Don't worry, I didn't miss the point - and I designed a good number of the test cases for the OS.
The model is designed for limited permissions for individual developers (focus on developers, not users) and doesn't cost "thousands" for an enterprise signature for signing multiple IMEI's. One sig. will sign multiple apps for multiple IMEI's for commercial developers and enterprise admins. Java is intended as the primarly enthusiast development environment on Symbian OS.
The type of sig you get depends on the kind of permissions you request.
Muddle through before V9? Yeah, in limited comms environments, non 3G, non WiFi, single contexts. The OS introduction was timed and driven by 3G deployments. Sorry, but the world is a scarier place now, and the OS has to balance the intrests of governments, manufacturers, operators, enterprises with those of the developer and the individual. Great pains were taken to avoid the mess that is the Windows security model.
As an enterprise if you're deploying commercial apps you pay nothing. If you're developing apps, you need a sig. It allows you to control where your app goes, and doesn't go. It also alows you to restrict what employees can put on your devices... not something the other OS's are capable of.
The kind of myopic view you're taking is exactly why we designed the security model the way we did.
Yes, of course you should have to rely on the servers for signature issuing and validity cheques... That's what it's designed for. Otherwise you wouldn't be able to revoke a certificate that is misused. The model of course allows for the servers not being reachable, and madatory validity checks are not (yet) required on application install by most manufacturers (but supported by the OS).
Most real developers understand that. A majory security on an OS's could result in boycotting of devices based on that OS... by operators and enterprises. All of a sudden the market for you applications dries up. We're already seeing a backlash to the RIM outages. Be thankful that Symbian has put more thinking into it than Microsoft, RIM, Google and Apple combined.
And lose the attitude, Chip. Just because it's a free country doesn't mean you can do what you want.
I want to be able to do what I want with
my phone, not yours. The developer certificates are tied to one specific IMEI (
my phone). The signed program will not run on any other phone. Why, then, do I not get all capabilities when signing an app to run
solely on my phone?
Besides, we somehow managed to muddle through before Symbian 9.
Also, as an enterprise, I shouldn't have to pay thousands of dollars to install an app on phones my company owns. Perhaps making it possible to set up our own chain of trust would be one way of going about it. I shouldn't have to rely on the continued functioning of Symbian's servers to write an application and run it.[/QUOTE]