The Sun advisory page on this flaw, however, informs you about two flaws which are nothing but Buffer Overflows. Do not mistake me that I am undermining the impact of Buffer Overflow Attacks in any way. It’s just the ZD Net article’s title which’s bugging me. It makes the flaw look like an out of world ET attack scenario.

1. A buffer overflow vulnerability in the image parsing code in the Java Runtime Environment may allow an untrusted applet or application to elevate its privileges. For example, an applet may grant itself permissions to read and write local files or execute local applications that are accessible to the user running the untrusted applet.
2. A second vulnerability may allow an untrusted applet or application to cause the Java Virtual Machine to hang.

Now firstly, Buffer Overflows are no new form of attacks. They have been here since the existence of man (I admit that’s a little much ), and they are here to stay. Thus, articles like this are more like FUD, IMHO.
Secondly, applet support is very limited in mobile devices. Not to mention that J2ME supports only PNG format. Thus, not “virtually everything” is everything.
Finally, image parsing library in Sun’s Java implementation is through a native library. It’s time that Sun writes a Java equivalent for it to avoid other similar issues. Further, since Java is now GPL, I also hope to see the code coming from some random, pimply, introvert teenage kid.

The problems can be resolved by updating the packages. Detailed info provided on the Sun’s advisory.

• An insight into Sun’s *crazy* strategy.
• Open JavaFX, an alternative to AJAX?
• AdSense exploited by malware (Trojan.Qhost.WU)
• Amazing Interrupt Handling!
• Month of Search Engine Bugs: “Mission Accomplished”

Disclaimer: The post may give you a notion that the author has surpassed all the heights of patheticism; which actually is sort of true

Have I ever posted that I am a *crazy* person?
Probably a number of times.
This post is another proof; which I am shamelessly sharing with a hope that my *unconscious* realizes the heights of pathetic-ism it has reached. I refer to my Unconscious mind because *the proof* is related to some of my dreams.

To build the foundation, let me take you back to my school days- class 10th.
That was when I was introduced to programming for the first time. Language was BASIC.
Might I boast that I was good.
I remember to be the fastest coder around and to have coded sound and graphics programs in BASIC. That was the time when I wrote my first (and the only game).
Where did I get the inspiration from?
A dream.
No kidding. I saw the algorithm in a dream

Scene 2:
I was kind of frustrated during my B.Tech. days when I wrote *factorial* and *Fibonacci* codes in C. The most frustrating event was when my teacher blamed me for *wasting* my time coding a Solar eclipse in C instead of what he asked for; a DDA algorithm. You can find the glimpses of those days here and here.
I do not deny the fact that I could have channelized my frustration and anger; something that I did a little later. I wasted my first 3 years.. (this, however, is not really relevant to this topic.)
During these B.Tech. days, I spent my first summer training (and consequently the second too) learning Java. I somehow fell in love with the language. (Off-Topic: If I don’t wish to be thrashed, I must mention that Raga helped me with most of my Java codes (and C codes, and C++ codes, and…) back then. It doesn’t mean that I was ignorant though )
There was a time during the training days when Abhu bhaiya tried waking me from sleep and I spoke something in sleep.
I was explaining Java concepts to him (
…and if I am not wrong, Priyo (my roommate) too *lived* a similar experience.

Several other such events happened in past, which I don’t feel like mentioning. I’d rather speak about present.

Dream 1
A few days ago… no weeks ago, I saw a dream
I was coding a cross platform desktop applications in Qt4.

You know what’s weird about it?
The fact that I had just *heard* of Qt4 and knew that it was somehow related to KDE. (I am more of a GNOME guy)
That’s it.
Nothing less, nothing more.

