DragMath equation editor gets a Java Security warning: should I be concerned?

DragMath equation editor gets a Java Security warning: should I be concerned?

Peter Ruthven-Stuart -
回帖数:29
Plugin developers的头像

Hello,

As the admin of a Moodle (version 2.4.3), I have been approached by a maths teaching colleague who wants to know how he can use Moodle in his classes.

This prompted me to experiment with the DragMath equation editor. On doing so, I got the following Java Security warning:

This application will be blocked in a future Java security update because the JAR file manifest does not contain the Permissions attribute. Please contact the Publisher for more information.

Java Security Warning

I have Java 7 Update 45, running on a Mac (OS 10.7.5). I believe that it's the latest Java version.

I get the same Java security warning when starting to use DragMath on a Moodle 2.5.3 system.

Does this mean that when Java is updated and my Maths colleagues (and students) then update their versions of Java that DragMath will no longer be usable?

Since I have not used DragMath before, I am not sure whether or not this is standard behaviour or something to be concerned about. At the moment I am reluctant to recommend DragMath if it will 'soon' be rendered obsolete by Java.

Any advice will be greatly appreciated.

回复Peter Ruthven-Stuart

Re: DragMath equation editor gets a Java Security warning: should I be concerned?

Ramon Eixarch -

Hi Peter,

recent changes in the Java policies by different browsers are behind the problem. The Dragmath Java applet should be digitally signed.

WIRIS team has recently signed our old math editor for Moodle 1.9 (our 2.x version works with JavaScript)

http://www.wiris.com/blog/docs/signed-java-applet

回复Ramon Eixarch

Re: DragMath equation editor gets a Java Security warning: should I be concerned?

Peter Ruthven-Stuart -
Plugin developers的头像

Hello Ramon,

Thank you for your reply. I don't know anything about WIRIS. I'll have a look a their site.

回复Peter Ruthven-Stuart

Re: DragMath equation editor gets a Java Security warning: should I be concerned?

Ramon Eixarch -

Hi Peter,

in a few words WIRIS is a suite of math tools for Moodle. www.wiris.com/moodle

WIRIS editor is an alternative to Dragmath. The main advantage is the Javascript interface (no Java dependency anymore).
The main difference is that WIRIS is a commercial solution. 

You can test how it works at www.wiris.com/demo-moodle2

回复Ramon Eixarch

Re: DragMath equation editor gets a Java Security warning: should I be concerned?

Richard Schwarz -

It looks like the WIRIS editor is commercial, however. The DragMath editor is part of core.

I did discover this page at the Java docs because DragMath was getting blocked for being unsigned. The solution which worked for me (and needs to be done by every user who wants to use DragMath to create.. not view.. equations) is this:

Steps to Add URLs to the Exception Site list

·Go to the Java Control Panel (On Windows Click Start and then Configure Java)

·Click on the Security tab

·Click on the Edit Site List button

·Click Add in the Exception Site List window

·Click in the empty field under the Location field to enter the URL

Example: http://www.example.com
(URL should begin with http:// or https://)

If the URL where the applet is hosted is different from the URL of the web page from which the applet is launched, then you will need to add both the URL for the applet as well as the URL for the web page. 


Link: https://www.java.com/en/download/help/java_blocked.xml



回复Peter Ruthven-Stuart

Re: DragMath equation editor gets a Java Security warning: should I be concerned?

Marc Grober -

Jean Michel has posted a bug with the DragMath developers (Moodle devs integrated DragMath with Moodle so arguably could edit DragMath themselves as long as that is not precluded by the licensing, but likely the better alternative is to see what the DragMath Devs decide to do ) and I have followed up with an e-mail.  I am sure this will be resolved in adequate time one way or another.  There are a number of persons experimenting as well with a similar approach using js and Mathjax.  In the meantime, DragMath continues to be an excellent tool because it can produce output in various syntax.

回复Marc Grober

Re: DragMath equation editor gets a Java Security warning: should I be concerned?

Peter Ruthven-Stuart -
Plugin developers的头像

Hello Marc,

Thank you for your reply.

I found the Tracker report to which you referred: MDL-40568

Hopefully this issue will be resolved soon.

回复Peter Ruthven-Stuart

Re: DragMath equation editor gets a Java Security warning: should I be concerned?

