Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.java.programmer > #26871 > unrolled thread

Signing an applet

Back to article view | Back to comp.lang.java.programmer

Contents

  Signing an applet emf <emfril@gmail.com> - 2013-12-13 08:40 -0500
    Re: Signing an applet Jeff Higgins <jeff@invalid.invalid> - 2013-12-13 09:52 -0500
      Re: Signing an applet emf <emfril@gmail.com> - 2013-12-13 10:12 -0500
        Re: Signing an applet Jeff Higgins <jeff@invalid.invalid> - 2013-12-13 10:30 -0500
        Re: Signing an applet Arne Vajhøj <arne@vajhoej.dk> - 2013-12-14 16:22 -0500
          Re: Signing an applet lipska the kat <"lipskathekat at yahoo dot co dot uk"> - 2013-12-14 21:24 +0000
    Re: Signing an applet lipska the kat <"lipskathekat at yahoo dot co dot uk"> - 2013-12-13 15:08 +0000
    Re: Signing an applet emf <emfril@gmail.com> - 2013-12-13 10:11 -0500
      Re: Signing an applet Jeff Higgins <jeff@invalid.invalid> - 2013-12-13 10:19 -0500
      Re: Signing an applet lipska the kat <"lipskathekat at yahoo dot co dot uk"> - 2013-12-13 15:27 +0000
        Re: Signing an applet emf <emfril@gmail.com> - 2013-12-13 11:08 -0500
      Re: Signing an applet Arne Vajhøj <arne@vajhoej.dk> - 2013-12-14 16:27 -0500
    Re: Signing an applet Wayne <nospam@all.invalid> - 2013-12-14 00:11 -0500
      Re: Signing an applet lipska the kat <"lipskathekat at yahoo dot co dot uk"> - 2013-12-14 11:41 +0000
        Re: Signing an applet Wayne <nospam@all.invalid> - 2013-12-15 22:22 -0500
      Re: Signing an applet Hiram Hunt <hiramhunt@verizon.net> - 2013-12-14 09:32 -0500
        Re: Signing an applet Hiram Hunt <hiramhunt@verizon.net> - 2013-12-14 09:39 -0500
          Re: Signing an applet Joerg Meier <joergmmeier@arcor.de> - 2013-12-14 15:48 +0100
      Re: Signing an applet emf <emfril@gmail.com> - 2013-12-15 00:04 -0500
        Re: Signing an applet Arne Vajhøj <arne@vajhoej.dk> - 2013-12-15 09:53 -0500
          Re: Signing an applet emf <emfril@gmail.com> - 2013-12-17 17:40 -0500
            Re: Signing an applet Arne Vajhøj <arne@vajhoej.dk> - 2013-12-17 18:08 -0500
              Re: Signing an applet Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2013-12-21 08:35 +0800
                Re: Signing an applet emf <emfril@gmail.com> - 2013-12-31 11:44 -0500
                  Re: Signing an applet Arne Vajhøj <arne@vajhoej.dk> - 2014-01-04 20:14 -0500
                Re: Signing an applet Arne Vajhøj <arne@vajhoej.dk> - 2014-01-04 20:11 -0500
                  Re: Signing an applet Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2014-01-06 08:04 +0800

Page 2 of 2 — ← Prev page 1 [2]

#26982

On 2013-12-15 09:53 Arne Vajhøj wrote:
> On 12/15/2013 12:04 AM, emf wrote:
>> On 2013-12-14 00:11 Wayne wrote:
>>> On 12/13/2013 8:40 AM, emf wrote:
>>>> I am trying to understand how to self-sign an applet. I've already
>>>> checked websites
>>>> that provide directions, but unfortunately I realized that my
>>>> relevant knowledge is
>>>> too limited to start understanding what they are talking about, so I
>>>> post here hoping
>>>> I'll get some help to get me started.
>>>
>>> To sign a jar file:
>>>
>>> Part I: Create an unsigned applet that just needs to be signed to work:
>>>
>>> ...
>>
>> That was quite an interesting article. I have to read again more
>> carefully. The impression, however, that I have gotten so far is that
>> there have been serious security problems with Java applets,
>
> Yes - there has been found a lot of those the last couple of years.
>
>> them sign by an official authority is expensive,
>
> Depends on the definition of expensive.
>
> :-)
>
>>                                           and that instead of
>> having the applet embedded in the webpage probably a better idea is to
>> have the visitor choose to download the jar file on his desktop, and
>> open the applet by clicking on it. Is my impression wrong?
>
> It is a lot simpler.
>
> But note that you are moving from a deployment model where
> there may be holes int he sandbox security model to a model
> with no sandbox at all, and from a web page model to a
> desktop app model.
>
> If you really need a signed applet in the first place, then
> switching to a desktop app may not meet requirements.
>
> Arne

