🚀 go-pugleaf

In <60cbb7$n1t$1@www.macbank>, on 09/25/97 at 12:30 AM,
   nospam@nowhere.none (Randy Olan) said:

**Hi,

**I'd just like to find out if there are any native OS/2
**applications that provide Internet security.  I'm particulary
**interested in an application that will check Java applets for
**viruses and prevent java applets from doing damaging things to my
**system in the background.

Java applets can't do any damage 'in the background' on your system.
That is part of the Java security as opposed to the Active X from
microsoft. (I suppose anything can be done, but Java is quite secure
from applets doing anything executable on the machine.

What you really want to do is make sure you don't get any cookies on
your machine, and to do that, just delete the existing cookies file
and create a directory called 'cookies' This will prevent the host
from putting anything on your machine.


John

In <60cbb7$n1t$1@www.macbank>, nospam@nowhere.none (Randy Olan) writes:
>Hi,
>
>I'd just like to find out if there are any native OS/2
>applications that provide Internet security.  I'm particulary
>interested in an application that will check Java applets
>for viruses and prevent java applets from doing damaging
>things to my system in the background.

     There is no such program, because it isn't needed:  Java takes care of 
all of this for you - it's a part of it's design.

     Because you can only assign a pointer in Java by using the 'new' keyword,
and can't actually specify memory pointers as you can under languages such as 
C and C++, it's technically impossible to create a Java-based virus.  Java 
applets can't even access files (under normal circumstances - they can only if
*you* disable Java's built-in security on purpose).

     And since Java is virtualized itself, it can't even directly access your 
hardware - so there is nothing bad that a Java applet can do.

Brad Barclay,
OS/2 Development Director,
Internet Direct Canada Inc.

---------------
From the OS/2 WARP v4 Desktop of Brad Barclay.
E-Mail:  os2@idirect.com  WWW: http://warp.idirect.com
Finger for Public PGP Key.  [ ] VoiceType Dictated.

Brad Barclay wrote:
> 
> In <60cbb7$n1t$1@www.macbank>, nospam@nowhere.none (Randy Olan) writes:
> >Hi,
> >
> >I'd just like to find out if there are any native OS/2
> >applications that provide Internet security.  I'm particulary
> >interested in an application that will check Java applets
> >for viruses and prevent java applets from doing damaging
> >things to my system in the background.
> 
>      There is no such program, because it isn't needed:  Java takes care of
> all of this for you - it's a part of it's design.
> 
>      Because you can only assign a pointer in Java by using the 'new' keyword,
> and can't actually specify memory pointers as you can under languages such as
> C and C++, it's technically impossible to create a Java-based virus.  Java
> applets can't even access files (under normal circumstances - they can only if
> *you* disable Java's built-in security on purpose).
> 
>      And since Java is virtualized itself, it can't even directly access your
> hardware - so there is nothing bad that a Java applet can do.
> 
> Brad Barclay,
> OS/2 Development Director,
> Internet Direct Canada Inc.
> 
> ---------------
> From the OS/2 WARP v4 Desktop of Brad Barclay.
> E-Mail:  os2@idirect.com  WWW: http://warp.idirect.com
> Finger for Public PGP Key.  [ ] VoiceType Dictated.



It's streets ahead of Active X but it ain't 100% see

http://www.zdnet.com/pcweek/news/0922/22java.html

yeah yeah it's Ziff Davis and we know how far we can trust them if it's
not made by Micro$loth, but the article appears to be based on an
independent 3rd party.

John

In <342A57CF.979@ibm.net>, John Littler <john.littler@ibm.net> writes:
>It's streets ahead of Active X but it ain't 100% see
>
>http://www.zdnet.com/pcweek/news/0922/22java.html
>
>yeah yeah it's Ziff Davis and we know how far we can trust them if it's
>not made by Micro$loth, but the article appears to be based on an
>independent 3rd party.

     So you can get some data structures past the verifier - so what?  This 
doesn't mean that Java will be able to suddenly have access to hardware to 
overwrite or corrupt files, for example.

     And as the story states, JavaSoft claims that all of this is based on 
bugs in the verifier in early versions of Java.  But even if it isn't fixed 
as claimed, I doubt if it's cause for alarm - the JVM itself is still fairly 
restricting as to what a Java program can do (a Java program cannot, for 
example, tinker with CPU registers, access memory outside of the JVM's memory 
pool, gain direct hardware access to any devices, or make BIOS calls).

     And even if someone came up with a way to use this to make a Java program 
dangerous, I don't see how we as OS/2 users need to worry.  Exploiting a 
problem like this tends to be highly system-specific.  And with OS/2's 
excellent application protection model, we're pretty safe.  A Java program 
can't do anything special that a native OS/2 program can't do, such as violate
protected memory spaces.

     If the data in this paper you point us is conclusive, then it is simply 
an oddity that needs to be fixed, and not something to be overly concerned 
with at this time.

Brad Barclay,
OS/2 Development Director,
Internet Direct Canada Inc.

---------------
From the OS/2 WARP v4 Desktop of Brad Barclay.
E-Mail:  os2@idirect.com  WWW: http://warp.idirect.com
Finger for Public PGP Key.  [ ] VoiceType Dictated.

John Brush wrote:
> 
> What you really want to do is make sure you don't get any cookies on
> your machine, and to do that, just delete the existing cookies file
> and create a directory called 'cookies' This will prevent the host
> from putting anything on your machine.
> 
> John

What hazard do you see from cookies? They're just a way for a server to
store state in one line of a file in your browser directory for later
retrieval.

-- 
 Ken
 mailto:shiva@well.com
 mailto:76161.3013@CompuServe.COM
 http://www.well.com/user/shiva/

On 25 Sep 1997 00:30:31 GMT, Randy Olan <nospam@nowhere.none> wrote:
>Hi,
>
>I'd just like to find out if there are any native OS/2
>applications that provide Internet security.  I'm particulary
>interested in an application that will check Java applets
>for viruses and prevent java applets from doing damaging
>things to my system in the background.

As others have posted, Java applets are not something that needs to be
checked. Most of the security bugs to date have been in JavaScript which
you can disable in Netscape Navigator if you are paranoid. However the
bugs have required that you visit a 'hostile' web site with code that
exploits the bug. I saw a post cautioning about cookies but that is a
privacy issue and not a security one. You can treat them like you would
a salesperson who wants to 'help' you by getting to know you.