Java Timer, swing

[Andrew Thompson]

...MS has from time to time fixed security
problems in the VM.

I was interested to note that even the 3810
build of the MSVM (the last and most secure)
will happily tell you exactly where in the
system the zips holding the classes are located..

The 1.1.5 Symantec JVM used in Netscape, and
all subsequent VM's, won't.

I would simply refer people to MS' own statement about their VM on

http://www.microsoft.com/mscorp/java/

Thanks for that link again, I now have it
bookmarked, but contrary to your general
advice, I am considering making a page..

'R.I.P. M.S.V.M.'

...Perhaps fortunately, I do have a
pile of other work to do..

 

[Piet den Dulk]

First of all, all of you thank you very much for your reactions on my topic.
Some things I allready knew but in practise I did not completly understand
at all. I first programmed my own timer which was from an old school subject
and works pretty much the same like the java.swing.Timer. But I did not want
to use my old Timer anymore because it sometimes oscillates to much. And for
gaming you need constant intervalls and more "look" realtime reactions.
Aside of that why use that own made class if you could use the allready
build Timers. And besides that I want to learn more about Java so this is a
good way to see that there are more ways.

What I understand is that I could replace the javax.swing.timer by the
java.util.Timer. allthough I first have to study how it works before I can
use this.
Second I can use some jar file allthough I never have used a jar file in one
of my programs. so I need to study that part too. But I could better leave
it because as mentioned there are better ways. And indeed downloadig a
complete swing jar file everytime the user wants to play a game is a waste.
So I think I need to study the jar part for other reasons like putting
classes and or media files together.
Then I now understand that java applets are a plugin just like macromedia
Flash. which I knew in a certain way. But I didn´t knew that java could be
updated easily. I though you need to download the complete 10MB jre
everytime and need to reinstall everytime. So I need to learn the updating
technique too. I also understand that not all browsers are java enables or
have the newest versions. Like MS did support java in their old browsers
like in Windows 98 but it was trown away from Microsoft XP. In XP you need
to download the jre anyway. So even one friend has windows 98 with the old
VM, it still doesn't approve because many other friends probably use XP
without any JRE installed. So the updating technique should be very
important especially for future development.
But my mind constantly keeps saying that there are a lot of beautifull java
applets on the internet like cool chatrooms and 2D/ 3D games that works on
very old VM's though. And a lot of people still have old computer systems
with old java versions and I don't want them to install jre's.

regards,
Piet den Dulk (Netherlands)

 

[Andrew Thompson]

<snip, snip, snip>

You seem to display a pretty good basis for
understanding this complex area now.

But my mind constantly keeps saying that there are a lot of beautifull java
applets on the internet like cool chatrooms and 2D/ 3D games that works on
very old VM's though.

(shrugs) I agree with you. Some truly
wondorous and beautiful things can be
done with 1.1.

I was developing Screensavers recently using
the new (Win 1.4+/Linux 1.5) API and musing
the containers that I used for rendering should
do just fine in 1.1 (until you wrap them in the
Saverbeans API, that is).

And a lot of people still have old computer systems
with old java versions and I don't want them to install jre's.

So you are happy (for the moment in any case)
sticking to 1.1 to allow usage on the 'maximum
range' of Java installations available. Cool.

It might pay to state that commitment as
clearly as you can when asking for solutions,
as most Java developers these days would
give you a 1.4 compatible answer without
hesitating. As well, (as you may have
noticed) discussions can become sidetracked
into convincing people of 'are you *serious*'?

Try to get your hands on a 1.1 rt.jar, if
you can compile against that, it will save you
a lot of heartache when you realize that Sun
has been a bit spare with the '@since' tags
in the JDocs.. Though of course you can use a
1.1 compatible VM itself to 'crash test' code
in your browser, but applet testing can be a
hassle due to class caching.

...errr. So you did come to an answer,
for ..*your* question then?

 

[Liz]

I was interested to note that even the 3810
build of the MSVM (the last and most secure)
will happily tell you exactly where in the
system the zips holding the classes are located..

The 1.1.5 Symantec JVM used in Netscape, and
all subsequent VM's, won't.

