Re: Java! hooah! What is is good for...?
"Daz" <cutenfuzzy@gmail.com> wrote in message
b) Unsigned applets cannot make connections with servers outside of
the
applet's home server, although anything goes for signed applets.
Is that actually Java's restrictions, or the browsers restrictions?
Java's restriction. It's part of the design of Java. However, a
particular implementation of Java may be buggy, and not correctly
implement this restriction. It's like how there's a C/C++ standard, but
not all compilers follow the standard correctly.
[...]
d) Java is probably more secure than Flash.
I was hoping so. I think you can decompact Flash, and hack it quite
easily with the right tools. Many people use it to get a good score on
Web sites with Flash Games.
To this form of attack, Java is just as vulnerable as Flash. You can get
decompilers which will produce something roughly ressembling the original
Java source code.
Is there any way to increase security
within Java code, by obfuscating it or something?
There are obfuscators available, some of them open source. I don't have
any experience with them.
Or is it just really
hard to crack? Perhaps that's not an easy question to answer. I will
consult my good friend Google.
The solution is to secure the game protocol between the applet and the
server, rather than securing the applet itself. Don't have the applet
merely report "The user solved the hangman puzzle in 1 move. Give him a
top score". Instead, have the applet report "Is there an A?", and have the
server report "No, no A. Part of the hang man should now be drawn."
I.e. move the rule enforcement and game logic to the server, and away
from the applet.
For a lot of people, this is simply too much trouble, so they tolerate
an insecure protocol, and manually delete "suspicious" scores.
By low level, I mean that it sits on top of God
knows how many layers of software, and it doesn't have any kind of
direct interface with any of the hardware.
Usually, people call that "high-level". Low level, in my mind, means
it has direct access to the hardware, and doesn't sit on top of anything.
What about a standalone Java app? Do they also have to be signed at
all? I would guess not as you ware willingly installing it.
If you download the app and run it locally, it has all the rights of
any other app (what these rights are exactly depend on the OS). If you run
the app via WebStart, there are some special rules, but it's somewhat
similar to the rules of an applet (i.e. anything safe can just run;
anything unsafe needs the user's permission).
- Oliver