<snipped reason='too long'/>

I just tested what i theorized above, and it works excactly like that.

A signed applet with absolutely no permission-checks or security code
whatever succeeds calling the following code:

 // Get timestring from another server
 public String getTimeFromServer( String urlString ) {

   String inputLine = new String("");

   try {
     this.setCursor(Cursor.getPredefinedCursor(Cursor.WAIT_CURSOR));

     String content = new String("");

     // URL of CGI-Bin script.
     URL url = new URL(urlString);

     HttpURLConnection connection = (HttpURLConnection)
url.openConnection();
     connection.setDoInput(true);
     connection.setDoOutput(true);
     connection.setUseCaches(false);
     connection.setRequestProperty("Content-Type",
                                   "application/x-www-form-urlencoded");
     connection.setRequestMethod("POST");

     // Prepare the output stream....
     PrintWriter out = new PrintWriter(connection.getOutputStream());
     out.println(content);
     out.flush();
     out.close();

     BufferedReader in = new BufferedReader(
         new InputStreamReader(connection.getInputStream()));

     StringBuffer inputBuffer = new StringBuffer("");
     while ( (inputLine = in.readLine()) != null) {
       inputBuffer.append(inputLine);
     }
     in.close();
     inputLine = inputBuffer.toString();
     connection.disconnect();
     this.setCursor(Cursor.getPredefinedCursor(Cursor.DEFAULT_CURSOR));
   }

   catch (MalformedURLException eURL) {
     eURL.printStackTrace();
   }

   catch (NoRouteToHostException eURL) {
     JOptionPane.showMessageDialog(this,
                                   "Can't connect to server, please try
later!",
                                   "Communication error!",
                                   JOptionPane.ERROR_MESSAGE);

   }

   catch (IOException eURL) {
     eURL.printStackTrace();
   }

   return inputLine;

 }

but if I call this from JavaScript, I get:
   java.security.AccessControlException:
       access denied (java.net.SocketPermission machinename resolve)