www.SonyEricsson.com ContactDeveloper World   Contact中文
Contact Member Login Contact Register Help Contact Help Search

This Question is Possibly Answered

1 "very helpful" answer available (10 pts) 1 "helpful" answer available (5 pts)
3 Replies Last post: Sep 8, 2009 4:17 PM by travdir  
saz ... Newbie 3 posts since
Jul 20, 2009
Currently Being Moderated

Sep 1, 2009 12:03 PM

Frustration in J2ME Signing

Hello There,

 

I have written a small app to send an automatic SMS from my Phone. The problem is the app requires confirmation from the user everytime it send the SMS. I have learnt that i need to sign my app to get rid of all security prompts using a CA by paying them atleast $100. But Why Should I ? , I am going to run my app only in my phone and can't I just self-sign for this process ???

 

Is thr anyway at all to run my app without any security prompts for free ?? Is thr any hack that exists out there ?

Can someone help me ????

 

FYI  .. I use SE G502 model.

fredrikj Professional 64 posts since
Mar 20, 2005
Currently Being Moderated
1. Sep 2, 2009 2:23 AM in response to: saz ...
Re: Frustration in J2ME Signing

I understand your frustration. The way code signing works in javame currently is the reason it wont fly in open source or hobby circles. I'm not aware of any way to get around the signature process, at least not in sony ericsson phones[0], and you have to pay annually for a certificate. That sucks! Technically there is nothing that would stop self-signed root certificates, that could easily be handled the same way phones treat self-signed https certificates. An alternative would have been to install a root certificate from http://www.cacert.org/ - a community driven certificate authority - and require developers like you to acquire (for free) a certificate from them. Are you listening Sony Ericsson. This could be a simple way for you to become a litte bit more developer friendly, at a very low cost for you!

 

Anyway, it is supposedly[1] the MIDP specification that prohibits installation of root certificates for the protected domain. I've skimmed the spec but have failed to find the specific language - anyone else know what section more specifically? - but there are numerous sources that confirms this, so unfortunately you seem to be out of luck. Either pay up, or buy a phone running android instead.

 

[0] Aparantly there are some phones that are buggy, and may allow installation of protection domain root certificates!

 

[1] http://wiki.forum.nokia.com/index.php/Java_Security_Domains

travdir Newbie 1 posts since
Oct 31, 2003
Currently Being Moderated
3. Sep 8, 2009 4:17 PM in response to: saz ...
Re: Frustration in J2ME Signing

Hi,

 

If you are a serious/dedicated developer wanting to do anything beyond toy apps, not doing 9-to-5 development for a BIG company or a network operator, you just have to leave Sony Ericssons phones behind. Their dafted certificate handling policy have quenched all hobby driven creativity and lust to develop apps for their phones. Not even smaller/mid size companies can justify the cost to create certified apps for their locked down phones.

 

My only advice is to go for an Apple phone or possibly some Android phones, but mind you, make sure that self signed root-certificates and/or disabling of the access questions are decently implemented for the phone brand of your choice - Android is still Java!!!

 

It really hurts to say this as I would love my company, Ericsson, to be THE manufacturer of choice of all phone application developers. Instead, SonyEricsson phones are nearly useless for me as a computer nerd if I want to extend my computerized home/car/work with some state-of-the-art apps on my phone.

 

Sorry to say...

 

/AÖ

More Like This

  • Retrieving data ...