Freeware or not?

[stenlik]

I developed network tool application (ping + sending some custom TCP/UDP packets), which I use only for my internal test purposes in our company and which will never reach the market. This application will be enhanced/changed many times as new requirement for fuctinality will arise. Until now I wrote code only for pre-Symbian9 devices and I had no problems with it.

I tried to read all available materials I found about platform security and signed process, but I still don't clearly understand what I should do. Can you correct me?

As I will need access to phone manufacturer approved capabilities "Network control" and I develop for both UIQ3 and S60FP3 I will need approval from both manufacturers (Sony Ericsson and Nokia) to get developer certificate and I will be forced to renew it every 6 months. Additionaly I'll need ACS Publisher ID from Verising, which is necessary for signing the application before requesting developer certificate? Everything could be done via www.symbiansigned.com page?

There's also way how to certificate freeware applications, could this apply on my case?

Thanks a lot
BR,STeN

[symbianyucca]

As far as understand, basically the freeware wouldn't apply for applications that are meant to be used only internally in the developing company, since the freeware signing authority also keeps some distribution rights for the app.

Anyway for manufacturer capabilities, you should usually have a business case, or the company internal functionality would need to be justified clearly before you would be able to get them to approve the capability.

Basically, if you would use it only for development time and wouldn't need it to be used for release signing, then you woud need to get it approved only by one party and you could use the same developer certificate for other apps as well (though I'm not 100% sure if they really check the IMEI's included in the certificate request, if so, then it also could be that you would need to request it from both)

Anyway, developer certificates are valid only for 6 months, thus you would need to renew them accordingly, and they require verisign id, thus you would be required to get it and renew it every year as well.

My suggestion would be to contact your Nokia BDM before requesting to ask what he/she thinks about the case, so you woudln't do unnessessary work for nothing. I think you might have a problem if you don't have business case to support the requested capability, thus you should think it a bit, before requesting the capability.

yucca

[stenlik]

Hi yucca,

many thanks for your response. I have the same opinion as you. I understand the necessity of signing/makeing platform secure, but it brings a lot of additonal problems to me. You're right that tha best way is using DevCert, which was obtained for other project for sharing between many test or "test&try" applications - that's what I will do. Or I'll move part of my work to Qtopia linux platform from Trolltech...

I have in my mind another scenario, which as I think could be quite problematic... Could you please comment it also?

Scenario 2
----------
First (trial)release of our application was prepared for customer. It was tested and signed and it's almost ready for beta release. Even that our testers test the release, as we develop mainly quite comprehensive network clients there is 100% probability that there are plenty of bugs we don't know about, which will be discovered by customer entry test process. The agreement with customer is that "major" bugs must be fixed within 3 days and every week on Friday we must deliver new release. This will be done for 2 months until customer accepts the quality of product. Now as I understand every release we will made must again and again pass the sign process. I cannot imagine now if this will be possible or not, because until now I havn't such big experiences with signing...

And another issue: As the deaqdline for project is usually very strict, we don't implement some functionality and let them to be done later. Also some parts of the code are written in hurry with keeping in mind that after the first release will be made we will return back to enhance or fix it. For this we will need to pass the process again... But that's the way how the mobile market is working - we don't have time for ideal application...

Could you please find a minute to comment it?

Best Regards,
STeN

[symbianyucca]

Hi Sten, always ready to comment, anyway my comments are just comments and can include mistakes, so if you think I'm wrong, or othervise disagree, its always good to verify things with second opinions from other people. And for other people reading this, please feel free to share your points of view here as well.

Signing will definetly make it harder to update applications, and if there is possibility for multiple updates in short time, it can be really annoying. Anyway, I would suggest you to first try talking some sence to the customer, and show them that normal signing process can take for a full week sometimes, thus your updates would be a week late.

Then you should also contact testing houses and ask what would needed to be done to get more priority for your signing processes to make it faster. You could maybe contact all of the testing houses and see if they can do something to get your signing processes faster.

One way that saves time is to open account in the testing house, thus when you send something in, it will be moved to testing directly after they get it, since they don't need to send you any bills to be paid, and you save at least one day on the process. Also you could maybe negotiate special pricing when using accounts.

And of course you should also get some IMEI's of your customes phones to be included into the developer certificates, so you could use non-symbian signed testing apps also.

-yucca-

[wizard_hu_]

And of course you should also get some IMEI's of your customes phones to be included into the developer certificates, so you could use non-symbian signed testing apps also.

Currently this kind of piloting is the most viable approach, for example Nokia itself also employs it.

The freeware signing process is way too slow for being integrated into on-going development, and also it is not really meant to.