RE: Web RPCs Considered Harmful

Please tell me more details.  Thanks.

-----Original Message-----
From: Michael Condry [mailto:Michael.Condry@eng.sun.com]
Sent: Wednesday, May 17, 2000 9:36 AM
To: Ken MacLeod; xml-dist-app@w3.org
Subject: Re: Web RPCs Considered Harmful


Yes, but I do not see any SandBOX model here. Do we wait
until the customer crys....
>"Dave Winer" <dave@userland.com> writes:
>
>> What would be the most practical, easy and low-tech way to add a
>> layer of security, using current best-practices of the Internet?
>> 
>> Rather than seeing this a time to put the brakes on, could we get
>> into problem solving mode and have an answer that can easily be
>> implemented in conjunction with the RPC work?
>
>Since the problem is not one of active security (access control), but
>of passive security (unintended faults), the solution isn't really
>something one puts into a specification.
>
>The current best-practice of the Internet for solving the passive
>security problem is "sandboxing", highly restricting the environment
>and access to resources from where code runs so that when that code
>fails it is still confined to the sandbox.
>
>Java and JavaScript, as examples, are designed with sandboxing as a
>core feature.
>
>  -- Ken
>

Received on Monday, 22 May 2000 18:30:59 UTC