Java Web Start: Difference between revisions

Revision as of 16:25, 8 January 2010

Revision as of 21:56, 11 January 2010

Line 47:

* Developer has to sign with certificate all jar files used by JNLP. Although it is not a problem for serious production applications, it complicates learning and small applications development. Certificate may be self-signed, so this does not really solve security issues.{{Citation needed|date=November 2009}}

* Bad user experience: user downloads .jnlp file into temp directory or Downloads folder. Browser may ask user, if he really wants to save that .jnlp file, and then has have to open downloaded manually. This again could be solved by browser plugin (which is done as of Java 6 Update 10 and using the Sun Java Deployment Toolkit, deployJava.js), or by introducing jnlp: URL scheme.{{Citation needed|date=November 2009}}

* Permission checking is too simple. Developer hardcodes required permissions into .jnlp descriptor (for example, developer may request "all permissions"), and user has to confirm permissions once at application start. It would be better if jnlp had no permission specifications at all, butor onperhaps unsafeduring operation JNLP engine asked user questions like "Application My Demo requests to read file 'preferencesruntime.txt', allow?" with answers like "Allow once", "Always allow this file", "Always allow read anything". JVM SecurityManager is capable of performing such checks, but JNLP does not utilize such capabilities.{{Citation needed|date=November 2009}}

* 64-bit Windows support added only in Java 6<ref name="win64">[http://bugs.sun.com/view_bug.do?bug_id=4802695 Bug ID 4802695, Support 64-bit Java Plug-in and Java webstart on Windows/Linux on AMD64]</ref>.