Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.java.programmer > #26871 > unrolled thread

Signing an applet

Back to article view | Back to comp.lang.java.programmer

Contents

  Signing an applet emf <emfril@gmail.com> - 2013-12-13 08:40 -0500
    Re: Signing an applet Jeff Higgins <jeff@invalid.invalid> - 2013-12-13 09:52 -0500
      Re: Signing an applet emf <emfril@gmail.com> - 2013-12-13 10:12 -0500
        Re: Signing an applet Jeff Higgins <jeff@invalid.invalid> - 2013-12-13 10:30 -0500
        Re: Signing an applet Arne Vajhøj <arne@vajhoej.dk> - 2013-12-14 16:22 -0500
          Re: Signing an applet lipska the kat <"lipskathekat at yahoo dot co dot uk"> - 2013-12-14 21:24 +0000
    Re: Signing an applet lipska the kat <"lipskathekat at yahoo dot co dot uk"> - 2013-12-13 15:08 +0000
    Re: Signing an applet emf <emfril@gmail.com> - 2013-12-13 10:11 -0500
      Re: Signing an applet Jeff Higgins <jeff@invalid.invalid> - 2013-12-13 10:19 -0500
      Re: Signing an applet lipska the kat <"lipskathekat at yahoo dot co dot uk"> - 2013-12-13 15:27 +0000
        Re: Signing an applet emf <emfril@gmail.com> - 2013-12-13 11:08 -0500
      Re: Signing an applet Arne Vajhøj <arne@vajhoej.dk> - 2013-12-14 16:27 -0500
    Re: Signing an applet Wayne <nospam@all.invalid> - 2013-12-14 00:11 -0500
      Re: Signing an applet lipska the kat <"lipskathekat at yahoo dot co dot uk"> - 2013-12-14 11:41 +0000
        Re: Signing an applet Wayne <nospam@all.invalid> - 2013-12-15 22:22 -0500
      Re: Signing an applet Hiram Hunt <hiramhunt@verizon.net> - 2013-12-14 09:32 -0500
        Re: Signing an applet Hiram Hunt <hiramhunt@verizon.net> - 2013-12-14 09:39 -0500
          Re: Signing an applet Joerg Meier <joergmmeier@arcor.de> - 2013-12-14 15:48 +0100
      Re: Signing an applet emf <emfril@gmail.com> - 2013-12-15 00:04 -0500
        Re: Signing an applet Arne Vajhøj <arne@vajhoej.dk> - 2013-12-15 09:53 -0500
          Re: Signing an applet emf <emfril@gmail.com> - 2013-12-17 17:40 -0500
            Re: Signing an applet Arne Vajhøj <arne@vajhoej.dk> - 2013-12-17 18:08 -0500
              Re: Signing an applet Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2013-12-21 08:35 +0800
                Re: Signing an applet emf <emfril@gmail.com> - 2013-12-31 11:44 -0500
                  Re: Signing an applet Arne Vajhøj <arne@vajhoej.dk> - 2014-01-04 20:14 -0500
                Re: Signing an applet Arne Vajhøj <arne@vajhoej.dk> - 2014-01-04 20:11 -0500
                  Re: Signing an applet Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2014-01-06 08:04 +0800

Page 1 of 2  [1] 2  Next page →

#26871 — Signing an applet

I am trying to understand how to self-sign an applet. I've already 
checked websites that provide directions, but unfortunately I realized 
that my relevant knowledge is too limited to start understanding what 
they are talking about, so I post here hoping I'll get some help to get 
me started.

 From what I've read so far I realized I needed JDK, so I've already 
installed it. (BTW, I also use Eclipse.)

Now, in

http://www-personal.umich.edu/~lsiden/tutorials/signed-applet/signed-applet.html

under "How To Create a Signed Applet"

I believe I have completed step 1, as you can see in my webpage

https://files.nyu.edu/emf202/public/jv/nataltransits.html

So we come to step 2. It starts:

============
Create a public/private key pair. The command for this is

     keytool -genkey
============

My initial question is: Where do I enter this command?

Alternatively, and probably even better, is there a webpage I have 
missed that provides step by step instructions that an amateur java 
programmer with my level of ignorance can understand?

