4 ms·

To be fair, the one thing they don't want to just work is exploits. Neither Flash nor Java has the best security track record. Java lately has been embarrassing

To be fair, the one thing they don't want to just work is exploits. Neither Flash nor Java has the best security track record. Java lately has been embarrassingly bad: http://arstechnica.com/security/2012/08/critical-bug-discovered-in-newest-java/ http://arstechnica.com/security/2012/08/critical-bug-discove... Of course, they were already installing the Java plugin but disabling it by default; not sure why they needed to take the extra step of removing the plugin completely.

Silhouette 14y ago
Neither Flash nor Java has the best security track record. Java lately has been embarrassingly bad People say this sort of thing a lot, and obviously with some justification. However, it's not as if the browsers themselves have a great track record on security either. Firefox had to yank their last update shortly after making it available because of a severe problem, and the update was itself intended to fix quite a few serious security vulnerabilities. Every month we get around to update day for Windows and there are typically a handful of security fixes for IE pushed out. And so on. It seems fairly clear by now that no-one actually makes a really secure browser yet, with or without plug-ins. It's just a problem that we haven't yet learned to solve, at least not without sacrificing some other benefit that the teams making mainstream browsers value more and choose to prioritise. If we need independent security tools to keep browsing safe anyway, is avoiding plug-ins any more than a modest improvement? (And I write this as someone who did once get hit by an undisclosed and unpatched exploit in Java, resulting in a complete reinstall. It wasn't fun. But I don't suppose it would have been any more fun if it had been a zero-day vulnerability in the browser itself.)
- LnxPrgr3 14y ago
  You're right. IIRC, the last non-Java security update I installed updated a bunch of image format libraries to fix exploitable vulnerabilities. We can't even safely decode static image files! I'm not sure how we expect to safely sandbox executable code, whether it's Flash, Java, Javascript, or anything else. Even so, if Java's currently being exploited on a wide scale and Oracle's not having the greatest luck fixing the problems letting malware in, it seems prudent to direct people away from it unless they really, really need it. Any well may be poisoned, but if you know this one is you'd avoid it and warn others, wouldn't you?
  - Silhouette 14y ago
    For me, the odd thing here is that they were already disabling running Java by default, which does a lot to defeat the drive-by download problem. Given that such a mechanism is in place, we already seem to have achieved the main goal you mentioned before: exploits don't "just work". At that point, making Java "just work as long as you click somewhere to confirm you want it to" seems a reasonable policy to me. As many here have pointed out, reports of the death of Java applets serving useful purposes have been greatly exaggerated.

Silhouette 14y ago

Neither Flash nor Java has the best security track record. Java lately has been embarrassingly bad People say this sort of thing a lot, and obviously with some justification. However, it's not as if the browsers themselves have a great track record on security either. Firefox had to yank their last update shortly after making it available because of a severe problem, and the update was itself intended to fix quite a few serious security vulnerabilities. Every month we get around to update day for Windows and there are typically a handful of security fixes for IE pushed out. And so on. It seems fairly clear by now that no-one actually makes a really secure browser yet, with or without plug-ins. It's just a problem that we haven't yet learned to solve, at least not without sacrificing some other benefit that the teams making mainstream browsers value more and choose to prioritise. If we need independent security tools to keep browsing safe anyway, is avoiding plug-ins any more than a modest improvement? (And I write this as someone who did once get hit by an undisclosed and unpatched exploit in Java, resulting in a complete reinstall. It wasn't fun. But I don't suppose it would have been any more fun if it had been a zero-day vulnerability in the browser itself.)

LnxPrgr3 14y ago
You're right. IIRC, the last non-Java security update I installed updated a bunch of image format libraries to fix exploitable vulnerabilities. We can't even safely decode static image files! I'm not sure how we expect to safely sandbox executable code, whether it's Flash, Java, Javascript, or anything else. Even so, if Java's currently being exploited on a wide scale and Oracle's not having the greatest luck fixing the problems letting malware in, it seems prudent to direct people away from it unless they really, really need it. Any well may be poisoned, but if you know this one is you'd avoid it and warn others, wouldn't you?
- Silhouette 14y ago
  For me, the odd thing here is that they were already disabling running Java by default, which does a lot to defeat the drive-by download problem. Given that such a mechanism is in place, we already seem to have achieved the main goal you mentioned before: exploits don't "just work". At that point, making Java "just work as long as you click somewhere to confirm you want it to" seems a reasonable policy to me. As many here have pointed out, reports of the death of Java applets serving useful purposes have been greatly exaggerated.