In the Java world, security is not viewed as an add-on a feature. It is a pervasive way of thinking. Those who forget to think in a secure mindset end up in trouble. But just because the facilities are there doesn't mean that security is assured automatically. A set of standard practices has evolved over the years. The Secure Coding Standard for Java is a compendium of these practices. These are not theoretical research papers or product marketing blurbs. This is all serious, mission-critical, battle-tested, enterprise-scale stuff.

The real payoffs you never understand. You should just give good people money and tell them to do good things.

You know, most people in the open-source world who use open-source software don't actually do builds themselves - those people just download the binaries. And so we expect that the big enterprise people will just do that and we will certainly be providing binaries that have been through full industrial-strength QA, that have been through all the conformance testing.

During the integration meetings between Sun and Oracle, where we were being grilled about the patent situation between Sun and Google, we could see the Oracle lawyer's eyes sparkle.

An API that isn't comprehensible isn't usable.

People think of security as a noun, something you go buy. In reality, it's an abstract concept like happiness. Openness is unbelievably helpful to security.

If I were to pick a language to use today other than Java, it would be Scala