Mark Wilcox's Forum Nokia Blog - Application Quality & Numpty Physics

Yes!

Sorcery-ltd — 2008-05-29T17:42:14Z

Thanks Nigel, yes, you can't trust code, only developers. Hence the need for Publisher IDs. Now for freeware and open source development even the cost of a Publisher ID is something of a barrier. In many cases it's not really the amount it's the principle. Why pay to develop on one platform in your free time when you can work on another for free? However, the amount is likely to be an issue in some countries!

Hence the need for some publisher(s) for freeware and open source. However, what would prevent me from doing that would be that I'd become responsible for the application, even though, as you say - it's impossible to provide any tests that would guarantee it isn't malware. Also, I'd currently be responsible for ensuring that this thing someone developed in their free time passes the Symbian Signed criteria - which just isn't reasonable. Particularly considering a lot of the software may be ported and already full of bugs. It's applying a "final release" criteria to something that in many cases has very valid reasons for being immature. The developer won't know whether it's worth putting more effort into the project and improving features and quality until they've made it available for distribution and seen what the interest in it is like.

I could rant about this for hours so I'll stop now.

Mark

nigel.brown — 2008-05-29T17:19:00Z

The link didn't work, I'll cut n paste:

Yes, in my view there is something slightly wrong with the whole concept.
The way it is all set up the trust relationship is between the Symbian signed and the code. It should be between Symbian signed and the developer.

You can't trust code!

E.g. You write a Trojan which passes all the tests. So, Symbian say they trust this code and allow it on their handsets. Then on July the 4th it deletes all the files it can get its hands on.
It isn't the code that gets slapped in irons and hauled off to a small room at the bottom of the NRC. It is the developer.

You can trust the developers!

They have something to lose. They should be trusted (or not).

But, it is just an opinion.

nigel.brown — 2008-05-29T17:17:20Z

I agree. I just made a post on a similar topic.

http://blogs.forum.nokia.com/blog/kiran-patels-forum-nokia-blog/testing/2008/05/27/lost-in-the-dark-quality-and-consistency-with-symbian-signed?ticket=ST-25547-e0j2rVijDwHQ9OaX6qse33lZg0ym2jUJKlZ-20

Damavik — 2008-05-26T14:59:44Z

You're completely right. Really, very often the existing Symbian Signed stuff throws Symbian developers into a rage :(

Thanks!

Sorcery-ltd — 2008-05-25T14:23:10Z

Thanks Bogdan, I really hope we get some more progress on this soon too!

bogdan.galiceanu — 2008-05-24T19:36:13Z

Great post, Mark. You make some very good points.

I have to say I agree with pretty much everything you say (not that I disagree with anything, but I find a few issues confusing as I haven't experienced them yet. So don't worry about that).
As a software developer myself, I know the hassle of getting an application that requires certain capabilities signed just to test it. And I do that because it's my responsibility as the person that made the application, but an end-user will most like just quit after the first encounter with the vicious "Certificate error".

The principles you suggested, allowing non-restricted signing for freeware and open source software and having a "gate" for controlling the quality of commercial software, are very good.

Hope someone with authority in the matter is reading this and will speed up the process of making this system better.

And by the way, that Crayon Physics application is the bomb :)

Best regards,
Bogdan