Windows Mobile 5 Signed Applications Snafu

[Bob Russell]

We recently reported that the way Windows Mobile 5.0 handles signed applications meant a workaround for ozVGA was necessary to run in VGA mode.

But it seems that this is a more general problem with Windows Mobile 5.0. As I understand it, the OS requires all applications to be digitally signed. On the surface this is a way to guarantee compatibility and safety of the program.

Both the application and the MUI (Multi User Interface) files need to be signed. The MUI files are used to provide things like multiple language support. This would not seem to be an issue because when an unsigned application is launched, you are asked if you want to run the unsigned application and consider it "trusted." That would be fine except for the MUI files when the "security prompt" feature is enabled.

Then when the application is not signed, even if you give it permission to run the application, it can't see the necessary MUI files because they are also not signed. But now you don't have another prompt to accept them, so the program will not operate as expected.

Basically, this forces applications (even freeware apps) to go through an expensive signing process. If they don't, then they get the security message prompt, or if they have MUI files they don't work at all.

This is all a bit beyond my technical understanding, so if you want the full scoop, be sure to check out the two part article by Frank Garcia at PocketNow...
Windows Mobile 5.0 Snafu (Part One)
Windows Mobile 5.0 Snafu (Part Two)

[johnsoax]

Isn't that one of the reasons that the Zodiac failed? Because to use all of the features of the device, you had to get your program signed?

[Brian]

Originally Posted by johnsoax

Isn't that one of the reasons that the Zodiac failed? Because to use all of the features of the device, you had to get your program signed?

I won't go into a full Tapwave Zodiac postmortem here, but in the Zodiac's case the signing process was free of charge, as were the APIs.

For Microsoft to charge developers to have applications signed for WM5.0, IMHO they're shooting themselves in the foot by making the barriers to entry too high for small developers, and WM5.0 users will probably never see quality open source applications like TCPMP.

[johnsoax]

Originally Posted by Brian

I won't go into a full Tapwave Zodiac postmortem here, but in the Zodiac's case the signing process was free of charge, as were the APIs.

For Microsoft to charge developers to have applications signed for WM5.0, IMHO they're shooting themselves in the foot by making the barriers to entry too high for small developers, and WM5.0 users will probably never see quality open source applications like TCPMP.

I didn't realize that it was free, it could have sworn it wasn't.

I was pointing out that the Zodiac had signing trouble, so MSFT is definitely shooting themselves. Not that I am complaining .

[Brian]

Originally Posted by johnsoax

I didn't realize that it was free, it could have sworn it wasn't.

I was pointing out that the Zodiac had signing trouble, so MSFT is definitely shooting themselves. Not that I am complaining .

Aaron Ardiri goes into Tapwave's signing process here.

I was one of the developers behind the design and development of the DRM system - which across the web people are blaming the demise of the Zodiac on. It’s always nice to blame the DRM - pointing fingers at the likes of Apple and Microsoft has been fun; but, in this specific case; the DRM wasn’t to blame.

In the Zodiac's case, the requirement to use Code Warrior 9 to implement the Zodiac's unique features was a barrier to many due to its cost. Tapwave had a policy to sign pretty much anything including emulators, with the exception of Crimson Fire's commercial Nintendo GBA emulator Firestorm, for fairly obvious reasons.

In Microsoft's case with WM5.0, I agree that the signing process will likely prevent proliferation of freeware and open source applications by small developers.

[Chaos]

Originally Posted by Brian

In Microsoft's case with WM5.0, I agree that the signing process will likely prevent proliferation of freeware and open source applications by small developers.

<conspiracy-theory>
But, isn't that precisely what they want? Crush the developers who don't pay them signing fees, and give their software away? And of course they want to crush people who develop open-source even more, as everyone to compile the app would need to get it signed each time, correct?
</conspiracy-theory>

... That actually sounds more plausible in writing than it did in my head. Maybe it's not a nutty conspiracy theory after all?

[cbarnett]

Hmmm, I just can't help thinking MS have dropped the ball with this release of WM2005. Which is a real shame as WM2003SE has been a very usable and stable release. <sigh>