Christopher Sangwin -
Particularly helpful Moodlers的头像 Plugin developers的头像

I've been in email contact with Alex, who wrote and maintained the code for DragMath.  My role in this project was mostly at the design end.  He has agreed to look into this.  If anyone else has expertise in signing Java applets, then please contact me by email (C.J.Sangwin@lboro.ac.uk) and we would be very grateful for any help you could offer.

Chris

 

回复Christopher Sangwin

Re: DragMath equation editor gets a Java Security warning: should I be concerned?

Geoffrey Rowland -

Hi Chris et al.

The developers of the Jmol applet have recently made some progress with self-signed certificates and eliminating/minimising the Java security warnings. See this thread for more info:

http://sourceforge.net/mailarchive/forum.php?forum_name=jmol-users

or perhaps contact the lead developer, Robert Hanson, directly.

回复Christopher Sangwin

Re: DragMath equation editor gets a Java Security warning: should I be concerned?

Ramon Eixarch -

Hi Chris,

the WIRIS team is happy to help you with the signature of DragMath applet.

We foresee two main steps:

  1. Publishing a certificate in the context of Open Source project
  2. Using the certificate in your applet

Step 2 WIRIS team has fresh experience and we are happy to help.

Step 1 We don't have experience in Open Source development 邪恶. What follows may be wrong. Signing with a certificate implies that there is a private and a public key. Being an Open Source project all the code is public. Hence the private part of the key is suddenly public. Since the private key is public that may arise phishing issues. 

 

回复Ramon Eixarch

Re: DragMath equation editor gets a Java Security warning: should I be concerned?

Mauno Korpelainen -

Ramon,

maybe you should consider publishing a javascript based open source editor in addition to your excellent commercial products. Some people might see it as a revolutionary act on the ground of open source development and vote the product as a potential canditate for different educational/open source award winners...

One way to find new customers is to give something free - for example most people know and use Adobe Acrobat Readers (pdf) etc and many users still buy more advanced products if they need better tools - it's not only charity 眨眼

回复Mauno Korpelainen

Re: DragMath equation editor gets a Java Security warning: should I be concerned?

Ramon Eixarch -

We have considered several times but it is not our business model.

回复Mauno Korpelainen

Re: DragMath equation editor gets a Java Security warning: should I be concerned?

Jean-Michel Védrine -

Mauno is right,

The long term solution is to have a free, open source javascript equation editor. Maybe the work done by Java Molecule Editor authors Bruno Bienfait and Peter Ertl to port it to javascript using GWT can be of some help ? See article at http://www.jcheminf.com/content/5/1/24

In the meantime thanks a lot to Christopher and Alex if they can manage to sign the java applet.

And thanks to Ramon for his offer to help them to do so.

回复Jean-Michel Védrine

Re: DragMath equation editor gets a Java Security warning: should I be concerned?

Christopher Sangwin -
Particularly helpful Moodlers的头像 Plugin developers的头像

I'm quite happy to agree that a decent JS maths editor would be a great solution.  I'm amazed, and surprised, quite how long DragMath has lasted!

I would be very happy to discuss the design of DragMath with colleagues seeking to implement an editor.  There has been a lot of thought, and work, on "interface" with mathematics over the years, starting with papers by Babbage.  We learned a lot from implementing DragMath which it would be a shame to loose.

Chris

 

回复Christopher Sangwin

Re: DragMath equation editor gets a Java Security warning: should I be concerned?

Tim Hunt -
Core developers的头像 Documentation writers的头像 Particularly helpful Moodlers的头像 Peer reviewers的头像 Plugin developers的头像

If nothing happens before then, and if the opportunity arises, should we (you) try to make this a 2014 GSoC project? (I would probably be prepared to co-mentor, if you can't find anyone better.) Not sure if that should be done in the context of Moodle, or whether the generic JS equation editor widget would be better developed under the umberella of someone like the MathJax project?

回复Tim Hunt

Re: DragMath equation editor gets a Java Security warning: should I be concerned?

