Perry pointed out the standard set of concerns that anyone should have with Java. About the only thing I'd care to dispute at the moment is that Java is a "large complicated" application. It is in fact less than 20K lines of C code. And while it is true that applications of even this size are difficult to prove safe, there has been an effort to break that problem up into components such that each "layer" can be proven safe and where that layer is used that safety carries over. Let me give you an example: There are three "parts" of the Java system: o Java Bytecode o Java Runtime o Java Virtual Machine. At a "meta" level there is the Java Language and the compiler that converts it into byte codes however for the purposes of a security discussion those are irrelevant since the browser in this case receives byte codes and the compiler at the other end is presumed suspect. So one way to approach this analysis is to look first at the bytecodes. One of the things you will discover is that Java is *not* a general purpose language. It lacks crucial features such as introspection and anonymous memory access. So you might ask "How can anyone write anything useful in it then?" and that is a fair question. The answer is that it does have one loophole and that loophole is the 'native' keyword on a method description. Basically, if you need a general purpose feature (like object inspection) you can get it with a native method. "So I write a native method to delete your files, what does that buy me?" you might ask. Well Java is also a _late binding_ language. Thus the binding of external method references (which native methods are by definition one) can be identified at bind/link time (which always occurs on the client) and optionally rejected. The next level of inspection is all of the classes that, through one of their methods, actually call a native method. Those can be analyzed closely and there are relatively few of them (about 28). The final level of inspection is the virtual machine interpreter. Its operation as a giant switch statement can be inspected for valid code design. It isn't all that large and a team of three can inspect it in under a week. If the layers work, the system works. We encourage any questions on security or identifying any "holes" to be sent to java@java.sun.com for our immediate attention. --Chuck However, Java is also late