Thanks,

emf

-- 
It ain't THAT, babe! - A radical reinterpretation
https://files.nyu.edu/emf202/public/bd/itaintmebabe.html

[toc] | [next] | [standalone]

#26873

On 12/13/2013 08:40 AM, emf wrote:
> I am trying to understand how to self-sign an applet.
<http://www.cert.org/blogs/certcc/2013/09/signed_java_applet_security_im.html>

[toc] | [prev] | [next] | [standalone]

#26876

On 2013-12-13 09:52 Jeff Higgins wrote:
> On 12/13/2013 08:40 AM, emf wrote:
>> I am trying to understand how to self-sign an applet.
> <http://www.cert.org/blogs/certcc/2013/09/signed_java_applet_security_im.html>

Useless for what I asked and need. And, BTW, I had already come across 
this webpage.

emf

-- 
Date Calculator with all-purpose JS code
https://files.nyu.edu/emf202/public/js/dateCalculator.html

[toc] | [prev] | [next] | [standalone]

#26879

On 12/13/2013 10:12 AM, emf wrote:
> On 2013-12-13 09:52 Jeff Higgins wrote:
>> On 12/13/2013 08:40 AM, emf wrote:
>>> I am trying to understand how to self-sign an applet.
>> <http://www.cert.org/blogs/certcc/2013/09/signed_java_applet_security_im.html>
>>
>
> Useless for what I asked and need. And, BTW, I had already come across
> this webpage.
>
That's one way to advertise your miserable web presence.

[toc] | [prev] | [next] | [standalone]

#26897

On 12/13/2013 10:12 AM, emf wrote:
> On 2013-12-13 09:52 Jeff Higgins wrote:
>> On 12/13/2013 08:40 AM, emf wrote:
>>> I am trying to understand how to self-sign an applet.
>> <http://www.cert.org/blogs/certcc/2013/09/signed_java_applet_security_im.html>
>
> Useless for what I asked and need.

Not what you asked for but still relevant.

>                                    And, BTW, I had already come across
> this webpage.

Maybe Jeff's crystal ball that is supposed to tell him what pages
you have already found is not working properly.

Arne

[toc] | [prev] | [next] | [standalone]

#26898

On 14/12/13 21:22, Arne Vajhøj wrote:
> On 12/13/2013 10:12 AM, emf wrote:
>> On 2013-12-13 09:52 Jeff Higgins wrote:
>>> On 12/13/2013 08:40 AM, emf wrote:
>>>> I am trying to understand how to self-sign an applet.
>>> <http://www.cert.org/blogs/certcc/2013/09/signed_java_applet_security_im.html>
>>>
>>
>> Useless for what I asked and need.
>
> Not what you asked for but still relevant.
>
>>                                    And, BTW, I had already come across
>> this webpage.
>
> Maybe Jeff's crystal ball that is supposed to tell him what pages
> you have already found is not working properly.

I knew it was too good to last.


-- 
Lipska the Kat©: Troll hunter, sandbox destroyer,
treacherous feline and farscape dreamer of Aeryn Sun
GNU/Linux user #560883 - http://www.linuxcounter.net

[toc] | [prev] | [next] | [standalone]

#26874

On 13/12/13 13:40, emf wrote:
> I am trying to understand how to self-sign an applet. I've already
> checked websites that provide directions, but unfortunately I realized
> that my relevant knowledge is too limited to start understanding what
> they are talking about, so I post here hoping I'll get some help to get
> me started.
>
>  From what I've read so far I realized I needed JDK, so I've already
> installed it. (BTW, I also use Eclipse.)
>
> Now, in
>
> http://www-personal.umich.edu/~lsiden/tutorials/signed-applet/signed-applet.html
>
>
> under "How To Create a Signed Applet"
>
> I believe I have completed step 1, as you can see in my webpage
>
> https://files.nyu.edu/emf202/public/jv/nataltransits.html
>
> So we come to step 2. It starts:
>
> ============
> Create a public/private key pair. The command for this is
>
>      keytool -genkey
> ============
>
> My initial question is: Where do I enter this command?
>
> Alternatively, and probably even better, is there a webpage I have
> missed that provides step by step instructions that an amateur java
> programmer with my level of ignorance can understand?