I see that MS is not supporting java after 2007, but there
are a lot of casual users of computers that have no idea what
is going on other than "I went to this page and there is a
big gray box with a little red 'x', so it must be broken."
Meanwhile, the company/person providing said web page looses
business (potentially).

 

[Thomas G. Marshall]

You seem to display a pretty good basis for
understanding this complex area now.


(shrugs) I agree with you. Some truly
wondorous and beautiful things can be
done with 1.1.

Yes. I've said before (glibly) that the difference between java 1.1 and 1.0
is greater than the difference between java 1.0 and no-java at all.

....[rip]...

 

[Andrew Thompson]

I see that MS is not supporting java after 2007, but there
are a lot of casual users of computers that have no idea what
is going on other than "I went to this page and there is a
big gray box with a little red 'x', so it must be broken."

No. If the web-page author has used the
alt/alternateHTML parts of the applet tag,
and uses the JavaVersionApplet or Sun's
HTMLconverter, that can easily be fixed.

Just because Java is not installed/correctly
updated, does not mean we have to leave the
visitor in the lurch..

As it is Liz, there are hundreds, possibly thousands
of people a day downloading the 'light' versions of
the latest Mozilla or Opera browsers, the ones without
Java (which is over 14 Meg, and will soon be
around 30 - just for the run-time).

It is up to web page authors and applet
developers to convince the end users that
30 meg plug-in is worth it.

 

[Liz]

No. If the web-page author has used the
alt/alternateHTML parts of the applet tag,
and uses the JavaVersionApplet or Sun's
HTMLconverter, that can easily be fixed.

tnx for info, i did not know this

Just because Java is not installed/correctly
updated, does not mean we have to leave the
visitor in the lurch..

As it is Liz, there are hundreds, possibly thousands
of people a day downloading the 'light' versions of
the latest Mozilla or Opera browsers, the ones without
Java (which is over 14 Meg, and will soon be
around 30 - just for the run-time).

It is up to web page authors and applet
developers to convince the end users that
30 meg plug-in is worth it.

suspicious people like me don't download anything
from a web page without first checking the certificate
and even then I only download when the certificate is
issued by a respected certificate issuerr

 

[Andrew Thompson]

suspicious people like me don't download anything
from a web page without first checking the certificate
and even then I only download when the certificate is
issued by a respected certificate issuerr

So this 'makeshift outfit' would
definitely be off your list?
<http://www.physci.org/install/security.jsp>

Actually I am positively curious now..
if you saw the download page first..
<http://www.physci.org/install/download.jsp>

With it's big, clear link to the other page
I mentioned.. could a statement like that
on the 'security' page possible *change* your
mind on accepting the certificate from an
...untrusted authority, ..trusted unauthority,
...the guy too cheap to pony up $250 a year
to buy a certificate for his free software
suite?

 

[Roedy Green]

Actually I am positively curious now..
if you saw the download page first..
<http://www.physci.org/install/download.jsp>

On that page you say:

A Certification Authority would be able to issue Certificates for
about the same effort as the domain name folks, but for some bizarre
reason - certification costs more than the web hosting!)

The overhead is higher. For a DNS name all they need to ensure is
that the name is not taken. With a cert they have to prove you are
you. It is quite a production, at least for the customer getting all
the documents. Presumably they do some cross checks too.

See http://mindprod.com/jgloss/certificate.html

However, it can't be that difficult since you can get cheap certs.
Verisign in making you pay through the nose for brand recognition. It
is a form of status symbol.

 

[Grant Wagner]

As it is Liz, there are hundreds, possibly thousands
of people a day downloading the 'light' versions of
the latest Mozilla or Opera browsers, the ones without
Java (which is over 14 Meg, and will soon be
around 30 - just for the run-time).

There are also hundreds, possibly thousands of people a day
downloading the Microsoft JVM from unofficial sources because
either:

a) it starts up faster and doesn't eat CPU cycles like Sun's most
recent plug-in. I visit a page with an applet and my Celeron 1.7GH
w/512MB hangs for about 5 seconds, causing my MP3 software to
skip/stall, my mouse to skip, etc, with the Microsoft JVM I barely
notice it's started.

b) their favorite game site doesn't work right in the newest Sun
plug-in, not due to any "Java destroying proprietary feature" the
applet author used in the applet, but simply because something has
changed between Java 1.1 and 1.4 and the applet needs updating,
which the game site doesn't seem willing to do. I ran into this
with my parents... updated to the Sun JRE, my mom complained her
games didn't work anymore, had to remove it.

