Re: Applet restrictions in Microsoft and Netscape

Marianne Mueller (mrm@doppio)
Thu, 6 Feb 1997 22:00:31 -0800

Date: Thu, 6 Feb 1997 22:00:31 -0800
From: mrm@doppio (Marianne Mueller)
Message-Id: <199702070600.WAA17918@puffin.eng.sun.com>
To: kc1@doc.ic.ac.uk
Subject: Re: Applet restrictions in Microsoft and Netscape

Hello again,

check out the hypermail archive we set up (finally!) at
http://jeeves.javasoft.com:8080/hypermail/java-security-html/

to answer your question --

NN 3.x does put additional restrictions on applets loaded
via the file system, by making sure they are loaded by
the applet classloader. I don't think this is a change
from NN 2.x to NN 3.x though; as I remember, even in the first
browser, they wanted to be cautious and load all applets via
the applet classloader.

Now, the thing to realize is that if you put the applet in
a directory on the local machine that is on your classpath,
then the applet is treated as if it were part of the trusted
local system.

I used to run applets on all sorts of browsers all the time
and I don't do that as much any more, so pardon me if I don't
know the exact details of the browsers. For example I really
don't know the exact situation with the latest version of
the Microsoft browser.

One thing we are working on in JavaSoft is completing the
JDK Compatibility Tests, so that it will be a more straightforward
process to get a reading on various Java implementations, and
their adherence to the spec.

Marianne

> From kc1@doc.ic.ac.uk Thu Feb 6 16:19:15 1997
> From: "Kalpesh Chauhan" <kc1@doc.ic.ac.uk>
> Date: Fri, 7 Feb 1997 00:18:53 +0000
> To: mrm@Eng
> Subject: Applet restrictions
>
> Dear Marianne Mueller.
>
> Having failed to receive responses from either Microsoft or Netscape,
> I was wondering if you could help me with the following? With regards
> to applets loaded from the local file system, I notice in the Applet
> Security FAQ that Netscape Navigator 2.0beta4 subjected applets loaded
> from the local file system to the ClassLoader and SecurityManager API.
> Is this still the case with Netscape Navigator 3.x, and what about
> MSIE 3.x?
>
> Any help would be much appreciated!
>
> Thanks,
> Kalpesh Chauhan
> Imperial College London, UK