11 ms·

A close look at how Oracle installs deceptive software with Java updates

363 points by Hagelin 14y ago

chadscira 14y ago
What really upsets me about this is that it's Java that they are stuffing this adware into... Java a previously legitimate requirement that many applications have chosen to build on top of as a language/platform. For the average user it looks like all of these other programs are promoting this... I'm surprised that they can get away with it.
manaskarekar 14y ago
Can someone comment on how .NET platform + tools compare? As someone who is not invested in either camp, between the two, .NET seems like a much better place to be invested in right now. Edit: Thanks a lot for the replies, I'm much better informed.
- sc0rb 14y ago
  I've been a professional Java developer for just over 2 years now. Let me give you a simple example. The three leading Ecommerce platforms (Oracle ATG, Hybris and IBM WebSphere) are all done in Java. There is huge demands for Java developers working on Web and Enterprise systems the world over. The average Salary for Java developers is pretty high in most places (london and Sydney) and the day rates you can charge as a contractor are very good. There also seems to be more open source and technical community in Java. I am glad that I went down the Java route. also, Most Java development jobs nowadays focus on the web and server side stuff, this is followed by mobile (such as android) and embedded (such as TIVO boxes).
  - KumarAseem 14y ago
    Java isn't what it used to be. The products written in Java are slow, bad looking and less secure. The days of Java are anyways numbered.
    - sc0rb 14y ago
      That's an incredibly ignorant response and you have no idea what you're talking about. Java looks bad? You're probably talking about certain swing applications which are now very rare on the desktop. Java is slow? You clearly have no idea how fast the JVM can interpret and JIT java nowadays. Java is insecure? You're mainly talking about applets which are an ancient technology on their way out (slowly). In terms of actual JVM security. Every product has its security issues. You seem very ignorant, your java experience is probably from the past e.g. J2EE1.4 and old swing apps. Modern Java is an good language on a great platform. There's a reason why it runs some of the worlds biggest ecommerce sites and worlds fastest trading desks.
      - jbm 14y ago
        While I think the parent was overplaying it, I do find most of the Java applications on my mac are slow and irritating to run. Pycharm is an example of one of the apps I am talking about. It just feels like it struggles at times, eventhough I have a fairly new machine. Java was the first language I learned while going through college but I find the verbosity to be irritating.
        sc0rb 14y ago
        Your experience is not necessarily because Java is slow. It could just be the applications you are running that are slow for reason that have nothing to do with the language. Swing is probably going to be slower (maybe?) than some native windowing framework. But Java as a language running on the JVM is certainly not slow. I've just been looking up pycharm and it seems that the slowness issues are to do with things like opening files and doing parsing. These things are likely to be slow for anything but the language they are written in.
        matwood 14y ago
        Desktop java is dead. Actually desktop anything that's not web is going to end up dying. The server is where the languages will duke it out next and Java is fine there. C# is also fine on the server. The nice thing about Java is it easily runs on linux and has many OSS libraries to help quickly standup server applications.
  - kabdib 14y ago
    I went from writing client-server code in Java to writing similar things in .NET. After two months of C#, I remember thinking to myself, quite clearly, "Oh, thank God, the nightmare is over." Debuggers that worked. Native calling systems that actually interoperated well. A set of classes that weren't horribly overdesigned and under-implemented. Best of all, no culture that insisted on factories that made factories that made factories. Writing Java on phone platforms is fine. But the enterprisey stuff is death on roller skates. Hey, if you can stand it (my cousin does), then you might make a bunch of money. My cousin spends six months hacking Java for a bank, then six months vacationing. I prefer to do stuff that doesn't make me contemplate washing dishes for a living again. .NET has its warts, but it's not cancerous the way Java turned out to be in the hands of the architecture astronauts.
    - sc0rb 14y ago
      Interesting experience you have. I have spend most of my career doing Java6 JEE6 and modern Spring and it all feels quite modern. I did a lot of C# at University and it is a good language and platform but I don't think it's better than Java. New / modern Java is fine, it's old java that you want to avoid.
      - chaostheory 14y ago
        If you ever try any of the modern stuff (django, rails, play, grails, any node.js framework) in depth, j2ee / Spring and java just feels old and ancient. Spring has gotten better over the years, but there's still just too much work and too much unnecessary complexity and cruft with Spring. It's really telling when even Spring's creator jumped ship to work with TypeSafe and jvm7 has huge improvements designed for other languages. imo C# is an improved java, but C# open source ecosystem is just anemic compared to java.
