Re: Problem with Java Applets in Firefox
John Ersatznom wrote:
Andrew Thompson wrote:
There are some (few) applets that simply *cannot*
be (usefully or effectively) launched using web-start.
Most other applets, are better suited to web-start
launch.
Isn't there a huge difference between embedding an applet normally and
using an application-deployment networked installer?
Are you talking about web-start, specifically? (I am)
...Namely, the latter
is actually installing an *app*, rather than an *applet*, and as such it
has all kinds of unsandboxed access to your stuff that an applet would
lack?
No, it does not. Unlike any old jar file with a main() run
in a standard environment, which can do anything the
OS allows, or an applet which is either sandboxed or has
full permissions, a JWS application (or applet) can have
three levels of privileges.
- none - sandoxed (though it is still possible to use the JNLP
API to provide supervised* access to the file system, and
other resources)
- j2ee-application-client(?) a poorly named security level
that allows some things, but restricts others.
- all-permissions - full access.
The two latter privilege levels are only obtained by
signing the jars, and *requesting* extended permissions
from the end user - note that if the PC/Plug-In set-up
they are using is not configured to allow extended
permissions web-start apps., any permissions the user
attempts to grant, will be ignored.
* When using the web-start API to access system
resources, everything that might compromise security
comes complete with many warnings from the plug-in.
..I wouldn't like to see the currently fairly clean separation
between "Java that might trash my stuff like any other untrusted
executable" and "Java that's safe" on the Web get blurred or confused
any further than it already is...
I could link to examples that demonstrate a number
of features of web-start, but in the meantime..
Please read the web-start docs.
Now.. why did you trim the part where I
commented that the greatest barrier to more
web-start launched projects was ignorance on
the part of developers?
Andrew T.