When I first tried to deploy the applet on a webpage, I was surprised 
that there was a security risk, and so I had to use a different method 
from the one in the textbook to read the data file to fill in the array.

However, there is a better solution: JavaScript. The reason I had chosen 
Java for this program was because I wanted it to read a long text (csv) 
file. But then I thought why not make the csv a js file, containing an 
long array[54786][3]. I'll restrict the JavaScript program to the 2 
significant planets, so the js file starts with

var ephem = [["19000101","27i43","10i08"], ["19000102",...

instead of

19000101,01i08,27i43,10i08,25c13,15c15
19990102,...

No security problem whatsoever. The 2 planets js file is smaller then 
the 5 planets csv, but the jar file is even smaller, so I'll be looking 
to see if it is already possible to use a zipped js file, otherwise the 
js will have to do as is. And I will have a link to the jar file with 
the 5 planets transits for those who are interested and trust me.

They have been extending JavaScript a lot. If Oracle is phasing out 
applets as I've heard, JavaScript will be even more important for the 
web that it is right now.

emf

-- 
Google's top Spherical Triangle Calculator search result!
https://files.nyu.edu/emf202/public/js/spherical.html

[toc] | [prev] | [next] | [standalone]

#26985

On 12/17/2013 5:40 PM, emf wrote:
> On 2013-12-15 09:53 Arne Vajhøj wrote:
>> On 12/15/2013 12:04 AM, emf wrote:
>>> On 2013-12-14 00:11 Wayne wrote:
>>>> On 12/13/2013 8:40 AM, emf wrote:
>>>>> I am trying to understand how to self-sign an applet. I've already
>>>>> checked websites
>>>>> that provide directions, but unfortunately I realized that my
>>>>> relevant knowledge is
>>>>> too limited to start understanding what they are talking about, so I
>>>>> post here hoping
>>>>> I'll get some help to get me started.
>>>>
>>>> To sign a jar file:
>>>>
>>>> Part I: Create an unsigned applet that just needs to be signed to work:
>>>>
>>>> ...
>>>
>>> That was quite an interesting article. I have to read again more
>>> carefully. The impression, however, that I have gotten so far is that
>>> there have been serious security problems with Java applets,
>>
>> Yes - there has been found a lot of those the last couple of years.
>>
>>> them sign by an official authority is expensive,
>>
>> Depends on the definition of expensive.
>>
>> :-)
>>
>>>                                           and that instead of
>>> having the applet embedded in the webpage probably a better idea is to
>>> have the visitor choose to download the jar file on his desktop, and
>>> open the applet by clicking on it. Is my impression wrong?
>>
>> It is a lot simpler.
>>
>> But note that you are moving from a deployment model where
>> there may be holes int he sandbox security model to a model
>> with no sandbox at all, and from a web page model to a
>> desktop app model.
>>
>> If you really need a signed applet in the first place, then
>> switching to a desktop app may not meet requirements.
>
> When I first tried to deploy the applet on a webpage, I was surprised
> that there was a security risk, and so I had to use a different method
> from the one in the textbook to read the data file to fill in the array.
>
> However, there is a better solution: JavaScript. The reason I had chosen
> Java for this program was because I wanted it to read a long text (csv)
> file. But then I thought why not make the csv a js file, containing an
> long array[54786][3]. I'll restrict the JavaScript program to the 2
> significant planets, so the js file starts with
>
> var ephem = [["19000101","27i43","10i08"], ["19000102",...
>
> instead of
>
> 19000101,01i08,27i43,10i08,25c13,15c15
> 19990102,...
>
> No security problem whatsoever. The 2 planets js file is smaller then
> the 5 planets csv, but the jar file is even smaller, so I'll be looking
> to see if it is already possible to use a zipped js file, otherwise the
> js will have to do as is. And I will have a link to the jar file with
> the 5 planets transits for those who are interested and trust me.

