feedback requested: security warning text

[trembovetski]

@Riven

Do not allow such behaviour on untrusted applications. Don’t throw exception, just make is a no-op when the attempt is made.

What’s so bad about this solution? It seems so obvious.

Well, for one, what do you do about Window? Disallow showing them? That’d break backward compatibility.

FYI, popup menus are undecorated windows (when they extend beyond toplevel bounds). And because of the wonderful swing architecture you can put whatever you want into a menu.

Another thing with placing warning into the title bar that I can see is that on Windows it may not be visible in some themes.
Also, what do you do about non-resizeable windows? If the title which includes the warning doesn’t fit into the title bar, then what? Make window resizeable? But it’ll break all kinds of applications which don’t expect to be resized.

So, it ain’t that easy.

Dmitri

[trembovetski]

@CommanderKeith

Yeah, now I agree that this would be better than the current warning sign. Like OrangyTang said, users are familiar with it.

Also, like was said before, applets shouldn’t really need to pop up windows except for functional things like popping a file-open dialog which will always have a title bar (and won’t be undecorated or translucent).

If your applet doesn’t show a window, there won’t be an icon, so that’s not a problem, right?

The issue is that if your applet does need a toplevel window, it will have to have a warning. And, same goes for webstart apps, since they definitely will have at least one toplevel window.

[trembovetski]

@zammbi

Some apps are not signed. I’m not sure what limitations they have… But couldn’t find any on my basic test.

Reeeally? According to the docs every Adobe air app must be signed before it can be deployed.
http://www.adobe.com/devnet/air/articles/signing_air_applications.html

So what are we talking about here? Sign your java app/applet, and you’re done, you’ll be just like Air if that’s what you like.

[Riven]

@trembovetski

Well, for one, what do you do about Window? Disallow showing them? That’d break backward compatibility.

FYI, popup menus are undecorated windows (when they extend beyond toplevel bounds). And because of the wonderful swing architecture you can put whatever you want into a menu.

Fair point.

But I’m fairly sure there is a way to determine whether Swing created a Window or whether the user did. (even if it means to analyze the stacktrace)

Isn’t it all about raising the bar? I mean, currently, a context menu ALSO does NOT have a warning, even if you made it fullscreen.

@trembovetski

Another thing with placing warning into the title bar that I can see is that on Windows it may not be visible in some themes.
Also, what do you do about non-resizeable windows? If the title which includes the warning doesn’t fit into the title bar, then what? Make window resizeable? But it’ll break all kinds of applications which don’t expect to be resized.

• suppress the length of the Frame title visually, frame.getTitle() must return the full title
• append " - Java Applet Window" in the frame title.

That.

[Riven]

Maybe keep the ‘warning icon’ for the 0.1% of applets that use java.awt.Windows?

[zammbi]

@trembovetski

Reeeally? According to the docs every Adobe air app must be signed before it can be deployed.
http://www.adobe.com/devnet/air/articles/signing_air_applications.html

So what are we talking about here? Sign your java app/applet, and you’re done, you’ll be just like Air if that’s what you like.

Sorry I was mistaken. I thought they had sorted some of this problem in another way. But yeah it doesn’t help in that case.

A random thought, would be nice if we could choose a theme of the security window/WS downloader.

[Matzon]

@CommanderKeith

Also, like was said before, applets shouldn’t really need to pop up windows except for functional things like popping a file-open dialog which will always have a title bar (and won’t be undecorated or translucent).

and html doesn’t ned popups either???

we require popups to launch our games! - if we dont have this feature we will have to migrate. Signing is not an option.

[trembovetski]

@Riven

But I’m fairly sure there is a way to determine whether Swing created a Window or whether the user did. (even if it means to analyze the stacktrace)

It’s more complicated that that, again. What if the attacker replaces the contents of that menu? It may have been created by swing, but the application is allowed to customize the contents. They don’t have to play by the rules either, they can run stuff off edt. So it gets very complicated after a while.

Isn’t it all about raising the bar? I mean, currently, a context menu ALSO does NOT have a warning, even if you made it fullscreen.