keytool is a binary executable just like java and javac and jarsigner
executables etc that live in the bin directory of your chosen JDK

On my present machine it's

/opt/jdk1.7.0_45/bin

You should be able to run keytool from anywhere you can run javac


-- 
Lipska the Kat©: Troll hunter, sandbox destroyer,
treacherous feline and farscape dreamer of Aeryn Sun
GNU/Linux user #560883 - http://www.linuxcounter.net

[toc] | [prev] | [next] | [standalone]

#26875

On 2013-12-13 08:52 Stefan Ram wrote:
> emf <emfril@gmail.com> writes:
>> My initial question is: Where do I enter this command?
>
>    Into the text command prompt (sometimes called "shell") of
>    your operating system. Additional requirements might apply
>    such as having a command search path set up properly. This
>    is explained in the operating system literature, usually
>    separate from Java literature. A manual might already be
>    part of your operating system.
>
>> Alternatively, and probably even better, is there a webpage I have
>> missed that provides step by step instructions that an amateur java
>> programmer with my level of ignorance can understand?
>
>    Search for tutorials or text books about your operating systems,
>    especially text commands and batch files, check out information
>    about the search path for commands. Knowledge out this kind
>    always comes in handy for both users and programmers.

Sorry, I did not make myself clear: I am looking for step by step 
instructions. I have taken 2 classes on Java programming (and a long 
time ago a class on DOS), and I do not intend in the near future to get 
more classes. There should be some webpage out there that provides the 
information I asked the way I asked.

emf

-- 
It ain't THAT, babe! - A radical reinterpretation
https://files.nyu.edu/emf202/public/bd/itaintmebabe.html

[toc] | [prev] | [next] | [standalone]

#26877

On 12/13/2013 10:11 AM, emf wrote:

>             There should be some webpage out there that provides the
> information I asked the way I asked.
>
There is. Keep looking.

[toc] | [prev] | [next] | [standalone]

#26878

On 13/12/13 15:11, emf wrote:
> On 2013-12-13 08:52 Stefan Ram wrote:
>> emf <emfril@gmail.com> writes:
>>> My initial question is: Where do I enter this command?
>>
>>    Into the text command prompt (sometimes called "shell") of
>>    your operating system. Additional requirements might apply
>>    such as having a command search path set up properly. This
>>    is explained in the operating system literature, usually
>>    separate from Java literature. A manual might already be
>>    part of your operating system.
>>
>>> Alternatively, and probably even better, is there a webpage I have
>>> missed that provides step by step instructions that an amateur java
>>> programmer with my level of ignorance can understand?
>>
>>    Search for tutorials or text books about your operating systems,
>>    especially text commands and batch files, check out information
>>    about the search path for commands. Knowledge out this kind
>>    always comes in handy for both users and programmers.
>
> Sorry, I did not make myself clear: I am looking for step by step
> instructions. I have taken 2 classes on Java programming (and a long
> time ago a class on DOS), and I do not intend in the near future to get
> more classes. There should be some webpage out there that provides the
> information I asked the way I asked.
>
> emf
>

 From 
http://www-personal.umich.edu/~lsiden/tutorials/signed-applet/signed-applet.html

How To Create a Signed Applet

1. Package the applet into a JAR file. The applet must be in a JAR file 
before a certificate can be attached to it. Use the jar JDK utility. If 
the applet was previously referenced with the help of a codebase 
attribute in <applet> tag, replace the codebase attribute with the 
archive attribute. The value of the archive attribute is a URL of a JAR 
file.

2. Create a public/private key pair. The command for this is

         keytool -genkey

keytool is another SDK utility. It will prompt you for a password to 
your keystore and for the remaining parameters, one of which is alias, 
whose value is the name of the key. The keystore is a file that contains 
your public/private key-pairs, and the public-keys of others with whom 
you exchange information. See the documentation in the above link.

