Re: SecurityManager

Surendra Lingareddy wrote:
> We have a controlled environment where the server and clients most
> likely will be in the same network. Our packaging is done where the stub
> files are provided to the client so that no one the downloading business
> needs to happen. In this case, is a SecurityManager necessary at all?
> Also, to provide security, we are use SSL factories to make the
> connection between a client and a server. 

The SecurityManager has to be set due to explicit checks in RMI.  You ask if it 
is necessary.  In your case, it probably isn't doing anything to enhance normal 
activities.  But, you should always keep security in mind and try and protect 
your environment from things that you haven't anticipated.

The current state of the world regarding viruses is predominately related to 
Microsoft not addressing security as a primary thing from the start.  Later, 
they became more interested in it, or so it seems.  But if you watch the CERT 
advisories, MS is still the predominate source of issues.  Thus, there are still 
things happening that they didn't anticipate which are creating problems.

It is much easier to have a policy file with no controls, and to make everything 
just work without any real security.  But, in the end, that's what makes 
everything that you don't want to happen, happen...

Gregg Wonderly

===========================================================================
To unsubscribe, send email to [email protected] and include in the body
of the message "signoff RMI-USERS".  For general help, send email to
[email protected] and include in the body of the message "help".

For a list of frequently asked RMI questions please refer to:
http://java.sun.com/j2se/1.3/docs/guide/rmi/faq.html

To view past RMI-USERS postings, please see:
http://archives.java.sun.com/archives/rmi-users.html