The point about certificates and signing

If you ever tried to use BitLet, you should have encountered a window that says you that the signature of the applet cannot be verified (see the screenshot below).




Since some users appear to be quite puzzled about what is the exact meaning of that message, we will try to shed some light on this issue.

Let's start from the beginning...
In order to protect users from malicious applets, the JVM (Java Virtual Machine) considers the code of applets that are embedded in web pages to be untrusted, and it is executed in a sort of sandbox, which prevents it from executing any action that could (possibly) harm the client system.

This means that, by default, common Java applets are not allowed to perform some tasks, including opening network connections to other servers or to access the filesystem of the client machine on which they are running.

Obviously, any bittorrent client (including BitLet) needs to perform both those operations to be of some use, even without intending to do any harm.

In order to overcome this problem, the applet is digitally signed, i.e. it is signed using a digital certificate that ensures that the applet comes from the certificate holder.

This brings us back to the first line of this post. You are seeing that annoying message because the certificate used to sign BitLet is not issued by a trusted Certificate Authority. Actually, it was generated on a common development box. Why?

Because code signing certificates cost. And they cost a lot of money, too.

If you know any CA that issues that kind of certificates without charging outrageously high prices, don't hesitate to let us know or drop us a line in the comments.