3. Create a certificate for the key you created in the previous step.

         keytool -selfcert

Again, keytool will prompt you for a keystore password and remaining 
parameters. This certificate is now self-signed by you, meaning that it 
has not been validated by any third party. This is suitable for demo 
purposes, and may be acceptable to yourself and those who know you 
because if there is any doubt that the certificate is really yours they 
can always call you up and ask you for the digest to verify that it is 
really you and not some impostor that created the certificate. However, 
if this applet were to be widely distributed, and you wanted it to be 
accepted by those who do not know you personally, you would certainly 
want to pay a modest fee to obtain a certificate that is validated by a 
trusted certificate authority. The procedure for this is 
straightforward, but beyond the scope of this simple tutorial.

4. Run jarsigner associate this certificate with the JAR file that 
contains your applet. You will need to give the name of the public key 
of the certificate you just created. This creates a digest for each file 
in your JAR and signs them with your private key. These digests or 
hashes, the public key, and the certificate will all be included in the 
"WEB-INF" directory of the JAR.

Your applet is now signed.


-- 
Lipska the Kat©: Troll hunter, sandbox destroyer,
treacherous feline and farscape dreamer of Aeryn Sun
GNU/Linux user #560883 - http://www.linuxcounter.net

[toc] | [prev] | [next] | [standalone]

#26881

On 2013-12-13 10:27 lipska the kat wrote:
> On 13/12/13 15:11, emf wrote:
>> On 2013-12-13 08:52 Stefan Ram wrote:
>>> emf <emfril@gmail.com> writes:
>>>> My initial question is: Where do I enter this command?
>>>
>>>    Into the text command prompt (sometimes called "shell") of
>>>    your operating system. Additional requirements might apply
>>>    such as having a command search path set up properly. This
>>>    is explained in the operating system literature, usually
>>>    separate from Java literature. A manual might already be
>>>    part of your operating system.
>>>
>>>> Alternatively, and probably even better, is there a webpage I have
>>>> missed that provides step by step instructions that an amateur java
>>>> programmer with my level of ignorance can understand?
>>>
>>>    Search for tutorials or text books about your operating systems,
>>>    especially text commands and batch files, check out information
>>>    about the search path for commands. Knowledge out this kind
>>>    always comes in handy for both users and programmers.
>>
>> Sorry, I did not make myself clear: I am looking for step by step
>> instructions. I have taken 2 classes on Java programming (and a long
>> time ago a class on DOS), and I do not intend in the near future to get
>> more classes. There should be some webpage out there that provides the
>> information I asked the way I asked.
>>
>> emf
>>
>
>  From
> http://www-personal.umich.edu/~lsiden/tutorials/signed-applet/signed-applet.html
>
>
> How To Create a Signed Applet
>
> 1. Package the applet into a JAR file. The applet must be in a JAR file
> before a certificate can be attached to it. Use the jar JDK utility. If
> the applet was previously referenced with the help of a codebase
> attribute in <applet> tag, replace the codebase attribute with the
> archive attribute. The value of the archive attribute is a URL of a JAR
> file.
>
> 2. Create a public/private key pair. The command for this is
>
>          keytool -genkey
>
> keytool is another SDK utility.

I opened the Command Prompt and navigated to the folder. OK so far.

It will prompt you for a password to
> your keystore and for the remaining parameters, one of which is alias,
> whose value is the name of the key. The keystore is a file that contains
> your public/private key-pairs, and the public-keys of others with whom
> you exchange information. See the documentation in the above link.

OK so far. I entered the password and the remaining parameters. Now, 
where is the keystore? I do not see it in the bin folder. And I am not 
sure which link it refers to.

> ...

Things are moving a little.

Thanks,

emf

-- 
Natal Transits Calculator
https://files.nyu.edu/emf202/public/jv/nataltransits.html

[toc] | [prev] | [next] | [standalone]

#26899

On 12/13/2013 10:11 AM, emf wrote:
> On 2013-12-13 08:52 Stefan Ram wrote:
>> emf <emfril@gmail.com> writes:
>>> My initial question is: Where do I enter this command?
>>
>>    Into the text command prompt (sometimes called "shell") of
>>    your operating system. Additional requirements might apply
>>    such as having a command search path set up properly. This
>>    is explained in the operating system literature, usually
>>    separate from Java literature. A manual might already be
>>    part of your operating system.
>>
>>> Alternatively, and probably even better, is there a webpage I have
>>> missed that provides step by step instructions that an amateur java
>>> programmer with my level of ignorance can understand?
>>
>>    Search for tutorials or text books about your operating systems,
>>    especially text commands and batch files, check out information
>>    about the search path for commands. Knowledge out this kind
>>    always comes in handy for both users and programmers.
>
> Sorry, I did not make myself clear: I am looking for step by step
> instructions.

