Java security hassles

[Will Nelson]

Question, how are other Java applet developers out there adapting to the increasing security hurdles that users face? We make two Java apps, SyMAP and TCW, and we love Java b/c it unifies backend/frontend/web functionality very conveniently and provides full UI capability, in contrast to say CGI. But it is getting difficult for our users because applet security popups get ever scarier and the default settings keep getting more strict.

We are thinking of doing a proper applet signing through a CA - has anyone had experience with that? Also, is there an alternate platform offering similar capabilities?

[lindenb]

Use a webstart-based application ? . Eg: for IGV http://www.broadinstitute.org/igv/startingIGV

[Richard Finney]

Consider using HTML5

[Will Nelson]

Hmm, webstart...I thought those were supposed to use the same security policies as applets? I do get one popup from blast2go, which isn't bad. I'm pretty sure blast2go is signed with a CA, so maybe that's the best we can do.

Regarding html5, it doesn't provide a good solution for the backend data processing does it? ( the unified codebase aspect that I mentioned in my post).

[GenoMax]

Not a good practice in terms of security but is saving a self-signed certificate as "trusted", an option? Specially if you only have local users and do not need to worry about external access. Getting a real certificate is safer.