-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > Nextgens has created a really nice GUI installer for Freenet using > JavaWebStart. Unfortunately, it is not able to produce a desktop/start > menu icon and is therefore a regression over the old wininstaller on > Windows. He is now looking at other options; JWS can create an icon, but > it points to itself, so we will probably make the node self-installing, > with web config...
There are a couple of issues why I'm hesitant about Java Web Start and JNLP in general, as applied to Freenet. Below is just my IMHO, based on recent experience developing a relatively large application launched via JNLP (I haven't tested Freenets' installer, yet): 1. JNLP apps should be signed if they are to have total access to the end user's system. Moreover, _all_ jars downloaded by the app should be signed as well, or placed in the Java's lib directory manually by the user. This applies _specifically_ to all native libraries. Unsigned JNLP apps run in a sandbox similar to applets. 2. There's no way to guarantee a certain application path (for example, to keep the log file). The place where JNLP-installed application will reside is entirely implementation-dependent and is (usually) not obvious to the user. 3. JNLP insures that app files are up-to-date on each application launch, and forces updates if necessary. If general, JNLP gives user _absolutely_ no choice as to what version will be installed. What if in the future, Freenet's site will become compromised and an "evilly" modified version will silently get installed on _all_ of the users' computers when Freenet is next launched? 4. There's no simple way to transfer JVM parameters to a JNLP-launched app, save for a very limited set. What could be created is a JNLP installer/wrapper (such as the one from http://www.duckcreeksoftware.com, which is freely available for non-profit projects, BTW). It can then allow a choice between several different versions, optional libraries, etc. But if we're going to do this, why not use something like IzPack? Regards, Victor Denisov. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFEDbeHZNYkuHT6CyURAlqzAJ9Ba+cEsNJ47bB5ey+C9xRIs1EdqwCgrRHR UpvZw3TIS2NyMCQhSA8LSd4= =cUzn -----END PGP SIGNATURE-----