You already got those. You posted link and quoted
part of it in your original post.

The reason why it is not clear to this is that you are not
familiar with the environment that you work in.

It makes sense to study how to work in that environment.

And anyway given that you did not tell what environment you are
working in, then it almost the only possible advice.

>    There should be some webpage out there that provides the
> information I asked the way I asked.

Maybe.

But you are probably the only one that can recognize that
web page as being so.

Arne

[toc] | [prev] | [next] | [standalone]

#26883

On 12/13/2013 8:40 AM, emf wrote:
> I am trying to understand how to self-sign an applet. I've already checked websites
> that provide directions, but unfortunately I realized that my relevant knowledge is
> too limited to start understanding what they are talking about, so I post here hoping
> I'll get some help to get me started.

To sign a jar file:

Part I: Create an unsigned applet that just needs to be signed to work:

1) Make sure your applet is in a package.  Don't use the default,
nameless package for signed code.  (It may be possible, but
it can't be a good idea for applets you plan on sharing with the
world.)  For this demo, let's use "mypackage" for the package
name, and "MyApplet" for the applet name.

Here is the demo Java code I used:

// Signed MyApplet Demo - A simple Applet, signed.  This applet
// attempts "read" access the "user.dir" property, normally not
// allowed from the "sandbox".  By signing the applet, you can have
// it run with "app-permissions".
//
// Written 12/2013 by Wayne

package mypackage;

import java.io.*;
import javax.swing.*;

public class MyApplet extends JApplet {
    public void init () {
        JLabel label = new JLabel( "Hello from a Signed Applet!" );
        add( label );
        try {
            File file = new File( "." );
            label.setText( "The current directory is "
                + file.getAbsolutePath() );
        } catch ( Exception ex ) {
            ex.printStackTrace();
            label.setText(
              "Security exception while attempting access "
              + "to current directory" );
        }
    }
}

2) Package the applet into a JAR file. The applet must be in a JAR file
before a certificate can be attached to it.  You should also add
a manifest file to specify permissions and other information for
your applet.  Without this, your signed applet runs without
restrictions, and could be run from any website.  Let's call
the jar file "MyApplet.jar".

3) Create a UTF-8 text file (let's call it MyAppetManifest.txt)
with these three lines in it:

Permissions: all-permissions
Codebase: localhost 127.0.0.1
Application-Name: My Applet

Make sure each line ends with an NEWLINE (the Enter key).
A common error is to forget to hit Enter after that last line.
Currently (Java 7U45), the default is to run unsigned applets
in the sandbox, and signed applets with all permissions.  So
the Permissions entry probably isn't needed.  However, the default
has changed in the past and may change again, so including this
line seems a good idea to me.  If your applet doesn't require
extra permissions, change "app-permissions" to "sandbox".

The "Codebase" entry lists the places from where this applet
can be loaded from.  You need to list both localhost and
127.0.0.1, since one doesn't imply the other for some reason.
(For IPv6, you might need to add "::1", although I didn't see
where IPv6 addresses were supported in the manifest specification.)
Additional entries can be included to enhance security.

4) Use the jar utility to create a new jar file, and include the
manifest entries:

  jar -cvfm MyApplet.jar MyAppetManifest.txt mypackage

(Additional files, such as media files, could also be included
in the jar; simply add file names to the end of the command line.)

