OpenStreetMap
If you use JOSM, please download an up-to-date copy from josm.openstreetmap.de if you are unable to edit.
Java uses its own SSL stack, and it is rather special. Java 6 and 7 won’t talk to servers patched with Logjam. This means that the JOSM welcome screen won’t load, and you won’t be able to download or upload any data from the OSM API, because both servers have been diligently patched.
Last night, I thought this was due to my Internet connection being dodgy. Reading about Logjam this morning made it click.
And, yes, this will affect a whole lot of people outside of OSM-land…
Discussion
Comment from AndiG88 on 21 May 2015 at 09:58
Maybe also post it on https://www.facebook.com/josmeditor
Comment from Harry Wood on 21 May 2015 at 10:11
The servers were patched on Sunday evening with a change which means java6 applications won’t be able to make SSL connections. Maybe you were using an old JOSM v7000 on java 6? Quite a few mac users ended up on this old version because upgrading from java6->java7 can be a bit of a pain on certain versions of mac. See mac install notes.
When I read this, I was worried we’d hit quite a few problems at our next mapathon event, getting people up and running with JOSM, because we have encountered quite a few mac users who can get up and running easily on JOSM v7000.
However I believe this issue should only be a problem if you also set JOSM to connect over https rather than http on the API connection URL settings.
Obviously using all these old versions and http is not desirable, so I’d like that wiki page to offer more advice on how to upgrade your java version, however it is a different process on various (old) versions of MacOS. Some versions might be a simple click-through to upgrade… but other versions have java 6 welded in place. Basically between oracle and apple they’ve conspired to make the whole thing a massive pain in the ass …with a nice bit of ask.com toolbar sprinkled on top for good measure.
Comment from Firefishy on 21 May 2015 at 10:12
Java 7 should work without issue.
Comment from SimonPoole on 21 May 2015 at 10:20
Small note: if you are using oAuth there is no real need (need as in privacy/security concern) to use SSL to communicate with the API.
Comment from Warin61 on 22 May 2015 at 03:44
Well .. I’ve updated JOSM.. and have Java 8 v 45 .. the latest..
still have time delays … uploading 20 objects .. takes .. +5 minutes…
The update to the latest JOSM look to have fixed things.. but I think it is time of day sensitive .. as in there is a substantial load somewhere delaying things..
Comment from Chris Adams on 22 May 2015 at 20:58
Java 7 will fail or succeed depending on exactly how aggressively you addressed Logjam. If the Diffie-Hellman key lower bound is exactly 1024 (which is what e.g. Chrome picked), it will work. If it’s 1025 or higher, however, you need Java 8 according to https://docs.oracle.com/javase/8/docs/technotes/guides/security/enhancements-8.html