I think that learning Java and having fun using Java (it is possible ... and I speak as someone who doesn't think that programming is necessarily fun in its own right) is orthogonal to the issue of learning and applying the applet security model. In other words, learning Java today won't be a waste of effort when more sophisticated security schemes come online. I like Laura Lemay's book "Teach yourself Java in 21 days" and the O'Reilly book "Java in a Nutshell." We also have a tutorial online at http://java.sun.com/tutorial/, and all kinds of programmer's documentation at http://java.sun.com/doc/programmer.html The applet security model is described on http://java.sun.com/sfaq/ [Yes we know that more and better documentation is needed!] Anyone who wishes, can get a full source release by faxing us a license agreement. Source isn't a substitute for documentation, but some people actually prefer source to English. See http://java.sun.com/licensing.html for details on how to get the full source release. As other people have pointed out, applet security != internet security. Java is a programming language, and standalone Java apps can and do implement their own security policies. I apologize in advance to Perry and others who will tell me that this posting of mine isn't relevant to cypherpunks. I won't do it again. Marianne JavaSoft, Sun Microsystems Inc