The Artima Developer Community
Sponsored Link

Object Integrity
A Conversation with Bob Scheifler, Part III
by Bill Venners
July 22, 2002

<<  Page 4 of 5  >>

Advertisement

Sending Code Out-Of-Band

Bill Venners: A friend of mine who was learning about RMI asked, "Why can't RMI just send the classes in-band along with the object data?"

Bob Scheifler: There are many issues with sending code in-band. One is a three-party system. Suppose you are a lookup service in which some third service is registered. I want to get the proxy from the lookup service. Should I get that third service's code from you or from the service? Were the code sent in-band, then that means that somehow the service had to give you the lookup service all the code so that you can hand the code on to me. So that is one problem. Do you really want to be the intermediary for all of that code? Another question is, do I have to call back to you to call back to the service?

Another question has to do with what permissions you assign to the code. Code comes from URLs. You can use those URLs as a basis for security policies to decide what permissions to grant to the code. If the code comes inline and there are no URLs associated with it, then how do I talk about it from a security perspective if I want to do static grants to it? There is no notion. If you send me the actual class files and you also claim they are from some URL can I really trust that? Another problem comes up if you think about marshaled objects. If you think the sender has to provide the class files then the marshaled object has to have all of the class files in it.

<<  Page 4 of 5  >>


Sponsored Links



Google
  Web Artima.com   
Copyright © 1996-2017 Artima, Inc. All Rights Reserved. - Privacy Policy - Terms of Use - Advertise with Us