 | |
SDN Chat Sessions Transcripts Index
March 1, 2005 This is a moderated forum. MDR-EdO: Welcome to today's SDN chat on "Deployment With Java Web Start." Java Web Start is a one-click deployment solution for Java applications on the desktop. Leveraging the Java Network Launch Protocol (JNLP) API, Java Web Start gives you a way of deploying applications from a web server and automatically downloading the files and runtime environment needed by the application. Our guests today are Andy Herrick, Stanley Ho, and Thomas Ng. Andy is the technical lead of Java Web Start. Stanley is the architect of Java Deployment technologies in J2SE. Thomas is a major contributor to Java Web Start. Andy, Stanley, and Thomas are ready to answer your questions about deployment with Java Web Start, so let's begin. Who has the first question? Rob: Is there a paper that describes step-by-step how to debug a web-started application from a debugger? Andy Herrick: Unfortunately no, although we plan to publish one soon, as well as make the process much easier in 1.6. mynzai: Does HTTPS from a web start client work in the latest web start? Thomas Ng: Yes - we have supported HTTPS since Java Web Start 1.4.2. You should be able to make HTTPS connections with your web start application. Usability: What was done in web start in 2002, 2003, 2004... anything to help? Stanley Ho: In Tiger (Java 2 Platform, Standard Edition (J2SE) 5.0), there are many improvements in Java Web Start, including enterprise configuration and lock-down, Java Control Panel, HTTPS client authentication support, browser keystore and SmartCard support, timestamp signature, networking and cookie enhancements, and many many others. JThaddeus: Why don't you allow variable parameters in a JNLP? I can craft a JSP to open an applet with a different parameter but I can't do this with JNLP. Andy Herrick: You can do this with Java Web Start using either a JSP page or a servlet to generate the JNLP file. We do this ourselves using the JNLP servlet available in the samples directory of the JDK of 5.0. mprudhom: It would add a lot to the "native" feel of Web Start if it actually used the native L&F when it started. What is the rationale behind using Metal instead of native when it starts? Stanley Ho: In J2SE 5.0, Java Web Start has been changed to use "native" look and feel in all of its user interfaces, and it should significantly improve the user experience of Web Start users. Sean: Is it possible to sign an application with a private certificate, rather than needing to purchase one?
Stanley Ho: It is possible. Developers may create a self-signed certificate using mynzai: When will Update 2 be available? Andy Herrick: 5.0 update 2 will be released this week. danw: I have last used JWS 1.4, I believe that is the version, corresponding with Java 1.4.2_06. There seems to be a lot to be desired for one-click install. It works under IE Explorer and Windows XP. But, I would like to see it work as a "one-click" operation with Firefox, Mozilla, and other browsers that have some use in the marketplace and may be up and coming. The only other alternative for my Java Client application I see is using an installer that is very expensive or some of the open source ones that I have not investigated yet. Thoughts? Thomas Ng: Currently the auto-install (one-click) feature of Java Web Start works on IE on Windows only. We are looking into adding similar support to Firefox in the 6.0 time frame. TomG: What is the status of the famous "scary" screen thread? Stanley Ho: We are currently working on improving the entire user experience (including the scary screen, of course) in Java Web Start in J2SE 6.0. You should expect dramatic improvements over the current release. JThaddeus: When is JNLP going to be fixed in the latest versions of Linux (Suse 9.2, latest Fedora Core)? Thomas Ng: I believe you are talking about the fix for the bug 6188963: Java Web Start cannot start on Linux with newer glibc. This is fixed in 5.0 update 2 and 6.0.
Rog: When I try to use Andy Herrick: Without specifying an href, the J2SE specification is defined to be a "platform version." A platform version specifies the version of the Java Specification, and there is no "1.4.2" specification. To get 1.4.2, include an href. danw: Andy, where do you specify the href? Can you give an example?
