Cgoban being blocked in a future Java security update?

[rottenhat]

Yes, I get the pop-up window to say that the application is downloading, but the progress bar never advances. Similarly, the applet just sits there allegedly loading (with the spiralling graphic around the Java logo) but never gets anywhere. Any notion what might be the issue? I tried disabling browser extensions to see if that would make any difference but no luck.

[Bantari]

I wonder if most people who sit there and busily download all the newest versions for all the newest stuff they use even know what "security issues" really mean. And what exact security issues is the new versions of the new stuff fixing. Or if they even need it....

Just sayin'...

1. Users do not need to know exactly what exploit was fixed on what version. Users should not need such technical expertise

You are right, of course. Users are just that - users, consumers. They don't need to know nothing, just blindly follow the updates and trust... no, not "trust" - *know!*... that the big corporations releasing the new and improved versions of the stuff they use are always up to par and on the level.

Silly me.
Sorry for suggesting that users should actually benefit from knowing anything. What was I thinking?!?...

[RobertJasiek]

There are different scopes of trust. It is very deep trust to allow a software to autoupdate using administrative or even system privileges. Such an update service can, in principle, spy everything. (Many other softwares actually do it.)

[Javaness2]

Sad to see what is happening to Java these days

To be honest, I just downloaded Java SDK 1.6 and command line from that "java -jar cgoban.jar"
http://stackoverflow.com/questions/6749 ... on-windows

[uPWarrior]

You are right, of course. Users are just that - users, consumers. They don't need to know nothing, just blindly follow the updates and trust... no, not "trust" - *know!*... that the big corporations releasing the new and improved versions of the stuff they use are always up to par and on the level.

Silly me.
Sorry for suggesting that users should actually benefit from knowing anything. What was I thinking?!?...

That's childish. You should know as must as you can. However, you should also know that nobody knows everything and therefore trust is part of living in society. Do you know every ingredient of everything you eat? Do you know what goes into the fuel that the car passing by is using? Do you know if the building you are in is going to come to pieces in a second? You don't. You trust and that is fine because you have the opposite option: if you suspect the java update might do something unintended, then simply don't install it and move on, exactly the same way you wouldn't go into a building you don't trust.

[UnclMartin]

None of this is working for me, I'm afraid - I've added every exception mentioned in this thread but both the client and the applet just hang while loading. Has anyone managed to get this working on OS X Mavericks with Java 7.51?

You can try this: Open a command window, and type in the following command: javaws -uninstall -clearcache

That should remove everything from the Java Web Start cache. This is what I advise when I suspect someone has a corrupt cached file. I often give that advice even when I do not suspect corruption and I think it will not work, but it often does.

Sorry about not seeing your request earlier.

[rottenhat]

You can try this: Open a command window, and type in the following command: javaws -uninstall -clearcache

OK, tried that, and got this response:

objc[410]: Class JavaLaunchHelper is implemented in both /Library/Internet Plug-ins/JavaAppletPlugin.plugin/Contents/Home/bin/java and /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/jli/./libjli.dylib. One of the two will be used. Which one is undefined.

which is the kind of thing that makes me realise that I still know bugger all about computers after all these years. I grasp what it's saying, but what I should do about it, if anything, is a mystery.

Anyway, the symptoms persist, so I guess I'll be doing without KGS for the foreseeable. A shame, after all these years, but there are other fish in the sea. Thanks for the suggestion though - I'll store that away for future reference if I have other issues.

[UnclMartin]

You can try this: Open a command window, and type in the following command: javaws -uninstall -clearcache

OK, tried that, and got this response:

objc[410]: Class JavaLaunchHelper is implemented in both /Library/Internet Plug-ins/JavaAppletPlugin.plugin/Contents/Home/bin/java and /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/jli/./libjli.dylib. One of the two will be used. Which one is undefined.

[snip]

In that case, I suspect the Java installation itself is corrupted on your computer. Try completely uninstalling Java. (Sorry I cannot give detailed advice, since I am unfamiliar with Apple.) After you uninstall it, see if you can get help or advice on finding and removing Java files that might be left on your computer. (It may be possible that one version of Java was installed on your computer without uninstalling a previous version.) When you have Java removed from your computer, download and install the most recent version available for your machine.

[rottenhat]

OK, I was able to delete the Java 1.7 plugin, and reinstall, and now things seem to be working fine.