As long as the CSV files are served from the same server as the JS, then
the JS should be able to retrieve and parse the CSV using
XmlHttpRequest.

> They have been extending JavaScript a lot. If Oracle is phasing out
> applets as I've heard, JavaScript will be even more important for the
> web that it is right now.

I don't think Oracle is really changing anything regarding applets.
Applets has not been mainstream for more than a decade.

And JavaScript does not care. It is already 10000 more widely used
than Java applets.

Arne

[toc] | [prev] | [next] | [standalone]

#27004

On 12/18/2013 7:08 AM, Arne Vajhøj wrote:
8<

>
> I don't think Oracle is really changing anything regarding applets.

In order to cater for the inadequacies and introduced vulnerabilities of 
WebStart and JNLP Oracle have knee-jerked their way into destroying the 
sandboxed paradigm and made Applets almost impossible to activate 
without reciting some incantation while waving a dead chicken over your 
head :-(

For example: -
https://blogs.oracle.com/java-platform-group/entry/liveconnect_changes_in_7u45


> Applets has not been mainstream for more than a decade.

Unless your eyes are open and can see websockets and worker-threads are 
a joke and you have an appreciation of the power of Java on the client.

>
> And JavaScript does not care. It is already 10000 more widely used
> than Java applets.

Cheese definitely is used a lot more than chalk. Or "Why use a 
screw-driver when you have a perfectly good hammer?"

>
> Arne

Cheers Richard Maher.

BTW. I think the interesting one to watch will be Chrome's threatened 
removal of the NPAPI in 2014.

http://blog.chromium.org/2013/09/saying-goodbye-to-our-old-friend-npapi.html

Google, Apple, and Microsoft know how powerful the Java plugin is. Just 
a shame Oracle doesn't.
>
>

[toc] | [prev] | [next] | [standalone]

#27153

On 2013-12-20 19:35 Richard Maher wrote:
> On 12/18/2013 7:08 AM, Arne Vajhøj wrote:
> 8<
>
>>
>> I don't think Oracle is really changing anything regarding applets.
>
> In order to cater for the inadequacies and introduced vulnerabilities of
> WebStart and JNLP Oracle have knee-jerked their way into destroying the
> sandboxed paradigm and made Applets almost impossible to activate
> without reciting some incantation while waving a dead chicken over your
> head :-(
>
> For example: -
> https://blogs.oracle.com/java-platform-group/entry/liveconnect_changes_in_7u45
>
>
>
>> Applets has not been mainstream for more than a decade.
>
> Unless your eyes are open and can see websockets and worker-threads are
> a joke and you have an appreciation of the power of Java on the client.
>
>>
>> And JavaScript does not care. It is already 10000 more widely used
>> than Java applets.
>
> Cheese definitely is used a lot more than chalk. Or "Why use a
> screw-driver when you have a perfectly good hammer?"
>
>>
>> Arne
>
> Cheers Richard Maher.
>
> BTW. I think the interesting one to watch will be Chrome's threatened
> removal of the NPAPI in 2014.
>
> http://blog.chromium.org/2013/09/saying-goodbye-to-our-old-friend-npapi.html
>
>
> Google, Apple, and Microsoft know how powerful the Java plugin is. Just
> a shame Oracle doesn't.

I rewrote the program in JavaScript and now it runs perfectly without 
any warnings. And it looks even better, since with Unicode I am able to 
use symbols, while with Java that was problematic:

https://files.nyu.edu/emf202/public/nt/nataltransits.html

emf

-- 
Google's top Spherical Triangle Calculator search result!
https://files.nyu.edu/emf202/public/js/spherical.html

[toc] | [prev] | [next] | [standalone]

#27240

On 12/31/2013 11:44 AM, emf wrote:
> I rewrote the program in JavaScript and now it runs perfectly without
> any warnings. And it looks even better, since with Unicode I am able to
> use symbols, while with Java that was problematic:
>
> https://files.nyu.edu/emf202/public/nt/nataltransits.html

????

