>>>>> Again, the ISP allows I run Java in his server because Java is "safe".
>>> Huh ? Java program can't send spam ? Or open socket ?
>> No, unless you provide an appropriate permission.
>
> To whom ? Who is security subject ? Process ? Or someone else ?

to a Java class loaded in a particular classloader.

> If Java security manager may give disk access permissions to classes
> by its name, why do we need to integrate (read - re-invent) this functionality
> into FB ?

I'd say we don't need to worry about this topic a lot, I can't think
about a scenario that Java plugin can't handle provided it has some
configuration (I'd prefer to have a system table for it with write
access to database owner, but a file on a disk is also ok).

Roman