Hacking midlet signing
in [Java Programming]
|
From: Lew on 3 Apr 2010 18:41 Lew wrote, quoted or indirectly quoted someone who said : >> There must be a way to add root certificates, otherwise Thawte and >> Verisign could never have gotten in there in the first place. That is >> ineluctable. Roedy Green wrote: > Browsers and Java and Windows come with root certs pre-installed. It Which proves conclusively and inarguably that there was a way to add them! > certainly would be sensible for there to be a mechanism to add more, > but not logically necessary. Yes, of course it's logically necessary. The manufacturer just repeats the process that let them load the list in the first place. > This applies even more so for cell phones where lockin-mechanisms are > more tolerated. Once again, if there are any certificates in the cellphone's trust store, then there was a way to get them in there. No other conclusion is possible. It is the height and depth of silliness to argue that there's no way for certificates to get into the trust store when we can observe that there are certificates in the trust store. If there truly were no way to get certificates into the trust store, then there would not be any certificates in the trust store. That's just the most basic simple logic. -- Lew
From: Roedy Green on 6 Apr 2010 20:56 On Sat, 03 Apr 2010 18:41:52 -0400, Lew <noone(a)lewscanon.com> wrote, quoted or indirectly quoted someone who said : >> Browsers and Java and Windows come with root certs pre-installed. It > >Which proves conclusively and inarguably that there was a way to add them! Get a job as a lawyer. You keep bending over backwards to twist my words. I am have been arguing there is not necessarily a way for the USER to add them. And you were perfectly well aware of that. If not, you are not nearly as intelligent as you purport to be. Grow up. -- Roedy Green Canadian Mind Products http://mindprod.com Programs are abstract structured data. They map better onto 3D visual structures than they do onto linear streams of characters. We have to gently break the strangehold of the written language metaphor for programs before we can make any major progress. An IDE ginergerly decorates text with graphics. We need to evolved that to a SCID with graphics ginergly decorated with text, where the dynamic graphics tell nearly all the story.
From: Lew on 6 Apr 2010 21:05
Lew wrote, quoted or indirectly quoted someone who said : >>> Browsers and Java and Windows come with root certs pre-installed. It >> Which proves conclusively and inarguably that there was a way to add them! Roedy Green wrote: > Get a job as a lawyer. You keep bending over backwards to twist my > words. > > I am have been arguing there is not necessarily a way for the USER to > add them. And you were perfectly well aware of that. If not, > you are not nearly as intelligent as you purport to be. Grow up. I am not at all twisting your words, and you should relax. There's no point in getting all personal just because I disagree with you. You act as if I didn't have a point. My point was that there could be a way for a DEVELOPER to get a certificate into a cell-phone, as I stated upthread, perhaps by entering into a business arrangement with the manufacturer. Your close-minded insistence on interpreting "get a certificate into the phone" as a "USER" operation only limits the possibilities for the OP, and is no help at all. If the OP or anyone else had a need to get trusted certificates going and for some reason or other didn't want to do business with the current players, they should not discount such possibilities. Who knows? Perhaps Motorola or someone has a developer program whereby they issue certificates for free in return for promotional consideration or something. I just made that up, but it's exactly the sort of creative, problem-solving thinking that comes out of considering all the possibilities instead of ossifying to one limited outlook and getting all snarky with people who have the audacity to consider alternatives. -- Lew |