5) In the <applet> tag of your HTML file, add the "archive" attribute.
The value of the archive attribute is the URL of a JAR file.  If
the jar file is in the same folder as the HTML file, just
use the file name:

   <APPLET CODE="mypackage.MyApplet.class" ARCHIVE="MyApplet.jar"
       HEIGHT="120" WIDTH="400">

This should result in a working, non-signed applet.  If the Java
control-panel security settings are set to "medium", you should
be able to run this applet.  But, not if you use the default
security settings.  For that, you must sign the applet.

Here is a sample HTML file showing the correct applet tag:

<HTML><HEAD>
<TITLE>My Applet - Demo signed applet</TITLE></HEAD>
<BODY>
 <APPLET CODE="mypackage.MyApplet" WIDTH="400" HEIGHT="120"
         ARCHIVE="MySignedApplet.jar">
 </APPLET>
</BODY></HTML>

=============================================================

Part II: Sign the unsigned applet

When you sign your jar file, both the signature and
the public key are added to the jar file.  But not just the
public key; that wouldn't prove much.  The public key is part of
of a "certificate"; it is the certificate that is added to the jar.
A certificate includes your public key, the algorithm used to
sign the jar, the signer's ID, and other information.  To prevent
forgery, the certificate itself must be signed by a well-known,
trusted third party called a "certificate authority" (or "CA").

Such CAs charge money for this service.  Instead, you can become
your own CA, and then sign your own certificate.  Such certificates
are called "self-signed".  While you should never trust self-signed
applets from the Internet, you can use them yourself for testing your
code.

6) Create a key pair in user.home/.keystore:

   keytool -genkeypair -alias mykey

This will create a private key to sign your code with, and a public
key that can be used to validate the digital signature.  Since Java 6,
it will also generate a self-signed certificate.  The keys will be
put in the default file in the default location (the file
".keystore" within your HOME directory).

The alias you give is the name for the key (sometimes, you may have
multiple keys and use different keys for different applications.)
There are defaults for everything (including the alias, which does
default to "mykey"), but you can use additional command line options
to override the defaults.

6a)  One default is the "validity period" of 90 days.  After that,
the certificate is expired and won't (or shouldn't) work.  If you're
generating a key for use in a one semester Java course (four months),
or a longer course, you will probably want to change this default, like
so (for a one year certificate):

   keytool -genkeypair -alias mykey -validity 364

The keytool utility is interactive.  it will ask you for
your name, your organization's name, your department ("organizational
unit", and the city, state, and country of your organization.  You
can include all that on the command line, but this way is often
easier.

You will also be prompted for a password to protect the private
key, and another for the keystore file.  You must pick good
passwords; access to your private key has legal implications.
You can write these down, but please don't put the passwords
on a post-it note or other public place; keep the passwords
safe!  Note, you can also put the passwords as options on the
command line, but generally, that isn't a good idea.

You can view the contents of your keystore with:

   keytool -list

Or, if you want the gory details:

   keytool -v -list

(To sign your jar file with a real, non-self-signed certificate,
you use keytool to export your certificate data in a form ready
to be signed by some CA.  This file is called a "certificate
signing request".  You generally email or upload that to the
CAs website, submit proofs of identity, pay them, and some time
later they send back the signed certificate.  You can then import
that into your keystore file, and use it the same as the self-signed
certificate.)

7) Now that you have a signed certificate, you can sign your jar file
with it:

   jarsigner -signedjar MySignedApplet.jar MyApplet.jar mykey
Check the result:

jarsigner -verify -certs -verbose MySignedApplet.jar

That should be it!

8) To test, move the signed jar file and the HTML file to another
location.  (Otherwise, the original package may be found on CLASSPATH,
and your signed jar ignored.)

Don't use appletviewer to test!  In older JDKs, appletviewer
defaulted to all-permissions.  Now it defaults to "sandbox",
and there is no way to override that, even with signed applets!
"Appleteer" is a non-Oracle alternative that uses "all-permisions".
Probably, best is to test using a web browser.

In the future, you can use the same key and certificate to sign other
jar files (or newer versions of this one).  You'll only need to
re-run the jarsigner command.

