On Wed, Mar 24, 2010 at 12:17 AM, Eric Iverson <[email protected]> wrote: > You are quite right to be concerned about security. This is an issue that > has been ignored to date, but will be important to address in the near > future. > > When you start the jhs task it is listening on port 50000. This means that > anybody who knows your IP address AND connects to port 50000 AND knows J has > nasty access to your machine. This is not good in the long term and perhaps > not even good in the short term.
This problem used to be solved already. Back in j601, the documented way to start jep was to run it with the -listen option and then it would act as a tcp server with this same security problem. There was, however, an undocumented -connect option which made it act as a tcp client. This would eliminate the security problem (at least if you're running the server on the same host as your program): your program would first listen on tcp and then make the J engine connect to you. This option is how my jevalbot used to work for a while -- though now it doesn't in the default config. Ambrus ---------------------------------------------------------------------- For information about J forums see http://www.jsoftware.com/forums.htm
