The Symbian Signed Story, Part 4
Posted by Craig H on 2 July 2010
It really is time that I brought my very occasional series of posts on the history of Symbian Signed up to date. We have some future changes in the pipeline that we are hoping will make things still less of a burden for developers, and I think it’s helpful to put that in the context of what has gone before (a 6 year history of incremental improvements).
In the last instalment, I had got up to 2006, when the first phones with platform security started shipping. This was a major turning point in the perception of Symbian Signed, as before then it was an optional thing for developers, but afterwards it was a requirement for access to the more security-sensitive APIs on the platform. I’ve already explained (I hope!) why that was necessary, but it did mean that some developers who would really rather not care about security now were forced to, and started to complain very loudly about it.
The first significant change in the Symbian Signed processes came in late 2007 with the introduction of Express Signed. Prior to that, all submissions had to undergo individual testing by a test house, which the developer paid for (typical charges were in the region of $300-$400). With Express Signed, the developer was not required to pay for individual testing, but they affirmed that they had performed the tests themselves and that the submission passed the test criteria. A percentage of the submissions were audited by a test house after being signed; the costs of those random audits were spread across the charges for all submissions, so the charge per submission was much reduced, down to $20.
The previous, paid-for individual testing, process (now called Certified Signed) was kept for those that wanted the benefits of an independent tester. Certified Signed was also still required for applications that used the seven most dangerous capabilities (
The next change to Symbian Signed processes was the introduction of Open Signed Online in early 2008. Prior to this, developers of applications using more than user-grantable capabilities needed a Developer Certificate to test their applications on a real phone.
Developer Certificates for one phone with most widely used capabilities were available to developers for free, but to request a certificate for multiple phones or more sensitive capabilities a paid-for Publisher ID was needed. Developer Certificates are now called Open Signed Offline because you can use them to sign a new build of your application at any time without going back to the Symbian Signed portal.
Open Signed Online, on the other hand, was introduced to avoid the complexity of having to download the devcertrequest tool, submit a certificate request, download and install the certificate, and then sign your SIS file. It’s a free service that allows developers to simply upload an application that they want to test on their phone (identified by its IMEI) and then download a signed copy of it that they can immediately install. After this, developer certificates were only available for developers with a Publisher ID, as Open Signed Online was simpler for those without one.
The most recent change to Symbian Signed came with the introduction of considerably simplified test criteria, resulting from a public discussion in the second half of 2009. The aim was to concentrate on testing that the application didn’t damage the device operation or configuration, removing some of the tests that were more targeted at general quality issues in the application itself. As a result of the simplified criteria, the charge for Express Signed submissions was reduced to €10, and the charge for Certified Signed testing was reduced to €150, in early 2010.
Looking back over the 6 years, the various incremental improvements have added up to a substantial reduction in cost and inconvenience for developers. When Symbian Signed was first introduced, it could cost well over $1000 for a developer to get their first application signed for public distribution ($395 for a Publisher ID and $800 or more for testing of a complex application) and turnaround could be several days; today the same application could be signed for a little over $200 ($200 for a Publisher ID and €10 for Express Signed) with no waiting.
Even so, we acknowledge that this is still too expensive for many small-scale and independent developers, and the next round of changes should provide another big reduction in the costs. Stay tuned!