BCeSIS, Java, Yosemite OS X 10.10

For people that have upgraded their OS to Yosemite on their Mac you may need to fix Java before being able to use BCeSIS.

1. If you’ve installed Oracle’s java 7, You’ll need to remove it. Follow the instructions at the link at https://www.java.com/en/download/help/mac_uninstall_java.xml

2. Download –  http://support.apple.com/kb/DL1572?viewlocale=en_US&locale=en_US

3. Open Terminal by clicking on your magnifying glass and type in Terminal. Press Enter or double click on the Terminal icon. You can also find the terminal app in Applications > Utilities

4. Type in the following or copy the bold text below and paste it into terminal

sudo -s

Note that there is a space between sudo and -s but no space between the dash and s.

5. Press Enter then enter your computer’s password. Note that the cursor will not move when you are entering the password. Press Enter.

6. Copy the bold text below and paste it into terminal and then press enter. Make certain you scroll to the bottom right of the window below and copy everything.

sudo mkdir -p /Library/Internet\ Plug-Ins/disabled
 sudo rm -R /Library/Internet\ Plug-Ins/disabled/JavaAppletPlugin.plugin
 sudo mv /Library/Internet\ Plug-Ins/JavaAppletPlugin.plugin /Library/Internet\ Plug-Ins/disabled
 sudo ln -sf /System/Library/Java/Support/Deploy.bundle/Contents/Resources/JavaPlugin2_NPAPI.plugin /Library/Internet\ Plug-Ins/JavaAppletPlugin.plugin 
 sudo ln -sf /System/Library/Frameworks/JavaVM.framework/Commands/javaws /usr/bin/javaws

7. Close Terminal

8. Test your result at javatester.org/version.html – you will need to enable the java plugin (keep an eye on your address bar for a notification). If all went well you should see a pink box that list your java version with the following in it.

Java Version: 1.6.0_65 from Apple Inc.

9. Restart any Browsers

10. Go to www.isw-bc.ca and click on the BCeSIS Icon. Check the address bar for any blocked plugin notifications and allow the java plugin.

Notes:

If the BCeSIS application stalls at an Allow/Deny window close the window with the grey bar and try again by clicking on the BCeSIS icon again. We’ve seen this behaviour and do not have a specific fix for it.

The Allow/Deny windows may not have the option to click allow. Where they do not, click Deny. It doesn’t affect the end functionality although they are annoying!

If you are running an older version of OS X there are instructions at http://www.prn.bc.ca/ts/?p=2049 that may be helpful to you.

If you are running a PC and you cannot connect to BCeSIS do the following

1. Uninstall Java through Add/Remove Programs
2. From www.isw-bc.ca download and install and try any of the Java versions available at https://www.isw-bc.ca/csi/node.do?method=display&page=JRE_Downloads
3. Restart Browsers
4. Click on the BCeSIS link at www.isw-bc.ca
5. Check for blocked plugin warnings in the address bar and enable as appropriate

Finally if you are running a district owned computer, you can put in a work order at helpdesk.prn.bc.ca and a technician can do this for you or help you do it,

Java Updates Dilemma

This meme was passed along to me, but I’m unsure of the original source. It does reference an important and difficult issue we are going to struggle with for the near future.

notojavaupdates

We are at a frustrating time where BCeSIS is requiring us to use an older version of Java, but other tools are requiring newer versions. This is affecting both Apple and Windows machines. Apple and OS X 10.6+ have caused issues due to blocking of the older version of Java needed for BCeSIS. We do have an imperfect resolution to this. Reports of a recent system update for 10.6 fixing the Java issue are good, but don’t help us for users with 10.7 and 10.8. We’ll be using BCeSIS for likely the next one to two school years so it will be an ongoing struggle.

Yesterday we were told a Ministry web tool may have required a newer version of Java to run. We aren’t sure yet if that was Java asking for an update, or the Ministry tool requiring it.

So at this point, follow the meme’s advice. Don’t update Java, or run system updates that reference Java on Windows or Macs (with the exception of OS X 10.6 if Java isn’t currently working). This does create a vulnerability due to older versions of Java. Avoid the “risky click” where you are on an unknown website, or following links to places you aren’t sure about.

If something is not working, give us a call at the helpdesk at 250-263-6442 or put in a ticket at helpdesk.prn.bc.ca and we will help you out as soon as possible.

Java Issues for OS X 10.6+ affecting BCeSIS [UPDATED]

Yesterday Apple released a malware definition that set a specific version of java to be allowed to run on OS X 10.6+. Unfortunately this definition precludes us from using BCeSIS as it requires an older version of Java on OS X. This update happens in the background with no user intervention. It is not part of the Software Updates. The reason for this is that the older versions of Java have security vulnerabilities that are often exploited by malicious websites or websites that have been compromised. A good way to avoid those websites is not to use the web… or more realistically don’t go to sketchy websites, follow unknown links etc.

We can’t update the version of Java as BCeSIS sadly requires an older version on OS X to run.

Our initial solution to remove this definition that is blocking our version of Java is as follows:

  • If you aren’t confident in doing the below steps or have difficulty, please call the helpdesk (250-263-6442) and we can do it remotely if your computer is on and Remote Desktop Management is turned on
  • Quit Browsers (ie Quit and restart, don’t just close windows!)
  • Open the Terminal application / Search for Terminal and run the application
  • copy and paste all the bold text below in terminal at the prompt
    sudo defaults delete /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta JavaWebComponentVersionMinimum

    EDIT – I had missed a slash above but it is now correct.

  • Press Enter/Return on your keyboard
  • Enter your password for your computer
  • Assuming you’ve entered the command correctly and no errors come up, quit Terminal
  • Restart any Browsers
  • Test and see if you are able to get to the BCeSIS login screen or other Java related programs/services

A significant question with this fix is whether or not the definition will return on the next malware update or not. We are monitoring this and will adapt the fix if needed.

Feb 1 Edit – An Apple Engineer has said that the definition will likely return on the next update so to avoid doing this again you will need to turn off the automatic definitions update. This may leave your computer vulnerable in the future. This takes a few steps which I’ve listed below:

  1. Click on Apple > System Preferences
  2. Click on Security (or Security & Privacy) in the top row
  3. Unlock to make changes (bottom left) using your laptop password – you need to be an admin of the laptop which most staff are. Use your laptop password
  4. Click on Advanced button (bottom right)
  5. Uncheck “Automatically update safe downloads list”

If there were a large scale sweeping OS X attack of some kind reminiscent of the Blaster worm we will suggest that you turn the Automatic update back on even though that will likely mean we will have java problems in the future. Keeping the older version of Java active on the macs will also mean that your computer is vulnerable especially if you are going to websites that are unknown or following unknown links.

We are looking at some options for a separate browser application to run Java for BCeSIS and disable Java in other browsers. 

If these instructions does not work for you, try a restart on your computer and don’t hesitate to call the helpdesk at 250-263-6442.

Further to this there was another issue last year with Java that had the following solution – http://www.prn.bc.ca/ts/?p=1696

Thanks to the many technical staff from our and other SDs who worked to come up with this solution.