Java Decaffeinated in Windows XP.

Business Editors

ATLANTA--(BUSINESS WIRE)--July 18, 2001

Covert Changes in XP and Outlook Security Permissions

That Disable Java Should Give Internet Users and

2.5 Million Java Developers the Jitters 

Changes to security settings and their definitions in the Release Candidate 1 (RC 1) of Windows XP could deny millions of users email and web browser access to Internet content enabled through Java(TM) applets, according to non-profit organization People for Open, Safe and Secure Internet and Email (POSSIE).

In Windows XP, new default security settings in Outlook and Outlook Express will automatically block harmless Java applets in user inboxes. And even more far reaching, Microsoft changed its security definitions so that Java applets are blocked in browsers when administrators opt for high security settings. Previously, Java was not blocked in high security mode - a setting routinely used by IT administrators to protect corporate networks.

"While we commend Microsoft for taking steps to plug some of the security holes in Windows, we're concerned about changes that could curtail the use of Java and limit the richness of web content and email," said POSSIE Director Andrew Shikiar. "Java has proven to be a secure environment that simply doesn't deserve these restrictions."

POSSIE was formed earlier this year in response to beta versions of Windows XP that indicated the potential diminishment of Java as part of new security measures. Microsoft's blocking of Java applets in Outlook will limit email to basic text and graphics. Additionally, if browser default settings are changed to high security, users will be unable to view common web page components created with Java - from stock and sports tickers to electronic forms and animation.

"The livelihoods of some of the world's most innovative software developers could be jeopardized if Microsoft maintains its current plans to wrongly categorize Java as a security risk in Windows XP," said Shikiar. "The bottom line is that Microsoft should provide the same, base-level Java support corporate customers and consumers have come to depend on with previous Windows releases - which can be achieved by re-allowing Java in Outlook and returning Java to its former lower security category," said Shikiar. "If security really is the issue, there are better things Microsoft could do, such as bundle anti-virus software into XP."

Java applets are generally considered to be safe, since they execute in a contained area developers refer to as a "sandbox" which prevents code from accessing the computer hard drive. To date, no Java applet has been linked to a large-scale virus outbreak on the web or via email. Conversely, Microsoft places no restrictions on sending Word, Excel and other Microsoft Office files as email attachments. A prevalent security risk with Word and Excel files is that they are used to transmit viruses through embedded macros.

The Windows OS resides on about 92 percent of PCs worldwide. Windows XP will be released Oct. 25, 2001 and has already stirred controversy with features some view as potentially anti-competitive or monopolistic. Microsoft recently announced it would remove the Windows XP Smart Tags feature, which had been criticized over concerns the links would take users to sites and content selected by Microsoft.

About POSSIE

People for Open, Safe and Secure Internet and Email (POSSIE) was formed in 2001 and is an alliance of individuals and technology companies committed to fostering Internet innovation, fair competition and open standards using safe and secure methods. The organization is currently recruiting members.

For more information or to find out how you can help, go to the POSSIE web site at www.POSSIE.org or call [phone].