Mauno Korpelainen -

Geoffrey mentioned in https://moodle.org/mod/forum/discuss.php?d=243197#p1062025 Ray Wainman's MathQuill based editor plugin for moodle https://github.com/oohoo/moodle-tinymce_matheditor.
I tested that plugin shortly last weekend and it looks pretty good, is open source and some nice sites like https://www.desmos.com/ are already using MathQuill. Core moodle developers might see some problems in MathQuill using jQuery but at least it offers a nice start for yui based projects...

In my opinion the critical point is how to show re-editable notations (spans) in editor content area. Wiris is using server side scripts (images) and Ray's plugin is using mathtex images but the method how CKEditor's mathJax plugin is using widgets to render notations looks better than placeholder images ( see http://ckeditor.com/demo#widgets ) - it's a little like old AsciiMathML plugin editing mode switch.

If you want to test Ray's plugin combined with mathQuill but don't want to build them from GIT I have the tinymce plugin available in http://korpelainen.net/matheditor.zip - just unzip it to moodle 2.X folder lib/editor/tinymce/plugins and read the notes from https://github.com/oohoo/moodle-tinymce_matheditor

test

回复Mauno Korpelainen

Re: DragMath equation editor gets a Java Security warning: should I be concerned?

Marc Grober -

a dat.GUI front end to the existing xml files by way of an xml parser?

What is Christian's tool built on?

回复Mauno Korpelainen

Re: DragMath equation editor gets a Java Security warning: should I be concerned?

Martin Dougiamas -
Core developers的头像 Documentation writers的头像 Moodle HQ的头像 Particularly helpful Moodlers的头像 Plugin developers的头像 Testers的头像

Some questions ...

1. What do you guys think about the basic interface of Ray's moodle-tinymce_matheditor?

It's not dragmath but I think most people agree that Java is a dead end and we do need a truly cross-platform solution built into Moodle.  Of the few I've looked at it seems the most promising, but unfortunately they all seem pretty buggy.

2. Is there really no strong opensource JS equation editor out there?

I'm surprised - these are not new technologies and there are so many maths techheads.

3. Feature wise, if Wiris was open source and included in Moodle would it satisfy everyone's needs?

回复Tim Hunt

Re: DragMath equation editor gets a Java Security warning: should I be concerned?

Mauno Korpelainen -

2014 GSoC project is a good idea, Tim.

For example a couple years ago the PaintWeb project was really successful even if that canvas based online painting tool did not find it's way to core...

I would be happy to help in testing the "canditates".

If you are interested in MathQuill there are some online test pages like http://jenseng.github.io/mathquill/demo.html or http://laughinghan.github.io/mathquill/test.html where you can check the ideas without installing the scripts yourself.

回复Jean-Michel Védrine

Re: DragMath equation editor gets a Java Security warning: should I be concerned?

Mauno Korpelainen -

Jean-Michel, thanks for that link! Really nice work...

Developers of GeogebraWeb http://geogebraweb.appspot.com/app.html might give editor developers some feedback too - they have been working hard in changing Geogebra applets to current javascript / HTML5 based apps

https://dev.geogebra.org/trac/wiki/Web

http://dev.geogebra.org/trac/wiki/SevenRulesGWT


 

回复Jean-Michel Védrine

Re: DragMath equation editor gets a Java Security warning: should I be concerned?

Daniel Thies -
Core developers的头像 Particularly helpful Moodlers的头像 Plugin developers的头像 Testers的头像

I have a working prototype for Dragmath type plugin now for the atto editor at  https://github.com/dthies which is based on YUI and MathJax. I would be happy for testers and comments. I will rework it in a bit for the other editors as well.

回复Daniel Thies

Re: DragMath equation editor gets a Java Security warning: should I be concerned?

Jean-Michel Védrine -

Hello to all and a happy new year 2014,
As this thread is about DragMath I decided to post here.

