Almost all older useful (physics) java applets blocked

[greypilgrim]

Hi.

I have lots of bookmarks to splendid physics Java applets, but most of them are a bit dated. Many of them get blocked by current Java versions. To make them work I have to go to the Windows control panel, open Java control panel, add the page to the exception site list and restart the browser, which is an absolute pain. And even this makes the applets work only in some cases.

I need a shortcut for this, some kind of button in Firefox to directly lower security settings for pages I know I can trust. Is there anything like this?

It seems to me that allowing only high and very high security levels was just the cheapest solution for Oracle to address Java's terrible reputation concerning security. Instead of closing security holes, just make everything with the slightest potential of danger unusable...

 

[JorisL]

I don't think it is possible. (And definitely shouldn't be made easy)

You can check out the PhET which is creating HTML5 versions of their applets at the moment.
Another example are the Walter Fendt simulations which are being converted as well.

The huge advantage is that they should work on every modern browser without a hitch.

 

[Psinter]

Theory:
In a Chrome web-browser you can create an extension to execute a command where you modify the file exception.sites of Java and add the website to an exception with the click of a button. However, Chrome dropped support for the Java plugin long ago.

In Firefox you could maybe create an add-on and execute a command to modify the file exception.sites using your host terminal or command prompt with the click of a button following a similar process as the one described here: http://stackoverflow.com/questions/10215643/how-to-execute-a-windows-command-from-firefox-addon and add your current opened tab URL to the exceptions.

I can't say if it will work since that is a question from 2012 and I haven't tried it.

The minor problem with that is that Firefox is currently planning on deprecating the old way of developing add-ons and officially introduce a new one called WebExtensions by the end of 2017. At the moment of writing this, that new way of developing add-ons doesn't support runtime.connectNative() which is what you would use to modify the file exception.sites through a command. As you can see from here, support for that is still a work in progress and it's still not supported.

The exception.sites file is located in operating system dependent places as stated here: https://docs.oracle.com/javase/7/docs/technotes/guides/jweb/jcp/properties.html
In Windows you would find it in: <User Application Data Folder>\LocalLow\Sun\Java\Deployment\security\exception.sites

Practice:
However, even if you were to create an add-on to add a site as an exception, you would need to restart the browser for it to take effect. And also, there are other major problems going on. First, even if you were to create an add-on now, it will be deprecated. Second, by the time Firefox supports runtime.connectNative(), the Java plug-in may not be supported anymore since Firefox is planning to remove NPAPI support by the end of 2016 as stated here: https://blog.mozilla.org/futurereleases/2015/10/08/npapi-plugins-in-firefox/ and that includes the fact that those old Java applets will not be supported. Instead, it falls on the shoulders of the developers of those applets to transition to a plugin-free solution.

Edit:
As a side note, it strikes me as funny that they preach consideration of transition of technology as stated here:

Oracle[/PLAIN] recommends that sites currently using Java applets consider switching to plugin-free solutions such as https://blogs.oracle.com/java-platform-group/entry/java_web_start_in_or.

Yet, they themselves haven't transitioned. You notice when you install Java and open the verifying page: https://www.java.com/en/download/installed.jsp in Chrome and see a message telling you that your browser does not support NPAPI. Unless it is because they have it there only for users who still use a browser with NPAPI support so they can verify it works well with the browser. But I don't know because if it were for that the page shouldn't say Verify Java Version. It should say something like Verify Java Web Browser Support and the page to Verify Java Version should be something made in WebStart or JNLP that would actually work. But this is just a side observation, I don't know the reasons why they still at this point in time decide to use an applet for that.

 

[robphy]

Whenever something tedious needs to be done repeatedly on Windows, I ask myself... can it be scripted?
Batch files (.bat or .cmd), perl or python scripts (possible using something like Cygwin or similar bash shell), https://www.autoitscript.com or https://autohotkey.com/ , or some combination?

Here is an autohotkey script that works for me and my setup.
You'll have to play with it for your setup.

https://autohotkey.com/docs/Tutorial.htm
If you need help with a command (say, WinActivate), try https://www.google.com/search?q=autohotkey+winactivate
To get GUI information, like pixel locations in a window, use the WindowSpy ( https://autohotkey.com/board/topic/63365-using-window-spy/ )

Good luck.

;; THIS AUTOHOTKEY SCRIPT
;; adds to Exception Site List:
;;    http://yourfavorite.website.com
;;    file:///X:/#NoEnv  ; Recommended for performance and compatibility with future AutoHotkey releases.
; #Warn  ; Enable warnings to assist with detecting common errors.
SendMode Input  ; Recommended for new scripts due to its superior speed and reliability.
SetWorkingDir %A_ScriptDir%  ; Ensures a consistent starting directory.

Run, C:\Program Files (x86)\Java\jre1.8.0_40\bin\javacpl.exe

WinWaitActive, Java Control Panel, , 15
  if ErrorLevel
  {
  MsgBox %message%
  return
  }

WinActivate,Java Control Panel
Click, 160,35
Sleep, 200
Send,{TAB}
Sleep, 200‎
Send,{TAB}
Sleep, 200
Send,{TAB}
Sleep, 200
Send,{ENTER}
Sleep, 300
Send,{ENTER}
Sleep, 250
Sleep, 500

WinActivate, Exception Site List
Click, 421,268
Sleep, 250
Send, http://yourfavorite.website.com
Send,{ENTER}

WinWaitActive, Security Warning, , 5
  if ErrorLevel
  {
  ;MsgBox %message%
  return
  }
WinActivate, Security Warning
Click, 382,233
Sleep,200

WinActivate, Exception Site List
Click, 421,268

Sleep, 300
Send, file:///X:/
Send, {ENTER}

WinWaitActive, Security Warning, , 5
  if ErrorLevel
  {
;  MsgBox %message%
  return
  }
WinActivate
Click, 382,233
Sleep,200

Sleep,200
Click, 430,346
Sleep,200
Send, !{F4}

 

[Vanadium 50]

It seems to me that allowing only high and very high security levels was just the cheapest solution for Oracle to address Java's terrible reputation concerning security. Instead of closing security holes, just make everything with the slightest potential of danger unusable...

The second cheapest. The cheapest is to simply withdraw the product, Which is why we can't have nice things.