Testing, by POSSIE, Indicates Windows XP Not JVM-Agnostic

Business Wire, July 19, 2001

Business Editors

AUSTIN, Texas--(BUSINESS WIRE)--July 19, 2001

Reinstatement of Java Will Also Require

More Than Bundling JVM Back Into XP

Through statements made to the press this week, Microsoft said it is no longer bundling a Java Virtual Machine (JVM) with Windows XP.

The company said that instead, its users can choose to download a VM from Microsoft or other third-party vendors. But testing conducted by developers associated with non-profit group POSSIE (People for Open, Safe and Secure Internet and Email) indicates the Internet Explorer (IE) browser will not recognize VM downloads from Sun Microsystems or IBM in Release Candidate 1 of XP.

Microsoft also indicated previous versions of Windows being upgraded to the new XP would maintain the VM, and that only new installations of the desktop OS would be impacted. However, POSSIE testing also shows the existing VM is not recognized by Internet Explorer after upgrading to XP from Windows NT, Windows 98, or Windows 2000.

"These tests certainly create an early concern that the disablement of Java is going to be a bigger issue," said Andrew Shikiar, director of POSSIE. "Beyond the VM download issue, users will still be denied Java due to little-known changes to security settings and their definitions in XP."

Shikiar explained that in Windows XP, new default security settings in Outlook and Outlook Express will automatically block harmless Java applets in user inboxes. Even more far reaching, Microsoft has also changed its security definitions so that Java applets are blocked in browsers when administrators opt for high security settings. Previously, Java was not blocked in high security mode - a setting routinely used by IT administrators to protect corporate networks.

Microsoft's blocking of Java applets in Outlook will limit email to basic text and graphics. Additionally, if browser default settings are changed to high security, users will be unable to view common web page components created with Java - from stock and sports tickers to electronic forms and animation.

"The bottom line is that Microsoft should provide the same, base-level Java support corporate customers and consumers have come to depend on with previous Windows releases," said Shikiar. "Java has proven to be a secure environment that simply doesn't deserve such restrictions."

Java applets are generally considered to be safe, since they execute in a contained area developers refer to as a "sandbox" which prevents code from accessing the computer hard drive. To date, no Java applet has been linked to a large-scale virus outbreak on the web or via email. An expert at Trend Micro was quoted in yesterday's Wall Street Journal as saying, "The threats that I would put at a red-alert level have been zero in the Java category."

Conversely, Microsoft places no restrictions on sending Word, Excel and other Microsoft Office files as email attachments. A prevalent security risk with Word and Excel files is that they are used to transmit viruses through embedded macros.

About POSSIE

People for Open, Safe and Secure Internet and Email (POSSIE) was formed in 2001 and is an alliance of individuals and technology companies committed to fostering Internet innovation, fair competition and open standards using safe and secure methods. POSSIE is credited for first discovering and alerting the development community about Java restrictions and changes in security settings in Windows XP. The organization is currently recruiting members.

For more information or to find out how you can help, go to the POSSIE web site at www.POSSIE.org or call (678) 477-1161.