Security Concerns with NetLogo - java

I'm quite new to NetLogo, but I'm very interested in learning more about it. Currently I'm trying to get my company to allow it to be installed on our corporate network, however I'm being denied by IT security because "The product is capable of producing stand-alone executables."
So my questions to you guys are:
Is NetLogo capable of compiling java code, or does it merely use externally-created (via another not included program) JAR files as extensions?
Are any of the programs (Netlogo, Netlogo 3D, HubNet, or Behaviorsearch) included with the NetLogo 64 or 32-bit installers capable of creating standalone executables?
Do you know of any way to leverage the Netlogo suite for malicious purposes?
Thanks for taking the time to read this. Any help would be greatly appreciated.
-Jeff

Previous versions of NetLogo were able to create a jar file that ran the model without having NetLogo on the computer. I believe this has been depreciated, but it might be the source of the concern.
This seems to be in reference to NetLogo applets. It's true that the newest versions of NetLogo don't allow making applets anymore. But even in the older versions that have applets, the NetLogoLite.jar file used is precompiled and is always the same, only the .nlogo file varies from model to model.
Is NetLogo capable of compiling java code
no
or does it merely use externally-created (via another not included program) JAR files as extensions?
yes
Are any of the programs (Netlogo, Netlogo 3D, HubNet, or Behaviorsearch) included with the NetLogo 64 or 32-bit installers capable of creating standalone executables?
no
Do you know of any way to leverage the Netlogo suite for malicious purposes?
Yes, you can write an .nlogo file that does something malicious when run (run within NetLogo, not standalone), most easily by using the https://github.com/NetLogo/Shell-Extension/ . You could even put the malicious code in the model's startup procedure.

Related

How to package all required libraries with .so file linux

I am attempting to port an application that was written with a combination of c++ for the back end, and java for the front end. This application relies on the library opencv 2.4.13, which is outdated, as well as multiple other libraries. The concern i have is that i do not want the end user to need to install these dependant programs, as they have been proving challenging to install on any but a select few linux distributions. I believe the term i am looking for is statically linking, but i'm a bit unfamiliar with c++ compilation at the moment, so i am unsure the steps i need to take to make these files portable. The java application requires these files to be libraries, and while i have managed to get them to compile on one machine, the problem seems to be getting them to run on a different one after compilation.
Don't bother - this might also give you licensing problems, depending on what libraries you need.
Instead, just figure out what platforms your application is supposed to run on and package the libraries for each platform with your jar - or download them at startup, or provide them as a separate package. The exact mechanics you choose depend on your use case, the point is you don't need to rely on system wide installs.

Difference between running java program using jar file or installing onto a system using Izpack?

is there a difference between using my java program as a jar file as opposed to using a software like IzPack to create an installer and install it onto a system ? Does it make any difference performance wise and what are some benefits ( if any) of going either way ( aside from creating shortcuts) ?
Using jar directly allows it to be used in other machines.
If you were to use IzPack to create an installer, it will still work in other systems after installation.
As far as I know, there is none performance-wise.
Your question is very vague.
Some tools like WinRun4J can be helpful to optimize the amount of memory available for your program at startup. WinRun4J and PackR allow to use a custom name for the executable which is useful if you want to hide the fact that your program uses Java.
Some web browsers under some operating systems break the downloaded JARs by wrapping them in ZIPs for "security purposes".
Some tools use a fat JAR in input and produce a kind a native bundle which is more familiar for the end users, PackR and JNDT produce APP files for OS X, JNDT produce RPM and DEB packages for GNU Linux.
Whether it is a jar file or Izpack installed java app, there won't be any performance difference.
The main differentiator I see is the user experience. For simple applications it doesn't make much difference. But for any medium to large scale application which needs to perform some prerequisite checks, capture configuration data from user, upgrade the application etc, installer helps a lot in making installation more user-friendly.
So using Izpack or in any installer in general, improves the user experience. Some of them I can think of are:
Installer can perform any software prerequisite checks before
installing the application.
Allows user to choose the installation location
Prompts for any required input parameters or configuration and validating it
Allows the user to enter these input or configuration data
Upgrades the software by taking care of any data software or data/configuration migrating and ensures proper rollback in case of
failures.
Without the installer most of these need manual intervention and installation becomes more error prone, manual errors and becomes a tedious job for the user.

Matlab Builder JA - Compile Matlab into a Java jar - Free Version?

