From ZDNet News July 18, 2001 Microsoft pulls back on Java support

Microsoft is quietly pulling back support for Java in its new products, dealing a new blow to a rival technology that played a starring role in the software giant's continuing antitrust battle with the government.
Prerelease copies of Microsoft's new Windows XP operating system, which goes on sale this fall, drop the software needed to run Java-based programs. Java software is used to create some of the animated and interactive features of Web pages and hand-held devices; Web surfers using computers with Windows XP won't see those features without loading additional software.

A Microsoft spokesman said Java support was diminished for "business reasons" and noted that it follows last year's legal dispute with Java's creator, Sun Microsystems Inc. Under terms of a settlement with Sun, Microsoft was given the right to continue to use early versions of Sun's Java code in Microsoft products for seven years, but made no commitment to do so.

The spokesman said the Java support in Windows up until now "is a lot of code that many users don't need, and if they do need it there will be a variety of ways for them to obtain it, including through PC manufacturers, who will be free to install it on Windows XP, and by downloading it from the Web." He also said that customers upgrading from an earlier Windows version will still be able to use the Java software.

After Windows XP is launched in October, users will be directed to download a plug-in from Microsoft's Web site (www.microsoft.com) to make Java-based programs work. Without this step, "any Web page that contains Java applications will not run -- it will be a dead page," said Jan Vitek, a professor of computer science at Purdue University, West Lafayette, Ind. "This favors Microsoft's new technologies, and will inconvenience consumers," he said.

For Web-based businesses, Vitek added, "if you want your Web page accessible to the largest number of people, you may want to drop Java" and switch to Microsoft's competing set of products, which is under development and is known as .Net.

Because Java is designed for use across different operating systems, Microsoft has long viewed it as a threat to its Windows monopoly, and the technology has played a central role in the U.S. antitrust case. Among its findings in the case three weeks ago, a unanimous federal appeals court in Washington D.C. ruled that Microsoft had engaged in a deceptive and predatory campaign to cripple Java technology.

Microsoft hasn't said whether it will appeal the June 29 ruling to the Supreme Court. After the ruling, the company said it would work with the government to resolve remaining issues in the case, whether in a settlement or proceedings before a new judge.

A Sun spokeswoman declined to comment.

Tightening Java security
In a separate move affecting Java, Microsoft is tightening security settings in its new Windows and Office programs that in some cases will also disable Java programs. Microsoft's new products will now screen out Java as a possible carrier of computer viruses in e-mail and, under high-security settings, in Web-browsing software. This move, first signaled in a software "security patch" distributed last year, is part of a broader effort by Microsoft to help stamp out the spread of computer viruses.

A Microsoft security-product manager, Scott Culp, noted that the tighter security settings affect several Microsoft products as well.

"We treated our own technology exactly the way we have treated Java," he said. The security settings are fully customizable by the user or by a computer-system administrator, he noted. "We made the default setting the highest possible and want the customer to be able to then make an informed choice," Culp said.

Java backers complain that the new security settings unfairly lump Java with other, more risky types of code, because Java has built-in security making viruses extremely rare. Unlike many forms of "executable" code that Microsoft seeks to block, Java runs in a software "sandbox" in the browser that prevents it from gaining control of the computer. As a result, Java viruses have been rare.

"Making e-mail and browsing more secure is a good thing, but banning Java doesn't make sense," said Andrew Shikiar, the director of Possie (www.possie.org), an Atlanta-based group of Java developers funded by small and midsize companies affected by the changes.

Shikiar also charges that Microsoft's new security rules don't halt the transmission of e-mail attachments that contain Microsoft Word or Excel "macros," a form of code that has often been identified as spreading viruses. But Microsoft counters that it has taken other steps to tighten security on viruses spread this way.

Motoaki Yamamura, development manager for the antivirus software maker Symantec Corp., estimated that about a dozen Java viruses have been found by researchers, compared with thousands based on the "macro" programming features of Word and Excel.

"The threats that I would put at a red-alert level have been zero in the Java category," added Bob Hansmann, enterprise software manager for Trend Micro Inc., another antivirus specialist in Cupertino, Calif.

Yet some corporate computer managers routinely block or scan Java code with gateway programs called firewalls out of a more general fear that computer hackers will find new ways to exploit Java to do mischief. Hansmann speculated that Microsoft is reacting to concerns expressed by some of those customers and said the security restrictions are warranted if managers can turn them on or off.

Lisa Gurry, another Microsoft product manager, said the "macro" security settings in Word and Excel have been tightened using a different approach, substantially lessening their threat while providing the maximum consumer choice. "We want to provide both a high level of security and a high level of choice," she said.

The decision to drop Java support from Windows XP was first apparent last week in a "beta" or test version that Microsoft released to software developers. Java "virtual machine" code, which is what runs Web-based Java programs, had been included in all previous versions. Microsoft didn't announce the change.