        DoubleCluster 14y ago
        I actually like old and ancient. That means all bugs have been fixed already. Systems become complex quickly enough and you need to use the most boring bricks imaginable if you want to build something sturdy.
- TimGebhardt 14y ago
  For the newest versions of Windows (Server 2012, Windows 8) .NET comes installed -- I forget if it's installed by default or installs as a Windows component. If it's the latter you install it from the same screens you install IIS or the SMTP server from. After you install it updates to the .NET framework show up in the "optional" windows updates. There are certainly standalone installers as well: http://www.microsoft.com/net/download http://www.microsoft.com/net/download But if you're producing client-side software that's dependent on the .NET framework then you most certainly will make your installer "bootstrap" the installation of the correct framework for your OS language and hardware.
- edandersen 14y ago
  You never have to worry about drive-by installers with .NET updates - security updates just come down with Windows Updates. .NET is seeing a small renaissance with ASP.NET MVC and what the Server teams are putting out, but Java is also gaining popularity again as a way of running Rails apps quickly and with Scala. Both platforms have enough legacy apps out there for a lifetime of maintenance work, if that's your sort of thing. Cleaning up after outsourcing companies is lucrative.
- chaostheory 14y ago
  In terms of just the languages themselves, .NET is very solid. C# is definitely a better version of Java, and the rest of the # languages in general are decent or good. However, the .NET open source ecosystem (while greatly improved from years back) still really really sucks. Historically, this is directly MS's fault (codeplex helped but it still will never be able to undo the damage MS did early on). I just think it's a waste of time having to reinvent wheels that pretty much every other major platform (Java, PHP, Ruby, Python, etc...) has plenty of. I always hate having to do extra work that I feel is entirely unnecessary, which happens a lot on .NET.
- davesims 14y ago
  I had about a decade in both, and really they're two very different worlds. From a code standpoint I'd much rather be in C#. It's one thing that MS has done really, really well over the last 10 years. They've taken a pretty aggressive stance towards adopting new features and although it's become fairly complex as of 4.0 and on, it really has some great features, some functional-inspired things like closures and collections api stuff that reminds me of Ruby in a lot of ways, and a great web framework in MVC that is honestly almost as fun to code for as any of the open source web frameworks out there. If you had to choose between one of the big J2EE stacks and MVC, no question, MVC is far, far better. The infrastructure is still a big 'ol MS GUI world, and I'd rather do <badPainfulThing> than spend a lot of time configuring and deploying IIS apps, but then TomCat and WAR files et. al. ain't exactly fun either. Java's JVM/bytecode infrastructure on the other hand has undergone a renaissance as a VM platform for a lot of very cool languages: Scala and Clojure being the two big examples there. But that's Really not the same thing as Java, obviously. And there's Android -- a completely different ecosystem, and somewhat truncated as a Java dialect, but still basically the Java language and able to employ most of the libs you're used to having: Guava, Guice and so on. No dynamic code gen, which stinks, but I know why they did it. So if you have Java under your belt and want to get into mobile stuff, that's a huge plus. So, as a general-purpose language skill, Java is still really, really important to know and will have legs for a long time to come. ASP MVC is a great framework, and if you can't work in something like Django or Rails or the like, it comes in nice 3rd or 4th place in terms of making for general coder happiness. C# is a far more progressive and interesting language than Java, but that's a philosophical difference between the gatekeepers of the two languages: Java intentionally moves slow for the sake of stability and continuity, C#'s minders have apparently embraced a little of the 'move fast break things' attitude of some parts of the open source world. I prefer the latter, but understand the rationale of the former. Me, I'm a Rails coder these days but also get to hop back into Java for Android dev and the rare foray into ASP work and they all have strengths and tradeoffs and they'll all be around a long time. The only thing I think I would avoid on principle, for my own sanity, is any enterprisey J2EE framework. That truly does feel like a massive leap backwards.
  - untog 14y ago
    Agreed with this. I used to code C# for a living but have moved on- however, I'm now playing around with MonoTouch in my spare time and I'm loving using C# again. MonoDevelop is a poor man's Visual Studio, but it's a lot less demanding and runs on OSX. Backend frameworks like Nancy.fx are really great for being even simpler versions of MVC, too.
