On 26 Mar 2012, at 19:38, lkcl luke wrote: > On Mon, Mar 26, 2012 at 7:30 PM, Scott Wilson > <[email protected]> wrote: >> >> On 26 Mar 2012, at 18:57, lkcl luke wrote: >> >>> On Fri, Mar 23, 2012 at 10:12 AM, Scott Wilson >>> <[email protected]> wrote: >>>> See: http://www.w3.org/TR/widgets-digsig/ >>> >>> well now, scott - that is veeery interesting, and incredibly useful, >>> because it is *exactly* the same thing - bar the file-formats - that >>> all the top GNU/Linux Distributions do. >>> >>> thank you very much for this: i'll add it to the wiki in the section on >>> https://wiki.mozilla.org/Apps/Security#Secure_Application_Distribution >> >> np :) >> >>> >>> btw do you happen to know of any actual implementations (especially >>> free software ones)? >> >> There is a GSoC project to implement it in Apache Wookie, which already has >> student interest, so I'm sure we'll have an open source implementation by >> the end of Summer :) > > eyy, superb. > >> On the commercial side, its been implemented by Opera, Nokia, Vodafone, >> Samsung, Obigo, RIM and a bunch of web TV platforms as its part of a lot of >> other spec stacks in the mobile and TV space such as WAC, MPEG-U, HbbTV, CMX >> (etc). >> >> There have been some packaging and signing tools supporting the specs issued >> as part of SDKs, e.g. the Vodafone widget packager and the WAC SDK (I think >> Samsung/Limo wrote that one). I think the Blackberry webapps signing tools >> also uses widgets-digsig as Blackberry Widgets are W3C Widgets - I seem to >> remember RIM open-sourcing most of their Widgets code last year so that may >> be another lead. > > wow. that's... rather cool. that gives plenty of leads for the B2G > team to investigate (hope you don't mind but i'm just going to > cut/paste most of what you've just written up onto the wiki, so it's > not lost in the noise).
(Not at all, glad to help...) > but... that actually means that it's a standard that's *already* > being adopted by the very telcos (vodafone, RIM) that B2G is targetted > at. interesting. The W3C Widgets family of specs was developed very much with mobile in mind, so its been adopted in one form or another by a lot of telcos and can be used on a variety of handsets and OS's. You can even make them run on a Nokia Series 40 :-o (I also seem to remember a note about B2G from Telefonica about it supporting WAC) ((There was some communication between Moz OWA and the Widgets groups ages back, but it sort of fizzled, partly as I think at W3C the focus was on packaged and installed apps, and OWA was more into app store APIs. And the people with the patience to contribute to both communities moved on)) > > hey, you wouldn't happen to know if any of the implementors of W3C > XML Digital Widgets adopted SSL at all, would you? the primary > expertise of the mozilla team is of course in SSL, and the continued > recommendation to use it has me deeply concerned. Hmm don't know - maybe worth a quick post to [email protected] > > l. _______________________________________________ dev-security mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security
