Petition against Java Verified

[jleplat]

Real shame Nokia wants JV for ME apps.

paying for JV on a per phone model basis is unrealistic: Nokia's abundant output of new handset models makes the whole idea unprofitable.

Nokia would do well to start a database of their models, screen sizes, along with the JSR's supported and known to be working. I've often come a cropper trying out apps on phones which claim to implement a JSR, only to find that the claim is only partially true. This has hapened not just with Nokia, but also Samsung and others.

The JAD/Manifest of an app could state what minimum requirements are, and OVI could automate cross-referencing which models fit the bill.

Certification for bugs / malicious software should not be a reason to castigate all the developers out there. Nokia can just remove offending apps, refuse to list a vendor's apps, and for malicious apps, sue them: listing on OVI is not open to anonymous vendors.

So long as Nokia demands JV for Java apps, I'll just sell my mobile apps using alternative outlets, as I expect many other small developments house will. It's just not realistic to do JV when an app is meant to cover all phones which support MIDP 2.0 and a couple of JSR's.

[jkauppin]

Nokia should create some lightweight certification at least for midlets. JV cannot find all bugs and anyway customers can easily vote if some app doesn't work. JV is really out of question because of it's price.

[pjohnsen]

This is just sooo saaaad.

I'm sure there are many other indie developers like me who have good applications ready, but it's just not worth it to publish on Ovi, with these kind of requirements. As mentioned by others: both having to shed out hundreds of dollars for the JV certification (not to mention all the time and hassle), the 50 USD sign-up fee to Ovi and on top have Nokia take 30% of the net revenue .... the business case for many small apps and games just disappears.

Come on Nokia, please help us small indie developers make Ovi and Nokia devices fulfill their potential, instead of setting up barriers like this.

Why not make JV optional and make it visible to the end user if the app. they are about to purchase has been certified or not? Most users will be able to understand this.

Btw. can a Nokia rep please confirm whether JV is really needed for Ovi or if signing with Verisign/Thawte is enough.

Sure hope Nokia understands the bad implications of this barrier,

-Pelle

[grahamhughes]

I have to confess, I am one of the (apparently few) people who want some barriers to entry. I'm sure there are many individual developers with good products, but I fear that making Ovi too open will just result in every undergraduate final-year project appearing on there.

Minimizing the cost also makes it too easy for people to give software away. Some people might not need to make a living from mobile apps, but some of us would like to!! Freeware on Ovi benefits unfairly from Nokia's marketting expenditure, paid for out of Nokia's cut from our application revenue. I don't know what the price bands are, but personally I'd rather there wasn't a "free" option.

Remember that if you get a JV pass on a device like the N95, you get automatic passes (free!) on about 20 other devices. So it's not $150 (or whatever) per device.

Barriers are still very much lower than those involved in selling through many operators (such as, long lists of devices that must be supported).

Pelle: I like your idea of indicating to the customer whether each app has been certified. I'd be much happier having my certified app listed next to your uncertified app, if mine has a big green tick (or whatever) next to it. After all, you'll have the advantage of being able to sell at a lower price. I agree, I'm sure everyone understands the concept of independent testing. A scheme like this would seem to satisfy everyone.

I also echo your request for confirmation on the actual requirements.

Cheers,
Graham.

[pjohnsen]

I totally agree, that having Ovi flooded with bad quality apps will not benefit anyone.

However making the business case for many good, small apps/games almost impossible is to me going too far in the other direction.

Another option to consider is something like XNA Community Games (http://creators.xna.com). They rely on peer review of submitted apps. I don't know if this scheme would work in a setting with so many different devices, but I kind of like the idea of getting my app. peer reviewed by other developers just like me. Anyway just a thought.

-Pelle

[pjohnsen]

I found this wording from the slides of the publish to Ovi webinar (http://www.forum.nokia.com/info/sw.n...nar_perry.html - omg. who makes up those urls):

"Java applications for S60 and Series 40 devices must be either Java Verified or approved by Verisign" (slide 10)

I wonder if approved by Verisign just means that the app. is signed with a Verisign cert.

[grahamhughes]

Yes, no idea what "approved" by Verisign suggests. They're not a testing house, that I know of. It must simply mean "signed with a Verisign certificate". Hmmm... last time I checked, you have to sign an app before you can submit it for JV anyway, so the implication would basically be "Java Verified is irrelevant".