Please keep in mind that I know nothing about Matlab.
Matlab Builder JA lets developer build Matlab applications and export them into Java jars. That's great, I just have to produce a jar and I can then use it from other java code.
Does anyone know how much the single jar packaging module cost?
Is there any free version or similar freeware product?
Is there any other way to achieve the same thing -Using Java to pass inputs to Matlab and getting an output back without worrying about anything else- with standard Matlab/Java?
The Matlab JA Builder (also referred to as the Matlab JA Compiler) runs about $5k, but for the deployment to actually work you also need to get the MCR Toolbox, which is about $4k. This is of course on top of an existing Matlab installation which will run you about $2k. So for about $11k you can have a fully armed and operation workstation that converts .M file functions to a compressed .jar file that can be used in an arbitrary Java application. The cool thing is that these license fees give you a site license for DEPLOYMENT... meaning it is free to deploy any .jar file produced by this setup at the site that pays for the licenses to any target machine. The target machines do NOT need matlab installed. OS support exists for Win/Mac/Linux/Solaris last I checked.
However be advised that the license structure is for one site and for one development machine. You want two developers working simultaneously? double the costs. You want to deploy the same app to multiple sites... double the costs. call Mathworks they're very happy to tell you precisely what you need and don't need and you'll probably talk to an engineer and not some call center drone. I did all this at a previous job in 2009.
MATLAB Builder JA for Java is currently £3,150 for an individual commercial license, and requires MATLAB Compiler, which is currently £3,850 for an individual commercial license. I'm in the UK so can't get pricing in other currencies, but you can get your local prices from the following links.
Pricing for MATLAB Builder JA
Pricing for MATLAB Compiler
Contrary to Birdasaur's answer, the products (and the deployed components) are not supported on Solaris - MATLAB itself has not been supported on Solaris since R2010a. You can also deploy the generated .jar files to as many sites as you like. Individual licenses can be either assigned to a named individual, in which case only that developer can use the product; or to a specific machine, in which case any developer can use it as long as they are at the console of the machine (not remotely logged in).
MATLAB also has an undocumented interface called JMI (Java MATLAB interface) that you can use to call MATLAB directly from Java. Take a look at matlabcontrol. However, this requires a live copy of MATLAB for the deployed application.
You should probably contact MathWorks about licensing. As this is fairly high end functionality I would speculate that it is quite expensive.
You should probably take a look at Octave which is licensed under GNU GPL. Also, there are also a wide variety of wrappers around Matlab, such as MLabWrap, however they require a Matlab version installed, so it would not work for redistribution or anything.

Implement Ahead of Time compilation (AOT) for Java based applications

We are in process of developing a commercial desktop based application in java using Rich Client Platform framework from Netbeans/Eclipse. The IDEs (Netbeans/Eclipse) provides nice inbuilt installer for packaging the application. The only problem is our end users can see jar files on deployment and we don't have enough protection of our intellectual property as reverse engineering is possible. Code obfuscation can be used to minimize the impact but can't avoid it. We were searching for open source solutions/products which can help us mitigate our problem by directly converting our application to native code something similar to what AOT is supposed to do.
Thanks in advance for ur help.
-Bhan
this was already discussed here: How do I create an .exe for a Java program?
You may transform an Eclipse RCP applications into a real EXE (or Linux binary) containing no bytecode using the product my company makes.
In general, an AOT compiler must be aware of the inner workings of such a dynamic framework or container, specifically its class loading, otherwise the original bytecode will be required at run time for consistency checks and possible JIT compilation. Our product only "knows" about Eclipse RCP and Apache Tomcat classloaders as of now (it always knew about the standard ones of course.)

Simple cross platform GUI app

I would like to know if there is any way that I could build a very simple GUI app (it doesn't even have to look good) that will run on a fresh install of Windows Vista and OS X with no other installations needed by the user. I would perfer not to use Java (just out of personal programming preference). I will use it though, if it is the only way. Specically, I am wondering if I can write a swing app with Scala or Groovy and run in on windows without them having to install anything. Sorry if this is a silly question, I am a Obj-C developer by trade.
You can pack the Scala jars into your own, which should work as long as Java is installed (which it usually is on a 3rd party vendor install of Vista or OS X). If you use Java web start, no installations are needed beyond Java itself. Plus, if you're going to install your own code, why not just copy along the Scala jars also?
If you really mean a fresh install--nothing but what the OS provides--then no, I don't think so.
Edit: You do always have javascript on the browser(s). I assume this won't cut it for what you want?
If you really, really don't want to install anything (or carry anything in your app), then write the application as a web app (possibly a javascript app). Then any user can run that UI from any machine with a decent browser. But then, this will require that you host the app somewhere.
If that is not an option, you can develop your app to as a single html/xhtml file containing a self-contained, self-modifiable javascript application (like TiddlyWiki which I use a lot). Then the user user can download on it on his machine, point his browser to it and voila.
If you combine javascript with HTML5 (and assuming the user has a HTML5 compliant browser like safari), your application can use localStorage to keep its state in the user's machine (thus no longer needing to be self-modifiable to save state as TiddlyWiki does.)
But this would break your rule of not downloading anything on the user's host machine. It is a chicken-and-egg problem that has no solution since each OS implements its own set of application libraries. For multi-platform support, you must use a layer that abstracts out differences between operating systems, be it a vm (like JVM, Ruby or Mono) or a set of libraries (Qt, Gnome).
As far as i know you won't be able to accomplish that with no other installations needed by the user. If you violate this restriction, mono (with gtk#) is a good choice.
Scala and Groovy will have the same deployment issues as Java; all of these require a JVM to be installed. You generally have to first install the JVM (which is not included with Windows) and then install your program. Java is included in OS X, however.
It is possible to use Ruby or Python and one of the cross platform libraries (like wxWidgets) and compile these to an executable file that includes the entire set of runtime libraries (e.g. all of ruby and python).
REAL Studio (formally REALbasic) certainly meets this requirement. It creates native applications that have no external dependencies for OS X and Windows (plus Linux).
In theory you could write a .net application using Mono that it should run without issues on any other one with the .net runtime environment installed.
But I'm not sure if it will work on practice.
I've had some success with XulRunner
There's also a couple of recommendations from these questions I asked
Building Cross Platform app - recommendation
Building XUL app a-la SongBird
XULRunner is pretty cool once you get into it, but it's a tad confusing at first (I thought).. the folks on the mozilla google groups are really nice and helpful though!

Categories