From what I have heard, some people are seriously trying to develop Production-ready applications using "Swing" and Java Remoting.
Whilst this may be easy to implement as a developer, it is worth pointing out that there is simply NO SECURITY in the default Java Remoting.
It is left up to the DEVELOPER to define security layers on the default Java Remote Instantiation Protocol.
Put another way, if you create a Java Object which can be instantiated remotely, anybody (I mean anybody) can call this object.
SO... a Live Production Object which creates a multi-million deal could be instantiated by a developer.
That's what I call a security hole.
|
