FNC and ASD interested in Symbian C++, Security, LBS and VoIP. Administrator of Russian mobile developers community: DevMobile.ru.
truf | 13 April, 2008 09:14
All we know, what Symbian Signed support freeware developer’s community with Submit freeware. Frankly, I never use it, but that process definitely has lots of issues, so developers prefer to publish unsigned applications. What Cellmania do? It's provided access to Cellmania PubId and performs testing (taking risks to sign spyware etc). That's all.
Now let's see on PubId owners. That’s privileged and controllable category of developers completely hasn’t support for freeware development. PubId owners don’t need Cellmania, because they can take risks for signed app for self.
So if I’m a freeware coder, then I haven’t any reason even try to get PubId, because it's not give me any benefits, and I still have to use Cellmania process. On other side, if I’m PubId owner and I want to sign freeware application for free, then I have no any advantages of owning PubId, and forced to use Cellmania process again. Of course, thats force to publish unsigned applications.
That’s kind of *supporting* freeware
development looks a bit ugly.
I think Symbian Signed can make it
better. Symbian Signed can make Express Signed free for freeware applications.
That will have some advantages and
disadvantages. Let’s clear up what that give to us:
Issues:
Let’s look closely at our issues. First one is a biggest problem. But it's can be solved well. First of all — PubId owners is vulnerable in compare with other developers. Symbian Signed have good way to penalty irresponsible developer — block its PubId or write off its TC Ids. And as more desired PubId looks for developer as more he don't want to lose it. That’s why PubId owners more responsible. Second — developer should mark it's submission as freeware before signing, so that kind of submissions is easy to track. Then Symbian Signed can use old technique of submissions random checking to find shareware apps which signed as freeware. If that still looks risky for Symbian Signed, they can implement more severe method: Developer should have enough TC TrustCenter IDs before signing freeware. Those IDs can be locked until Symbian Signed will check submission and confirm its freeware.
What about malware? 20$ is not a big price for signing malware. Moreover, if someone try to sign malware for free, he's prefer to send it to CellMania then to use PubId which allow to find his real name and firm details. So making Open Signed free for freeware doesn’t open the door for malware.
Now let's be honest: Symbian Signed will lose some profit (TC Id's), but such kind of freeware support looks much better then existing one.
S60, General, Signing |
Next |
Comments (14) |
Trackbacks (1)
truf | 13/04/2008, 10:51
Self-signed certificate is nothing. That was good illustrated when Symbian Signed close Open Signed Offline for peoples, who not own PubId - most efficient and popular applications was distributed as unsigned packages. They can't be signed with self-signed certificate.
I make lots software, include freeware - and no one from them can be self-signed.
aol | 13/04/2008, 14:40
I don't see big problem for Freeware Developer in purchasing of Publisher ID and express signing (provided that they would be discounted for freeware). But a problem is that to acquire Publisher ID you need to have a registered company! This much bigger problem than just paying a few bucks.
truf | 13/04/2008, 14:53
Unfortunally, i did't see a way to weaken PubId purshasing rules. Bcs then PubId will loss sense.
I think only way to improve that - provide more wide range of organisations, which can give freeware developer access to own PubId and take testing risk's. Curently Cellmania looks like monopolist and may work as it want.
symbianyucca | 14/04/2008, 07:37
I really like to disagree with your saying that "Self-signed certificate is nothing.", most of the API's do only require them, and I have done quite a lot of free ware applications that are distributed as self-signed, if it wouldn't be nothing, I probably wouldn't get over 1000 page loads everyday for my file manager alone...
truf | 14/04/2008, 08:34
So, lets answer on a main quistion. Is SelfSigning + CellManina is well enouth freeware development support? My answer is No, It's not enouth. For example, I have a big inconvenience because of lack of Location capability in user granted capability set. I know that's will be fixed in FP2 devices. But that's only prove what current freeware development support is out of all proportion to present-day freeware developer needs, and it's have to keep up to date.
I did't suggest a panacea or ultimate solution. I just suggest next little step to make Symbian Signed a bit better and confortable for freeware developers. And i'm sure that step can be done.
