AniDB Java Applet?

Post by **PetriW** » Tue Nov 16, 2004 12:49 am

Furcube wrote:maybe rewriting AOM to Java would be better?

I assume you have no idea how much time this would take.

kidan · Post by **kidan** » Tue Nov 16, 2004 3:59 am

nich wrote:
Rar wrote:Can't the small(?) proportion of non-windows users just use a windows emulator?[...]
I wouldn't mind if I could. But wine doesn't run aom (yet! PetriW said 0.6 should be much more wine friendly ). And I'm not willing to use WMware.

I just wanted to point out qemu. It's a decent free alternative to vmware, which runs without a kernelpatch in userspace: http://fabrice.bellard.free.fr/qemu/

Elberet · Post by **Elberet** » Tue Nov 16, 2004 7:33 am

DonGato wrote:We're talking about a small app here. Not AoM replacement.
exp, the problem is that it has to be signed

Applet != Application !
An Applet runs enclosed in a Java VM in a browser and is heavily restricted by that sandbox. An Application runs in a Java VM outside of a browser but is not enclosed in a sandbox - it runs with the full privileges of the user account it's been started in.

The reason for this difference is simple: An applet can be forced on a user without the user being able to decide whether he wants to have it or not (as long as Java-Support in the browser is active) - visiting a website with an embedded applet suffices. An application, however, needs to be downloaded, stored in some folder and run manually or through an installer. In either way, it requires the user's attention and explicit command before it runs.

In that regard, a Java application is no different from any other binary program...

DonGato · Post by **DonGato** » Tue Nov 16, 2004 8:19 am

My first line was related to the comment about doing AoM in Java and my comment about doing a small application (C++) with the requested capabilities. Not with the applet thing.

The second line was directed to exp.

I already know the difference between an applet and an application.

Furcube · Post by **Furcube** » Tue Nov 16, 2004 9:52 am

Maybe simple md5 or pgp would be sufficient?
Cheking is more troublesome. But it must be easy for security maniacs

Elberet · Post by **Elberet** » Tue Nov 16, 2004 12:10 pm

@DonGato: Sorry, that was a misunderstanding on my end.

@Furcube: No, applet signing works differently. Basically, the applet's classes are packed into a .jar file which includes a checksum and a digital signature. The user's webbrowser, or rather, the Java VM that browser uses, needs to be able to check the signature's authenticity which is done by looking for a x.509 certificate signed by a commonly well trusted certificate authority (such as Thawte, Verisign and other companies).

And that's the problem... Browsers only consider a certificate valid if they have the issuing root certificate authority's signing public certificate. If you sign the Java applet with a certificate you issued for yourself, the applet won't be run.

nich · Post by **nich** » Tue Nov 16, 2004 2:08 pm

kidan wrote:[...]I just wanted to point out qemu. It's a decent free alternative to vmware, which runs without a kernelpatch in userspace: http://fabrice.bellard.free.fr/qemu/

It still implies in:

Wasting space with a windows install (for a single program? no, thanks)
Having a windows copy

Doesn't look like it's free, for me.

But I guess this is getting a bit off-topic.

DonGato · Post by **DonGato** » Tue Nov 16, 2004 2:34 pm

The purpose of this request was to have an easy tool everybody could use to hash their files and add them to AniDB without having to install anything, just by accessing the site and clicking over an option.

I don't think we need another AoM, unless exp wants to have a minimal application in C++ or Java (platform independent) to do such a task.

Post by **exp** » Tue Nov 16, 2004 6:21 pm

DonGato wrote:exp, the problem is that it has to be signed (you need a certificate for that and it's $$$). And another problem is that we need to take in account the browser he is using as it seems it's different for each one. :?

wasn't there a file in the jre directory which one could edit to give the needed privileges to an applet?
what about a self-signed certificate which we make available for download and which the user has to add to his keystore before using the applet?

DonGato wrote:The purpose of this request was to have an easy tool everybody could use to hash their files and add them to AniDB without having to install anything, just by accessing the site and clicking over an option.

well, if some "simple" action by the user is required before the applet can be used (like installing the sun jre and maybe double clicking on some certificate file) that would also be ok, I'd say.

BYe!
EXP

DonGato · Post by **DonGato** » Tue Nov 16, 2004 6:37 pm

The policies file is only valid for local Java Applets (I will never understand why someone would want to use that).

I don't know if it works with self signed certificates but that would mean to have a CA and issue the signing certificate. If it's that ok with you we might want to do it. :/

Elberet · Post by **Elberet** » Tue Nov 16, 2004 8:18 pm

As far as I'm concerned, I'd go with a single, self-signed certificate for code signing and have users install that as a trusted certificate. Doing that is one thing, but installing someone's certificate as a root CA is something completely different and shouldn't be taken lightly.

Post by **exp** » Wed Nov 17, 2004 6:23 am

Elberet wrote:As far as I'm concerned, I'd go with a single, self-signed certificate for code signing and have users install that as a trusted certificate. Doing that is one thing, but installing someone's certificate as a root CA is something completely different and shouldn't be taken lightly.

well, I'd say we go with which ever way is easier for the user to "install".
I don't think it makes much difference from a security standpoint if you install an "untrusted" certificate as trusted or root cert.

BYe!
EXP

Elberet · Post by **Elberet** » Wed Nov 17, 2004 10:19 am

It does. If you install it as a root certificate, the owner of the root cert could possibly issue certificates for other malicious reasons, such as fake webserver or email identities.

Post by **exp** » Wed Nov 17, 2004 11:19 am

Elberet wrote:It does. If you install it as a root certificate, the owner of the root cert could possibly issue certificates for other malicious reasons, such as fake webserver or email identities.

the applet could as well install such certificates once it has been executed by the user with filesystem access permissions.
I don't see a big difference there.

BYe!
EXP

Elberet · Post by **Elberet** » Wed Nov 17, 2004 11:48 am

Well, yes - if the applet requests full filesystem privileges and the user grants them. However, an AniDB applet only needs read privileges, and if only those are granted, it couldn't install other certificates.