Yeah, I got that. But my point was that by having stub URL handlers at VM startup, we *can* specify VFS URLs in security.policy, and the whole dirty mess can be avoided. Still checking to see if the behavior is consistent across various JVMs though. One hopes that this behavior is verified by the TCK, but there's only one way to find out... View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4188595#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...