Is Microsoft Attacking Sun or Protecting Consumers?

In a move that has Java developers up in arms, Microsoft Corp. decided not
to ship a Java Virtual Machine for the cross-platform Java language in the
recent beta version —
Release Candidate 1 (RC 1) — of its new Windows XP operating system. Nor
will the final version of Windows XP, slated for release in October, ship
with a JVM.

Also, Windows XP’s default security settings in Outlook and Outlook Express
block Java applets in user inboxes, and the company has changed security
definitions to block Java applets in browsers when administrators opt for
high security settings — the default settings for the OS.

Java, developed by long-time Microsoft rival Sun Microsystems , is a popular
platform for the creation of animation and interactive features for the Web.
Java requires the installation of a plug-in called a Java Virtual Machine
before it will run on a user’s computer. The plug-in is widely available for
download on the Web and also frequently ships with Java-enabled software.

Although Java was not included with RC 1, as it has been with previous
versions of Windows, a user running RC 1 could still install a Java Virtual
Machine. In fact, according to Microsoft spokesman Tom Pilla, if a user goes
to a Web site that utilizes Java applets, Microsoft’s Internet Explorer
browser will prompt the user to go to Microsoft’s Windows Download page to
download Microsoft’s version of the JVM. However, Windows XP’s default
security settings would still block
many Java applets from running.

Microsoft has long viewed Java’s ability to run on multiple operating
systems — including those that run mobile devices like PDAs — as a threat
to its Windows product line and its .NET platform, which has capabilities
similar to Java’s. Microsoft’s maneuverings against Sun and Java were part
of the foundation of the government’s antitrust case against Microsoft.
Three weeks ago, the U.S. Court of Appeals for the District of Columbia unan
imously upheld
a lower court’s finding that Microsoft used deceptive and
predatory tactics to undermine Java technology.

Microsoft’s decision to drop support for Java and block many Java applets
from running prompted a number of small- and mid-sized Java developers to
form People for Open, Safe and Secure Internet and Email (POSSIE), based in
Atlanta, Ga. POSSIE’s members have decided to stay anonymous for now — “for
fear of retribution,” according to a spokesperson — but said it is not
supported by any big companies, including Sun Microsystems.

“While we commend Microsoft for taking steps to plug some of the security
holes in Windows, we’re concerned about changes that could curtail the use
of Java and limit the richness of Web content and email,” said POSSIE
Director Andrew Shikiar. “Java has proven to be a secure environment that
simply doesn’t deserve these restrictions.”

POSSIE said that Microsoft, by blocking Java applets in Outlook, will limit
email to basic text and graphics. Additionally, the group said that by
changing browser default settings to high security, users will no longer be
able to view common Java-based Web page components including stock and
sports tickers, electronic forms and animation.

“The livelihoods of some of the world’s most innovative software developers
could be jeopardized if Microsoft maintains its current plans to wrongly
categorize Java as a security risk in Windows XP,” Shikiar said. “The bottom
line is that Microsoft should provide the same, base-level Java support
corporate customers and consumers have come to depend on with previous
Windows releases — which can be achieved by re-allowing Java in Outlook and
returning Java to its former lower security category. If security really is
the issue, there are better things Microsoft could do, such as bundle
anti-virus software into XP.”

But Yankee Group Analyst Neal Goldman said Microsoft’s decision to
discontinue support for Java likely has more to do with the sett
the company reached with Sun earlier this year than with an
attempt to further hurt Sun.

Microsoft agreed in January to pay Sun $20 million to settle a lawsuit
initiated in 1997. The lawsuit stemmed from an agreement the two companies
made in 1996, when Microsoft obtained a license from Sun to use the Java
technology, with the stipulation that Microsoft would deliver only
compatible implementations of the technology. Following the agreement,
Microsoft used the Java Development Kit (JDK) 1.1.4, a version that had long
been superceded, thus ensuring Windows-only compatibility.

As part of the settlement, Sun gave Microsoft the right to continue using
the outdated JDK for seven years, though Microsoft made no commitment to do

“It comes down to the settlement agreement,” Goldman said. “On the one hand,
you could say, ‘gee, Microsoft is attempting to keep people from using Java
on Windows and this is sort of an exclusionary tactic.’ I think that’s
probably not true. Because of the settlement agreement with Sun, they can’t
ship current or new versions of Java. If my choices were to ship nothing or
an old version, I would ship nothing.”

Indeed, Microsoft’s Pilla said making the Microsoft JVM downloadable rather
than shipping it with Windows XP helps the company abide by the terms of its
settlement with Sun.

“We’re still supporting our JVM,” Pilla said. “We’re just not going to
include the JVM in XP…Everyone that wants Java support in Windows XP will
get it.”

Pilla also noted, “PC manufacturers are free to install the Microsoft JVM
before they ship.” He added that IT managers will also be able to make the
decision to install the JVM on computers, and that anyone who upgrades to XP
from a previous Windows operating system will retain their Microsoft JVM.

That sentiment was echoed by Bob Stein, president of Active Network Inc.,
which runs, a site that provides Windows support and news.

“[Microsoft] didn’t make Windows XP so that Java support was
completely eliminated,” he said. “A lot of novice users don’t use Java.
Anyone that would need it can download it. There’s a lot of ways to get Java

Goldman noted that the decision to block Java on high security settings
shouldn’t affect the Java development community to any great degree because
most companies now shy away from client-side Java. Client-side Java
applications, which run on a user’s machine and are the type Windows XP’s
high security setting would block, must be downloaded by the user. Often
those downloads are quite large.

“The vast majority of real, pure Java programming is occurring on the
server,” Goldman said. Server-side Java would not be blocked by Windows XP’s
settings. “More client-side stuff is done either in JavaScript or dynamic
HTML or VBScript,” Goldman continued. “Making [Windows XP] more
secure on
client-side Java I don’t think really impacts Java development on the

However, Shikiar contended, “There still are a substantial number of
companies out there that are building businesses and building applets on the
version of Java that Microsoft supports…That’s why this is not a Sun vs.
Microsoft issue, necessarily. We’re supporting developers that want applet
support in Outlook and Outlook Express. We just want backwards

Still, Pilla noted that XP’s high security settings don’t discriminate
against any particular language.

“In no way does this high bar for security ever single out any single script
or language,” he said, adding that the setting even blocks Microsoft’s
VBScript and ActiveX controls.

Stein added, “Regarding security, I think that’s a good start. There are a
lot of viruses that are transmitted using Java. If there are any ways that
the spread of viruses could be curtailed, go for it. I don’t blame them one
little bit.”

Stein noted that although there are very few “high-risk” Java viruses, a
virus doesn’t need to have a high threat-level to waste a recipient’s time
and money.

Sun was not available for comment as of this writing.

News Around the Web