Java security: hostile applets, holes&antidotes