Information Security & US & Life & Love & Fashion & Hacking & Passion

Java Applet Security Model

The standard Java applet security model forces downloaded Java applets to run within a highly restrictive sandbox, severely limiting their capabilities as well as the damage they can do to the user's system. The sandbox prevents applets from accessing the machine's file system, which includes the registry on a Windows box, and does not allow them to launch other programs. Additionally, applets cannot communicate with any system on the network except with the host from which the browser downloaded them. I've always been surprised by the use of the word sandbox to describe this critical component of the Java security model. Although this word invokes happy images of children playing peacefully, most parents know that children playing in a sandbox can jump out of the sandbox and spread sand everywhere. Who uses a sandbox to improve security? I use locks, keys, cages, and other physical devices to protect my stuff. Therefore, I think of the Java sandbox as more of a locked cage. Java applets can operate within the cage, but cannot reach outside of the cage to cause any damage (provided that the cage itself is secure, of course).

In the example depicted in Figure 4.12, the SSH applet was operating within these sandbox restrictions. Therefore, I was only able to make an SSH connection to the Web server that was hosting the applet. If I asked the applet to connect to another host, say ftp.example.com, for example, the JRE would block the attempt and present me with the following error message:

java.security.AccessControlException: access denied (java.net.SocketPermission ftp.example.com resolve)

Over the past 13 years, Sun Microsystems' Java language has become one of the computer industry's best known brands—and underappreciated assets.

The tension wasn't lost on Sun's new owner, Oracle (ORCL), which on Apr. 20 said it will purchase Silicon Valley pioneer Sun (JAVA) for $7.4 billion in cash. If Oracle has its way, Java will emerge not only as a strong revenue source but also a key component of plans to keep customers loyal for years to come.

During a conference call with analysts on Apr. 20, Oracle CEO Larry Ellison called Java "the single most important software asset we have ever acquired." It's a bold statement from a chief executive who has spent in excess of $40 billion to buy more than 50 software companies since 2005.

Powering PCs and Cell Phones

Ellison is willing to make that call because the Java programming language, widely used to write much of the world's business software, is a key ingredient in Oracle's recipe for ensuring the many products it has already acquired work smoothly together. Java also runs on 800 million PCs and 2.1 billion mobile phones. PC makers and cell-phone vendors, including Nokia (NOK), pay royalties to license the software. "When you look at those numbers, they're enormous," Citigroup (C) analyst Brent Thill says of Java's potential. "Oracle looks at this and says, 'This could be a $1 billion business.'" Yet Java supplied just $220 million of Sun's $13.9 billion in 2008 revenue. "Java is the most valuable brand in software that has no value," says Joshua Greenbaum, principal of industry analysis firm Enterprise Applications Consulting.

Oracle hopes to wring value from the deal in part by cutting costs to make Sun's hardware and software businesses profitable. Oracle also wants to sell Sun's Solaris operating system and servers in tandem with its market-leading database software. Citigroup's Thill estimates Oracle could cut between 40% and 70% of Sun's roughly 33,000 employees. Excluding restructuring costs, Oracle expects Sun to add $1.5 billion in profit during the first year after the acquisition closes this summer, and another $2 billion the following year. Oracle executives declined to say how many jobs would be eliminated.

Buying Sun gives Oracle access to popular software it can wield against its competitors. In addition to Java, Oracle gains Solaris, widely used in industries including telecom and finance. Oracle also picks up the MySQL database, which is available free under an open-source licensing arrangement, and could help Oracle check sales of Microsoft's SQL Server database to smaller companies. "Sun is not a well-managed company," says one industry executive familiar with its business. "But it does have assets that can become lethal weapons for the one owning them."

Little Hardware Experience

But to gain those assets, Oracle also has to take on a hardware business, something it has little experience running. Ellison will have to make a success of Sun's server business, which has been losing money. Oracle has made its own forays into the hardware business, striking a deal with Hewlett-Packard (HPQ) last year to produce servers designed to provide a performance boost to Oracle databases that run on them.

Oracle to Buy Sun

"We expect this acquisition to be accretive to Oracle's earnings by at least 15 cents on a non-GAAP basis in the first full year after closing. We estimate that the acquired business will contribute over $1.5 billion to Oracle's non-GAAP operating profit in the first year, increasing to over $2 billion in the second year. This would make the Sun acquisition more profitable in per share contribution in the first year than we had planned for the acquisitions of BEA, PeopleSoft and Siebel combined," said Oracle President Safra Catz.

"The acquisition of Sun transforms the IT industry, combining best-in-class enterprise software and mission-critical computing systems," said Oracle CEO Larry Ellison. "Oracle will be the only company that can engineer an integrated system - applications to disk - where all the pieces fit and work together so customers do not have to do it themselves. Our customers benefit as their systems integration costs go down while system performance, reliability and security go up."

There are substantial long-term strategic customer advantages to Oracle owning two key Sun software assets: Java and Solaris. Java is one of the computer industry's best-known brands and most widely deployed technologies, and it is the most important software Oracle has ever acquired. Oracle Fusion Middleware, Oracle's fastest growing business, is built on top of Sun's Java language and software. Oracle can now ensure continued innovation and investment in Java technology for the benefit of customers and the Java community.

The Sun Solaris operating system is the leading platform for the Oracle database, Oracle's largest business, and has been for a long time. With the acquisition of Sun, Oracle can optimize the Oracle database for some of the unique, high-end features of Solaris. Oracle is as committed as ever to Linux and other open platforms and will continue to support and enhance our strong industry partnerships.

"Oracle and Sun have been industry pioneers and close partners for more than 20 years," said Sun Chairman Scott McNealy. "This combination is a natural evolution of our relationship and will be an industry-defining event."

"This is a fantastic day for Sun's customers, developers, partners and employees across the globe, joining forces with the global leader in enterprise software to drive innovation and value across every aspect of the technology marketplace," said Jonathan Schwartz, Sun's CEO, "From the Java platform touching nearly every business system on earth, powering billions of consumers on mobile handsets and consumer electronics, to the convergence of storage, networking and computing driven by the Solaris operating system and Sun's SPARC and x64 systems. Together with Oracle, we'll drive the innovation pipeline to create compelling value to our customer base and the marketplace."

"Sun is a pioneer in enterprise computing, and this combination recognizes the innovation and customer success the company has achieved. Our largest customers have been asking us to step up to a broader role to reduce complexity, risk and cost by delivering a highly optimized stack based on standards," said Oracle President Charles Phillips. "This transaction will preserve and enhance investments made by our customers, while we continue to work with our partners to provide customers with choice."

The Board of Directors of Sun Microsystems has unanimously approved the transaction. It is anticipated to close this summer, subject to Sun stockholder approval, certain regulatory approvals and customary closing conditions.

There will be a conference call today to discuss the transaction at 5:30 a.m. Pacific time. Investors can listen to the conference call by dialing (719) 234-7870, passcode 923645. A replay will be available for 24 hours after the call ends at (719) 884-8882, passcode: 923645. A live audio webcast of the call will be made available at www.oracle.com/investor and a replay will be available for seven days after the call ends.

About Oracle

Oracle (NASDAQ: ORCL) is the world's largest enterprise software company. For more information about Oracle, please visit our Web site at http://www.oracle.com.

About Sun Microsystems, Inc.

Sun Microsystems develops the technologies that power the global marketplace. Guided by a singular vision -- "The Network is the Computer" -- Sun drives network participation through shared innovation, community development and open source leadership. Sun can be found in more than 100 countries and on the Web at http://sun.com.