🚀 go-pugleaf

On Fri, 30 Jun 2000 17:44:37 +1200, Slow <aputto@htomail.com.no.spam> wrote:
>"David Mohring" <heretic@localhost.localdomain> wrote in message
>news:slrn8lmeh7.636.heretic@localhost.localdomain...
>> On Thu, 29 Jun 2000 23:09:00 +1200, Slow
>>                <aputto@htomail.com.no.spam> wrote:
>> >"David Mohring" <heretic@localhost.localdomain> wrote in message
<SNIP>
>
>Digital certificates for code etc is already implemented in Win32 and IE
>etc. There are holes in IE and Netscape that allow use of object that may
>already be installed on the users PC.
>
Yes - but signed outside the your organization by Micorosoft or any 
vendor willing to pay microsoft for an Active-X approved signature.

You should not have to blindly accept scripts from any Vendor ( including
Microsoft ).

QUOTING http://www.deja.com/[ST_rn=ps]/getdoc.xp?AN=634259957&fmt=text
>>Is my (public) provider a trusted server ?
>No I meant a NT server within your organisation, working just like the NT 
>password login server DDL.
>
>>If not who is than going to evaluate (and sign) the scripts 
>
>You personaly can be a trusted signer as well as trusted individuals
>within your organisation and trusted system integration providers. 
>
>You sign the scripts when the script executes/performs the action for the
>first time. When (for example) the script attempts to interface the MAPI
>interface to mail outwards for the first time the user gets presented with
>a dialog saying 
>
>""The script within this document is attempting to use the Microsoft mail 
>  interface. 
>  This will give the script the ability to - 
>  access Outlook address book,
>  access Outlook mail folders,
>  email out to other users.
>  Allow the script to access this interface?
>  [N]o ne[V]er [T]his time only [A]lways
>""
>If the user chooses '[A]lways' then a digital signiture is inserted.
UNQUOTE

The difference is that you or someone you (or your organization) trusts
signs the script - For each type of access to an API interface or
named filed access. You can grant or deny the scripts access on 
a Case by case basis.

><snip>
>
>> Just switching to NT will not provide protection to document files that a
>> user has write access to OR information in documents that a user has
>> read access to. It is possible to create scripts that check access
>> permissions before attempting to do so.
>
>On a secure NT workstation, script could check for access permission to the
>startup folder or whatever system folder, but if it is set to RO, they
>cannot access it!
>

The script executed can however read the file ( say looking for credit card
numbers ). Marking a file as Read Only does not protect the information
inside the document.

David Mohring-http://www.microsoft.com/technet/security/bulletin/fq00-042.asp