4 ms·

I was under the impression that Java still prompts the user to allow applets to start before they're even called - is this still true, or am I missing something

by Shank 14y ago

I was under the impression that Java still prompts the user to allow applets to start before they're even called - is this still true, or am I missing something? The dialog always advises not running applets from places you don't trust, last I checked.

mscarborough 14y ago
This doesn't mean much to most users, like my parents. There's a generation of computer users who were dragged into the technology. Sure, now they may or may not love it, but throughout that time they were conditioned to just click 'OK' if it got in the way of whatever they were trying to do. This isn't an exploit targeted towards the security experts, much less people who know what "not running applets from places you don't trust" even means.
justinschuh 14y ago
I think you're confused, because the Java plugin has never behaved the way you describe.
- bdcravens 14y ago
  All of the sites with Applets I go to do this in Chrome on OSX (unless I've explicitly said the site is trusted after the first time I run it) (Can't recall a site off the top of my head, else I'd post a screenshot)
  - kijin 14y ago
    It's probably a browser feature, not a Java feature. Firefox also does this.
  - justinschuh 14y ago
    That's the browser, not the plugin. We added it to Chrome a few years ago for out-of-date plugins, and plugins that have a bad track record on fixing their vulnerabilities (e.g. Java). Firefox recently added the same thing for out-of-date plugins, and just this week started doing it for all versions of Java.
grahamedgecombe 14y ago
For signed applets which get full privileges anyway, yes, Java will prompt you to accept the certificate. However, Java does not prompt before running unsigned applets (which run with limited privileges), and the actual security issue allows unsigned applets to gain more privileges than they should have. So, unfortunately, the prompt doesn't help.

by Shank 14y ago

mscarborough 14y ago

This doesn't mean much to most users, like my parents. There's a generation of computer users who were dragged into the technology. Sure, now they may or may not love it, but throughout that time they were conditioned to just click 'OK' if it got in the way of whatever they were trying to do. This isn't an exploit targeted towards the security experts, much less people who know what "not running applets from places you don't trust" even means.

justinschuh 14y ago

I think you're confused, because the Java plugin has never behaved the way you describe.

bdcravens 14y ago
All of the sites with Applets I go to do this in Chrome on OSX (unless I've explicitly said the site is trusted after the first time I run it) (Can't recall a site off the top of my head, else I'd post a screenshot)
- kijin 14y ago
  It's probably a browser feature, not a Java feature. Firefox also does this.
- justinschuh 14y ago
  That's the browser, not the plugin. We added it to Chrome a few years ago for out-of-date plugins, and plugins that have a bad track record on fixing their vulnerabilities (e.g. Java). Firefox recently added the same thing for out-of-date plugins, and just this week started doing it for all versions of Java.

grahamedgecombe 14y ago

For signed applets which get full privileges anyway, yes, Java will prompt you to accept the certificate. However, Java does not prompt before running unsigned applets (which run with limited privileges), and the actual security issue allows unsigned applets to gain more privileges than they should have. So, unfortunately, the prompt doesn't help.