Andy Herrick: Lordy: Hey. I read in the release notes from Java SE build 24 () that the bugs/RFEs "Support PNG files (including alpha-channel support) for icons" and "Java Web Start does not support *.ico Icon files" are now fixed. I read many forum posts and mail lists about these missing features, so my question is, if they are fixed, are they included in Java 5.0 Update 2, 3, 4.... or must we wait for Java SE? Thomas Ng: I believe both of these are RFEs and are fixed in Java SE 6.0. Usually RFEs will not be backported to an update release unless there is a escalation request. Sean: Stanley, will a user have to click-through any additional warnings with a self-signed certificate as opposed to one from a public certificate authority? Stanley Ho: If you use a certificate issued by a public CA or a self-generated one, the user will see the security warning dialog in both cases. In general, signing of an application is not equivalent to trust, so users will be prompted to determine if a signed application should be accepted before it runs. Dan: Is there any guidance out there on how to set up a server to distribute the JRE on an Intranet? Thomas Ng: We included the JRE auto-installer for Java Web Start as a sample application (source code included) in the JDK 5.0 samples directory. keithkml: What are the big plans for JWS in J2SE 6.0? Stanley Ho: In J2SE 6.0, the main theme in Java Web Start is ease-of-deployment. We plan to redesign the user experience of Java Web Start (including the download experience, security dialog, desktop integration). We also plan to improve the download engine in Web Start to make it more efficient, and you should see a noticeable download speedup during application startup. In addition, there will be improvements in supporting timestamp signature verification. Additional features and enhancements in 6.0 will also include support for simpler deployment, support for corporate desktop, and many many others. WebStarter: How can I customize the splash screen?
Andy Herrick: You can provide a completely customized splash screen by providing your own image with: frankg: Are there any issues using the new 5.0 release to deploy older Java applications? Thomas Ng: No, not at all. Java Web Start will always use the JRE that you specified in the JNLP file J2SE tag to launch the application. Actually the example included is an auto-installer for 1.4.2. TomG: What is the timeframe for the public release of 6.0? Stanley Ho: You should expect a beta release before the end of this year, and it is expected to ship in the middle of next year. If you are interested, you may download the Java SE 6.0 build snapshot. citrusoft: How can I replace Web Start's implementation of Policy so that the Security Manager can use my special Permissions?
Andy Herrick: It is insecure to have an unsigned web application that can set its own policy, but Web Start provides various ways to do this given that you are either first running a trusted application, or have access to the client machines. Java Web Start will pick up the policy file pointed to by the deployment property "deployment.user.security.policy", so you can either configure that property to point to the URL of your policy file, or install a policy file into the default location of that ( danw: Will one-click work with all Windows versions using IE or just XP? I am talking about checking for the latest JRE, downloading it, if needed, and the application, and selecting the right JRE to run the app if there are multiple JREs installed. Thomas Ng: This one-click support is for all Windows platforms that Java Web Start runs on. It makes use of the object tag and detects whether Java Web Start is installed at all on the system. If not, it will launch the installer to install Java and Java Web Start. Java Web Start will then be launched to handle the JNLP file and take care of using the correct JRE to launch the application. James: Andy, that href will force a user to download 5.0. Is there a link to download only 1.4.2+?
Andy Herrick: No, Lordy: is there any tutorial for the new import feature of 5.0? A sample of how to build a CD installer would be nice.
Thomas Ng: Currently we do not have such a tutorial; however we are working on a white paper that might include this. For now, you can look here. It describes the command line arguments that we support in 5.0. (The arguments that are related to the import feature are danw: Can the newest version of JWS (and hence the newest JRE 5.0) be used to distribute an application written in Java 1.4.2 to take advantage of the new features before my code is upgraded to using Java 5.0 features? Is JWS 1.5 indeed the most stable, including the version someone said will be released this week? I have a production app that I want to move over to the new version of Web Start with the above-mentioned characteristics. Andy Herrick: Yes, you can use the Java Web Start in JRE 5.0 and still use JRE 1.4.2. Almost all the new features are then available. Features relying on new features in the JRE will not be available, such as dynamic proxies, or certificate timestamping. Rob: Any thoughts on bugid:4801527? Stanley Ho: This is for the feature "Support for Optional Packaging Repository for Java Web Start." We recognize the importance of this feature, and we have been working with a number of groups in J2SE to address it in a future J2SE release. frankg: Can you point me to a good Java Web Start tutorial? Our members in the NYJavaSIG would be very interested. Thomas Ng: We are working on a Java Web Start white paper that will serve this purpose. It should be posted on the Java Web Start product page when it is completed. Stay tuned. sirwio: What's the best way to launch a Web Start application from another Web Start application without getting a browser window?
