On the FN discussion boards there has been every now and then questions about Cingular's security domain policy for MIDlets. As many of you know by now they do not follow the recommended security policy for MIDlets.

All developers wanting to know the specifics should check the "Java Signing Requirements" document on Cingular developer Web site. However, as the document has not changed for almost a year now, I think I can summarize the main points of the doc (without needing to update this entry right away).

For unsigned MIDlets access to socket connections, PushRegistry, PIM API, SMS/MMS messaging, and Bluetooth (Connector.open()) are not allowed. Socket connections are not allowed for trusted 3rd party applications either, and most of the APIs do not have the option "always allowed" for this domain. You can use Thawte, Verisign or Java Verified signing to get your MIDlet to the trusted 3rd party domain.

There is also an additional semi-trusted "operator" domain, which allows socket connections and also includes blanket permissions for many APIs. You need to sign your MIDlet with Cingular Preferred certificate, in order to place your MIDlet to this "in-between" domain.

Unfortunately I have not yet found a similar document for T-Mobile US (this carrier also has a little modified security domain policy).