What is the purpose for Java JNLP requiring a signature?
digital-signature, java, jnlp, security
Solution
You cannot just sign something - not if you want the browser to execute it without restrictions. The certificate that you use to sign your software must be signed using another certificate, and so on, until the chain of trust reaches a root certificate that has been installed in your browser.
While there have been a few less than diligent Certificate Authorities occasionally, you cannot generally get such a certificate without providing some proof of your (network) identity. That means that malicious people have to provide some sort of identification, little as it may be. Even more important, CAs are expected to revoke certificates that have been used for malicious activities, or otherwise compromised, thus limiting the extent of the exposure.
To get to your point, if you use a CA-signed certificate in your site and that certificate is used to distribute malicious software, the CA will revoke your certificate sooner rather than later. If, on the other hand, you use a self-signed certificate, the browser will ask the user to confirm its use. If the user goes through with it despite the warning, well, it's their own fault, ain't it? There is no general countermeasure to either stupidity or ignorance, after all...
Problem
I have only a limited understanding of security basics and things like digital signatures. I understand, for example, how digital signatures are useful in public key cryptography. I do not, however, understand why signing my JNLP is necessary, or what maliciousness it prevents against, nor can I find this info readily available. I have found that deploying unsigned JNLP's is allowed, but things like disk and network access are restricted. However, let's assume I am a malicious person who makes a Java application that will do something malicious to the content of your disk (and I disguise it as something else). I can easily sign this, deploy it, and you can come to my website, unsuspecting, and launch the app and have your disk attacked. In a case like this... what did the signature accomplish? More to the point... if anyone can simply sign an application with hardly any effort required... then what's the point? I'm sure I'm missing something painfully obvious... please enlighten me.