RealTime IT News

Is Microsoft Attacking Sun or Protecting Consumers?

In a move that has Java developers up in arms, Microsoft Corp. decided not to ship a Java Virtual Machine for the cross-platform Java language in the recent beta version -- Release Candidate 1 (RC 1) -- of its new Windows XP operating system. Nor will the final version of Windows XP, slated for release in October, ship with a JVM.

Also, Windows XP's default security settings in Outlook and Outlook Express block Java applets in user inboxes, and the company has changed security definitions to block Java applets in browsers when administrators opt for high security settings -- the default settings for the OS.

Java, developed by long-time Microsoft rival Sun Microsystems , is a popular platform for the creation of animation and interactive features for the Web. Java requires the installation of a plug-in called a Java Virtual Machine before it will run on a user's computer. The plug-in is widely available for download on the Web and also frequently ships with Java-enabled software.

Although Java was not included with RC 1, as it has been with previous versions of Windows, a user running RC 1 could still install a Java Virtual Machine. In fact, according to Microsoft spokesman Tom Pilla, if a user goes to a Web site that utilizes Java applets, Microsoft's Internet Explorer browser will prompt the user to go to Microsoft's Windows Download page to download Microsoft's version of the JVM. However, Windows XP's default security settings would still block many Java applets from running.

Microsoft has long viewed Java's ability to run on multiple operating systems -- including those that run mobile devices like PDAs -- as a threat to its Windows product line and its .NET platform, which has capabilities similar to Java's. Microsoft's maneuverings against Sun and Java were part of the foundation of the government's antitrust case against Microsoft. Three weeks ago, the U.S. Court of Appeals for the District of Columbia unan imously upheld a lower court's finding that Microsoft used deceptive and predatory tactics to undermine Java technology.

Microsoft's decision to drop support for Java and block many Java applets from running prompted a number of small- and mid-sized Java developers to form People for Open, Safe and Secure Internet and Email (POSSIE), based in Atlanta, Ga. POSSIE's members have decided to stay anonymous for now -- "for fear of retribution," according to a spokesperson -- but said it is not supported by any big companies, including Sun Microsystems.

"While we commend Microsoft for taking steps to plug some of the security holes in Windows, we're concerned about changes that could curtail the use of Java and limit the richness of Web content and email," said POSSIE Director Andrew Shikiar. "Java has proven to be a secure environment that simply doesn't deserve these restrictions."

POSSIE said that Microsoft, by blocking Java applets in Outlook, will limit email to basic text and graphics. Additionally, the group said that by changing browser default settings to high security, users will no longer be able to view common Java-based Web page components including stock and sports tickers, electronic forms and animation.

"The livelihoods of some of the world's most innovative software developers could be jeopardized if Microsoft maintains its current plans to wrongly categorize Java as a security risk in Windows XP," Shikiar said. "The bottom line is that Microsoft should provide the same, base-level Java support corporate customers and consumers have come to depend on with previous Windows releases -- which can be achieved by re-allowing Java in Outlook and returning Java to its former lower security category. If security really is the issue, there are better things Microsoft could do, such as bundle anti-virus software into XP."

But Yankee Group Analyst Neal Goldman said Microsoft's decision to discontinue support for Java likely has more to do with the sett lement the company reached with Sun earlier this year than with an attempt to further hurt Sun.

Microsoft agreed in January to pay Sun $20 million to settle a lawsuit initiated in 1997. The lawsuit stemmed from an agreement the two companies made in 1996, when Microsoft obtained a license from Sun to use the Java technology, with the stipulation that Microsoft would deliver only compatible implementations of the technology. Following the agreement, Microsoft used the Java Development Kit (JDK) 1.1.4, a version that had long been superceded, thus ensuring Windows-only compatibility.

As part of the settlement, Sun gave Microsoft the right to continue using the outdated JDK for seven years, though Microsoft made no commitment to do so.

"It comes down to the settlement agreement," Goldman said. "On the one hand, you could say, 'gee, Microsoft is attempting to keep people from using Java on Windows and this is sort of an exclusionary tactic.' I think that's probably not true. Because of the settlement agreement with Sun, they can't ship current or new versions of Java. If my choices were to ship nothing or an old version, I would ship nothing."

Indeed, Microsoft's Pilla said making the Microsoft JVM downloadable rather than shipping it with Windows XP helps the company abide by the terms of its settlement with Sun.

"We're still supporting our JVM," Pilla said. "We're just not going to include the JVM in XP...Everyone that wants Java support in Windows XP will get it."

Pilla also noted, "PC manufacturers are free to install the Microsoft JVM before they ship." He added that IT managers will also be able to make the decision to install the JVM on computers, and that anyone who upgrades to XP from a previous Windows operating system will retain their Microsoft JVM.

That sentiment was echoed by Bob Stein, president of Active Network Inc., which runs activewin.com, a site that provides Windows support and news.

"[Microsoft] didn't make Windows XP so that Java support was completely eliminated," he said. "A lot of novice users don't use Java. Anyone that would need it can download it. There's a lot of ways to get Java support."

Goldman noted that the decision to block Java on high security settings shouldn't affect the Java development community to any great degree because most companies now shy away from client-side Java. Client-side Java applications, which run on a user's machine and are the type Windows XP's high security setting would block, must be downloaded by the user. Often those downloads are quite large.

"The vast majority of real, pure Java programming is occurring on the server," Goldman said. Server-side Java would not be blocked by Windows XP's settings. "More client-side stuff is done either in JavaScript or dynamic HTML or VBScript," Goldman continued. "Making [Windows XP] more secure on client-side Java I don't think really impacts Java development on the whole."

However, Shikiar contended, "There still are a substantial number of companies out there that are building businesses and building applets on the version of Java that Microsoft supports...That's why this is not a Sun vs. Microsoft issue, necessarily. We're supporting developers that want applet support in Outlook and Outlook Express. We just want backwards compatibility."

Still, Pilla noted that XP's high security settings don't discriminate against any particular language.

"In no way does this high bar for security ever single out any single script or language," he said, adding that the setting even blocks Microsoft's VBScript and ActiveX controls.

Stein added, "Regarding security, I think that's a good start. There are a lot of viruses that are transmitted using Java. If there are any ways that the spread of viruses could be curtailed, go for it. I don't blame them one little bit."

Stein noted that although there are very few "high-risk" Java viruses, a virus doesn't need to have a high threat-level to waste a recipient's time and money.

Sun was not available for comment as of this writing.