[1366] in java-interest
Re: Third Party Library Loading
daemon@ATHENA.MIT.EDU (Matt Cline)
Thu Aug 31 04:34:03 1995
Date: Wed, 30 Aug 1995 22:47:48 -0700
From: gandalf@viman1.viman.com (Matt Cline)
To: java-interest@java.sun.com
> I am currently working on an applet that will allow
> searching into a Sybase database. Originally I created the
> applets using native methods to call the database library
> calls and things were working ok. But I have been told that
> this is not a solution because for anyone to use the applet I
> will have to download the sybase library onto thier machine,
> since it is dynamically loaded for them to use the applet. Is
> this true? If so how do I get around it. It is impossible for
> me to distribute database libraries and would like my search
> commands to come from the client if possible.
I was wondering the same thing about making applets that for some reason
have to use a native method. Anyone who wanted to use it would have to
download the class with the native methods in it to their machine, which
is inconvienient, and is also insecure, since the native methods can
do pretty much anything. I had an idea of a way to solve this; it's
probably a bad idea, but here it is anyways:
If you have a native method that you want people around the net to use,
give the source code for the native method to someone running a
"trusted host". This person will go over the code with a magnifying
glass, fine-toothed comb and what-not to make sure that it only does
what its supposed to do, and doesn't do anything sneaky. Once they are
sure of this, they compile the code and put it onto their host.
If you download an app which needs to use a native mehtod, it goes to one
of the trusted hosts to get it. This would require several changes to
the browser. One would be to allow it to download native methods from
a trusted host (the list of trusted servers could be hardcoded or in a
config file). The other would be some way of letting the browser know that
the class it's trying to load has native methods in it, and also a way of
telling the browser which trusted host it should go to to retrieve that
class. I don't really know how this could be done.
Would this have even a chance of working?
-
Note to Sun employees: this is an EXTERNAL mailing list!
Info: send 'help' to java-interest-request@java.sun.com