There's another thread that might interest you: OVI publishing - Java Verified certificaiton a requirement for J2ME or not?.

Ultimately, there's not much point us speculating. Nokia's reluctance to clear the issue suggests that they haven't quite made up their minds. They need to pull their fingers out.

Graham.

[pjohnsen]

Thanks, I've been following that thread too.

I'm currently considering preparing for JV. The thing for me is that the game I'm developing is something I'm doing in my spare time, so having to spend too long hours (and too much money) isn't exactly helping my motivation to get it published on Ovi.

It is actually a minor update to an old game, that back when it was originally launched went through heavy user and automated testing, so I know that the quality is good - that's why it's even more frustrating for me to have this barrier to publishing on Ovi.

I think that IF I decide to go through with JV, then I'll make a thread or blog telling about the experience. That would hopefully help others and at least make it clear how much trouble it is (or isn't).

-Pelle

[pjohnsen]

Hi again,

I've decided to try and go through Java Verified. I will start a new thread and tell about the experience.

-Pelle

[Laura_]

My bigger annoyance is that, apparently, Symbian apps do not require testing, even though a native application is potentially far more hazadous to the end-user.

I'm a bit confused about if Symbian applications have to be signed or not.

"Symbian and Flash Lite applications for S60 devices must be either Symbian express or certified signed."

Doesn't that mean that they do require testing, that for example carbide++ self-signing isn't enough?

[jimgilmour1]

I'm a bit confused about if Symbian applications have to be signed or not.

"Symbian and Flash Lite applications for S60 devices must be either Symbian express or certified signed."

Doesn't that mean that they do require testing, that for example carbide++ self-signing isn't enough?

Symbian has to be Express signed by a signing house, see links

Step by Step instructions to Express signing

Ovi Developer - Getting Started

Jim

[grahamhughes]

I'm a bit confused about if Symbian applications have to be signed or not.

"Symbian and Flash Lite applications for S60 devices must be either Symbian express or certified signed."

Doesn't that mean that they do require testing, that for example carbide++ self-signing isn't enough?

As I understand it, Express Signed applications are not tested as part of the signing process. They might be randomly selected for testing some time later. Or not. The end user has no guarantee that an Express Signed application has been tested.

Express Signed Guide - Step 6: Auditing and Test Criteria Compliance

Graham.

[rippe]

Moro,

This means that both Symbian Signed Certified Signed and Express Signed are accepted. Which one to use is up to the set of capabilities which the application uses and if the application meets the Symbian Signed quality. Using Express Signed means you can test your application on your own and then sign it. If your application does not meet the required quality (Symbian Signed criteria) you will end up wasting time with the OVI submission.

As for what comes to Java applications things are bit more complicated, but here comes something to clarify with.

The applications must meet the Java Verified application quality in order to be accepted to the Ovi Store. The test criteria can be found from www.javaverified.com. You can also use the Java Verified program to get your application tested and signed.

If you are confident with your application's quality you can also sign them by your self. To do that you can use the VeriSign or Thawte Code Signing certificates.

The main differences are that with Java Verified the applications are tested by a test house and after passing the testing they are signed. With VeriSign and Thawte code signing certificates you do the testing on your own and sign the application.

When looking deeper with the differences, the Java Verified used root certificate is more available than VeriSign or Thawte. If a device does not have the root certificate the application will not install. The applications pass through time is quicker with Java Verified applications as they do not require that much testing.

The one of the most considerable differences is that the Java Verified signature is valid for ten years. VeriSign and Thawte signatures are valid as long as the signing certificate is valid for, which means one to three years at the best. To give an example, when purchasing a two year valid VeriSign code signing certificate on the 15th of June 2009 the validity of the certificate expires on the 14th of June 2011. All signatures made with that certificate are valid until 14th of June 2011no matter when the application is signed. So an application signed with such a certificate on the 23rd of July 2010 is valid until 14th of June 2011. In comparison a Java Verified application signed on the 23rd of July 2010 is valid until 23rd of July 2020. After the signature expires the application will not install.

I recommend you check out the latest criteria of Java Verified and the coming changes in the site next week.

[grahamhughes]

The applications pass through time is quicker with Java Verified applications as they do not require that much testing.

Is that true? Are you speaking on Nokia's behalf when you say this?

Graham.

[rippe]

That is what the QA manager of OVI said to me.
Risto