Signed Applets and different JVMs
2 Message(s) by 2 Author(s) originally posted in java security
| From: phil |
Date: Monday, October 30, 2006
|
Folks,
Apologies in advance if I'm asking stupid questions here but JAVA is
way outside my area of expertise and I really need some help.
We provide web-based applications that, in a few cases
include a small,
signed JAVA
applet to allow information to be posted across domains.
The applet
code is really quite simple (even for me!) but one of our
clients is asking us to guarantee that the applet will work across The
Mircosoft
JVM and
Sun JVMs 13., 1.4 and 1.5 - I'm really not sure if we
can say this and am trying to avoid having to go through the pain of
testing it on all environments.
We've signed the applet using jarsigner for Sun (a .jar
file ) and
using signcode for
Microsoft (a .cab file) but I'm not sure if this
enough to do the trick.
Spedific questions:
* When did the JAVA Plug-in
switch from the
JDK 1.1 security model to
JDK 2.0 security model?
* Will the signed .jar file work in all of these
version s of the Sun
JVM?
* If not, can we ude JAVAScript to determine which version of the
pulg-in is being used and then include a different applet
tag for each
version?
I'm really a
bit at a
loss here so any information at all on how to do
all this'd be greatly appreciated.
Thanks, in advance for your help,
Phil (JAVA newbie!)
| From: Ben_ |
Date: Monday, October 30, 2006
|
one of our
clients is asking us to guarantee that the applet will work across The
Mircosoft JVM and Sun JVMs 13., 1.4 and 1.5 - I'm really not sure if we
can say this and am trying to avoid having to go through the pain of
testing it on all environments.
How do you intend to assure you customer it works without testing ?
We have signed the applet using jarsigner for Sun (a .jar file) and
using signcode for Microsoft (a .cab file) but I'm not sure if this
enough to do the trick.
Microsoft VM will be out of
support by the end of 2007
(
http://www.microsoft.com/mscorp/JAVA/), so you will probably want to limit
investment on this technology.
For discussion of Authenticode vs. JAVA
signature , see the "Potential
Upgrade Issues" at
http://JAVA.sun.com/j2se/1.5.0/docs/guide/deployment/deployment-guide/upgrade-guide/index.html.
Spedific questions:
* When did the JAVA Plug-in switch from the JDK 1.1 security model to
JDK 2.0 security model?
The
product archive is here:
http://JAVA.sun.com/products/archive/.
The readme of 1.1.1_006 says it's designed for JDK 1.1 and 1.2. So I assume
using one or the other
specification depends on what the
developer
advertises as JVM requirement in its page.
* Will the signed .jar file work in all of these versions of the Sun
JVM?
I assume signature verification'd work. That the applet'd work is
another story: if the developer uses features only present in a certain
release , then it won't. So, ask the developer to assess this.
* If not, can we ude JAVAScript to determine which version of the
pulg-in is being used and then include a different applet tag for each
version?
The developer advertises its
requirements in the
HTML page and the JAVA
Plug-in can
download and install a newer release if necessary.
See object/embed tag usage in
http://JAVA.sun.com/j2se/1.5.0/docs/guide/plugin/developer_guide/using_tags.html.
I'm really a bit at a loss here so any information at all on how to do
all this'd be greatly appreciated.
I think the JAVA Plug-in FAQs answers all questions above and much more:
http://JAVA.sun.com/products/plugin/reference/faqs/index.html.
Microsoft's Transition Guide will also prove helpful
(
http://www.microsoft.com/mscorp/JAVA).
Thanks, in advance for your help,
Phil (JAVA newbie!)
>
Next Message: JCE 1.2.2 - "Cannot set up certs for trusted CAs"
Blogs related to Signed Applets and different JVMs
j2me for beginers
a configuration specifies a
jvm and some set of core apis for a specific family
... several
different profiles are being developed under the
java community
... known for its ability to safely run downloaded code like
applets. this is a
...
1 Frimaire CCXV
Well, I finally got around to doing it -- I
signed up for an i-name on 2idi.
... and
Java applet support in Netscape made the first round of rich client
... It kept the entire thing really fun and refreshing --
different parts of your
...
JNI Interview Questions - Part2
5)What is necessary to have an
applet call a native method?
... using JNI (call C/C++ code from
java, embed
jvm in C/C++ code) and ways to.
... EJBs are supposed to be portable between
different app servers who comply with the Sun's
...
Java/J2ee Interview Companion
In the last 5 years of contracting, I have worked for 5
different organisations
... locally within the same
JVM using
Java’s form of pass-by-reference,
... A
signed applet can become a trusted
applet, which can work outside the sandbox.
...
SCJP Question & Answer
Component; Panel;
java.
applet.
Applet; Dialog; Frame; MenuComponent
... Believe me, certification exam is completely
different from a real project experience.
... The programmer cannot force the
JVM to free the memory used by an object.
...
Java FAQ
Here are a few tips on some of the sticky points of
signing applets.
... I run 2
different Java Programs on one machine at the same time, both of
... Obviously you would need a
different JVM or Hotspot.
Java never lets you discover how
...