4 ms·

Damn... I thought it was another remote DoS (like the semi-recent hashmap degenerating that could be triggered by using parameters in URL like aa=xx, ab=yy, ac=

Damn... I thought it was another remote DoS (like the semi-recent hashmap degenerating that could be triggered by using parameters in URL like aa=xx, ab=yy, ac=zz, etc. or the floating-point 12-years old bug that people noticed could be remotely triggered on any Tomcat server) and that, once again, I'd have to apply a workaround on my Java servers. Thankfully this one is only concerning Java applets. Java applets where probably the stupidest thing ever. They surely did sck and did bring terribly bad reputation to Java : ( Don't know who's still using them. Can Google Chrome even be made to run Java applets? I know latest OS X don't even ship* with Java anymore...

tomjen3 14y ago
The company I work for made Java applets (specifically online games) until very recently. To interact with the danish government online (say because you want to update your tax records) you have to login -- with a java applet. That also means you can't do it from your phone. Yeah, Java is still used in plenty of places, and yes Chrome still support it.
JabavuAdams 14y ago
Java applets were great for graphics demos and teaching apps. Flash and Unity, etc have taken over, but who's to say that they are more secure?
taylodl 14y ago
Exactly. A web application platform you should have stopped using 10 years ago is still causing problems. Imagine that!
Chris_Newton 14y ago
Java applets are still in wider use than you seem to realise. For example, in some places, they seem to be the norm for things like on-line banking or interaction with government web sites. As a second example, they are also used for UIs on network-accessible devices. As a third, I’ve seen quite a few used for interactive illustrations on academic/training web sites. People have been doing these things with Java for at least as long as they’ve been doing them with Flash. And there are plenty more cases: tomjen3 already mentioned games, IIRC the conference call/screen sharing service used by one of my clients is Java-based, etc. The likes of Google and Mozilla might want us all to drop these tried and tested technologies and move to shiny new ones like HTML5 and the latest JS and CSS developments, but realistically, it takes time for users to move on. Most of us don’t have the luxury of controlling our customers’ platforms so we can ensure they run up-to-date builds of Firefox or Chrome with all the latest toys. It takes time for developers to move on, too. I’m currently working on a project that uses a Java applet for a client. If I were starting the same project today, I’d probably chose different tools, but it wasn’t started today, and not so many years ago when the architectural decisions were being made, those new tools didn’t exist yet. The main thing holding Java applets back today seems to be the second rate support they now get from the major browsers and/or Oracle, assuming they are supported at all. The number of blatant, show-stopping bugs in browser/Java interactions is getting silly, and code that has worked for years is breaking because someone installed a software “upgrade”. That’s a pity, IMHO, because the JVM is still a decent platform, and there are several interesting modern programming languages other than Java itself that we could be using to develop web apps otherwise.
- nwh 14y ago
  I've literally never seen Java in the wild that's not part of an exploit kit. I've disabled Java in every browser / OS since about 2007, and I'm yet to be unconvinced by not having it. Can you show me any examples of what I might be missing out on?
  - Chris_Newton 14y ago
    The applet I’m working on is rather specialised, so talking about that isn’t going to prove much. Others have pointed out some common examples from among the fields I mentioned, such as Minecraft, WebEx, and Danish government web sites. Each of these has a significant user base relying on Java applets.
    - SiVal 14y ago
      Does Minecraft use applets or is it just a standalone desktop Java app? Does installing Minecraft create any vulnerability to this bug on a machine whose browsers have deactivated any Java plugin?
      - Aticus_Finch 14y ago
        There are unrelated. Besides downloading the Java app, you can play Minecraft in the browser through an applet at https://minecraft.net/play https://minecraft.net/play. So no, if you are not running Java in the browser, a malicious web page can't run neither Minecraft nor other Java apps that you have locally installed.
  - mrgoldenbrown 14y ago
    You don't mention where you work, but I'm guessing it's not an "enterprisey" or "corporatey" kind of place. Count your blessings :)
  - bashinator 14y ago
    Just about every out-of-band management card (e.g. HP iLO, Dell iDRAC) for server-class computers, uses the Java plug-in to present a KVM (keyboard/video/mouse) console through a web browser.
TurplePurtle 14y ago
Unfortunately, Java applets are the only way to connect a Midi Keyboard to an HTML5 app.
freehunter 14y ago
It looks like you tried to censor suck for some reason and triggered the markup between the asterisk used for censoring and the first one highlighting the word ship.
reinhardt 14y ago
Dont know who's still using them. At least one online banking site of a large Scandinavian bank...
ttt_ 14y ago
Currently it's the best way to serve labels for thermic printers that our clients need. There is no direct input to the printer as a byte buffer, the browser will always print a markup document. Unless HTML5 comes up with Printer Sockets, we are stuck with Applets in order to be granted hardware access to the client machine.
- bragh 14y ago
  The same problem applies to most point of sale hardware, the stuff we use doesn't mostly care about drivers at all. Receipt printers just want raw bytes sent to their port, no matter COM or LPT or LAN - OS is bit of an obstruction on the way. Kind of sad that web-based POS software can't take full advantage of the conveniences web brings (ease of updating the program, easier and prettier graphical designs) without losing the capability of interfacing properly with hardware.
cnlwsu 14y ago
> Don't know who's still using them. One thing about applets is they are the only way I know of to generate UDP packets from the browser. If it wasn't for that I couldnt think of anything.
finnw 14y ago
Banks like java applets because of the built-in cryptography functions.

tomjen3 14y ago

The company I work for made Java applets (specifically online games) until very recently. To interact with the danish government online (say because you want to update your tax records) you have to login -- with a java applet. That also means you can't do it from your phone. Yeah, Java is still used in plenty of places, and yes Chrome still support it.

