Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.java.programmer > #27244

Re: Signing an applet

Show all headers | View raw

On 1/5/2014 9:11 AM, Arne Vajhøj wrote:
> On 12/20/2013 7:35 PM, Richard Maher wrote:
>> On 12/18/2013 7:08 AM, Arne Vajhøj wrote:
>>> I don't think Oracle is really changing anything regarding applets.
>>
>> In order to cater for the inadequacies and introduced vulnerabilities of
>> WebStart and JNLP
>
> I was not aware that the vulnerabilities were not in traditional
> applet tags.
>
> Are you sure about this?
>
Just one recent example: -
https://addons.mozilla.org/en-US/firefox/blocked/p428

But the underlying architectural problem with WebStart and JNLP is that 
the elevated privileges needed to work their bastardry means all THEIR 
applets need to be signed. So why not just make everyone do it? hese 
people refuse to believe that anyone would not want to use their 
WebStart crap :-(

>
>>                   Oracle have knee-jerked their way into destroying the
>> sandboxed paradigm and made Applets almost impossible to activate
>> without reciting some incantation while waving a dead chicken over your
>> head :-(
>>
>> For example: -
>> https://blogs.oracle.com/java-platform-group/entry/liveconnect_changes_in_7u45
>>
>
> They tightened security. I think that is fine. I think it is very bad that
> they change the rules for every other release - they should define the
> rules they want and stick to them, so people have a chance of complying.

As I questioned in the referenced blog, I am not sure this change is 
about tightening security: -

Deanna: It's not a matter of [Allowing the caller to say "yes, I really 
am allowed to call this, honest guv'"] it's allowing the authour of the 
document base to say "Hey, I'm including a whole lot of script files 
from other domains and I don't want them to be able to script this 
Applet". [would defeat the point of it] I'm not sure Oracle have 
articulated what "the point of it" is. Is it CopyRight Protection or 
marketing mechanism or is it a security mechanism? [It's an option for 
the publisher of the applet to specify who can call it.] You mean like 
they've always been able to do by interogating the results of 
Applet.getDocumentBase()?

The whole idea of having to ship/package/manufacture a separate Applet 
for each customer is ludicrous!

costlow: [because it guards against repurposing] Fine. *IF* the check 
scrutinized the domain of individual.JS files then I could see the sense 
in it, but my quick testing says it ONLY checks the Document Base. 
Please communicate exactly what you were trying to accomplish.

On the subject of communication please feel free to assume a fair 
portion of responsibility for user-base feelings like this: -
https://bugzilla.mozilla.org/show_bug.cgi?id=914690

Cheers Richard Maher

PS. Why don't I get any pop-up when I dynamically include an unsigned 
Applet at run-time with innerHTML="<OBJECT. . .".

>
> Arne
>

Back to comp.lang.java.programmer | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Signing an applet emf <emfril@gmail.com> - 2013-12-13 08:40 -0500
  Re: Signing an applet Jeff Higgins <jeff@invalid.invalid> - 2013-12-13 09:52 -0500
    Re: Signing an applet emf <emfril@gmail.com> - 2013-12-13 10:12 -0500
      Re: Signing an applet Jeff Higgins <jeff@invalid.invalid> - 2013-12-13 10:30 -0500
      Re: Signing an applet Arne Vajhøj <arne@vajhoej.dk> - 2013-12-14 16:22 -0500
        Re: Signing an applet lipska the kat <"lipskathekat at yahoo dot co dot uk"> - 2013-12-14 21:24 +0000
  Re: Signing an applet lipska the kat <"lipskathekat at yahoo dot co dot uk"> - 2013-12-13 15:08 +0000
  Re: Signing an applet emf <emfril@gmail.com> - 2013-12-13 10:11 -0500
    Re: Signing an applet Jeff Higgins <jeff@invalid.invalid> - 2013-12-13 10:19 -0500
    Re: Signing an applet lipska the kat <"lipskathekat at yahoo dot co dot uk"> - 2013-12-13 15:27 +0000
      Re: Signing an applet emf <emfril@gmail.com> - 2013-12-13 11:08 -0500
    Re: Signing an applet Arne Vajhøj <arne@vajhoej.dk> - 2013-12-14 16:27 -0500
  Re: Signing an applet Wayne <nospam@all.invalid> - 2013-12-14 00:11 -0500
    Re: Signing an applet lipska the kat <"lipskathekat at yahoo dot co dot uk"> - 2013-12-14 11:41 +0000
      Re: Signing an applet Wayne <nospam@all.invalid> - 2013-12-15 22:22 -0500
    Re: Signing an applet Hiram Hunt <hiramhunt@verizon.net> - 2013-12-14 09:32 -0500
      Re: Signing an applet Hiram Hunt <hiramhunt@verizon.net> - 2013-12-14 09:39 -0500
        Re: Signing an applet Joerg Meier <joergmmeier@arcor.de> - 2013-12-14 15:48 +0100
    Re: Signing an applet emf <emfril@gmail.com> - 2013-12-15 00:04 -0500
      Re: Signing an applet Arne Vajhøj <arne@vajhoej.dk> - 2013-12-15 09:53 -0500
        Re: Signing an applet emf <emfril@gmail.com> - 2013-12-17 17:40 -0500
          Re: Signing an applet Arne Vajhøj <arne@vajhoej.dk> - 2013-12-17 18:08 -0500
            Re: Signing an applet Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2013-12-21 08:35 +0800
              Re: Signing an applet emf <emfril@gmail.com> - 2013-12-31 11:44 -0500
                Re: Signing an applet Arne Vajhøj <arne@vajhoej.dk> - 2014-01-04 20:14 -0500
              Re: Signing an applet Arne Vajhøj <arne@vajhoej.dk> - 2014-01-04 20:11 -0500
                Re: Signing an applet Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2014-01-06 08:04 +0800

csiph-web