In my last post I talked about a smart new S60 application and its implications for Symbian Signing and platform security.  I said I'd talk about the other part of Symbian Signing, application quality, in my next post... so here it is already.

My personal opinion is that what is currently Symbian Signed should have absolutely NOTHING to do with application quality.  It should be entirely about identity and trust. In addition to this I do believe there should be a signing program that is ALL about application quality.  Here's why, the current system basically assumes that there are developers and there are dumb users and nothing in between.  There is a quality gate that can actually prevent you from properly distributing many types of application.  In the real world there is a sliding scale of user knowledge from the very advanced power-user to those who've never used a computer or smartphone beforeand have no idea what software really is or what it can do.  Where those different groups of users discover content is likely to be very different.  Software published in some places is unlikely to be found by anyone but the enthusiast - in this way the audience is somewhat self-selecting.  On the other hand, the Download client built into Nokia devices and operator portals should only carry content of an appropriate quality - otherwise there are likely to be serious customer service issues.

For open source and freeware developers, very often it is the advanced users that are in fact the alpha and beta testers.  You can't really rely on finding them all before you start testing - you just publish your first vaguely usable version and see who wants to play with it and what feedback they give.  That's one of the wonders of the internet - it seems there's almost always someone out there who's interested.  Release early and often is one of the major practices in the open source world. The current Symbian Signed program and criteria are incompatible with this practice.

Now, to illustrate my point I want to use the example of my new favourite application on the N800 Internet tablet - Numpty Physics. It's based on the concept for the amazing Crayon Physics, here's a video showing the gameplay for the upcoming commercial version of that, Crayon Physics Deluxe:

Numpty Physics is listed as "The pearl" on Maemo.org as I write this (which basically means it's a lot of other people's favourite too) and it's publicly stated that it's only beta quality.  In fact I've had it crash so badly I had to take the battery off and also the only way to quit is via the 'q' key which is only available on an N810 - oops.  Do I care about these issues - no.  I love that I can play it now - I'll like it even more when it's finished.  If I had the time and inclination I could get involved and help improve it.  If I had to download an unsigned package and submit it to a signing portal would I have installed it and then got excited enough to think about getting involved in the project?  Almost certainly not.

And that is really my point.  What open source and free software projects need are motivated users and developers to easily access them and give them a quick try.

Signing an application just to enable it to be installed on any device should be both free and without restriction (except some kind of identity/trust chain).  I'd be happy to sign other people's open source projects after fairly limited contact with them (because I can see the code after all - I'm not at all so sure about closed source freeware, I'd want to get to know the developer quite well first) if I didn't then have a legal responsibility for any harm they might do.  That responsibility has to rest with the end users that choose to install them.

Application quality should be policed at the point of distribution.  That can certainly be via a central signing program, it just shouldn't be the same signing program that gates whether on not an application can be installed on a device at all.

What about security for the end users?  Well, I think my last post showed that Symbian Signed doesn't really do much about that anyway.

Any thoughts or suggestions?

Mark