|
|
Security Instructions for Oracle Java
|
Go to the applet
Simple instructions to securely run the applet
... and avoid security warnings with Oracle Java... well, most of the time :(.
- Start Java Control Panel
- Go here to find Java Control Panel under Windows.
- Go here to find Java Control Panel on Mac.
- Open the "Security" tab and change the security level to "Medium". Note that this will lower your security level for all Java applets,
so you may want to bring it back up to " High " when not using the applet.
- Optionally, add the website below to the "Exception Site List" (NOTE: this setting seems to have no effect in current Java version.):
-
Run the applet by following the link above.
-
If a "Security Warning" pop-up appears, select
"I accept the risk and want to run the application". Then
click the "Run" button.
IMPORTANT: When running the applet from the University of Arizona site, do not use https://..., i.e. always
choose this link:
http://alamos.math.arizona.edu/~rychlik/JOde
The reason is that alamos has a self-signed server certificate and marekrychlik.com has a commercial server certificate.
Details of Oracle Java settings
Recent "security enhancements" in Oracle's implementation
of Java flag all Java applets which are not electronically signed by
a certificate issued by a
commercial certificate
authority as unsafe to run. Signing with a commercial
certificate costs $$$ per year! In order to keep this Java applet
(JOde) free of charge, the applet is signed with a self-signed
certificate which you can inspect to check that the applet
has not been tampered with. Oracle's implementation of Java does not
allow a self-signed applet to run with the default security setting,
which is set "High". The applet will run without problems,
however, if the security level is lowered to
"Medium". To change the security settings to
"Medium", you should
start Control
Panel and use settings as shown:
Also, you can use the "Edit Site List" to add the JOde websites to "Exception Site List",
but at the time of writing this setting seems to have no effect.
Even with these settings, Oracle's implementation generates an annoying pop-up:
Linux users can alternatively use a free
replacement for Oracle's Java plugin IcedTea,
which can be configured so that it does not generate annoying security pop-ups.
Go to the applet
Enjoy,
Marek Rychlik (rychlik@u.arizona.edu)