Tomorrow, I'm updating the site with a signed, but still sandboxed, Java applet. This means that if your Java install is reasonably up-to-date (Java 7 Update 25 or later; Update 40 is current as of this writing), you'll start getting nagged a lot less about our Java applet. Instead of being nagged every time you come to the site or even every game, you'll be asked just once if you want to trust us. You'll see this message:
Do you want to run this application?
Name: com.pocket-monkey.games.mumble.Mumble (those last parts vary) Publisher: Farsight Software Ltd Location: www.pocket-monkey.com
This application will run with limited access that is intended to protect your computer and personal information.
[x] Do not show this again for apps from the publisher and location above
[Run] [Cancel]
(Farsight Software is my company.) If you tick the checkbox and click Run, you shouldn't see that message again unless you reinstall Java. Not on the next game. Not when you close your browser and come back later. Not the next time Oracle updates Java. Only if you uninstall and reinstall (and then, of course, just once).
If you're still using an outdated version of Java (anything prior to Java 7 Update 25), the line saying
This application will run with limited access that is intended to protect your computer and personal information.
...will be the much scarier
This application will run with unrestricted access which may put your personal information at risk. The publisher's identity has been verified. Run this application only if you trust the publisher.
...which is a good reason to update your Java install. :-) Note that if you update to the very latest (Java 7 Update 40), which I recommend, then between now and tomorrow you'll get hassled a bit -- but then tomorrow things will get better.
Backstory and Details
The past couple of years Oracle/Sun and the browser manufacturers have made it increasingly unpleasant to use Java applets, in the name of security. Some malicious people have been making malicious applets, and Oracle/Sun and the browser people have reacted.
Much as I would prefer otherwise, Pocket-Monkey still uses a Java applet (primarily) for the games; I just haven't been able to get the time free to do the substantial work necessary to rewrite the games using my preferred technology. So this Java hassle has had a real impact on people here on PM.
Well, Oracle/Sun has finally done something constructive! To explain it, first I have to explain the following:
Java applets can be "signed" or "unsigned." There are two big differences between them:
A signed applet can be traced back to the person who created it, because they've "signed" it with a digital certificate saying who they are. An unsigned applet could come from anywhere, you have no idea who created it. So in that sense, signed applets are much safer than unsigned ones, since you can trace them back to their creator.
A signed applet historically has unlimited access to your computer (it can read your files and such). (Naturally, there's a warning about that before you run them, and most people would reasonably say "no"!) (More on this below.) An unsigned applet is run in a "security sandbox" preventing it from accessing your files and such. So in that sense, a signed applet has historically been much less safe than an unsigned one, for most purposes, because most of us don't want to give websites unlimited access to our computers!
Naturally, Pocket-Monkey's applet has always been unsigned, because we don't need or want unlimited access to your computer. :-)
The constructive thing Oracle/Sun has finally done (and it's very constructive indeed) is that a couple of months ago, they made it possible to sign an applet without giving it full access to your computer. The best of both worlds: A signed applet (so you can trust it a lot more), but still without access to your files and personal information. Fantastic!
So I've gone through the fairly rigorous process of getting the appropriate certificate for my company, and tomorrow I'll update the site with a signed, but sandboxed, applet.
Hopefully this will put the Java hassles behind us until I can get rid of the applet entirely.
Thank you TJ.. You know I've been one of THOSE that have been dealing with this for a very long time and I"m still here.. Gotta love it. and I do love it here THANKS FOR BEING HERE FOR US.. GinnyB.
Forum
software by
Crowder Software Pocket-Monkey and the Pocket-Monkey logo are trademarks of T.J. Crowder and Jock Murphy. All other trademarks are the property of their respective owners.