I had a look at Jason Fowler's post : https://moodle.org/mod/forum/discuss.php?d=245896 and followed the link in it to the documentation page : http://docs.moodle.org/dev/Editor_2.7
And was quite shocked by some of its content :

  • Given we need to redo the dragmath support - is dragmath the best choice for an equation editor?
  • Cons of dragmath
    • Java applet
    • Requires tex filter to be enabled globally
    • Complaints about tex filter
    • Open GPL issue: MDL-32450
  • Alternative
    • MathJax filter + equation editor plugin


This is simply nonsense because it show that whoever wrote this has not a clear view of what an equation editor is and that he is completely confused between equation editing and equation rendering.
I guess that it will not be a big surprise for this forum's readers given that it took us several years to persuade Moodle HQ people to decouple DragMath and TeX filter in Moodle !
Let's look at some of the affirmations here
"the fact that Dragmath require tex filter to be enabled globally" is wrong and misleading  : Dragmath is a tool for editing and the tex filter is a tool for display (quite different !) we all know that Dragmath works well with other solutions for display (Mathjax for instance) and that the TeX filter works with other equation editing tools.
"Complaints about TeX filter" exact same confusion

The alternative given to DragMath : "MathJax + equation editor" shows once more time that the author is completely confused about what  DragMath is !

What should be the right questions asked in this page ?
First there should be nearly no mention of the TeX filter or MathJax (more on this latter at the end of my text) as this is a documentation about the future editor not about the way to display equations in Moodle.
The main question should be "What is the best way to create/edit equations in the future editor" no more no less

Of course the question "Is Dragmath the best choice to create/edit equations in the Moodle editor" is a very valid point.
As I said my answer is that DragMath is a very good choice for students to write equation : the interface is good, the feature cover nearly anything necessary for "general" equations, there are different output formats, ... My only concern is not about DragMath  but about the fact that DragMath is a Java applet, but if DragMath was ported to Javascript, I would be in fact very satisfied with it.

But unfortunately currently DragMath uses Java, not Javascript, so until DragMath is eventually ported to Javascript, we can look at other way to create/edit equations in the Moodle editor.

I went to http://prototype.moodle.net/editor/ and tested the four editors available here : ckeditor, atto, tinymce3, tinymce4. The 2 tinymce editors use DragMath so I will not add anything to what I said above

But to my great surprise the plugins installed in the ckeditor and atto editors are not at all "equation editors" for me : they are just what I would call "TeX previewers" and none of my students would be able to use them at all because none of my students know anything about TeX.

This is the common mistake: a lot of people seems to think that all math users are TeX users, but this is totally untrue and this is the whole  point of an equation editor : write TeX equations without any TeX knowledge.


Once more we see that developers at Moodle HQ are completely confused about what an equation editor is and are confusing equation editing and equation rendering: look at the table at the end of the http://docs.moodle.org/dev/Editor_2.7 page, for ckeditor it says "Has mathjax plugin - uses different maths delimiters so needs hacking to make it backwards compatible with our existing equations."

At this point I decided to install Daniel Thies mathslate plugin and give it a try (I tested versions for tinymce3 and atto, I was not able to test the version for tinymce4 but I imagine it would be quite similar)
This is a real editor even if as Daniel says this is just a prototype and it is not feature complete

Good points

  • it is fast
  • this is javascript and YUI (Moodle devs will certainly like that 微笑 )
  • the fact that Daniel was able to do Atto and Tinymce versions is a very good point because it shows that this editor is portable


Minor problems

  • the tinymce version is giving me a warning about a missing string identifier "mathslate"
  • the cursor shape is not very good in the tinymce version
  • as I said this is only a prototype so it would need more work to be able to create all equations that we need


Major complaint

  • I don't like too much the fact that everything must be done by drag and drop: there is a lot of stuff in equations that are more easy to type than to drag


But my conclusion is that Daniel's work is very promising. A big thank you Daniel for working on this and sharing the result with us.

Last thing I want to mention is that most of the plugins mentioned here just create the TeX equation but once inserted into the editor it looks as TeX source so this is not WISIWIG at all.
There is one exception : the ckeditor plugin uses MathJax to render the equation into the editor.
This is very good and very friendly for users. If this plugin does it, other plugins surely would be able to do it too (David old asciimathml tinymce plugin was also rendering equations in the editor using asciimathml too)
So this is in my opinion the only point where there is a connexion between MathJax and the editor : MathJax should be used as a way to render equations into the editor (as it does for all other texts outside the editor).
Sorry for this long post

回复Jean-Michel Védrine

Re: DragMath equation editor gets a Java Security warning: should I be concerned?

Joshua Bragg -

Thanks for taking the time to write all this to keep everyone informed. Hopefully HQ will listen to this because you're spot on. 

