questions about security & WWW browsers

[Brad - Walker <bwalker @ shell . portal . com>]

My questions concern HTML and Web browsers. Is it possible for a WWW
server to issue HTML commands to the browsers to do things like
delete a file, spawn a process or some other anti-social behavior (much
like `deletefile' in Display PostScript).

I'm in a discussion about firewalls and their limitations when it
comes to application filtering.

Thanks.

-brad w.