===========================================
References:

http://docs.oracle.com/javase/tutorial/security/toolsign/index.html
http://docs.oracle.com/javase/tutorial/deployment/jar/signindex.html
http://docs.oracle.com/javase/7/docs/technotes/tools/windows/keytool.html
http://docs.oracle.com/javase/7/docs/technotes/tools/windows/jarsigner.html
http://docs.oracle.com/javase/tutorial/deployment/jar/signing.html
http://docs.oracle.com/javase/tutorial/deployment/jar/manifestindex.html
http://docs.oracle.com/javase/7/docs/technotes/guides/jar/jar.html#JAR%20Manifest
http://docs.oracle.com/javase/tutorial/deployment/jar/secman.html
https://www.cert.org/blogs/certcc/2013/09/signed_java_applet_security_im.html
http://docs.oracle.com/javase/tutorial/deployment/applet/html.html
https://blogs.oracle.com/java-platform-group/entry/code_signing_understanding_who_and?msgid=3-9171379647
http://pscode.org/appleteer/

-- 
Wayne

[toc] | [prev] | [next] | [standalone]

#26889

On 14/12/13 05:11, Wayne wrote:
> On 12/13/2013 8:40 AM, emf wrote:
>> I am trying to understand how to self-sign an applet. I've already checked websites
>> that provide directions, but unfortunately I realized that my relevant knowledge is
>> too limited to start understanding what they are talking about, so I post here hoping
>> I'll get some help to get me started.
>
> To sign a jar file:
>
> Part I: Create an unsigned applet that just needs to be signed to work:
>
> 1) Make sure your applet is in a package.  Don't use the default,
> nameless package for signed code.  (It may be possible, but
> it can't be a good idea for applets you plan on sharing with the
> world.)  For this demo, let's use "mypackage" for the package
> name, and "MyApplet" for the applet name.
>
> Here is the demo Java code I used:
>
> // Signed MyApplet Demo - A simple Applet, signed.  This applet
> // attempts "read" access the "user.dir" property, normally not
> // allowed from the "sandbox".  By signing the applet, you can have
> // it run with "app-permissions".

<snip>

Well I haven't tested it but I have to say that this is possibly one of 
the best and most complete answers I've ever seen in this group. No 
smart arsed comments, no smugness and no pointless abuse or denigration 
of the OP.

First class answer.

Gets my vote for post of the year.


-- 
Lipska the Kat©: Troll hunter, sandbox destroyer,
treacherous feline and farscape dreamer of Aeryn Sun
GNU/Linux user #560883 - http://www.linuxcounter.net

[toc] | [prev] | [next] | [standalone]

#26943

On 12/14/2013 6:41 AM, lipska the kat wrote:
> On 14/12/13 05:11, Wayne wrote:
>> On 12/13/2013 8:40 AM, emf wrote:
>>> I am trying to understand how to self-sign an applet. I've already checked websites
>>> that provide directions, but unfortunately I realized that my relevant knowledge is
>>> too limited to start understanding what they are talking about, so I post here hoping
>>> I'll get some help to get me started.
>>
>> To sign a jar file:
> <snip>
> 
> Well I haven't tested it but I have to say that this is possibly one of the best and
> most complete answers I've ever seen in this group. No smart arsed comments, no
> smugness and no pointless abuse or denigration of the OP.
> 
> First class answer.
> 
> Gets my vote for post of the year.
> 

Thanks.  When I win, I'll take the award in Bitcoin please.  :-)

Actually, I've already tweaked the post and made a web page
of it, at <http://wpollock.com/AJava/SignedCodeDemo/>.

-- 
Wayne

[toc] | [prev] | [next] | [standalone]

#26891

On 12/14/2013 12:11 AM, Wayne wrote:
 > ....
 >
 > 3) Create a UTF-8 text file (let's call it MyAppetManifest.txt)
 > with these three lines in it:
 >
 > Permissions: all-permissions
 > Codebase: localhost 127.0.0.1
 > Application-Name: My Applet
 >
 > Make sure each line ends with an NEWLINE (the Enter key).
 > A common error is to forget to hit Enter after that last line.
 > Currently (Java 7U45), the default is to run unsigned applets
 > in the sandbox, and signed applets with all permissions.  So
 > the Permissions entry probably isn't needed.  However, the default
 > has changed in the past and may change again, so including this
 > line seems a good idea to me.  If your applet doesn't require
 > extra permissions, change "app-permissions" to "sandbox".
 > ....

