JOGL Applet Security

That’s working !

Now, there is no more freezing, as everything is preloaded, with a nice progress bar from the plug-in, and a nicer one when the native is installed :wink:

So I’ll stop the development here, unless some of you think about other nice features that could be included.

by the way, the “jogl_cg” native isn’t installed by the applet launcher, I don’t know if it’s critical or not. We could at least start without cg and add it later ?

Lilian

It sounds like a good solution,

But on my system I can’t see any progress bar while downloading the jar’s (on 1.5.0_03-b07)
It seems like the progressbar feature is dropped from 1.5 on ???
(it doesn’t appear in the special tags list for 1.5: http://java.sun.com/j2se/1.5.0/docs/guide/plugin/developer_guide/special_attributes.html)

Seems we’re back where we started, unless its still possible to enable the progress bar on 1.5 somehow different.

This is what happens when I play with 5 different plug-ins… thanks for reporting it.

In that case, removing the image tag should be enough (it shows the default java animation with a progress bar).

That what I’ve just done for the demo.

however, leaving the progressbar tag ensures there is still a loading feedback for mac os.

Lilian

This is great work. Thanks very much for pushing it through. I’ve filed Issue 182 to track this and will incorporate it as soon as possible, hopefully next Monday.

:wink: :slight_smile: :smiley: ;D

hey lilian
nice work, i get an errormessage thought

Error: The native libraries arent't properly signed

my system setup is:
Mac OS X 10.4.3
Safari Browser
Java Version 1.4.2_09

and i do have the jogl version 1.1 installed in my ~/User/Library/Extensions/Java folder.

It 's related to having the jogl in the extension directory : as the certificates of the native libs are validated against the ones the jogl.jar, your
jogl.jar has got differents certificates than mine (which is normal : I’ve self signed mine for the demo).

Once the applet is integrated in JOGL, with proper certificates, this issue should be resolved as the natives will also have the certs from sun.

Lilian

Thanks you very much, I deleted the jogl.jar extension and it worked! Your Java applet is much better! In my opinion, Java is much better to make games than in Shockwave 3D.

FYI, thanks again to Lilian the JOGLAppletInstaller has been checked in to the JOGL source tree after some security testing. The forthcoming JSR-231 beta 2 will contain a live example of an unsigned applet using JOGL through this installer.

Great !

After so many years asleep, the applets are waking up and getting ready for prime time gaming !

Lilian

All this is great… but a user who wants to use an applet made like this still needs to accept the signature… Do you guys think there could be any way to keep the binaries on the server and load them remotely from there after detecting on which platform the applet is running? Would this be enough to be able to avoid the signature?

Regards

The signature dialog is a “good thing”. User education is needed here, not a hack to bypass security.

swpalmer is right. There is no way to bypass the security dialog and still have the signed applet work. This would be a violation of the Java security model. The applet installer does detect which platform it’s running on and downloads the appropriate native code from the server, but the applet installer needs all permissions in order to be able to save the native libraries to the local disk and load them. I believe once you’ve accepted the certificate the first time you don’t get repeated security dialogs.

I totally agree with you, users need to be “educated” on this, but I m sure you know how many scams and stuff you can find on the internet which pop up “will you accept to be f**ed?”. Let’s say I make a java game and I deploy it in a signed applet. An average user who doesn’t know it (I will not make any big advertising campaign etc… I m just a poor student ^^ ) finds it with google or something. He gets curious and wants to try it. Then this window pops up. “Will you allow blah blah?”. I think a good 50% of these users would click “nowayinhell” and just close my website never to come back because of past experiences with scams etc.
You can obviously see how this would have a very bad impact on the success of my application.
What I would like to do is to load the binaries directly from my server, without having to write anything to the user’s machine (so I can avoid signatures, and I can run it on machines without any writing permissions, like for example school machines or whatever).
Is that at all possible?

  1. unsigned applet loads.
  2. detects os type
  3. asks the server for the correct dll, and the server sends it for the client to load (not to copy to the target machine, only to load it).

In my newbieness I kinda think this would be the best solution for this scenery, if technically possible.
What are your opinions about this idea?

Regards.

It is not possible. If it was all applets would be a security risk and java would be removed by the anti virus software :wink: