Are JMP Addins a potential source of threat?!Hi all,
once again I came across a question I had not considered so far. A customer found out about addins and how interesting some are for him. But he did not want to download any, because he was afraid that these could potentially contain harmful elements.
Has anybody ever had this question or discussion before?
I know we can revise the script, before installing it and thus checking what the addin will do. But I was looking for how you have answered this question in customer situations. My explanation seemed not a 100% satisfying for him, so maybe I was missing out on emphasizing important points.
Thankful for any reply as always!
Best regards,
Florian
Re: Are JMP Addins a potential source of threat?!I can't say that I've had the question from a customer, but I have given this some thought myself a while back. Here were my conclusions:
- Strictly speaking, it would be possible to put harmful code into an add-in. I have faith that our users wouldn't do that, so it's not something that keeps me up at night. But, we have to concede it's possible for an add-in to cause some small mischief if someone were interested in doing that.
- Because of the way JMP works in the host environment, I don't think an add-in could cause too much trouble. Especially in an administered environment. IT is pretty good about locking important stuff down.
- There are some things that users can do if they want to sanity check that an add-in is okay. Since users can inspect the contents of an add-in (see my blog post (link) to see how) they can look for things that are concerning:
- In the JSL does anything look odd - (deleting or writing files that don't make sense for the use of the Add-in, for example)?
- Is the JSL encrypted? If it's encrypted and it's not from someone you know or the community trusts - you might want to be careful.
- Is there anything in the JMP Add-in package that looks like it shouldn't be there?
Those are just my thoughts on this... again - never had anyone ask me about it over here.
Re: Are JMP Addins a potential source of threat?!Hi @MikeD_Anderson,
Thanks for sharing your thoughts on the subject.
As I mentioned to @Florian_Vogt this is the types of conversations we are hoping to host during the JMP Scripting Unsession.
Please consider dropping into one of the breakout rooms to participate in the conversations.
cheers,
Stan
Re: Are JMP Addins a potential source of threat?!Thank you both!
That's exactly what I needed @MikeD_Anderson and @stan_koprowski . I will get in touch with the customer and see if he is willing to join the session!
Thanks again,
Florian
