HelloImpl.java Security and Registration

You must (should) create and install a SecurityManager.
If the client is an application (and not an applet) it would also require one.
The SecurityManager guarantees that loaded classes do not do bad things.
When the server starts running (main) it creates one (or more) instances of the remote object. Since this construction automatically exports the object, the object is immediately ready to accept incoming calls.
We then register the remote object with Naming.rebind("//host/objectname", obj) which allows the caller to find the object by name. If host is omitted then localhost is assumed.
Once the object is exported RMI substitutes the stub for the actual object (obj). The registry return this stub.
For security reasons, an application can bind and unbind only to the registry running on local machine. Lookups can be done from any host.