java.policy

[Darren]

The two other easier choices are JAWS and plain old Application.

It has to be web page based so an application is out the questio and all i
could find und jaws on google is the movie.

The nice thing about avoiding an Applet is it gets all the
uncertainties added by the browser out of the equation. It also gives
you back its ram if you want to do something grandiose.

I agree but this thing needs to be run from a web page.

 

[Darren]

I did a check on my own machine and discovered this property, despite
its name, is Opera specific. So, never mind.

I guess the other browsers expect java.policy in the standard places
offset from the java.home = C:\Program Files\Java\jre1.5.0_04
property or user.home = C:\Documents and Settings\Administrator.ROEDY.

C:\Program Files\Java\jre1.5.0_04\lib\security\java.policy
or
E:\Program Files\Java\jdk1.5.0_04\jre\lib\security\java.policy

You also might have a user .java.policy which could be interfering.

I explain the chain you can use to figure out which policy file is the
one in effect at http://mindprod.com/policyfile.html

I revamped that entry it recently. You would feel awfully silly if
the reason it was ignoring your permissions was you modified the wrong
file.

Well I found my java policy file but the idea is that everyones' java can
access this page. if the browser can see the page then the site is up
otherwise it's down.

 

[Andrew Thompson]

It has to be web page based so an application is out the questio and all i
could find und jaws on google is the movie.

JaWS* is a silly name, try searching for JWS or Webstart
at Sun's site.

[ I detest Sun's decision to introduce the 'a' when it is not
the first letter of any of the words, but simlpy 'cute'. It is
too easy to mistake for the 'Jaws' movie ( or the character of
that name in some of the James Bond movies . ]

Unfortunately, JWS has some unfortunate aspects in
regard to applets, including ..
- The applets appear in a fixed size window where the
sizes must be hard coded in the JNLP.
- Access to interapplet communication, JS, and any other
page elements becomes dodgy or non-existent (not a worry here) .

To get full access via JNLP/JWS, would require the applet
be signed in any case, so if you can manage to sign the
applet, I would recommend simply calling it from a
standard web page, rather than use JWS for this one.

 

[Andrew Thompson]

Well I found my java policy file but the idea is that everyones' java can
access this page.

That is why I feel that adjusting policy files is not a workable
solution for this application. In fact, I have *never* seen an
applet deployment situation where using that approach made any sense.

It is ridiculous to consider that your average end user will
manage to edit their own policy files appropriately, and
while developing a Java utility to do it for them might be
possible, it would be more effort than signing the applet.

 

[Darren]

It has to be web page based so an application is out the questio and all i
could find und jaws on google is the movie.

JaWS* is a silly name, try searching for JWS or Webstart
at Sun's site.

[ I detest Sun's decision to introduce the 'a' when it is not
the first letter of any of the words, but simlpy 'cute'. It is
too easy to mistake for the 'Jaws' movie ( or the character of
that name in some of the James Bond movies . ]

Unfortunately, JWS has some unfortunate aspects in
regard to applets, including ..
- The applets appear in a fixed size window where the
sizes must be hard coded in the JNLP.
- Access to interapplet communication, JS, and any other
page elements becomes dodgy or non-existent (not a worry here) .

To get full access via JNLP/JWS, would require the applet
be signed in any case, so if you can manage to sign the
applet, I would recommend simply calling it from a
standard web page, rather than use JWS for this one.

Doesn't getting a signiture for an aplpet cost money?

 

[Darren]

That is why I feel that adjusting policy files is not a workable
solution for this application. In fact, I have *never* seen an
applet deployment situation where using that approach made any sense.

It is ridiculous to consider that your average end user will
manage to edit their own policy files appropriately, and
while developing a Java utility to do it for them might be
possible, it would be more effort than signing the applet.

so where do i go from here?

 

[Andrew Thompson]

...
Doesn't getting a signiture for an aplpet cost money?

No.

- A *verified* certificate from Thawte/Versisign costs a
lot of money. It also needs to be renewed periodically.
- Thawte also offers a 'Personal Certificate' type set-up
for free. I could not be bothered pursuing it once I
discovered it had a very generic name, but it might suit you.
- You can also use a 'self-signed' certificate as I do for
the PhySci software suite, it costs nothing but is tricky
to create. 'Production level' software should generally
not be issued with self signed vertificates, as they show a
very onerous warning to the end user that 'certificate
cannot be verifed - recommend not install'

Note that only the first option (a fully verified certificate
in your own name) costs money.

 

[Andrew Thompson]

so where do i go from here?

That's up to you. If you want to pursue code signing,
best do it on the other sub-thread where there is more
information related to it.

--
Andrew Thompson
physci.org 1point1c.org javasaver.com lensescapes.com athompson.info
"..I pick up all the pieces and make an island. Might even raise just a
little sand"
Jimi Hendrix 'Voodoo Chile (Slight Return)'

 

[Darren]

No.