- darklajid 14y ago
  You got a lot of replies already, but let me join the crowd. Disclaimer: Was a Java guy, working with C# exclusively now by day (F# and Clojure - not Clojure-Clr - are my pet languages at night). In my opinion the languages (specifically Java vs. C# now, ignoring other languages for now) started out really, really close when C# was new. C# gained a lot of nice features, while Java was - euphemistically - 'stable'. Thinks that made my day and made every sporadic try to get back to Java (or work on Android) a chore: .Net events, properties (later automatic properties), usable generics, delegates, yield based generators/enumerators and the reason they were added: LINQ. Type inference aka 'var'. Basically every release brought half a dozen interesting features (and new technology, WCF/WPF/Silverlight/Workflow), while Java was sleeping as far as I could tell. I understand the latest release of Java now came closer again, but C# is still quite ahead in my opinion. Tooling: Visual Studio. Now, I'm not a total fan and some releases are better (2008, 2012) than others (2003, 2005, 2010), but it's a decent tool for most all your developing needs and ranges from free to 'includes the kitchen sink and costs $$$'. It supports three languages out of the box (F# is very interesting and a fully supported language!). I like IntelliJ and sympathize with the Eclipse project, but for me the VS experience is more streamlined, simple and nicer in general. Libraries: If it's _really_ popular in the Java world, you'll find a port (think nhibernate, log4net) or something equivalent. I wouldn't want to go back (C# -> Java), but I DO have the jdk around for Clojure (and I'm still watching Scala from a distance).
  - chaostheory 14y ago
    > Tooling: Visual Studio. It's a decent tool but I think the alternatives for other platforms are either equal or better. imo MS is typically playing catchup in this area now. > Libraries: If it's _really_ popular in the Java world, you'll find a port (think nhibernate, log4net) or something equivalent. This is what truly makes .NET a no go for me. There's just too few non-paid and open library equivalents compared to almost any other platform. Not mention the libraries in other platforms tend to have more features. The .NET open source community is still pretty small and weak, and I just don't see that changing (even with CodePlex it hasn't really had any drastic changes).
  - edwinnathaniel 14y ago
- edwinnathaniel 14y ago
  I used to intern at MS and have used .NET platform for a while (on and off, including not too long ago doing a bit of ASP.NET, ASP.NET MVC, and Sharepoint for one-week project). I've used VS.NET 2005, 2008, and 2010. I've also used Java for a while, the whole Spring MVC, JEE6, Eclipse, IntelliJ. If you're willing to live in Windows OS platform, you should go with .NET, no question asked. Forget about tooling and everything else. If you want more flexibility, more choices, etc, Java is your choice. (There's also Python, Ruby, and the rest but let's scope it to Java). .NET culture is heavily influenced by the culture of Microsoft which means: 1) Less Open Source, More mISV (more "pay" products) 2) Windows/GUI, less command-line (has changed a bit but still not there) 3) Fire and Motion http://www.joelonsoftware.com/articles/fog0000000339.html http://www.joelonsoftware.com/articles/fog0000000339.html #3 is important because MS makes money from tooling as well. When I was there, the internal chatter was "tool will be out of date every 2-3 years". Please make your own conclusion. Some people said Java had this period of "sleeping" which was true. But during that time frame, we've seen TONS of open source projects that are very mature, battle-tested, and probably everlasting. We've also learned a better way to write Java code (HN made such a big deal of Factories yet HN never acknowledge the best breed of Java code out there, it's a typical of a community like this anyway). Thus that "sleeping" period is being used efficiently to stabilize things. When it comes to tooling, Java beats .NET by miles. Java deployment packaging (JAR for library and WAR for web-app) is one of the best out there and it's been stable for many many years. (http://dirtsimple.org/2004/12/java-is-not-python-either.html http://dirtsimple.org/2004/12/java-is-not-python-either.html) Java build and dependency management tool is also far ahead of what the .NET has. Maven is far beyond NuGET and MSBuild (shrudder). Integrating Java build with popular Continuous Integration server like Jenkins, TeamCity is waaaay easier than .NET. Eclipse foster a good community of open source and free tools/plugins which put VS.NET to shame BUT BUT BUT experience may vary when using Eclipse. Eclipse is like black magic and moody: if somehow you're in the position that your Eclipse is stable, it's one of the best IDE out there. Eclipse has its own built-in "app-store" that makes installing plugins sooo much easier, seamlessly, and faster. m2clipse, a Maven plugin for Eclipse can perform the following steps: 1) Download dependencies 2) Download the dependencies javadoc (auto-complete will show the code documentation) 3) Download the dependencies source code (#1 only download the compiled code) if you ever wanted to "navigate to the implementation of a method" It does this seamlessly without you breaking a sweat. Tools like FindBugs and CheckStyle helped to improve your code hygine/style and EclEmma can tell your Code Coverage. All of these are free. Java has rich and mature tools and libraries: 1) Sonar => http://www.sonarsource.org/ http://www.sonarsource.org/ 2) Jenkins => http://jenkins-ci.org/ http://jenkins-ci.org/ To put it simply, the Java community has a very strong Software Engineering discipline and continue to find better ways to develop whereas the .NET/C# community is either following Java lead or serving its own master: Microsoft. I'm glad I'm out the .NET world because it was soo much limiting and "capping" your day-to-day productivity.
jakub_g 14y ago
One additional note regarding the installer: to opt out of the toolbar installation, you have to click the checkbox itself. You can't click the text label associated to it. I call it a bug, but certainly it's a feature in this context.
