Thread: January RIA changes

So I was reading Oracle's blogpost about the RIA changes in January: https://blogs.oracle.com/java-platfo...ments_for_rias

What are everyone's thoughts on this change?

Also, I had a question regarding it. In the developer's section of that blog, it states that all RIAs must contain:

Code signatures from a trusted authority. All code for Applets and Web Start applications must be signed, regardless of its Permissions attributes.

Does this mean no more self-signed jars for webstart? If so how does one go about signing with a "trusted authority" for free? I definitely don't want to shell out money to sign programs I am not making any money on.

This has been discussed here: http://www.javaprogrammingforums.com...e-release.html (wait now I see you replied to that discussion, oh well)

I've also asked this question on JGO: Running Jar with Unknown Publisher Blocked in Future Java Release - Java-Gaming.org

Long story short: yes, this does seem to mean no more self-signed jars for applets and webstarts. I'd love to be wrong about that. But the solution seems to be packaging up your program into a platform-dependent executable. Blah.

Sounds like $$$$ will be needed for most applets.

Well the signing rules only apply to webstart. Apparently desktop jars are unaffected. So, worst case scenario: my web-based program will have to turn into a downloadable desktop application with a required connection to the server (eww). Although, that might not be an option, since I don't think my free host allows me to provide download links or anything.

Still, I'd like to find a way to get a free trusted certificate. I'll have to do some investigation today. I'll mention any solution I come up with.

Originally Posted by Norm

Sounds like $$$$ will be needed for most applets.

I'll be curious to see whether this improves the public opinion of applets, or just makes them more scarce (and therefore even less friendly to end users). Pretty much eliminates applets as an option for newbies and hobbyists though.

Originally Posted by aussiemcgr

Well the signing rules only apply to webstart. Apparently desktop jars are unaffected. So, worst case scenario: my web-based program will have to turn into a downloadable desktop application with a required connection to the server (eww). Although, that might not be an option, since I don't think my free host allows me to provide download links or anything.

Right, executable jars are not affected. The difficulty comes with classpath issues, which were easy to handle using jnlp.

Originally Posted by aussiemcgr

Still, I'd like to find a way to get a free trusted certificate. I'll have to do some investigation today. I'll mention any solution I come up with.

I wish you good luck, although I remain skeptical. I'll be curious to hear about anything you come up with.

Two interesting blog posts regarding this.
Exception List: https://blogs.oracle.com/java-platfo...n_site_list_in
Oracle's "Solution" to Self-Signing: https://blogs.oracle.com/java-platfo...ificates_for_a

Obviously their "solution" for self signing is not ideal, since it requires additional stuff for the user to do on their end, so it is not really practical for a large-scale open-source program distribution or anything. But, it might be able to serve as a temporary workaround until better options are available.

My understanding of the self-signed certificates is that the end-user has to run the keytool on the command line to authorize your application. This is a non-starter for hobbyists and newbies. The typical end user doesn't know anything about Java, let alone how to run command-line programs. They just want something they can double-click and run, or have automatically run in their browsers.

Exactly, which is why I said it is not ideal. In my opinion, if your deployment instructions require the end-user to do anything beyond double-clicking a runnable program (whether it be an installer or the program itself if installation is not required), you have failed at creating ideal deployment instructions.

I'd like to email oracle to get a more exact response to my concerns, but apparently they require you to purchase some BS "Oracle Premium Support" account if you want to ask them anything.

I've tried reaching them (okay I tweeted at them), but I'm afraid we don't appear as a blip on their radar compared to server-side developers, which is where Oracle's focus is.

The game development and JavaFX communities are pretty active, so I'm hoping something reasonable comes from them. But so far the only solution seems to be packaging your program up as an executable. So much for WORA!

I think the vast majority of java developers are in the dark about this. I wasn't aware until earlier today, and I try to stay pretty active when it comes to this stuff. As soon as the January update hits and everyone starts having issues, I'm sure that, at the very least, some sort of open-source or free certificate authority will pop into existence. I mean, who really believes the mainstream $200-$400 (USD) per year CAs will just be accepted by the open-source community? Never going to happen.
Until then, I don't see much of an option other than bracing for impact.

My plan is to investigate the packaged executable option.

I think a lot of serious developers already deploy using packaged executables. This mostly screws over novices who rely on "easy" deployment of applets.

I highly doubt a free CA is going to pop up, as that defeats the whole point. I could be wrong though.

Unfortunately, the packaged executables may not be an option for webstart developers who use free hosts (like myself). In my specific situation, my host allows me to host my applet on the server for free, and to use server resources such as database and file system to store user data related to the applet, but they would not allow me to do the same if the program was in the form of a desktop application. Weird tidbit for sure, but I suppose it is because the program being launched in the browser still allows them to advertise on the sides of the page, whereas a desktop application obviously would not.

Ah, I understand now.

I actually have the inverse problem of yours: I run a free hosting website (it's free for the users, I'm paying for it) that supports applets and webstarts. When this update rolls around, every game uploaded to the site will be broken. I'm hoping to either figure out an easy way for novices to export executables and allow those to be uploaded directly, or to roll my own exporter that takes class files and exports the executables as a part of the upload process.

For your purposes, it might be time to take the plunge into paid hosting. HostGator hosting is pretty cheap (I think I pay 5 dollars a month for my old sites) and comes with database access. Amazon Web Services (what I use for Static Void Games) is also worth checking out.

Well I am hoping to not spend any money for something which is essentially a personal project where I am seeing absolutely no profit. In 6 months or so, I hope to have a companion Android app. The Android app will absolutely have advertising on it so I can get some revenue (even if it is just pennies). My current host allows me to upgrade to a $1/month paid hosting, which will remove their advertisements (among other things) and allow me to put my own ads on my website. If I can cover the $1/month from the Android app, I will probably purchase the host and add google banner ads to the website or something to make me a few more pennies per month.
My hope in all this is to get enough revenue from advertisements on the app and website to break even after all my expenses in maintaining the program and website without having some stupid "paid service" for members. Obviously, that plan is all out the window if I have to purchase a fricken CA for a couple hundred dollars a year, since I don't expect to earn nearly that much from advertisements on a low-traffic website. We will see what happens...

Just an update for those interested, I received a response from Oracle when I asked about nonprofit/open-source, ect:

Non-profit individuals are fine. When writing examples in other posts, I've intentionally used university-like examples to avoid just talking about for-profit companies. A number of CAs have programs for people and IIRC some give free signing certs to valid open-source projects.
If you really don't want to sign code, there's the Exception Site List coming in 7u51 or I've been seeing other posts of people distributing Java programs through app stores (even iOS).

It's cool that you got a response, although those aren't really new solutions.

The first solution is to have your end-user whitelist your site. You could also tell your end-user to change their security settings to accept self-signed code. Both would work, but requiring your end-user to futz around in their control panel is already a game over.

The second solution is to package your program up as an executable.

I intend to tell my users to whitelist.
I'm also asking around the different CAs for their input on free signing certs. To be honest, I have no idea what even qualifies as an "open-source project", as far as end-result goes.

It all depends on your end-user. I'm aiming towards absolute novices, so forcing them to screw around with their settings isn't a great option. We'll see.

I'm aiming at people who have no idea what programming is in the first place, lol. I'll just have to write up a detailed explanation of how to do it on my website for my users to follow and point them to it. Not much else I can do.