kill off First Person (couldn't make a business case for it). So the Java team negotiated with them to let us release the sources so that when we were job hunting the person could look at the source to see what we had been doing for the last 4 years. We did a stealth release in January of '95, then an "official" release in March. That put us on the front page of the Mercury News. A couple of us attended the WWW conference in Darmstadt Germany and it was all anyone wanted to talk about (much to SGI's chagrin). At which point the politics REALLY ramped up back at Sun when people figured out it would be a "good" thing to be associated with Java instead of a "loser" thing. This affected different people differently, and some, who had pretty bad case of imposter syndrome, went all out trying to claim credit for everything. It ceased to be "fun" with the hard to get along with folks becoming intolerable.
    - 6y ago
- jariel 6y ago
  Why would something so existentially important such as a 'security model' be blocked at the code-level, let alone 'code being checked in'? Would that be something discussed long before anyone implements anything? It touches every part of the system and informs the very essence of the product.
  - ChuckMcM 6y ago
    You know that phrase "Reality is complicated"? Smart people tend to over estimate their understanding of complicated subjects, and it irritates them when it appears you are making something more complicated than it "should be." Even though the error is their over estimation, not the complexity of the solution. If you combine that with their ego being unable to accept that something is more complicated than they assume, then you get the situation where they propose a solution that is simple, easy to implement, and wrong. Add to that a measure of "hurt" from feeling like the messenger is getting the credit that you are due. And you get someone who directs their anger at the messenger not the message. Yes, it's broken, yes it's dysfunctional, but it's just business. If you are in that spot you can assuage your hurt feelings by forcing the simple/wrong solution through to "prove" to yourself that you have more power. In all fairness I don't blame the engineer. They fully believed that their simple solution was completely adequate. I do however blame the management that put up with this. They are the ones who should have been looking out for the company/technology and not whose feelings would be hurt by doing the right thing. Several years later James apologized to me for not doing the right thing, and I appreciated that, but I also recognize that while my system was much more secure and would have not had the vulnerabilities that were later found, it was more complicated and thus harder to validate, and it could have just as easily been broken in a different way.
    - jariel 6y ago
      I appreciate the fact that the Security Model may have been 'simple' - and frankly 'simple' is usually better with these things. However - it doesn't abnegate the fact that no matter how you slice it the 'Security Model' is an important thing unquestionably deserving of some open discussion among participants, because there existential consequences. Especially with Security - it's not one of those things that's ever obvious. This is why we have bug bounties, certain kinds of open source - it generally benefits from 'a lot of eyes, and pondering'. It's probably something you might try a few versions of and not even make your mind for a bit. The evidence that 'it's a big deal' is in your own response: the solution was screwed up, and Java paid a big price. The fact that anyone 'right or wrong' was trying to put together a solution and just 'check it in' frankly is a little frightful. Engineers threatening to quit, and decisions made on the basis of that are comical. If this narrative is authentic, then it seems Java Security Model - and probably a bunch of other things were just 'slammed together' by a bunch of smart guys passionately working on it, arguing, playing games' and we're lucky to have what we have today I guess. Imagine what we would have if there was some intelligent social deliberation there.