- talmand 14y ago
  Actually, that's very common. It's one of my pet peeves for web design but I see it often in installers and the applications themselves.
edandersen 14y ago
Looks like YC should make an investment!
- bobsy 14y ago
  It does seem to meet PG's critera 1. The user has an opportunity to opt out. 2. Calling Ask Toolbar "crapware" is only an opinion. Someone may actually want it. sniggers I think bundling software is fine so long as it is relevant and genuinely useful. Ask Toolbar fails on both accounts. Bundled software shouldn't be offered during minor updates or security fixes... or at the very least, during these minor updates, it should be opt-in instead of opt-out.
regularfry 14y ago
This problem has been known and complained about for ages. What's the community response? We have OpenJDK, why does anyone put up with an abusive installer from Oracle?
- jarito 14y ago
  Because Windows is not a supported platform? You have to find an unofficial build or build it yourself.
  - mathnode 14y ago
    Is anyone distributing 64bit OpenJDK builds for windows? EDIT: I found: https://github.com/alexkasko/openjdk-unofficial-builds https://github.com/alexkasko/openjdk-unofficial-builds
    - untog 14y ago
      Just the word 'unofficial' is enough to stop most large companies using them. It is (was?) the same with Firefox- they never offered an MSI installer for use on corporate networks. There were unofficial versions, but you could never be sure that someone hadn't bundled something extra in there.
      - mamcx 14y ago
        "but you could never be sure that someone hadn't bundled something extra in there". Irony, With Oracle, your are SURE.
      - klez 14y ago
        Well, this thing about Java shows that you can trust not even official versions...
  - eumenides1 14y ago
    Is there an OpenJRE(or even a need)? or do we just run OpenJDK?
Aardwolf 14y ago
This sums up everything I find wrong about the Windows philosophy. Software whining for updates. Unwanted background programs. Installers that want to install more than you ask for. Usage of the phrase "We recommend" where recommend means "we get money if you". I've never seen any of those terrible anti-user behaviours in a Linux package manager, or makefile. I would be fine with an actual security fix being downloaded and installed silently (without any other payload of course).
- kevingadd 14y ago
  This has nothing to do with Windows specifically and everything to do with software developers prioritizing profit over all else. What does the 'Windows Philosophy' have to do with the decisions Oracle makes about Java anyway? Do you really think Java follows the 'Windows Philosophy'?
  - steveklabnik 14y ago
    > This has nothing to do with Windows specifically and everything to do with software developers prioritizing profit over all else. Sounds like Windows to me.
  - sc0rb 14y ago
    I have a feeling he means bundling crap with installers. This has been done for a long time on Windows and not so much on Linux or OSX.
    - bmj 14y ago
      Likely because Windows has enjoyed a rather massive installation base, particularly among folks who are not terribly knowledgeable. I'm sure as other platforms become more dominant, we'll see similar shenanigans.
      - bad_user 14y ago
        Having a user base of folks that aren't very knowledgeable is no excuse for abuse. Also, I do not think other platforms can be as plagued as Windows is, because it's a matter of culture and user expectations being driven by that culture. The size of the user base has nothing to do with it. On Windows users wishing to get anything done resort to installing some crap, even for basic things like uncompressing an archive, watching a movie, listen to some MP3 or viewing a PDF or an Office document. Things got better with open-source software that was ported to Windows, but considering that Windows is the dominant operating system, the ecosystem is actually kind of lame. If you want quality software, the few exceptions are some open-source apps and some products being sold by some big publishers and that's it. I have a theory that this is because Microsoft itself encouraged piracy and bundling of crapware, while discouraging indie developers, communities and open-source.
NelsonMinar 14y ago
It's a nice racket Oracle has. Every time they release a security fix, they make a few hundred thousand bucks on drive-by installs. Security holes as business model.