I scribbled about the dream on my mini-diary, that I use as a portable “To-Do list”, and forgot about it.
A few minutes ago, I stumbled across this link:
How To Create a Linux Desktop App In 14 Minutes For Beginners (Using QDevelop and Qt4)

Dream 2
A few days ago, I saw a dream that I am *purchasing* a book on Wireless Security.
It was priced somewhere between 390/- and 400/- (Don’t ask me how I remember the price)
Today I bought a book on Wireless hacking… (
Don’t ask me either the price or why I bought it. The price’s is anyways not really the concern here.
I really wonder if these dreams are some sort of sign.

Dream 3
You CAN go crazy on the wilderness of my other dream, mentioned below. So you can discontinue the rest part of the article.

Still reading?
Okay! Read at your own risk.

I am appearing an exam.
The syllabus is…… Amir Khusro’s composition, “Chhap Tilak sab Chhini ray”
I am wondering what sign does this dream carry ( ( ( (

You cannot even imagine how I feel after writing it here and realizing the fact that this post will not only be read by a number of random people but will also be indexed by bots.

Anyways, now the wish-list part.
If the dreams have to finally turn into reality (in one or other form); then why don’t I ever see something good… something romantic.
Hey wait!
Does the reverse count? I mean other people seeing me in their dreams… [Huge-Grin]

Footnote: The author would like to apologize to all who have are experiencing anger and/or depression . He would also like to thank GOD for what he mentioned in the last line.

• A 13 Year Old CEO!
• A program called "3~" (Om)
• Bill Gates wins me!
• An insight into Sun’s *crazy* strategy.
• Is Google Bomb REALLY Diffused?

The Past

Most of the people know James Gosling as the father of Java. Only a few know that he was also the lead engineer of Gosmacs (gmacs or Gosling Emacs) and NeWS. Now, I won’t be talking about Gosmacs (which according to some people is/was the reason of some conflict between RMS and Gosling. Phew!)
However, NeWS (Network extensible Window System) is of a little concern, mostly because it was arguably superior to X Window System… and because it FAILED. The most important reason for its failure (and X Window’s success) is that Sun kept it proprietary.
Later on when Sun developed Java, some people, especially the genius Eric Schmidt (then CTO-Sun, now CEO-Google), were aware that keeping Java within enclosed fences will lead to similar devastating results. Not to mention that *7 (for which Java was developed) had already failed and Java was still in search of a viable market.

So what did he do?
He focused on making it as open as possible and tried building a *Java Community*. (Google SoC, IMHO, is also a “win-the-community-and-you-win-everything-else” approach. But then that’s a different topic altogether. )

Where were we?
Yeah! So he focused on building a Java Community.
Apart from organizing developer conferences like JavaOne, Sun also encouraged user groups (JUGs), which reached over a number of 400 in year 2000 itself. In fact they went a step further with JCP (Java Community Process) to make the development of Java *as open as possible*.
The reality behind all this community building scene was the fact that the direct control remained with Sun (well mostly).

Everything, however, was running smooth; for Sun as well as the Java developers.

“I envy you. But such a thing is not meant to last.”

— Persephone, Matrix Reloaded

I guess the above statement is valid for every aspect of human existence.
In early 2004, Jonathan Schwartz, referenced Eric Steven Raymond’s “The Cathedral and the Bazaar” and compared JCP to the “Bazaar”, stating that development of Linux was more like a “Cathedral”. I would not expand on it but this was enough to infuriate ESR

ESR wrote an open letter addressed to Scott McNealy, CEO-Sun, with a subject line “Let Java Go”. He accused Sun on several fronts (for which I’d pursue you to read the letter) and appealed to Open Source Java. A few weeks later RMS wrote an essay on Java Trap and appealed the developers to contribute and use open source projects like GCJ/Gnu Classpath etc. Several other appeals/open letters were published (Apache’s Geir Magnusson Jr., IBM, etc.)

A series of events followed before Sun announced that it will be open sourcing Java. There main concern was Microsoft forking Java and hence, destroying its cross platform compatibility (which shows that they really were clueless on how Open source model works/ can work).
They had no other option than to Open Source the *giant*, and they did it.

