Perry writes: You can do that safely without making it dangerous for your machine. I know how I would build a restricted execution environment for such markets. However, Java is 1) too slow, since if you are selling rendering cycles or such you don't want to be running an interpreter, 2) insufficently safe, and 3) paradoxically, insufficiently powerful for the sort of code you would want to run in such an environment. What solution is fast enough and safe enough and powerful enough? Does such a solution exist? I say, No, it doesn't. So let's quit pretending that the Holy Grail exists, and get back to engineering. But let's not have a food fight. Although entertaining in the short term, food fights are actually deathly boring and incredibly unfruitful in the long term. I'm interested in helping people do interesting things in a reasonably secure way, on the internet, using Java. We're working on a response to the Felten el al. paper, which will be posted to the net shortly. I think some of their points are perfectly valid, some of their points are irrelevant, and a lot of the presentation is melodramatic. Melodrama is good for sound bites, I guess. Marianne working on Java security stuff at Sun