Java Oracle 是否会在 JRE 7 更新 51 上杀死内网小程序？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/19440354/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Is Oracle killing intranet applets on JRE 7 update 51?
提问by
Refer to New security requirements for RIAs in 7u51 (January 2014) .
请参阅7u51（2014 年 1 月）中针对 RIA 的新安全要求。
RIAs must contain two things:
- Code signatures from a trusted authority. All code for Applets and Web Start applications must be signed, regardless of its Permissions attributes.
- Manifest Attributes
Permissions– Introduced in 7u25, and required as of 7u51. Indicates if the RIA should run within the sandbox or require full-permissions.Codebase– Introduced in 7u25 and optional/encouraged as of 7u51. Points to the known location of the hosted code (e.g. intranet.example.com).
RIA 必须包含两件事：
- 来自受信任机构的代码签名。Applet 和 Web Start 应用程序的所有代码都必须签名，无论其 Permissions 属性如何。
- 清单属性
Permissions– 在 7u25 中引入，从 7u51 开始需要。指示 RIA 是应在沙箱内运行还是需要完全权限。Codebase– 在 7u25 中引入，从 7u51 开始可选/鼓励使用。指向托管代码的已知位置（例如，intranet.example.com）。
ref another post on stackoverflow, I have the same concern that certificate is expensive for intranet use.
Sign applet and deploy it in intranet.
参考 stackoverflow 上的另一篇文章，我同样担心证书对于 Intranet 使用来说很昂贵。
签署小程序并部署到内网。
I am planning to start a new intranet project, should I give up the consideration on applet?
All of my intranet user do not have the ability to connect outside internet, they are in closed network, I highly doubt the need of signed applet......?
我打算开始一个新的内网项目，我应该放弃小程序的考虑吗？
我所有的内网用户都不具备连接外网的能力，他们在封闭的网络中，我很怀疑是否需要签名小程序......？
采纳答案by eis
I am planning to start a new intranet project, should I give up the consideration on applet?
我打算开始一个新的内网项目，我应该放弃小程序的考虑吗？
Well, yes. Applets haven't been a very good technology choice for a long time, even without Oracles latest changes. If you can do the same using other technologies, that's usually better.
嗯，是。很长时间以来，即使没有 Oracle 的最新更改，Applet 也不是很好的技术选择。如果您可以使用其他技术来做同样的事情，那通常会更好。
Some reasons:
一些原因：
- continuous stream of vulnerabilities (which is why it should really be disabled by default on browsers)
- resource intensive
- separate access from the web page (act close to plugins)
- deployment isn't very straightforward
- doesn't have the tooling some alternatives have
- 连续的漏洞流（这就是为什么它应该在浏览器上默认被禁用）
- 资源密集型
- 与网页分开访问（接近插件的行为）
- 部署不是很简单
- 没有某些替代品所具有的工具
The most serious reason is the vulnerability issue, but others play a role as well.
最严重的原因是漏洞问题，但其他原因也起作用。
All of my intranet user do not have the ability to connect outside internet, they are in closed network, I highly doubt the need of signed applet......?
我所有的内网用户都不具备连接外网的能力，他们在封闭的网络中，我非常怀疑是否需要签名小程序......？
It's mandatory in the latest versions of java plugin, so you cannot really help that.
它在最新版本的 java 插件中是强制性的，所以你真的帮不上忙。
See this discussionon what's needed if you would like to keep on going with the applet. If you don't do it, it will not work on the latest versions of java.
如果您想继续使用小程序，请参阅有关需要什么的讨论。如果您不这样做，它将无法在最新版本的 java 上运行。
回答by Costlow
As a disclaimer, I am the author of the blog post that you linked to. Intranets are typically known communities where people have reasons to trust each other. If you do not want to purchase a code signing certificate, you can share your public certificate within the small network of trust. This works on an organizational scale but not so much internet-scale. Also for @TomHawtin above, OpenJFXis available.
作为免责声明，我是您链接到的博客文章的作者。内联网通常是人们有理由相互信任的已知社区。如果您不想购买代码签名证书，您可以在小型信任网络内共享您的公共证书。这适用于组织规模，但不是互联网规模。同样对于上面的@TomHawtin，OpenJFX也可用。
回答by centic
I think another option if you want to stick with Applets would be the promised Exception Site List, which should be available in 1.7.0_51 as well, it still means that users need to adjust Java Applet Properties, but at least as far as I understand the post, it will make it possible to allow certain applets on the user machine.
我认为如果你想坚持使用 Applets 的另一个选择是承诺的Exception Site List，它也应该在 1.7.0_51 中可用，这仍然意味着用户需要调整 Java Applet 属性，但至少据我所知后，它将可以在用户机器上允许某些小程序。
回答by user3170456
As centic mentioned Dec 6 '13 at 20:23, the Exception Site List is a per user override to allow applets to run. Oracle help has been updated with this article How can I configure the Exception Site List.
正如centic 于2013 年12 月6 日20:23 提到的，例外站点列表是每个用户的覆盖，以允许小程序运行。Oracle 帮助已更新，这篇文章如何配置例外站点列表。