I am not actually sure, may be they have a size trigger or something - if it gets bigger than certain size, they have a warning window. I have vague recollections about wanting to investigate that at some point.

But the point is moot, I think - we have to support Window, and on Windows OS it won’t have a border.

That.

I’m not sure what this is supposed to mean, sorry. Meaning, I thought I have pointed out specifically the issues with what you proposed.

[trembovetski]

@zammbi

A random thought, would be nice if we could choose a theme of the security window/WS downloader.

To what degree? Just select from one of pre-defined themes? We can’t allow customizing too much, or the attacker will put a picture of a cute puppy, and the user will not read anything but stare at the picture and click yes…

I think it’s actually important that they all look the same. The overall appearance and wording of the current dialog may need to be improved though. I think this is being worked on - have you tried 6u14?

[trembovetski]

@Riven

Maybe keep the ‘warning icon’ for the 0.1% of applets that use java.awt.Windows?

So, leave the icon for Window and undecorated Frames, but take it out (with may be some title warning) for decorated Frames?
Potentially could be done. But as I mentioned before, we can’t guarantee that the warning put into the title will be seen by the user because of Theming support on Windows.

Also, you will have to put restrictions on where the frame is placed so that it doesn’t get placed such that the title is not visible - we already do something like that for the icon anyway (and used to do for the whole window when we had a warning banner).

[CommanderKeith]

@Matzon

I signed up to your site (certusgames) and had a look - I see that you use a pop-up to join a table.

Pretty nifty setup - you don’t require any permission dailogs even though you’re communicating with a server because i guess it’s the same server that serves up the web page.

I never guessed that an applet would be as complex as yours, I always thought that such a thing would be a webstart app. I guess that the current triangle situation is the best for you. Out of interest, why don’t you use webstart?

PS: Could you use JInternalFrames instead of JDialogs? JInternalFrames wouldn’t have the triangle, but obviously could only be displayed inside the Applet window…

[zammbi]

[quote]To what degree? Just select from one of pre-defined themes? We can’t allow customizing too much, or the attacker will put a picture of a cute puppy, and the user will not read anything but stare at the picture and click yes…
[/quote]
I was meaning pre-defined themes. I know that customizing is a no no and would be hard via parameters…

[quote]I think it’s actually important that they all look the same. The overall appearance and wording of the current dialog may need to be improved though. I think this is being worked on - have you tried 6u14?
[/quote]
No I haven’t. I’m currently on dial up speeds, so ill wait for the update. Any sshots around?

[Markus_Persson]

Why does backwards compatibility matter more than security?
If old applets were allowed full file system support, surely you’d break backwards compatibility over that?

@Matzon

and html doesn’t ned popups either???

we require popups to launch our games! - if we dont have this feature we will have to migrate. Signing is not an option.

html doesn’t need popups, no. Many (most?) modern browsers block popups by default because it’s annoying and evil.
Flash can’t do popups at all, and it seems to work just fine.

[edit:]
No, wait, that’s a lie… It can pop up new browser windows. But not any window decorated in any which way.

[Riven]

@trembovetski

I’m not sure what this is supposed to mean, sorry. Meaning, I thought I have pointed out specifically the issues with what you proposed.

Another thing with placing warning into the title bar that I can see is that on Windows it may not be visible in some themes.
Also, what do you do about non-resizeable windows? If the title which includes the warning doesn’t fit into the title bar, then what? Make window resizeable? But it’ll break all kinds of applications which don’t expect to be resized.

Lets say you have a frame with he title: “Very long title, just to be as descriptive as possible for people with a widescreen”

It would become: “Very long title, just to be as descriptive as possible f… - Java Applet Window”
If the frame would become very narrow: “Very lon… - Java Applet Window”
The frame has to become extremely narrow for the ‘warning’ to become stripped: “…va Applet Window” (which might still be enough)
If the frame becomes really really really tiny, just use the ‘warning icon’, just like on java.awt.Window

In all circomstances, frame.getTitle() should return “Very long title, just to be as descriptive as possible for people with a widescreen”

And maybe you can determine whether some WindowsTheme doesn’t show the titlebar, and in that case… use the ‘warning icon’ ?

