Benedict Evans writes:
> As I see it, the idea that Java is handicapped because it can't access
local
> information is flawed for two reasons.
>
> First, it isn't quite true: the MExE spec allows tiered levels of
> permissions to be granted to different applets: an applet can be given any
> permissions you want, if you trust it. "This applet is trying to access
your
> phone book: do you want to let it?" is fine for a new messaging applet
from
> Iobox, not so fine for that karma sutra app you grabbed from a site in
> Bulgaria.
Yes, but what's the implicit message to the user in a program asking for
permission at all? Some conversations never get back on track after
the first unpleasant question. And, as it is put so well in The ClueTrain
Manifesto, markets are conversations. We would all probably be better
off if our software engaged us in conversations about system security at
every juncture at which it might be an issue, but it sure wouldn't be
much fun. Nor would there be much of a market for software. Some
bosses would probably even mandate a return to manual typewriters.....
> Secondly, there's no *information* on your handset that you need to give
an
> applet access to, except maybe your phone book......
*Definitely* your phone book, anyway!
> I simply don't understand why certification offers any real-world
advantages
> over MExE permissions combined with a sandbox, other than speed.
As I tell a friend of mine on issues like this: "Sit down and try to explain
it to
your mother. If she's still baffled after 1 minute, you have your answer."
Consumers have to get it, and if what they get is "I can sue someone for
things going wrong even they are only 10% at fault," they'll buy that over
over "caveat emptor", "the price of liberty is eternal vigilance", and
"there's no such thing as a free lunch."
-m
leap@gol.com
[ Did you check the archives? http://www.appelsiini.net/keitai-l/ ]
Received on Wed Apr 25 10:47:40 2001