Newsgroup: it.comp.aiuto
Titolo: APPLET JAVA E NETSCAPE 2.01

Con il NETSCAPE 2.01 non mi funzionano gli applet java.
Ogni volta che provo a collegarmi con un applet la risposta è: questo 
programma ha eseguito una operazione non valida e sarà terminato.
Nei "dettagli": NETSCAPE ha provocato un errore di pagina non valida nel 
modulo NSPR32.DLL in 0137:1000427d.
Le ho provate tutte: qualcuno saprebbe aiutarmi?


Purtroppo confermo: la Netscape scrive molto male i suoi browser per Mac.  Ci
sono continui problemi.
Capita anche che compaia un errore con indicazione di mancanza di memoria.
Tom
*************************************************
Message sent from Telemacus BBS - Milano  (Italy)
in FirstClass© Software by SoftArc - Toronto
Tel. +39-2-48.017.867 all 28.800 V34 HST Courier
IP Number: 194.177.96.2    Port 3004
http://www.telemacus.it
 
*************************************************

 Capita anche che compaia un errore con indicazione di mancanza di memoria.
Tom,  qualcosa   mi dice che  Nicola  usava  una macchina  Windows (il
messaggio di  errore riportato   del tipo  Errore "error"   nel Modulo
"modulo" e poi un bell'indirizzo segmentato).
La cosa e' un'altra e  potrebbe essere relativa  ad uno dei bachi  del
motore  Java     di  Netscape (Anche   di   Windows,    Tom, anche  di
Windows!!!!!!!!) con i quali si puo' mandare in Crash Netscape.
Riporto   qui   parte  di    un'articolo   che Alberto   Cammozzo    (
mm...@hal.stat.unipd.it
 ) ha   impostato sulle news del   DEI . E'   in
inglese e come   dice Alberto " E`   solo  l'INDICE elle cose   che il
Sig.   LoVerso  ha  scoperto   su        java:   il resto    e`     su
http://www.osf.org/~loverso/javascript/
   (attenzione:   io    non  lo
visiterei con Netscape 2.x :-) "
)                      JAVASCRIPT PROBLEMS I'VE DISCOVERED
)                                       
)   These have all been reported back to Netscape.
)   
)   The press had a spotty record of reporting correctly on this. I've
)   prepared a small report on the stories I've seen. I'm amazed at how
)   inaccurate some of the stories are! You'd think that they would have
)   at least read some of what I've written!
)   
)     If you see an article in the press mentioning these pages, please
)     let me know.
)     
)   
)     _________________________________________________________________
)   
)     * (4/1) I will be making the 3/18 and 3/21 exploits available
)       shortly, since they are fixed in 3.0b2. -->
)       
)     * (3/29) Netscape has gotten some fixes into 3.0b2. Of my three
)       exploits that I reported against 2.01, only the new history
)       tracker continues to work (I.e., the others were fixed in response
)       to my report).
)       
)     * (3/22) Here is a note to the www-security list I wrote describing
)       the latest problems I know affecting 2.01.
)       
)     * (3/21) I have a means (using 2.0 or 2.01) to read and retrieve
)       files off a user's disk. It requires a minimal forms interaction
)       by the user (MEANING: the user has to click on something to invoke
)       the file read). I am not making this exploit available at this
)       time.
)       
)     * (3/18) I have modified the "directory browser" exploit such that
)       it works with 2.01. I am not making this exploit available at
)       this time.
)       
)     * (3/18) Building on the item I discovered on 3/15, I found that if
)       I click on Cancel in the Save dialog, it invokes the "stuck
)       onload" bug I reported on 2/21 in a determinist fashion. Trying to
)       create such a repeatable incarnation of this bug is what lead me
)       to my "tracker" in the first place.
)       
)       Anyway, utilizing a Save File dialog as the initiator, this lets
)       me build a history tracker that works with 2.01. I've created a
)       sample exploit. This writes the the same log as my 2/22 tracker,
)       so use this to view the tail of the logfile.
)       
)       Note that with 2.01, the 1x1 window previously used ends up being
)       bigger, so you can easily see it flash. And, the "stuck onload"
)       gets "unstuck" by visiting another page with an onLoad() tag. This
)       may not be a very intriguing way to spy on someone.
)       
)     * (3/15) NOTE: This item in and of itself is not necessarily a
)       security problem.
)       
)       JavaScript loaded from some page can write to local files on your
)       disk. This info is from my news posting to the devs-javascript
)       group. This is the basic bit of code:
)
)        document.open("Can I write to your disk?")
)        document.write("<censored>")
)        document.close()
)   
)       
)       This trick requires the user to go through a File Save dialog, and
)       hence, is not transparent. The user chooses the file name, but I'm
)       able to write to disk none-the-less. This is quite against the
)       stated fact that JavaScript is "Secure. Cannot write to hard disk"
)       - and this works in 2.01.
)       
)       Try my example.
)       
)       For me, this always caused a GPF on Windows NT. That is, once the
)       File Save dialog appeared, no matter what I selected, it went
)       poof! It seems to core dump the UNIX version of Navigator if you
)       don't open up a new window relatively fast (i.e., before you go to
)       some other JavaScript laden page). I've found that nasty things
)       begin to happen if you click on Cancel in the Save dialog (see
)       3/18 for details).
)       
)       Note that the file never gets closed until you exit Netscape, so
)       small writes tend to get buffered up and not output.
)       
)       These above mentioned bugs with this mechanism initially lead me
)       to believe that the ability to write files was errantly added to
)       JavaScript. Brendan Eich has since informed me that this ability
)       is intentional, or at least, known about.
)       
)     * (2/22) I discovered a way to make my JavaScript stay resident in a
)       new window, so that I can track your history in real time.
)       
)       This problem has been fixed in Netscape-2.01; see Netscape's
)       security note on Java and JavaScript.
)       
)       You can read the original article I posted to the RISKS Forum on
)       this problem. That whole issue is also available in the archive in
)       the UK. Another article of interest appeared Keith Dawson's TBTF
)       on Feb 28.
)       
)     * (2/21) I've seen JavaScript stay resident after you leave a page.
)       This is what I call the "stuck onload()" problem, and is a BUG
)       (still in 2.01).
)       
)     * (2/13) The bug in Netscape 2.0b3 that allowed JavaScript to
)       directory browse lives on in the 2.0 release, even after
)       Netscape told us it was fixed.
)       
)       This is fixed in Netscape-2.01.
)       
)     * This is a classified as a red herring, but JavaScript has the
)       ability to toss up arbitrary alert boxes. I used to have this one
)       pop up on my home page. I wanted this message to sound really bad.
)       This was before I wrote the tracker. A more interesting message
)       would be Please type your password or something similar.
)       
)     * There are hundreds of exciting things to do with Netscape 2.0 and
)       JavaScript.
)       WARNING: viewing this page may damage or crash Netscape.
)       
)   
)     _________________________________________________________________
)   
)    John Robert LoVerso, OSF Research Institute
)    
)    Last modified on Monday, 01-Apr-96 14:51:07 EST.
Capite  adesso perche' non  vi  conviene  usare netscape per  guardare
quelle pagine ?
o   oooooo	Gian Uberto Lauri
      o    o	
sa...@maya.dei.unipd.it
     o o