JabavuAdams 14y ago

Java applets were great for graphics demos and teaching apps. Flash and Unity, etc have taken over, but who's to say that they are more secure?

taylodl 14y ago

Exactly. A web application platform you should have stopped using 10 years ago is still causing problems. Imagine that!

Chris_Newton 14y ago

Java applets are still in wider use than you seem to realise. For example, in some places, they seem to be the norm for things like on-line banking or interaction with government web sites. As a second example, they are also used for UIs on network-accessible devices. As a third, I’ve seen quite a few used for interactive illustrations on academic/training web sites. People have been doing these things with Java for at least as long as they’ve been doing them with Flash. And there are plenty more cases: tomjen3 already mentioned games, IIRC the conference call/screen sharing service used by one of my clients is Java-based, etc. The likes of Google and Mozilla might want us all to drop these tried and tested technologies and move to shiny new ones like HTML5 and the latest JS and CSS developments, but realistically, it takes time for users to move on. Most of us don’t have the luxury of controlling our customers’ platforms so we can ensure they run up-to-date builds of Firefox or Chrome with all the latest toys. It takes time for developers to move on, too. I’m currently working on a project that uses a Java applet for a client. If I were starting the same project today, I’d probably chose different tools, but it wasn’t started today, and not so many years ago when the architectural decisions were being made, those new tools didn’t exist yet. The main thing holding Java applets back today seems to be the second rate support they now get from the major browsers and/or Oracle, assuming they are supported at all. The number of blatant, show-stopping bugs in browser/Java interactions is getting silly, and code that has worked for years is breaking because someone installed a software “upgrade”. That’s a pity, IMHO, because the JVM is still a decent platform, and there are several interesting modern programming languages other than Java itself that we could be using to develop web apps otherwise.

nwh 14y ago
I've literally never seen Java in the wild that's not part of an exploit kit. I've disabled Java in every browser / OS since about 2007, and I'm yet to be unconvinced by not having it. Can you show me any examples of what I might be missing out on?
- Chris_Newton 14y ago
  The applet I’m working on is rather specialised, so talking about that isn’t going to prove much. Others have pointed out some common examples from among the fields I mentioned, such as Minecraft, WebEx, and Danish government web sites. Each of these has a significant user base relying on Java applets.
  - SiVal 14y ago
    Does Minecraft use applets or is it just a standalone desktop Java app? Does installing Minecraft create any vulnerability to this bug on a machine whose browsers have deactivated any Java plugin?
    - Aticus_Finch 14y ago
      There are unrelated. Besides downloading the Java app, you can play Minecraft in the browser through an applet at https://minecraft.net/play https://minecraft.net/play. So no, if you are not running Java in the browser, a malicious web page can't run neither Minecraft nor other Java apps that you have locally installed.
- mrgoldenbrown 14y ago
  You don't mention where you work, but I'm guessing it's not an "enterprisey" or "corporatey" kind of place. Count your blessings :)
- bashinator 14y ago
  Just about every out-of-band management card (e.g. HP iLO, Dell iDRAC) for server-class computers, uses the Java plug-in to present a KVM (keyboard/video/mouse) console through a web browser.

TurplePurtle 14y ago

Unfortunately, Java applets are the only way to connect a Midi Keyboard to an HTML5 app.

freehunter 14y ago

It looks like you tried to censor suck for some reason and triggered the markup between the asterisk used for censoring and the first one highlighting the word ship.

reinhardt 14y ago

Dont know who's still using them. At least one online banking site of a large Scandinavian bank...

ttt_ 14y ago

Currently it's the best way to serve labels for thermic printers that our clients need. There is no direct input to the printer as a byte buffer, the browser will always print a markup document. Unless HTML5 comes up with Printer Sockets, we are stuck with Applets in order to be granted hardware access to the client machine.

bragh 14y ago
The same problem applies to most point of sale hardware, the stuff we use doesn't mostly care about drivers at all. Receipt printers just want raw bytes sent to their port, no matter COM or LPT or LAN - OS is bit of an obstruction on the way. Kind of sad that web-based POS software can't take full advantage of the conveniences web brings (ease of updating the program, easier and prettier graphical designs) without losing the capability of interfacing properly with hardware.

cnlwsu 14y ago

> Don't know who's still using them. One thing about applets is they are the only way I know of to generate UDP packets from the browser. If it wasn't for that I couldnt think of anything.

finnw 14y ago

Banks like java applets because of the built-in cryptography functions.