NOAA's Flight Path Tool

[Let'sgoflying!]

What app is used to open the .jnlp file offered when clicking their link "Launch Flight Path Tool"?

https://www.aviationweather.gov/flightpath

 

[asicer]

Java Network Launching Protocol. You must be running a browser that doesn't have Java.

 

[Crashnburn]

I tried both Internet Explorer, and Google Chrome. Neither one recognize fltp.jnlp

 

[arnoha]

And it's not going to work. Java Web Start isn't supported anymore, as it's a huge security hole. It's been disabled anywhere recent. You could get this working, but it would take quite a bit of work to run it outside of Java Web Start.

Here's the contents of the file. Note the date and security permissions:

<?xml version="1.0" encoding="utf-8"?>
<!-- A JNLP File for the Flight Path Tool Application.
 @version 1.0
 @date 2004/9/30
 @author Arnaud Dumont
-->
<jnlp spec="1.0+" codebase="https://bcaws.aviationweather.gov/java/fpt" href="fpt.jnlp">
  <information>
    <title>ADDS Flight Path Tool</title>
    <vendor>Aviation Weather Center</vendor>
    <homepage href="https://bcaws.aviationweather.gov/adds"/>
    <description kind="tooltip">Flight Path Tool</description>
    <description kind="one-line">Flight Path Tool</description>
    <description kind="short">The new ADDS Flight Path Tool, provided as a Java Webstart application</description>
    <icon href="ops_adds_button_icon.gif"/>
    <icon kind="splash" href="ops_adds_splash.gif"/>
  </information>
  <security>
    <all-permissions/>
  </security>
  <resources>
    <j2se version="1.5+" initial-heap-size="50331648" max-heap-size="204800000"/>
    <jar href="flightpath.jar" download="eager"/>
    <jar href="mapdata.jar" download="eager"/>
    <jar href="jai_codec.jar" download="eager"/>
    <jar href="jdom.jar" download="eager"/>
    <jar href="JTS-1.3.jar" download="eager"/>
    <jar href="resources-2.0-B1.jar" download="eager"/>
    <jar href="shapefile-2.0-B1.jar" download="eager"/>
  </resources>
  <application-desc main-class="edu.ucar.rap.adds.apps.flightpath.FlightPathTool"/>
</jnlp>

 

[arnoha]

Heh...I got it running! Wasn't that challenging.

1. Download and install the Java Runtime. http://java.com and follow the instructions.
2. Grab all the right files. https://bcaws.aviationweather.gov/java/fpt and grab each .jar file and stick them in a directory.
3. Open a command prompt window and change to the directory you stuffed all the files in.
4. Run this command:

   java -cp flightpath.jar;mapdata.jar;jai_codec.jar;jdom.jar;JTS-1.3.jar;resources-2.0-B1.jar;shapefile-2.0-B1.jar edu.ucar.rap.adds.apps.flightpath.FlightPathTool

Hope that works for you, too.

 

[asicer]

Note the date and security permissions:

15? Don't you know what that is in aviation years?

 

[Let'sgoflying!]

Hope that works for you, too.

Thanks for the info and assistance.
Based on the suggestion that this is a security issue, I might pass however.

 

[arnoha]

Thanks for the info and assistance.
Based on the suggestion that this is a security issue, I might pass however.

Unlikely that there's an issue with this particular app. Perhaps I should explain better what JNLP is. Java Network Launch Protocol is a format that allows an application written in the Java language to be started right from a web page. That's what's in the file above. First it says where the files to run are (https://bcaws.aviationweather.gov/java/fpt). Then there's some human-readable stuff to create the web link with. Then it's what security permissions this app should have. Unrestricted, in this case. The next section is a list of Java Archive (jar) files that actually contain the code. Finally it's the name of the file to run that will be found in one of the archives.

The problem with the format is that it allowed any random web page to run roughly any code on your machine. There were some protections built in, but they required a savvy user to understand and utilize them properly. That is the opposite of good security practice. Things should be secure by default and require a savvy user to unlock, instead of the other way around. Note that this file format is not the format used by the NOAA tool. It's only there to launch the program and it was created by Sun (now Oracle).

Installing Java doesn't have much in the way of security implications anymore, precisely because formats like JNLP have been disabled. So, step one is pretty safe.
Downloading the files also doesn't do anything by itself. Since you're not actually using JNLP, they won't launch themselves. Alone, that's completely safe.
The last step of manually launching the app is where there might be a risk. You're trusting that Arnaud Dumont of the University Corporation for Atmospheric Research didn't put something in nefarious in 2004. You're also trusting that the NOAA has not allowed these JAR files to be substituted on their site with something nefarious.

Not impossible, but highly unlikely. I base this on several factors. First, this thing is old. There's been plenty of time for issues to come up and also for any attack to become useless. It's a little used app, so it's not a tempting target for nefarious types. Especially with JNLP being unusable now, there is little reason for this app to be targeted by anyone. Also, the sort of innocent errors that might produce security holes from an app in 2004 are now quite well protected by modern anti-malware and firewall technologies that come turned on by default. (secure by default! we're learning!) In this particular case, I'd consider the risk very low.

Note: nothing I describe in the steps turns JNLP back on. JNLP is a hellish security risk. The browsers won't even let you turn it on. For the most part, their plug-in architectures that make JNLP launchers possible have been turned off, since they, too, were big security risks on top of the specific issues with JNLP. You make your own choices, of course, but I'm not very concerned with this particular app.

 

[Dave Hartzell]

Was able to confirm @arnoha 's instructions, although some slight differences for Linux and MacOS:

While it looks like NOAA is maintaining the codebase (as of Jan 2020) they really need to fix how this is launched, so folks won't need to do this.

After downloading all the files into a directory, run with:

Linux:
java --class-path flightpath.jar:mapdata.jar:jai_codec.jar:jdom.jar:JTS-1.3.jar:resources-2.0-B1.jar:shapefile-2.0-B1.jar edu.ucar.rap.adds.apps.flightpath.FlightPathTool

MacOS:

java -cp flightpath.jar:mapdata.jar:jai_codec.jar:jdom.jar:JTS-1.3.jar:resources-2.0-B1.jar:shapefile-2.0-B1.jar edu.ucar.rap.adds.apps.flightpath.FlightPathTool

 

[Let'sgoflying!]

Well I thought I remembered starting this thread...but its over a year now so - nope!
And the link is still not functional for the average pilot.

 

[Dave Hartzell]

Well I thought I remembered starting this thread...but its over a year now so - nope!
And the link is still not functional for the average pilot.

You're right, that is a problem. But after playing around with this tool, I don't find a lot of value in it.

I think the GFA and HEMS tools are better, for sure. It seems the primary focus of FLPT is to give a vertical slice along a flight path, and it isn't very good at it.

WeatherSpork provides a similar vertical cross section, and is a nice, portable app.

 

[Dave Hartzell]

Oh and @Let'sgoflying! if you really want to see it in action, I can set up a Zoom meeting and walk you through it.