Pushing the envelope

Applet security redux.

I have finally come upon a solution that is less expensive than paying the $200 plus $100/year to Thwaite for a digital certificate. I just put the following into my Java Plugin JRE's java.security file:

   grant codeBase "http://rollerweblogger.org/ekitapplet.jar" {
   permission java.security.AllPermission;
   }                                                                            

Now, this is fine for me because I trust myself. But, for example, what if Anthony Eden was to ask his users to do this, substituting roller.anthonyeden.com for rollerweblogger.org in the above snippet? Anthony would be asking his users to trust in the following things:

• Neither Howard Kistler, Dave Johnson, nor Anthony Eden have put no malicious code in Ekit
• An evil hacker will not break in to Anthony's site and replace ekitapplet.jar with malicious code

Is that too much to ask of Anthony's Roller users? If it is, then we need to buy a certificate for Ekit and hope that this one certificate would be good for all Roller users.

BTW, this is my first Ekit post using Mozilla.
[Blogging Roller]

Presumably, even with a certificate, users would still have to trust that none of the authors had put any malicious code into it? All the certificate does is assert where it came from. You are still required to trust the source.

BCELify

BCEL. A tool to build classes on the fly and output them as bytecode. Complex stuff. Luckily it comes with BCELifier. This tool can take an existing .class file and generate the BCEL java source code to build that class. Very cool.

What this means is that if (like me) you find BCEL itself a mite tricky, you can write your class in the normal way, compile it, BCELify it and end up with the source code you need to feed BCEL with to get the same result. Groovy. This reminds me of my dim past, recording VBA macros in Excel to find out how to do something, then hacking the generated code into what I wanted. [Pushing the envelope]

I'm really not sure how I feel about this. We are really re-treading the boards that lisp trod with it's macro system many moons ago. I suppose the complexity of our solutions is the result of refusing to swallow the lisp/scheme mantra of code and data being one.[Brett Morgan's Insanity Weblog Zilla]

Indeed. I'm still looking for the 'perfect' language. Java with closures, multiple inheritance, dynamic execution (like Perl's 'eval') and primitives as first-class objects (a la Smalltalk) would be pretty cool.

This article on an imaginary 'Java 3' also makes for an interesting read.