Hi Rob. Thank you very much for your comments. On 03-10-2012 05:53, Rob Janssen wrote: > The big problem with that is that this whole concept of "signed applet" > has zero value. > There is no auditing of the app whatsoever, everyone with a certificate > can sign his > app and certificates are a dime a dozen. > > I would for sure never run a signed java app on my system, especially > not when it > comes from a country with a shady reputation like Brazil. > (although that of course is a prejudice)
Two points here: First, the certificates are cheap, but I think it would be difficult for you to buy a valid certificate saying that you are the NIC.br. Talking about reputation, NIC.br is the executive arm of the Brazilian Internet Steering Committe, that is a multistakeholder (government + 3rd sector + private initiative) council, responsible for the Internet Governance here. We manage the ccTLD .br. We are the Brazilian NIR (distribute the IP addresses in Brazil). We are the Brazilian CERT (security) team. We host the Brazilian W3C office. We manage 20 Internet Exchange Points in Brazil. We are currently incubating the Internet Society Brazilian chapter. So, we have, at least, enough good reputation in our country to be trusted by the www.ntp.br visitors. Back to the idea, you can not trust NIC.br, I can understand and accept that. But would you run, for example, a java applet hosted and signed by the ISC (the guys that are hosting the ntp public services project)? Or by NTP.org? If so, we could go back and discuss the applet funcionality, that was my original idea. If not, this question leads us to the second point: you already run software that is hosted by ISC or NTP.org, I think (ntpd, for instance). Would an applet be less secure than a "full" software? In which way? > In fact, at work last month I blocked all java apps in the > proxy/firewall, and instituted > a whitelist of allowed apps. It now has 1 entry. > Before changing that setup there were several users that hit malicious Java > code that fortunately did not achieve it goals (installing rootkit on > the system) because > of other security settings. But I am not going to wait until they > combine a Java exploit > with a privilege escalation exploit! > > The use of java for apps in the browser for generic internet pages has > almost completely > died out, and the recent security mishaps don't help either. I agree that, from the end user point of view, not having the applets running by default, and using a white list approach, or just enabling it case by case, is the better alternative. But it is very different from not using Java at all. Do you think we should just stop using Java applets, and that it is wrong to provide an application based on this technology? []s Moreiras. _______________________________________________ pool mailing list [email protected] http://lists.ntp.org/listinfo/pool