回复Jean-Michel Védrine

Re: DragMath equation editor gets a Java Security warning: should I be concerned?

Geoffrey Rowland -

I'm also rather impressed with Daniel's MathSlate plugin. Particularly like the way you can rearrange things through drag-and-drop if you don't quite drop them in the right place, first time. Daniel has added some recent code updates on GitHub. So, the latest version of the TinyMCE MathSlate plugin should now work (at least it does for me on Moodle 2.6).

The architecture of the MathSlate plugin makes it relatively easy to customise. You can do quite a lot by simply editing the config.json file (a good way to learn some TeX and MathML!).

Inspired by Maunio's recent posting that MathJax now supports the mhchem extensions for chemical equations, I have 'cloned' MathSlate as ChemSlate and customised it to use mhchem. You can install this alongside MathSlate, and similarly need to install both /local/chemslate and /lib/editor/tinymce/plugins/chemslate (not yet done an Atto version).

https://github.com/geoffrowland/moodle-local_chemslate

https://github.com/geoffrowland/moodle-editor_tinymce-chemslate

The ChemSlate editor interface is currently a little 'rough-and-ready' but still quite functional. The display of some bonds and equilibrium arrows in the editor interface is not great, though much better when inserted in the page and rendered with mhchem. Also, would be nice to have the atom symbols in, say, a periodic table layout rather than separate tabbed rows. The use of italic and normal text in equations also needs some more attention.

Enjoy!

Geoff

 

回复Jean-Michel Védrine

Equation editors and Display Technology going forward

Marc Grober -

Thank you  Jean-Michel for the wide ranging discussion. The critical point, I think, is that Moodle HQ is clueless (a point upon which we had some disagreement not so many months ago, lol 微笑


I suppose one would have to ask "Jason & Damyon @ Moodle HQ" about the doc as they are solely responsible for it - I surpmise that they checked out bits and pieces of forum postings (at one time, as you know, DragMath was coupled to the TeX filter, though instructions on how to "fix" that "feature" were posted pretty quickly.)   Moodle usage of DragMath has been a long road since John began supporting the applet years ago.  I tried to maintain history but gave up when Moodle started rolling out new docs for every minor version.

Perhaps more importantly, the vision of the community building the documents has not had many takers. I am sorry if I haven't seen others contributions,  but I think it has been largely only CVolin working on the docs since I threw up my hands.  My suggestion for a search utility that would suggest answers to common questions before forum posts were allowed has languished for years and will never see the light,  so we largely have docs that are not always updated to reflect forum discussion.

Nevertheless, I would have assumed that HQ would have consulted the moderator of the Math forum (who just happens to be someone who has done quite a bit of work on editors, lol), past Moodle DragMath devs, or even posted in the forum soliciting involvement in the development of the subject page.   I guess I missed all that.

I had tried to provide documentation explaining the differences between what I called constructors (like DragMath) and display tools (such as a TeX plugin) -- both inside and outside the editor -- as that confusion has arguably been responsible for fully a third of the posts in the Math forum. As I noted above,  I don't even know whether those docs can even be found anymore, lol.

But the hallmark of the discussion among those working on math tool development at one time was making math universal and transparent.  One of the reasons DragMath is so wonderful is that it will create a tokenized string for multiple syntax, and this enjoys a happy marriage with MathJax, as mathjax can likewise parse multiple syntax. As a result, no matter what you write Math in, the reader can read it, at least within the limits of these products.

SEE - as presented in Mauno's TinyMath editor, was a further step in this direction. It was hoped that eventually the various benefits of inyMath would become easily installed add-ons for the editor, so for example, a teacher could provide a binary construction file and have a student tweak that to some end and submit it - all of which was demonstrable two years ago.

I think one of the things that was of concern back then was the increasing complexity of the javascript that was being processed, the possibility of the use of a preprocessor to streamline things and conflicts. My impression was that Moodle HQ had a hearing problem.  Of course Mauno, always the positive one, might suggest I was being a Cynic, and he was of course correct - but Cynics have been known to be right (though I am not arguing that here.)  Indeed, there was just a recent bit of flapping a month or so ago when Derek had something to say along these lines.....

