The JESSIE frequently asked questions.

Q. So what is this?

A. A cleanroom implementation of the Java Secure Sockets Extension,
the JSSE, as it appears in the Java 1.4 class libraries. This includes
the packages javax.net, javax.net.ssl, and javax.security.cert, and a
security provider that provides an implementation of secure sockets.

That is, Jessie provides a full implementation of the secure socket
protocols SSLv3, TLSv1, and the (forthcoming) TLSv1.1. It is a full
Java API for creating clients and servers that communicate over SSL.


Q. So why should I care?

A. You should if you are interested in free software implementations of
the Java language. Right now Jessie is the only free software package
implementing the JSSE API, so if you want to program JSSE applications
using free software, this is your only choice.


Q. Is it production-ready?

A. Maybe. It is certainly stable, and is fairly efficient. It has not
been thoroughly tested, however.


Q. Is it secure?

A. Maybe. Designing secure systems is a subtle and difficult thing to
do. While I have taken every precaution to make the right choices with
known weaknesses, I am a far from perfect coder.


Q. What other software does this depend on?

A. GNU Crypto <http://www.gnu.org/software/gnu-crypto/>, version 2.0.1
or later.


Q. What VMs does it run on?

A. Kaffe <http://www.kaffe.org/>.

It also works when compiled to native shared libraries with GCJ 3.3.x,
but probably won't work if interpreted with gij from this series. GCJ
3.4.0 has issues with GNU Crypto 2.0.1, but GNU Crypto CVS sources
will work.


Q. Wait, did you forget to mention Sun there?

A. No, I didn't. Jessie will not run on Sun's 1.4 runtimes. There are
two reasons for this: the first is that it does not allow pluggable
JSSE providers (you can work around this, of course, by replacing
Sun's javax.net and javax.security.cert packages with Jessie's); the
second reason is that making Jessie compatible with Sun's Java will
make it incompatible with Classpath-based VMs, and we choose to
support free runtimes over proprietary ones.

There aren't any *fundamental* incompatibilities in the code, and the
bits that Sun's VM needs are present, but commented out. If you need
to run Jessie on Sun's (or any other) VM, there aren't that many
things you need to change.

Of course, we encourage you to use and help improve free
implementations of the Java language instead of using proprietary
software.


Q. Can this software be exported from the US?

A. As far as I know, yes. Since 2000 the export rules have been very
different from the dread Draconian rules handed down from the cold
war. Basically free software (according to the US government, software
that is freely available with source code from the internet) falls
under a special exemption in export rules, which allows it to be
exported to anywhere except certain ``rogue'' nations.

Regardless, I am going to continue naively believing that doing
something as simple as ``writing software'' is not an illegal activity.