The Present

The past unarguably affects, if not defines, the present. Sun’s experience since the NFS days to (forced) Open Sourcing Java days taught/reminded them of their most important lesson.
The Community is fruitful!
Build a community and everything else will follow, sooner or later.

So here they are.
Open sourcing EVERYTHING.
Building Community, and making it mutually encashable. It’s obviously not so profitable for them today, but the future holds immense potential.

The way they have been endorsing and promoting stuff is simply adorable. Even NetBeans has its own *arena*.
Not to mention the, so called, developer conferences organized all over the world in a distributed fashion to reach the most number of developers. I, however, have several concerns regarding them. You may read some of them at Amit’s blog. I hope Sun listens to the plea of developers and improves the quality of these summits.

Another amazing strategy, IMHO, is the blogs that Sun employees post regularly. I have subscribed some of them and it’s really amazing to see that how important role these blogs are playing in binding people. They often link each other’s (Sun Employees, of course) blogs. You can have a look at the Sun-Blogging homepage to get a feel of the number of hits the folks out there are getting. Now even if I read only one of these, I’d get to know about latest developments. I am not sure whether it’s a part of their strategy, but it’s definitely working as a powerful advertising medium.
Yup! I know that employees of other firms write blogs too and probably get bigger number of hits, but I haven’t seen anyone of them making so much of a difference on an organizational level. (Please correct me if I am wrong)

The Future

I am no Nostradamus and I cannot predict future.
All I can say is the future is (mostly) Free & Open. IBM (previously referred Satan) secured its place (with a Halo on head) by contributing to the Apache httpd project and winning the FOSS community. Now it’s Sun’s turn and they are playing pretty well.
Yes, their revenue might be a concern today; but I don’t really see a reason why there future shouldn’t be bright.

• Java vulnerable to remote compromise
• Dreams… and (huh!) Reality.
• Bill Gates wins me!
• A Phish floating in Google Survey!
• Apache-MySQLPHP Installation & Configuration Tutorial for Beginners :)

My grandmother is no businesswoman, but I always cite two of her sayings pertaining to business:

1. Doctors can earn even in a jungle,
2. People will never stop learning/studying (formal education), at least not in India.

I personally believe very strongly that Education is an arena which hasn’t been exploited properly. NOT YET. It has a lot more potential. O’reilly’s School of Technology is an additional confirmation to my theory. I even consider Safari, a pretty smart and daring move.

I am also a very firm believer of the power of imparting lessons with fun, visuals or real life scenarios embedded in them. Some of the most prominent examples (that I am aware of) are:

• The Head First Series from O’reily.
• The flash/video presentations available all over the net. Coincidentally, Roman Strobl wrote about the great feedbacks he has been getting about his presentations.

I was really happy to come across the news of a new venture called Elementeo, aimed at imparting chemistry lessons with the aid of games. The most remarkable thing about the venture is that it’s CEO is a 13 year old kid, Anshul Samar (Indian origin! probably).
I really hope that these kids succeed in convincing some VC and eventually succeed in business too.

Looking at it all, I must say that my moves, that most blamed me for , are proving to be good too. I am currently co-working on a Java book which will be published by Wiley Publication. The USP of the book, IMHO, is the virtual content. Through these video presentations, we have tried to map theoretical concepts to real (and fantasy ) world examples. The best one from the presentations, IMHO, is the one where we (actually Rupi came up it ) map access modifiers with Duck Tales characters.
However, my favorite is the one where I have done exactly the reverse. I tried mapping my REAL LIFE into CODES.

Stay tuned for updates on the book… and wish us luck.

• An insight into Sun’s *crazy* strategy.
• AdSense exploited by malware (Trojan.Qhost.WU)
• "COLUKABKI – AOL – MSN – YAHOO – RED CROSS"….. aaah Comm’n Gimme a break.
• Java vulnerable to remote compromise
• Drive-by Download: Where Network Security Meets WebAppSec