Re: Distributing java.policy with Applet.jar
Willy Stevens wrote:
"Andrew Thompson" <andrewthommo@gmail.com> wrote in message
(trimmed odd assertion***)
(Security - applet)
This kind of problem really exists.
Of course it does. I am quite familiar with trusted applets,
as well as many of the problems with them. Some of those
problems can be fixed by not using an applet within a
browser, but instead launching it using Java web start*
(JWS) and using services of the JNLP API, which
can operate within a sandbox. Things like..
..Applet is distributed to user's
workstation
and it is connected to serversoftware. Applet must write to directory of the
user's
pc if user wants to store his Applet's/applications settings.
..storing application preferences. The JNLP API
provides the PersistenceService** for that.
Do you think that Installation instructions should contain a own page
"edit java.policy with notepad" or "copy policy file from CD" sections?
No and no. It should be unnecessary for either the
end-user *or* the developer to ever mess with policy
files. I have any number of JWS based apps. that
successfully 'break out' of the tight sandbox which
JWS applies (a very similar sandbox to the
browser/applet sandbox).
I have also dealt with full-trust applets in the past,
and kept up on the later developments in security in
relation to signed applets. The latest problem is with
trusted applets (and JWS apps.) launched on Vista
*using* *IE*.
...
Signed applets and policy files are the only way how applet can write/read
to
disk.
No they aren't. A signed applet, so long as the user
accepts the signed code, can do pretty much whatever
it wants short of calling System.exit(int). That is of
course, short of breaking out of the default directories
that the Vista/IE combo. mentioned above, imposes on
even fully trusted applets.
..You can find hundreds of artcles about signing applet
and using policy files using Google but distributing them is different,
that's why the question.
I agree there is a lot of information using policy
files with applets. It is bad information. Try this
search instead..
<http://www.google.com/search?q=applet+signed>
Distribution is as simple as ..deploying an unsigned,
untrusted applet, because excepting that the unsigned
applet might be not in a jar (one less attribute in the
<APPLET> element), it is identical.
But maybe your are freshman is your local college and you *know everything*
?
I sure don't know everything. But what if I *were* a
freshman in the local college, would you not want
me to answer?
* demo applet/JWS <http://www.physci.org/jws/#jtest>
** demo+e.g. PS <http://www.physci.org/jws/#ps>
*** Oh, but both of those demos are coming from my
own site, so I suppose if you wanted to accuse me
of spamming *now*..
--
Andrew Thompson
http://www.athompson.info/andrew/
Message posted via JavaKB.com
http://www.javakb.com/Uwe/Forums.aspx/java-general/200710/1