Today Niklas Heidloff tweeted about a new demo Java extension that have been published on OpenNTF. Besides being a very nice demo example it also has another noticeable difference from all other Java extensions that have been published so far. The difference is small although very important. The difference is that it’s digitally signed!
When installing Java extensions in Notes you have probably grown used to the “Are you really, really, really, really sure you want to install this unsigned Java extension in your Notes client”-prompt. Without thinking you probably click “Yes” out of habit which is why you may not remember the prompt. If you install this Java extension you wont see this prompt because it’s signed by a certificate you trust (it’s an IBM certificate).
Using jarsigner -verify -verbose -certs on the feature will yield something like this:
[entry was signed on 01-11-09 04:05] X.509, CN=International Business Machines Corporation, OU=Lotus Software Group, OU=Digital ID Class 3 - Java Object Signing, O=International Business Machines Corporation, L=Westford, ST=Massachusetts, C=US
The difference is small but very important. You did notice it didn’t prompt you right?
lekkimworld.com 