It is up to web page authors and applet
developers to convince the end users that
30 meg plug-in is worth it.

It is also up to page authors and applet developers to make sure
their offerings work properly in the newest Java plug-in. Heck, you
have sites *recommending* the Microsoft JVM:

<url: http://www.jippii.co.uk/jsp/games/java_help.jsp />

"If you are running Windows XP there is a good chance that you are
running the Sun Java plugin because Microsoft stopped including the
Java Virtual Machine with Internet Explorer recently.

However, after considerable testing here at Jippii we now recommend
that to achieve the best performance from Jippii's Pasiworld games
you should install the Microsoft Java Virtual Machine. It's this
version of the Java plug in that work the best."

<url: http://www.minatrix.com/servlet/view?file=/faq.html />

"Our applets run best with Microsoft's JVM (Java Virtual Machine),
or Netscape JVM 1.1 (found in Netscape 4.09 and up to 4.x)."


These sites and applet authors are well aware of the current
situation, they are well aware of the fact that the Microsoft JVM
is obsolete, the second url acknowledges the applets work with the
Netscape JVM (so no "Java destroying Microsoft proprietary
features" have been used), they have just recognized the fact that
their applets work *better* with Microsoft's JVM and are
*recommending* it.

Given the level of confusion and conflict in the Java community
over which JVM is "better", its easy to see why the general public
is falling back on Microsoft's JVM ("because my favorite game site
told me to download it!"). Until Sun can fix the startup
performance problems with the JRE and those advocating Java can get
their act together and convince people that it worthwhile
downloading a 15MB plug-in and having their system hang for 5
seconds when they visit a site with a Java applet is worth it,
applets will continue to be written to version 1.1.

 

[Grant Wagner]

For some value of "not updated". MS has from time to time fixed security
problems in the VM. They "just" didn't update the language to some
decent standard.

They *can't* update their Java implementation. The decision Sun got in court
decided that. As a result, Microsoft is unable to provide a Java
2-compatible JVM because *Sun won't let them*.

I would simply refer people to MS' own statement about their VM on

http://www.microsoft.com/mscorp/java/

Why should "we" waste time by trying to explain to people how MS let
their own customers and users down?

They were ordered not to change their JVM (except for bug fixes and security
patches) by the courts at *Sun's request*. Now you're advocating that they
should violate the court order to produce a Java 2-compatible JVM?

 

[Thomas G. Marshall]

They *can't* update their Java implementation. The decision Sun got
in court decided that. As a result, Microsoft is unable to provide a
Java 2-compatible JVM because *Sun won't let them*.

You seem to understand this historical legal hoo hah better than I do (the
decisions made me dizzy), but I thought that the key here is "compatible".
MS's notion of compatible was historically to hijack the language. As a
result, when it came time to sue MS for not supplying updated java's, this
got confused with disallowing MS from updating the java's /their way/.


....[rip]...

 

[Andrew Thompson]

With a cert they have to prove you are
you. It is quite a production, at least for the customer getting all
the documents. Presumably they do some cross checks too.

(shrugs) *presumably*?? I do not doubt the claim,
I am merely ..interested at the lack of certainty
in that statmement coming from a Java developer..

If people were telling me that SSL was ..presumably
better than no protection, and do I want to purchase
it now? My answer would be "come back to me with
something more concrete than 'presumably'"

What actually gives you, I or an end user any
form of guarantee that the certificate holder
has anything more than 'enough money to pay for
the certificate'..

See http://mindprod.com/jgloss/certificate.html

However, it can't be that difficult since you can get cheap certs.

Where? I followed the Thawte link and eventually
stumbled through there site to the place they
listed prices..

1 Yr | New - $200 | Renew - $160

Now, even if they *can* justify all that money
for the initial registration, how does it
explain the $160 per year just to change the
dates on their computer records?

Is anybody seriously suggesting they
*reverify* your identity?

