We closed this forum 18 June 2010. It has served us well since 2005 as the ALPHA forum did before it from 2002 to 2005. New discussions are ongoing at the new URL http://forum.processing.org. You'll need to sign up and get a new user account. We're sorry about that inconvenience, but we think it's better in the long run. The content on this forum will remain online.
Index › Programming Questions & Help › Programs › dude has beef with certificate signature
‹ Previous Topic | Next Topic ›
Page Index Toggle Pages: 1
dude has beef with certificate signature (Read 576 times)
ben_hem
dude has beef with certificate signature
May 15th, 2009, 7:01pm  
Hey, this guy has a good point:

When I try to go to this game, I get a message from Java saying the the game was signed by "sun microsystems, inc" (all lowercase), but that Java cannot verify the authenticity of the certificate.
Now, if this were really signed by Sun Microsystems, wouldn't Java recognize their certificate? And why was everything, from the name to the city and state of the certificate's origin ("cupertino, california") written in lowercase, like it was typed in by some random person?
And why is this game having their certificates signed by Sun in the first place? My company writes Java as well, and we have our own certificate.
I don't see any reason to think that benhem.com is a scammer, but when I see a trust certificate with that many questions, I don't click "Trust."

Image of the certificate details:
http://skitch.com/samfentress/bxpuh/http-benhem.com

----
I've been using Processing so long I look right through this stuff.  But I can't blame him for being wary.  What to do?

[edit: tried using jarsigner to sign all my .jar files, but that looks even worse: "certificate is not in the trusted root directory" (as well it should not be)]

Thanks,
Ben
Back to top
 
WWW  
PhiLho 
Re: dude has beef with certificate signature
Reply #1 - May 16th, 2009, 1:33am  
Which guy? You answer to somebody? I am confused.

Anyway, "wouldn't Java recognize their certificate" is wrong: you have to acknowledge Sun's certificates like the others. For example JavaFX official demos have to be accepted before running them.

Beside, the points you are rising are valid: one shouldn't trust blindly some obscure certificate, even less for a game that shouldn't have any reason to mess with your computer or another Web site...
Back to top
 
WWW  
ben_hem
Re: dude has beef with certificate signature
Reply #2 - May 16th, 2009, 7:41am  
Well, the Dude is just a Dude who left a comment, and might not be a dude, for that matter.  (El Duderino if you're not into the whole brevity thing.)  I am just quoting him here because I figure if one person is speaking up, the certificate issue is bothering others as well...

Ok, I checked out the JavaFX examples and the only difference I can see is that their certificate has not expired, so it gets a green Checkmark (no red X).  (Processing certificate seems to have expired on "April 30," not sure what year.)  I guess since this is the Processing certificate (problem doesn't seem unique to one version of Processing) that I will have to look into actually getting a jar key from Sun?  Who is being digested by Oracle...(the oracle is eating the sun?  Did Nostradamus write something about this?)

[edit -- only seems to be an issue in sketches that include OpenGL]
Back to top
« Last Edit: May 17th, 2009, 12:18am by ben_hem »  
WWW  
ben_hem
Re: dude has beef with certificate signature
Reply #3 - May 16th, 2009, 11:53pm  
Ok, some more dudes and dudettes over at Metafilter found the libraries (with the same certificate) at the Sun download site:

http://download.java.net/media/jogl/builds/archive/jsr-231-1.0.0/

so I guess this thread should really be in the "OpenGL" section...hopefully Sun will see fit to renew their own certificate soon.

http://forums.sun.com/thread.jspa?threadID=5384159&tstart=1

Apparently it expired just a couple of weeks ago.
Back to top
 
WWW  
Page Index Toggle Pages: 1
‹ Previous Topic | Next Topic ›