Java has always used Unicode.

Arne

[toc] | [prev] | [next] | [standalone]

#27239

On 12/20/2013 7:35 PM, Richard Maher wrote:
> On 12/18/2013 7:08 AM, Arne Vajhøj wrote:
>> I don't think Oracle is really changing anything regarding applets.
>
> In order to cater for the inadequacies and introduced vulnerabilities of
> WebStart and JNLP

I was not aware that the vulnerabilities were not in traditional
applet tags.

Are you sure about this?


>                   Oracle have knee-jerked their way into destroying the
> sandboxed paradigm and made Applets almost impossible to activate
> without reciting some incantation while waving a dead chicken over your
> head :-(
>
> For example: -
> https://blogs.oracle.com/java-platform-group/entry/liveconnect_changes_in_7u45

They tightened security. I think that is fine. I think it is very bad that
they change the rules for every other release - they should define the
rules they want and stick to them, so people have a chance of complying.

Arne

[toc] | [prev] | [next] | [standalone]

#27244

On 1/5/2014 9:11 AM, Arne Vajhøj wrote:
> On 12/20/2013 7:35 PM, Richard Maher wrote:
>> On 12/18/2013 7:08 AM, Arne Vajhøj wrote:
>>> I don't think Oracle is really changing anything regarding applets.
>>
>> In order to cater for the inadequacies and introduced vulnerabilities of
>> WebStart and JNLP
>
> I was not aware that the vulnerabilities were not in traditional
> applet tags.
>
> Are you sure about this?
>
Just one recent example: -
https://addons.mozilla.org/en-US/firefox/blocked/p428

But the underlying architectural problem with WebStart and JNLP is that 
the elevated privileges needed to work their bastardry means all THEIR 
applets need to be signed. So why not just make everyone do it? hese 
people refuse to believe that anyone would not want to use their 
WebStart crap :-(

>
>>                   Oracle have knee-jerked their way into destroying the
>> sandboxed paradigm and made Applets almost impossible to activate
>> without reciting some incantation while waving a dead chicken over your
>> head :-(
>>
>> For example: -
>> https://blogs.oracle.com/java-platform-group/entry/liveconnect_changes_in_7u45
>>
>
> They tightened security. I think that is fine. I think it is very bad that
> they change the rules for every other release - they should define the
> rules they want and stick to them, so people have a chance of complying.

As I questioned in the referenced blog, I am not sure this change is 
about tightening security: -

Deanna: It's not a matter of [Allowing the caller to say "yes, I really 
am allowed to call this, honest guv'"] it's allowing the authour of the 
document base to say "Hey, I'm including a whole lot of script files 
from other domains and I don't want them to be able to script this 
Applet". [would defeat the point of it] I'm not sure Oracle have 
articulated what "the point of it" is. Is it CopyRight Protection or 
marketing mechanism or is it a security mechanism? [It's an option for 
the publisher of the applet to specify who can call it.] You mean like 
they've always been able to do by interogating the results of 
Applet.getDocumentBase()?

The whole idea of having to ship/package/manufacture a separate Applet 
for each customer is ludicrous!

costlow: [because it guards against repurposing] Fine. *IF* the check 
scrutinized the domain of individual.JS files then I could see the sense 
in it, but my quick testing says it ONLY checks the Document Base. 
Please communicate exactly what you were trying to accomplish.

On the subject of communication please feel free to assume a fair 
portion of responsibility for user-base feelings like this: -
https://bugzilla.mozilla.org/show_bug.cgi?id=914690

Cheers Richard Maher

PS. Why don't I get any pop-up when I dynamically include an unsigned 
Applet at run-time with innerHTML="<OBJECT. . .".

>
> Arne
>

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | comp.lang.java.programmer

csiph-web