The issues have not changed much in a decade....  Math in Moodle needs to be transparent and universal for teacher and student

I saw the recent HangOut Peter K for MathJax participated in as a great move to broader sharing of Math tools and at one time Jonathan, David and others were perhaps more active here [we of course see Chris because of DragMath and STACK 微笑 ]. Was that because they were dragged in kicking and screaming, lol.  I don't think so, but that is a question.  Moodle should be an ideal target for math tools,  which means people should be developing math tools with Moodle in mind.... 

A wonderful Christmas to all.

回复Marc Grober

Re: Equation editors and Display Technology going forward

Colin Fraser -
Documentation writers的头像 Testers的头像

For me, most of this discussion is an SR-71, Blackbird, so far over my head I can't even hear it let alone see it. I would not put it that HQ is "clueless" when it comes to Maths and Science equations though. I would suggest they seem to be struggling, like many software companies, with the fact that any sort of Maths is difficult to render on a computer - let alone any other device. Given the heavy use of mathematics for development, design and construction of all digital equipment, computers in particular, I actually find it amusing that computers have, so far, really struggled with a consistent, easy to use, equation generating tool. When I say easy to use, I mean something that is used from the keyboard, not something like Word's Equation Editor - the tool that gives lie to the idea of "its better than nothing".

Jean-Michel makes the valid point there is a difference between the editing and the rendering of equations. I suppose I prefer to keep it as simple as possible so would be more likely to keep using the TeX Notation filter with the external latex, dvips/dvpng and convert tools.  Also something to think about, instead of relying on an external set of tools, like I do with TeX Live and ImageMagick, a better native tool would be far more effective. That may require the external convert processes of ImageMagick or Ghostscript, to work, but one external processor as opposed to two would make for a more consistent result I would think.  (I also suggest that dropping support for the Algebra filter would reduce confusion about which tools to be used - a little at least. And that is a separate issue.) 

A lot of interesting points have been made, but for me, the major one does not appear to be a consideration. The end user, for example. Something that everyone needs to think about, - if someone, like me, has to master another tool, like MathJax, after installing and configuring, then work out how to get results into Moodle, they probably wouldn't bother. Not that I am overly lazy, just seriously time poor at different times of a standard school year. (For me it seemed it was almost all year last year.) I want something quick, easy and a minimum of fuss to use. If it is native, then I am mastering Moodle, not some other tool and that is a very important user perception.   

回复Colin Fraser

Re: Equation editors and Display Technology going forward

Marc Grober -

In fact, there is technically no further need for ImageMagick with the current TexLive distro as the use of the binary from that distro can be now obviated with a few tweaks of the TeX filter (assigned to me, lol, before I quit.)

I can't agree that one size should fit all,  but I do think that we can provide tools and defaults so that it works in all cases out of the box as it were. But we do have to allow for more sophisticated users to use tools as they wish. This is the case with MathJax, which can be rolled out in a simple manner with a dozen lines of AdditionalHTML, but which can be tweaked by the sophisticated user to do much much more.

But there is are trade-offs to be made with any of these tools - Do you want it to work without access to the internet at large?  Do you want to have to include all the files for all the tools and what do you do when your product size is now 10 gigs, lol.

As some have noted, WordPress does a wonderful job of providing the sysadmin a GUI that addresses installation and management of plugins.  In the current environment that would have perhaps have been the primary target for Moodle 2 as some argued,  but it looks like we are fast approaching Moodle 3, lol, and who knows, maybe Maths will be viewed as a core focus of Moodle then....

 

回复Colin Fraser

Re: Equation editors and Display Technology going forward

Marc Grober -

BTW, Colin,
I sent you an e-mail of a TeX file I constructed (everything a high school kid needs to know about univariate quadratics, lol)  when I decided to look at what a document would look like if composed in TeX -- part of my explore of Google's LaTeXLab (http://docs.latexlab.org/)  and TexShop (which comes in many TexLive distros.)  As you could see, the doc is much simpler than the xml that is produced by today's word processors while it does offer some sophistication. I remember looking at the initial WordPerfect markup as a wordstar user and remarking how usable that was.  Now, we want to hide all the mark-up, and as a result we get web edited text that in many cases is comprised of 80% mark-up that is really not effecting the material presented at all with mangled spans that make manually "fixing" it almost impossible.