[ And even though your reject the connection,
I am still amazed that by comparison, my server
(full Java, w D/B thrown in) costs just $120/annum. ]

Verisign in making you pay through the nose for brand recognition. It
is a form of status symbol.

I might refer to it as any number of different
things. 'Daylight Robbery', 'Highway Robbery',
'Rip-Off', 'Certificate to prove you have money'...

Am I ranting yet? Time for bed.. ;-)

 

[Andrew Thompson]

There are also hundreds, possibly thousands of people a day
downloading the Microsoft JVM from unofficial sources because
either:

a) it starts up faster and.. ...
b) their favorite game site doesn't work right in the newest ..

You forgot 'c)'
c) They need to reinstall it to fix the Applet
tags broken by the unmsvm.exe, so that they can
*then* use JVMClean to strip it back out, and still
be able use applet tags with Sun VM.

 

[Liz]

So this 'makeshift outfit' would
definitely be off your list?
<http://www.physci.org/install/security.jsp>

Actually I am positively curious now..
if you saw the download page first..
<http://www.physci.org/install/download.jsp>

With it's big, clear link to the other page
I mentioned.. could a statement like that
on the 'security' page possible *change* your
mind on accepting the certificate from an
..untrusted authority, ..trusted unauthority,
..the guy too cheap to pony up $250 a year
to buy a certificate for his free software
suite?

In the 50's and 60's it was the good comunist that
was first to salute the usa flag. Today it is the
crooks that shout "hay, trust me, nothing bad is
going to happen, and besides there is this $500,000
thing from my bank that I will split with you if
you tell me your ssn"

 

[Sudsy]

Grant Wagner wrote:

Given the level of confusion and conflict in the Java community
over which JVM is "better", its easy to see why the general public
is falling back on Microsoft's JVM ("because my favorite game site
told me to download it!"). Until Sun can fix the startup
performance problems with the JRE and those advocating Java can get
their act together and convince people that it worthwhile
downloading a 15MB plug-in and having their system hang for 5
seconds when they visit a site with a Java applet is worth it,
applets will continue to be written to version 1.1.

Can't say that I disagree. When I absolutely HAVE to use an applet
then I code to the 1.1 standard. So crucify me! I don't have need
of Swing and all the other fancy features that the "latest and
greatest" JVM provides. If you need something more complex then
you should looking at a Java application or perhaps JWS.
Of course that's just MHO...

 

[Roedy Green]

Where?

the whole top part is prices.

 

[Andrew Thompson]

the whole top part is prices.

My apologies, I missed that part and found my way
to a link that led to Thawte..

You have an odd idea of 'cheap'. To me, cheap
and 'cert' would mean (at an absolute maximum)
$50. Prices listed start around $159 - $199
and go to $400 and beyond. Per year..

I am unconvinced that any of *those* prices deserve
the 'cheap' moniker, and stick by my original statement.
'Highway Robbery'

OTOH, there was a mention in your page of 'free for
Open Source' certificates, from 'Certrum'. That is
of particular interest to me, ..I might investigate
that further, in that if I could secure a certificate
from them it would soften my objections to the prices
of the other forms of certififcate.. If I follow that
through and come up with any new information, I'll
drop you an email..

[ Thanks ]

 

[Roedy Green]

OTOH, there was a mention in your page of 'free for
Open Source' certificates, from 'Certrum'. That is
of particular interest to me, .

The problem with Centrum is they don't have the political clout with
Sun to get their roots installed automatically in cacerts.

That is what you pay for really, possibly some sort of bribe. It is to
Verisign's advantage to keep that list as short as possible.

If you are interested in subverting them, have a look at
http://mindprod.com/projects/rootcertinstaller.html

With an easy tool to install a set of root certs from the smaller
companies, competition would heat up and prices would have to drop.

The problem then is finding a big name to back you so that big
companies could trust your program to install only genuine certs.

You might have to offer it as open source and even free.

Heck, you could even go into the cert business yourself.

 

[Roedy Green]

I am unconvinced that any of *those* prices deserve
the 'cheap' moniker, and stick by my original statement.
'Highway Robbery'

Verisign is $400 US a year. Certum is $147 which in most domains
would be considered relatively cheap.