This seems relevant to the "may change again" part:

https://blogs.oracle.com/java-platform-group/entry/signing_applet_code_does_not

Sorry about the link getting split across lines.  I am
having trouble finding an option to make my news reader
stop that.

-- Hiram Hunt (hiramhunt@verizon.net)

[toc] | [prev] | [next] | [standalone]

#26892

On 12/14/2013 9:32 AM, Hiram Hunt wrote:
> ....
> Sorry about the link getting split across lines.  I am
> having trouble finding an option to make my news reader
> stop that.
>

Sorry about the "sorry."  The line split was just an
artifact on my end.

-- Hiram Hunt (hiramhunt@verizon.net)

[toc] | [prev] | [next] | [standalone]

#26893

On Sat, 14 Dec 2013 09:39:15 -0500, Hiram Hunt wrote:

> On 12/14/2013 9:32 AM, Hiram Hunt wrote:
>> ....
>> Sorry about the link getting split across lines.  I am
>> having trouble finding an option to make my news reader
>> stop that.
> Sorry about the "sorry."  The line split was just an
> artifact on my end.

If you surround a link with < >, usenet clients usually understand not to
split it, like so:

<http://www.verylonglink.com/sdjfhsdkljfhsdkjfhsdkjlfhsdlkjfhsdkjlfhsdkjfhsdkjfhsdkfjsdhfkjsdhlfkjsdhfskdjfhsdjkfhkjsd>

Liebe Gruesse,
		Joerg

-- 
Ich lese meine Emails nicht, replies to Email bleiben also leider
ungelesen.

[toc] | [prev] | [next] | [standalone]

#26917

On 2013-12-14 00:11 Wayne wrote:
> On 12/13/2013 8:40 AM, emf wrote:
>> I am trying to understand how to self-sign an applet. I've already checked websites
>> that provide directions, but unfortunately I realized that my relevant knowledge is
>> too limited to start understanding what they are talking about, so I post here hoping
>> I'll get some help to get me started.
>
> To sign a jar file:
>
> Part I: Create an unsigned applet that just needs to be signed to work:
>
> ...

That was quite an interesting article. I have to read again more 
carefully. The impression, however, that I have gotten so far is that 
there have been serious security problems with Java applets, to have 
them sign by an official authority is expensive, and that instead of 
having the applet embedded in the webpage probably a better idea is to 
have the visitor choose to download the jar file on his desktop, and 
open the applet by clicking on it. Is my impression wrong?

emf

-- 
Natal Transits Calculator
https://files.nyu.edu/emf202/public/jv/nataltransits.html

[toc] | [prev] | [next] | [standalone]

#26924

On 12/15/2013 12:04 AM, emf wrote:
> On 2013-12-14 00:11 Wayne wrote:
>> On 12/13/2013 8:40 AM, emf wrote:
>>> I am trying to understand how to self-sign an applet. I've already
>>> checked websites
>>> that provide directions, but unfortunately I realized that my
>>> relevant knowledge is
>>> too limited to start understanding what they are talking about, so I
>>> post here hoping
>>> I'll get some help to get me started.
>>
>> To sign a jar file:
>>
>> Part I: Create an unsigned applet that just needs to be signed to work:
>>
>> ...
>
> That was quite an interesting article. I have to read again more
> carefully. The impression, however, that I have gotten so far is that
> there have been serious security problems with Java applets,

Yes - there has been found a lot of those the last couple of years.

>                                                            to have
> them sign by an official authority is expensive,

Depends on the definition of expensive.

:-)

>                                           and that instead of
> having the applet embedded in the webpage probably a better idea is to
> have the visitor choose to download the jar file on his desktop, and
> open the applet by clicking on it. Is my impression wrong?

It is a lot simpler.

But note that you are moving from a deployment model where
there may be holes int he sandbox security model to a model
with no sandbox at all, and from a web page model to a
desktop app model.

If you really need a signed applet in the first place, then
switching to a desktop app may not meet requirements.

Arne

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | comp.lang.java.programmer

csiph-web