- A *verified* certificate from Thawte/Versisign costs a
lot of money. It also needs to be renewed periodically.
- Thawte also offers a 'Personal Certificate' type set-up
for free. I could not be bothered pursuing it once I
discovered it had a very generic name, but it might suit you.
- You can also use a 'self-signed' certificate as I do for
the PhySci software suite, it costs nothing but is tricky
to create. 'Production level' software should generally
not be issued with self signed vertificates, as they show a
very onerous warning to the end user that 'certificate
cannot be verifed - recommend not install'

Note that only the first option (a fully verified certificate
in your own name) costs money.

No that's not what I want. I don't see why I should have to pay a lot of
money for my isp owned website to see if my own server is up. There must be
another way.

 

[Andrew Thompson]

No that's not what I want.

You must be referring to point 1 above, given..

.. I don't see why I should have to pay a lot of money

...option 1 was the only one that cost money.

..for my isp owned website to see if my own server is up. There must be
another way.

What - like the other *two* ways mentioned in the three
points *written* *above*?!?

 

[Chris Uppal]

so where do i go from here?

Some problems do not have a technical solution. This most often happens when
the problem has a non-technical aspect, as in this case. The non-technical
problem is that (for whatever reason of your own) you choose to publish your
web pages with a host that does not allow server-side scripting.

Either change that or accept the fact that there is /no/ 100% reliable solution
(not even if you are willing to pay).

-- chris

 

[Darren]

You must be referring to point 1 above, given..


..option 1 was the only one that cost money.


What - like the other *two* ways mentioned in the three
points *written* *above*?!?

Which were. Summarise please.

 

[Darren]

Some problems do not have a technical solution. This most often happens when
the problem has a non-technical aspect, as in this case. The non-technical
problem is that (for whatever reason of your own) you choose to publish your
web pages with a host that does not allow server-side scripting.

What makes you think it was my choice. I don't own the box that hosts my
website but i do own the one that hosts my members area

Either change that or accept the fact that there is /no/ 100% reliable solution
(not even if you are willing to pay).

So what is the best solution given my circumstances?
TIA

 

[Chris Uppal]

Which were. Summarise please.

Summarise a 14 line post ? (not counting blank lines or .sig) What sort of
idiot are you ?

-- chris

 

[Darren]

Summarise a 14 line post ? (not counting blank lines or .sig) What sort of
idiot are you ?

Not the kind of idiot who can't summerise a 14 line post. How about you?

 

[Darren]

You must be referring to point 1 above, given..


..option 1 was the only one that cost money.


What - like the other *two* ways mentioned in the three
points *written* *above*?!?

Ok The only free certificates i found on Thawt are email ones. I don't know
if javascript applets use these. I can't see an option for any other free
kind

 

[Andrew Thompson]

Not the kind of idiot who can't summerise a 14 line post.

So why are you asking me to summarise it..?
I lost my spoon.

--
Andrew Thompson
physci.org 1point1c.org javasaver.com lensescapes.com athompson.info
"When you believe in things that you don't understand, you suffer.
Superstition ain't the way"
Stevie Wonder 'Superstitious'

 

[Darren]

So why are you asking me to summarise it..?
I lost my spoon.

No need. I googled the thread. Did you read my other post?

 

[Andrew Thompson]

..Did you read my other post?

Yep. It inspired a new thread.
'Self-signed security certificates.. (oh, the evil)'

I think you would be better off watching that thread,
which will hopefully suggest some good strategies for
gaining certificate you need, at least for testing.

As far as the 'email' certificates go,
- I know one person who posts on these groups who has gained
a free Thawte certificate.
- I looked into it and was thoroughly confused.
- I *think* I ended up determining that the reference to
*email* was only because that was the 'identifcation' that
Thawte claimed. That is, Thawte is effectively saying -
'We *identified* this developer by their *email* -
but nothing more (for free)'

The major thing about these certificates is the level
of trust that can be assigned to any certificate.
- A self signed certificate is basically 'none', it
might be coming to you from anybody.
- A Thawte 'free mail' certificate is Thawte saying you
were willing to blow an email address to get this certificate.
It may allow interested parties to track you down by the
email address.
- For the 'full money', Thawte will go to much more effort
to verify who you are. Then, and only then, does the end
user get the messages 'Certified code, issued by "Your Company"'

[ And, for the record, I use a self signed certificate, and
this is what I need to do to convince people to download the
software and grant my code 'full access'.
<http://www.physci.org/install/security.jsp> ]

 

[Chris Uppal]

[me:]
Some problems do not have a technical solution. This most often
happens when the problem has a non-technical aspect, as in this case.
The non-technical problem is that (for whatever reason of your own) you
choose to publish your web pages with a host that does not allow
server-side scripting.

What makes you think it was my choice. I don't own the box that hosts my
website but i do own the one that hosts my members area

But you did choose to put your website on that box. You can change if you
want.

So what is the best solution given my circumstances?

Change the circumstances.

(Or, to be a little less unhelpful, what /I/ would do is change the static
website before taking down my own machine, and change it back again after the
maintenance was complete. That would be a pain to do by hand every time,
obviously, so I'd automate it.)

-- chris