Maybe just use the warning icon as a fallback wherever possible, for that 0.1% of usecases.

[Matzon]

@CommanderKeith

I never guessed that an applet would be as complex as yours, I always thought that such a thing would be a webstart app. I guess that the current triangle situation is the best for you. Out of interest, why don’t you use webstart?

PS: Could you use JInternalFrames instead of JDialogs? JInternalFrames wouldn’t have the triangle, but obviously could only be displayed inside the Applet window…

We dont use webstart because we can’t show ads that way (especially flash banners).
Also, as one of the few places out there we still support java 1.1 (!!). - so a great deal of features are cut off from us (unless we’re doing a java2+ build).

[Matzon]

@Markus_Persson

html doesn’t need popups, no. Many (most?) modern browsers block popups by default because it’s annoying and evil.
Flash can’t do popups at all, and it seems to work just fine.

actually, you ARE using popups all the time - just inside the flash app (which requires a window mechanism of some sort). Same with html, it also uses css popups. They serve the same purpose. But when you are confined to limited area and have to use floating windows - you have a serious issue without using popups.

As much as I hate pop ups, I still use them a lot for showing multiple things.

We are able to use a tabbed interface and no popups version of a client, but its much more intuitive that you go from a room to a table, and can keep both windows open - and even beside each other (mostly for the chatting in both locations at the same time).

Anyhow - I do not view popups as a security issue and as such it is not something that should be disabled?

[Orangy_Tang]

@trembovetski

Because of our evilness, of course, we’re out to harm the developers.

I don’t think it was thought of “alien or unfamiliar”. All we were trying to do is to get rid of the ugly java applet warning window (requested MANY times by the developers).

You say that tounge-in-cheek, but that’s certainly how it feels a lot of the time. Time after time the UI decisions made in the name of “security” have been questionable or flat out wrong. If you don’t think the utterly unheard of floating icon was alien or unfamiliar then frankly your UI design team is completely isolated from reality. The webstart security warning dialog was hideous in both appearance and wording and it’s taken ages for it to be improved. Similarly the broken pop-unders that webstart would spawn and block an app from starting. I’m sure there’s many other examples that other people have had issues with.

None of the the problems you’ve listed against putting the warning in the title bar are insurmountable, nor are the workarounds unreasonable. But it reads like Sun has put so much effort and time into the crazy floating icon implementation than no-one wants to actually admit that it’s a terrible idea and scrap it.

[Mr_Light]

• I’d opt for fade out centred thing when going full screen (ala flash)
• For undecorated + untrusted stuff I’d opt for a java cup. (with a relative size, not the fixed size the warning thing seems to be.)

If there’s a warning message it should be something along the lines of (this applet is started/loaded from <server name/adress> make sure that information you enter in this window is meant for the company/organistation that belongs to <server name/adress>.

[quote]This applet is loaded from ibm.com make sure that information you enter in this window is meant for the company/organistation that belongs to ibm.com.
[/quote]
But I agree with the sentiment that this is kinda time bound - what ppl are used to now is probably the way to go for now.

You can also add more smartness into the mix, only do stuff for undecorated + key-capturing + untrusted applets. (this would solve akwardness with menu popups.) I can’t oversee all usecases but given you can do that right you might, and perhaps should be, more intrusive and go for the bar thing. and have it remember you clicking it away.

[kappa]

Agreed a small cute java cup would be much nicer than the warning sign, it could even have a small animation of steam coming out of it (provided its not too cpu intense and only plays occasionally and not constantly, or even only play when the java frame gets focus so as to be a subconscious reminder that you are now focused on a java window and not a normal window so don’t enter personal data and passwords).

Another thing is that you could hide the system tray icon when the cup is displaying, as the cup could double as a warning and perform the functionality of the system tray icon so as to stays friendly and let the user know that its a java application.