On 02-10-2012 19:46, Mouse wrote:

> That's actually not relevant, because, at least as far as I can tell,
> there is no java involved.  I see two javascript scripts, but no java.

Hi Mouse. It seems you looked in the wrong place.

See that the test itself is inside a <iframe> in this relatively
unreadable page (that is generated by twiki, as part of ntp.br website).

The test is currently hosted at:
http://www.ntp.br/desafio-inscricao/verifica/ (it is where the iframe
points). The code in this address is smaller and manually generated, so
it is easier to read. So, applet itself is in
http://www.ntp.br/desafio-inscricao/verifica/signed.jar.

I will check the broken links. Probably you found some error in our
site, thanks.

> If you can't speak to 127.0.0.1 port 123, I should certainly home you
> can't run arbitrary programs like ntpdq.  (Also, what's ntpdq?  None of
> my NTP installs have anything by that name.)

You can do both things with a signed (trusted) applet: open sockets and
run arbitrary programs, as I have explained in the former email. For
this it is necessary that you sign the applet with a certificate,
similar to those used for https servers, and the user is asked for
permission.

Please see:
http://docs.oracle.com/javase/tutorial/deployment/applet/security.html

Our applet is signed (trusted) and do run "ntpq -np", and "ntpq -c rl".

Regards,
Moreiras.
_______________________________________________
pool mailing list
[email protected]
http://lists.ntp.org/listinfo/pool

Reply via email to