Re: launching executables through HTML files
montulli@stat1.cc.ukans.edu (Lou Montulli)
From: montulli@stat1.cc.ukans.edu (Lou Montulli)
Message-id: <9306221826.AA23983@stat1.cc.ukans.edu>
Subject: Re: launching executables through HTML files
To: www-talk@nxoc01.cern.ch
Date: Tue, 22 Jun 93 13:26:54 CDT
In-reply-to: <9306200250.AA00157@wintermute.ncsa.uiuc.edu>; from "Marc Andreessen" at Jun 19, 93 9:50 pm
X-Mailer: ELM [version 2.3 PL2]
>
> What's the current status on the idea of allowing hyperlinks in HTML
> documents to cause executables to be launched?
>
> Also, there was the idea that maybe executables should only be allowed
> to be launched from documents residing on the local host (not over
> ftp, http, or anything else). This seems like a pretty much useless
> restriction with the current state and expansion of transparent
> networked filesystems, though.
>
Most network file systems still appear to be local accesses so this IS
still a valid idea. I think it is unreasonable to expect users to be
able to make reasonable judgements about how a particular command might
effect there system. Do YOU really think that there is no one clever
enough to fool YOU with some cryptic UNIX trojan link. The average
user isn't competant enough to tell whether some command will destroy
his system, therefore tight control should be exercised with this
link type. Another issue is how can a single executable link be useful
on other systems? Why should a machine specific link be usable across
the network? We are playing with fire with this link type, I know this
from experience.
My suggestion would be to allow "exec:" type links to be run only if
the file that contains them resides on the local filesystem. (physical,
NFS, AFS, etc.) Or a file that resides on a trusted host. (in a list?)
That way there is at least some sense of security.
:lou
--
**************************************************************************
* T H E U N I V E R S I T Y O F K A N S A S *
* Lou MONTULLI @ Ukanaix.cc.ukans.edu *
* Kuhub.cc.ukans.edu ACS Computing Services *
* 913/864-0436 Ukanvax.bitnet Lawrence, KS 66044 *
* UNIX! Cool! I know that! Jurassic Park - The Movie *
**************************************************************************