3 ms·

> Until then, we recommend uninstalling Java if you don’t need it This advice feels very rash to me. This vulnerability (and most Java vulnerabilities in its

by zmmmmm 14y ago

> Until then, we recommend uninstalling Java if you don’t need it This advice feels very rash to me. This vulnerability (and most Java vulnerabilities in its class) affects ONLY the Java browser plugin. Many users won't know if they need Java on their computer, and common services like GotoMeeting and others use it transparently. Telling them to uninstall it will cause support headaches for companies that have coached the user through Java installation in the past and now suddenly it's gone. The result will be that after wasted time on everybody's part, they'll end up reinstalling Java and will be vulnerable all over again. It would be much better to include proper instructions for how to disable it (or set it in click-to-play mode) in the browser than telling people to uninstall it carte blanche.

greggman 14y ago
That would be great except as far as know it's impossible to install without the plugin. There's no download option that doesn't install the plugin as well and even if you disable it it will get re-enabled next time it upgrades (maybe they've fixed that?)
- drucken 14y ago
  You are correct. As far as I know, there is no way to not install Java browser plugin files as part of the Java installation process. You can only disable, rename, delete or block (in the browser configuration) after installation. As of Java 7 Update 10 (12 Nov 2012), there is also a Java Windows Control Panel option to control the security configuration of browser plugin, including preventing it running. I do not know if changes to these settings still apply if further updates or other Java versions are installed. However, all of these actions are non-trivial for typical users and besides Java is unlikely to be used on the desktop for most users.
meaty 14y ago
Yes this has shot us. Your approach is much better. Half of our outsourcers use Firefox with a screenshot tool which is a java applet. This just stopped working. So Monday is going to be a days work for our operations guys to sort out the mess. I don't expect the browser to police the internet - it's not its job. I'm actually gaining respect for IE these days - it doesn't pull shit like this and we have more control over it in a corporate environment.
- politician 14y ago
  I do expect the browser to police the internet though tab isolation, incognito modes, and plugin policies. These plugin vendors are a persistent source of exploitable security bugs. An analogy, if my butler allows you into my home and he notices you opening the door to criminals, then he's going to demand that you leave. If he doesn't, I'm going to fire him. (Disclosure: I don't have a butler.)
  - meaty 14y ago
    Warn yes, ban no. That is the problem. Anything which takes choice away from the user is negative if you ask me.
- rmc 14y ago
  I don't expect the browser to police the internet - it's not its job. Protecting users from getting compromised is part of the browser's job. Security on the internet is important.

by zmmmmm 14y ago

greggman 14y ago

That would be great except as far as know it's impossible to install without the plugin. There's no download option that doesn't install the plugin as well and even if you disable it it will get re-enabled next time it upgrades (maybe they've fixed that?)

drucken 14y ago
You are correct. As far as I know, there is no way to not install Java browser plugin files as part of the Java installation process. You can only disable, rename, delete or block (in the browser configuration) after installation. As of Java 7 Update 10 (12 Nov 2012), there is also a Java Windows Control Panel option to control the security configuration of browser plugin, including preventing it running. I do not know if changes to these settings still apply if further updates or other Java versions are installed. However, all of these actions are non-trivial for typical users and besides Java is unlikely to be used on the desktop for most users.

meaty 14y ago

Yes this has shot us. Your approach is much better. Half of our outsourcers use Firefox with a screenshot tool which is a java applet. This just stopped working. So Monday is going to be a days work for our operations guys to sort out the mess. I don't expect the browser to police the internet - it's not its job. I'm actually gaining respect for IE these days - it doesn't pull shit like this and we have more control over it in a corporate environment.

politician 14y ago
I do expect the browser to police the internet though tab isolation, incognito modes, and plugin policies. These plugin vendors are a persistent source of exploitable security bugs. An analogy, if my butler allows you into my home and he notices you opening the door to criminals, then he's going to demand that you leave. If he doesn't, I'm going to fire him. (Disclosure: I don't have a butler.)
- meaty 14y ago
  Warn yes, ban no. That is the problem. Anything which takes choice away from the user is negative if you ask me.
rmc 14y ago
I don't expect the browser to police the internet - it's not its job. Protecting users from getting compromised is part of the browser's job. Security on the internet is important.