Java Security Issue(s)

[Jim Corner]

Since updating Java a little while back (I am now using 1.7.0_45; Java HotSpot(TM) 64-Bit Server VM 24.45-b08) I have encountered two problems trying to run Java programs. These are:

Problem 1. When building code using NetBeans 7.4 I get these errors:

Warning: Setting Codebase manifest attribute to '*' due to current JNLP Codebase. Set manifest.custom.codebase property to override the non-secure value '*'.

Warning: Unsigned and self-signed WebStart applications and Applets are deprecated from JDK7u21 onwards due to security reasons.To ensure future correct functionality please sign WebStart applications and Applets using trusted certificate.

Problem 2. I have played online chess for years at one particular site. Since the Java update I can not run the applet. I receive this error (paraphrased here): "application blocked because, even though it is on the Exception list, application to resources across multiple domains".

Am I going to have to purchase a certificate to fix these problems, or is there a workaround? By the way, I'm much more concerned about problem 1 than problem 2.

Thanks.

[aussiemcgr]

Problem #1 means you just need to set the codebase attribute in the manifest and JNLP page. That's not bad. The codebase just should be the website domain name.

Problem #2 is where it gets bad. The Java 7 Version 51 update a week ago has made it so unsigned and self-signed applets refuse to start. One solution is purchasing a certificate. But another solution is to instruct your user to add your website to their exception list. The error message about the application to resources across multiple domains is probably related to you not having Problem #1 resolved.

[Norm]

For problem#2 I assume that the website was created by someone else. Can you contact the author about the problem?
A project I thought of for those problems is a stripped down browser written in java that would read the html page, parse out the <APPLET tag, read the jar file and execute the applet code without any security problems.

I have a website that has an applet that is still working for me. It gives warnings, but allows the applet to execute.
Way Points

[Jim Corner]

Thanks Norm, but when I clicked on the "Activate Java Platform" pop up I get this error message (the same one I see with Chess.com) - "Your security settings have blocked an untrusted application from running". This baffles me because my browser security setting is medium, where the browser is supposed to ask me if I want to run the app, and then run it when I say yes. I don't know if it will help, but here are the error details:

Java Plug-in 10.51.2.13
Using JRE version 1.7.0_51-b13 Java HotSpot(TM) Client VM
User home directory = C:\Users\robert barnes
----------------------------------------------------
c: clear console window
f: finalize objects on finalization queue
g: garbage collect
h: display this help message
l: dump classloader list
m: print memory usage
o: trigger logging
q: hide console
r: reload policy configuration
s: dump system and deployment properties
t: dump thread list
v: dump thread stack
x: clear classloader cache
0-5: set trace level to <n>
----------------------------------------------------

[aussiemcgr]

Is the website in your Exception Site List? If not, that would be the reason. It might not be your browser security settings blocking it, but your java security settings.

[KevinWorkman]

Thanks Norm, but when I clicked on the "Activate Java Platform" pop up I get this error message (the same one I see with Chess.com) - "Your security settings have blocked an untrusted application from running". This baffles me because my browser security setting is medium, where the browser is supposed to ask me if I want to run the app, and then run it when I say yes. I don't know if it will help, but here are the error details:

Java Plug-in 10.51.2.13
Using JRE version 1.7.0_51-b13 Java HotSpot(TM) Client VM
User home directory = C:\Users\robert barnes
----------------------------------------------------
c: clear console window
f: finalize objects on finalization queue
g: garbage collect
h: display this help message
l: dump classloader list
m: print memory usage
o: trigger logging
q: hide console
r: reload policy configuration
s: dump system and deployment properties
t: dump thread list
v: dump thread stack
x: clear classloader cache
0-5: set trace level to <n>
----------------------------------------------------

This isn't an error, it's just the default text that pops up in the Java console.

I wrote a tutorial on changing your security settings here: Deployment - Tutorials - Static Void Games