nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Are JMP Addins a potential source of threat?!

Florian_Vogt

Hi all,

once again I came across a question I had not considered so far. A customer found out about addins and how interesting some are for him. But he did not want to download any, because he was afraid that these could potentially contain harmful elements.

Has anybody ever had this question or discussion before?

I know we can revise the script, before installing it and thus checking what the addin will do. But I was looking for how you have answered this question in customer situations. My explanation seemed not a 100% satisfying for him, so maybe I was missing out on emphasizing important points.

Thankful for any reply as always!

Best regards,

Florian

Accepted answers

MikeD_Anderson

I can't say that I've had the question from a customer, but I gave this some thought for myself a while back. Here were my conclusions:

Strictly speaking, it would be possible to put harmful code into an add-in. I have faith that our users wouldn't do that, so it's not something that keeps me up at night. But, we have to concede it's possible for an add-in to cause some small mischief if someone were interested in doing that.
Because of the way JMP works in the host environment, I don't think an add-in could cause too much trouble. Especially in an administered environment. IT is pretty good about locking important stuff down.
There are some things that users can do if they want to sanity check that an add-in is okay. Since users can inspect the contents of an add-in (see my blog post (link) to see how) they can look for things that are concerning:
1. In the JSL does anything look odd - (deleting or writing files that don't make sense for the use of the Add-in, for example)?
2. Is the JSL encrypted? If it's encrypted and it's not from someone you know or the community trusts - you might want to be careful.
3. Is there anything in the JMP Add-in package that looks like it shouldn't be there?

Those are just my thoughts on this... again - never had anyone ask me about it over here.

All comments

MikeD_Anderson

I can't say that I've had the question from a customer, but I gave this some thought for myself a while back. Here were my conclusions:

Strictly speaking, it would be possible to put harmful code into an add-in. I have faith that our users wouldn't do that, so it's not something that keeps me up at night. But, we have to concede it's possible for an add-in to cause some small mischief if someone were interested in doing that.
Because of the way JMP works in the host environment, I don't think an add-in could cause too much trouble. Especially in an administered environment. IT is pretty good about locking important stuff down.
There are some things that users can do if they want to sanity check that an add-in is okay. Since users can inspect the contents of an add-in (see my blog post (link) to see how) they can look for things that are concerning:
1. In the JSL does anything look odd - (deleting or writing files that don't make sense for the use of the Add-in, for example)?
2. Is the JSL encrypted? If it's encrypted and it's not from someone you know or the community trusts - you might want to be careful.
3. Is there anything in the JMP Add-in package that looks like it shouldn't be there?

Those are just my thoughts on this... again - never had anyone ask me about it over here.

stan_koprowski

Hi @Florian_Vogt,

A great question! I would encourage you to submit to the JSL Unsession at Discovery Summit Americas.

These are the types of thought provoking conversations we are looking to host.

Allowing the various viewpoints on this topic is a wonderful idea.

I hope you consider submitting the idea or suggesting your customer contact do the same.

cheers,

Stan

stan_koprowski

Hi @MikeD_Anderson,

Thanks for sharing your thoughts on the subject.

As I mentioned to @Florian_Vogt this is the types of conversations we are hoping to host during the JMP Scripting Unsession.

Please consider dropping into one of the breakout rooms to participate in the conversations.

cheers,

Stan

Florian_Vogt

Thank you both!

That's exactly what I needed @MikeD_Anderson and @stan_koprowski . I will get in touch with the customer and see if he is willing to join the session!

Thanks again,

Florian