On the way I discovered why I got that message about there being two versions of Java on the machine - although this laptop is reasonably new, and I'm running the latest version of the OS, when I got it, I set it up from a backup of my previous Mac. And in older versions of Mac OS there is an install of Java 1.6 lurking, which seems to still be present. So I was able to delete the plugin, re-enable 1.6, and run CGoban from Java Web Start. But I couldn't run the applet in the browser because the plugin was gone. So just to see, I reinstalled the plugin, and everything still worked fine. Disabled 1.6, and everything is still working.

So the problem seems to have been with the plugin. Hopefully that's the end of it.

In case it helps anyone else, these two articles were useful:

http://support.apple.com/kb/HT5559?viewlocale=en_US

http://www.macobserver.com/tmo/article/uninstall-or-disable-java-on-a-mac

Many thanks to UnclMartin for his suggestions.

[AKaios]

Just wanted to say thanks for the Windows workaround. It was a success.

As for the osX workaround, well, this is the kind of restrictions you can expect with Apple products.

[RBerenguel]

Just wanted to say thanks for the Windows workaround. It was a success.

As for the osX workaround, well, this is the kind of restrictions you can expect with Apple products.

OS X workaround: open a terminal window, wget the .jar file, java -jar cgoban.jar Even sound works.

[Gohst]

I see the WMS post on Google+ about the fix to the Java issue but, when I download the latest CGoban, I get the one I already had (3.5.11), and it needs me to lower Java security just to be able to start it. So, I don't think WMS has posted the update just yet. I could be wrong....

If you are a Windows user and you just want to get on with your life, and play on KGS now, I would recommend the solution of temporarily lowering Java security to Medium in order to do a one-time approval of the KGS app, then increase Java security to High again. The details were posted by ErnestasRomeika in this thread.

It's an easy one-time fix, and worked fine for me.

[Marathon]

There are some threads about Java security and KGS:

• http://lifein19x19.com/forum/viewtopic.php?f=24&t=11423
• http://www.lifein19x19.com/forum/viewtopic.php?f=24&t=9870
• http://lifein19x19.com/forum/viewtopic.php?f=24&t=10876
• http://lifein19x19.com/forum/viewtopic.php?f=24&t=10180 (This thread)
• http://lifein19x19.com/forum/viewtopic.php?f=24&t=10234

. There might be others.

From recent discussions in the EGR and other rooms, I see some users are still having trouble connecting as a result of Java security issues. Coincidentally, yesterday, I was at a different computer, and, when I tried to connect to KGS, I had the same security issue. I did a little testing on that computer. I hope to do more testing later. When I do, I'll either edit this message, or add another in this thread.

The computer tested used Windows 7, with Java 1.8.0_60, and Firefox 40.0.3.

To activate the applet, I needed to have these two items in Java exception list.

• http://goserver.gokgs.com
• http://www.gokgs.com

To run the Web Start Client, I needed to add this one item in the Java exception list.

• http://files.gokgs.com

In the Java Control Panel, "General" (tab), "Network Settings" (button), I had "Direct Connection" selected. Several years ago, I was advised this is preferred over "Use Browser Settings," which is the default.

Currently, my regular computer uses Linux, with OpenJDK version of Java, with JNLP files handled by IcedTea. This will run either client without the need to enter security exceptions. I will give me one or two warnings asking if I'm sure I want to run it.

I tried the above using "https://" instead of "http://", and neither the applet nor web start clients would run. When I entered exceptions that began with "http://", Java gave me a warning, but allowed me to continue.

I said "activate", and not "run" the applet. In starting the applet, I got the pre-MOTD message, but did not get the actual MOTD. When I entered my user name and password, the rooms window did not appear. I believe this is an issue separate from the Java security issue being discussed in this thread.

The applet would not run at all using the Chrome browser. Neither will Chromium run the applet. This is the result of an separate Java issue: The plugin that allows browsers to run Java applets is based on NPAPI. Google says that NPAPI is associated with security holes, browser pages freezing, and other problems. They've withdrawn support for NPAPI. This issue is not expected to be resolved until Oracle or others who are responsible for maintaining Java create a PPAPI plugin for Java. This is also not related to the security issue in this thread.

I haven't yet tested Windows Explorer browser.

Edit: Nov. 18:
On my regular computer, which uses Linux, I switched from OpenJDK to Oracle's Java. As I said above, OpenJDK allowed me to run KGS without requiring me to enter exceptions in a list. It did give me warnings, and asked if I was sure I wanted to run the KGS software.

In switching to Oracle's Java, I found it worked exactly as it did on the Windows computer: I was required to enter security exceptions, as described above. Also, once that was done, the applet would accept my login account name and password, but the rooms window would never appear.

[wineandgolover]

PSA

I updated to the new Mac OS Sierra 10.12 and had no java problems.