Rippe | 14/04/2008, 10:41
There is a flavour to the freeware question. There are other parties who can sign freeware than just CellMania. Basically anyone with a Publisher ID can do it through Express Signed. The main item there is that the application must meet the Symbian Signed criteria. Otherwise you have to go through Certified Signed twice before you can use Express Signed again.
Anyways, the problem has been noted. The freeware channel in Symbian Signed is slow and loads of end users use Open Signed Online to sign the freeware applications which are not signed at all. Which then creates load to Symbian Signed services.
The good point is that with Open Signed Online there is data left behind - what is the most popular freeware. Such applications could be sent to parties who can sign applications with their Publisher IDs for a fee. And if the freeware application is popular enough the signing and testing cost could be subsidized. This before there is a better solution for freeware available.
aol | 14/04/2008, 15:28
I can't see how Open Signed Online helps the freeware development at all. The Open Signed Online requires that you own the UID if it's in the protected range. This means users can't use it to sign popular items like RotateMe etc. Maybe freeware developers should start using the testing range for their applications?
symbianyucca | 14/04/2008, 17:06
Please read the "An unexpected malware application" by lucian before you make comments like that...
aol | 14/04/2008, 20:36
I have read it. There if something seriously wrong with the system, if it leads people to misuse it to achieve their goal.
The average Freeware developer is probably only concerned that there is not much cost for him (as he's not getting any revenue from it), and that users can use the software. They probably aren't slightly concerned that they SHOULD not use the testing range, if the still CAN use it distribute their software.
Also one should think what this does to whole Symbian 3rd party software developer community, if Symbian Signed makes their life hard. I would suspect they are inclined to move to other platforms where there is less pain.
truf | 14/04/2008, 22:57
Frankly, I hear enough claims on Symbian Signed and don't want discuss Symbian Signed Online or Cellmania here. We all know what Symbian Signed have some disadvantages. Someone think they are not so big, for someone that’s a big issue. That’s no matter. We have what we have. And if that’s not convenient someone, then we should suggest some real steps to improve situation. I'm sure, what we as software developers know what we need much better then someone else. If that’s true, then why we waiting next step from Symbain Signing without showing our position and our thoughts? I think they are interested in new ideas. That’s why I make that post. I use that system, and I think what that (Express Signing freeware for free) can be done, and will be better for all. (Frankly, i don't believe what it's will be really implemented. It's not enouth positive.). If somebody disagree with that, or know more efficient way or may suggest another improvement - I glad to read your opinion.
aol | 14/04/2008, 23:34
Well my suggestion would be definitely to allow PubID's for private persons without a registered company. What extra security does a registered company bring to the equation as you will be needed to identify you self to the TrustCenter anyways?
Free Express Signing is basically something that would be very little or no effect, since after spending few thousand Euros founding a company, paying for book keeping etc, paying $200 per year for the PubID certificate. And then save $20 per shipping version, just because you've spend thousand of Euros to earn nothing?
truf | 15/04/2008, 06:34
I don't think PubId ever can be accessible for Private person. That’s make it's no sense.
BTW, I was surprised, but TC accepts PubId requests from Russian "individual businessman". I'm not sure, is that legal form exists in other countries. It’s allowing any individual start its business and pay taxes. It's easy to get and it's cheap. That’s really great and solve PubId problem for a most Russian who can't get PubId for firm.
About Free Express Signing. Main advantage which I expect is following. If PubId owner not pay anything for freeware signing, then we get better chance what he agree to sign 3rd party app. Of course, from trusted author. Moreover, I expect that helps with creation of non-profit organizations, which provide same services as CellMania.
symbianyucca | 15/04/2008, 09:19
I'm rather sure that would work also in Europe in quite many countries, basically at least in Finland you can make company type "Toiminimi", which would allow you to be individual business man/woman, but still have sort-of registered company. As far as i know it does not require extensive amounts of money to make one, and you pay all company profits as your personal tax.
I think the point in there is that "toiminimi" has to be registered, thus it can be considered as registered company.
Re: May Express Signing become free for freeware?
symbianyucca | 13/04/2008, 10:08
One thing you completely forget to mention, that as freeware developer you also have opportunity to utilize self-signed capabilities.
If you are willing to spend a little bit extra time to figure out how you could do things without needing unnecessary capabilities, you could get rather a lot done with the capabilities that do allow you to use self-signing.