Andy Herrick: On Windows, mprudhom: Are you considering evolving JWS into a more generic application installer platform for Java (similar to MSI)? It seems like it is most of the way there, and it is something that the Java platform would benefit greatly from. Stanley Ho: We are considering evolving Java Web Start into a more generic deployment technology for Java applications, for example, support deployment of non-Web Start Java applications, application packaging, extension packaging, etc. Usability: Can we pass arguments through JNLP from the web URL to the application? Thomas Ng: Yes, but you will need to use a servlet that dynamically generates the JNLP file with the arguments that you want, and pass that to Java Web Start. mynzai: Can Java Web Start update itself automatically? Andy Herrick: Since the initial 1.0.1 version, Java Web Start is only available as part of the JRE. Starting with 1.4.2_01, the JRE can auto-update on Windows, so Web Start will be auto-updated with it. keithkml: There are many benefits to launching an application from its own .exe file on Windows, including Taskbar Grouping, visibility in the Task Manager, and so on. Are there plans to create an .exe for each JWS application installed on the Windows platform? Stanley Ho: There is no plan to create such an .exe. However, we do plan to make Java applications appear more naturally on the desktop, so you will actually see the real application name from the Taskbar instead of simply "java". This should help the Taskbar Grouping problem you mentioned. robross: Does the auto-installer allow users with non-admin privileges to install the JRE on their machines? Stanley Ho: Currently, JRE installation on Windows requires admin privileges, so users are not allowed to install as non-admin. James: Is there a wizard to create JNLP files? Thomas Ng: Currently not. However we are now working on a plugin for the NetBeans IDE that will allow you to create/debug a JNLP application using the IDE. Usability: Having a trusted signed application means nothing to our end users, it still displays the un-trusted screen, after we took the steps and paid to be registered Andy Herrick: A properly signed application is not automatically "trusted". Anyone can buy a certificate. It still has to be up to the end user to decide if the Publisher should be trusted. keithkml: Many users are familiar with the idea of downloading a program, and running it. JWS does things differently, which may be confusing to users. Are there plans to create a JNLP-based system for distributing complete applications, not just JNLP descriptors, in a cross-platform way (like some kind of special JAR file)? Stanley Ho: Yes, we are investigating supporting such a deployment scheme in the future. Rog: Where can we email unanswered questions? Thomas Ng: For all the Java Web Start comments/questions that you have, please use the feedback form. This will be read by the Java Web Start team and we will try our best to get back to you. MDR-EdO: Well we've quickly come to the end of our session. I want to thank everyone who participated today. I thought we had an excellent range of questions. And of course, I'd like to thank our guests, Andy, Stanley, and Thomas, for their answers. mynzai: Thanks guys! Keep up the awesome work! frankg: Great piece of software. Wish the rest of Sun would publicize it more... MDR-EdO: Thanks. As Thomas mentioned there is a white paper coming out soon that will give JWS some more visibility. Andy Herrick: Thanks everyone. If you have more questions you can post them at the forums. Stanley Ho: Thanks everyone. It has been a great chat with all of you! Thanks for using Java Web Start in your application deployment! Thomas Ng: Thanks everyone for joining us today. It's good to talk to all the developers that use Java Web Start, so we can get more input from you guys on further improving the product! Goodbye. MDR-EdO: Moderator signing off. The forum is now unmoderated. | |
|
| ||||||||||||