- nhebb 14y ago
  They don't even need to release a fix. I have been prompted to update several times in the past year, where I go through the install process (including having to uncheck the Ask box), only to get the message at the end that version x.y.x is already installed. The updater is just plain buggy. Ed Bott mentioned the problems with limited user accounts, but I didn't see him mention the issue with jucheck ignoring the update settings: http://superuser.com/questions/130961/how-to-stop-jucheck-from-running-java-wont-remember-check-for-updates-automat http://superuser.com/questions/130961/how-to-stop-jucheck-fr... I also had an XP system where the %appdata% environment variable somehow got deleted. This completely breaks the installer.
  - niggler 14y ago
    Is the Ask.com toolbar installed before or after Java, and if java fails will ask.com be rolled back?
    - noselasd 14y ago
      When you check for the Ask toolbar and click next in the Java installer, the toolbar installer is fired off in the background, and installs itself after 10 minutes, regardless of what you do with the Java installer.
      - niggler 14y ago
        That's incredibly shady.
      - kaffiene 14y ago
        I don't get this. I install Java updates regularly and I've never had this toolbar installed. (I do agree that Oracle are jerks, however)
visualcsharp 14y ago
When I first saw that the Java installer has bundled shitware, I just couldn't believe it. Oracle? As in the global giant megacorp? Why would they need to bundle the Ask.com toolbar with a software platform installer? The whole thing just makes no sense!
chrisacky 14y ago
Just to tell my experiences on this, I was forced to install the crapware last week. There was no way for me to uncheck or opt out of the checkbox. I have a machines which I connect to that do not have any mouse connected. I have no problem in navigating systems with a keyboard and can run through installers probably quicker than most people with a mouse can, but when this dialog popped up for me, I was stumped for about 10 minutes. I employed every shortcut in my keyboard-shortcut arsenal and fell short. I genuinely felt like this was not just some programming mistake (because the "Next" control was already highlighted waiting for me to hit Enter). It is a dark pattern that was purposefully introduced to their installer to make it impossible for users like me to opt-out of their installer. A consequence of their deception was that they did get a dozen installs from me, but my dislike for Oracle increased tenfold, and in a quiet-protest, I'll make damned sure that I suggest any alternative to an Oracle product when I have reasonable alternatives (Without cutting off my nose to spite my face).
- corresation 14y ago
  It absolutely wasn't a mistake. Most legitimate software makes the descriptive text for a checkbox (the label) a trigger for the checkbox. The Ask Toolbar installer option, however, disables this, forcing you to specifically target the checkbox itself. It is incredibly scummy, and worse it actually encourages Oracle to create insecure software -- at least in the short term -- because each fix is another spin of the wheel.
  - iuguy 14y ago
    That's weird, I thought Oracle have been making insecure software for decades and this was just business as usual for them.
    - hnriot 14y ago
      clearly, you haven't been paying attention.
  - talmand 14y ago
    There are examples of legitimate software failing in this aspect as well. Not to suggest that Oracle does not do this on purpose for nefarious reasons or that other software is being scummy somehow. I don't work at Oracle so I can't say if it's intentional or just part of the problem that's more common then you think.
deleted 14y ago
[deleted]
DoubleMalt 14y ago
Well when after the last security issue there were articles calling end users for uninstalling java completely, I was pretty mad at the missing distinction between the plugin and the runtime. But now I really think this is a good thing to recommend under windows. I will still continue using OpenJDK for server projects under Linux, but will press for different solutions whenever installation of Jav on a Windows machine might be required.
king_magic 14y ago
I happily uninstalled Java from all of my machines/OSes last week. Glad to be rid of it.
- neumann_alfred 14y ago
  I decided to try the same. It's been ages since I last played Minecraft, and I have frankly no idea what other apps I'm using might be using Java; the only way to find out is to uninstall it. It's not like I can't install it again if I need it.. but the days of just having it installed "just in case" are over for me. I might even uninstall Flash just for kicks.
nnq 14y ago
Java could have been such a good thing, even in the browser (ok, as platform, ignoring the language's shortcomings, but still...). Whys did both Sun and Oracle strive so hard to fuck it up? It's as if these guys have a "how to fuck things up for the end user" brainstorming meeting every week!
- brazzy 14y ago
  I think the last few years have shown conclusively that the it is not a good thing in the Browser because the sandbox security model is too complex to be implemented correctly.
  - nnq 14y ago
    > the sandbox security model is too complex to be implemented correctly ...is there any other simpler security model than this? Java even seems a simpler and more "well behaved" language than JavaScript, and JVM bytecode is said to be even simpler (though I'm not an expert on this...), and browsers had they own share of Javascript related exploits but people rolled updates quickly, acted responsibly and didn't do anything particularly stupid (as opposed to the described crapware incident perpetuated by Oracle). EDIT+: one can buy browser exploits cheaper on "the x market" and they are more useful than JVM exploits so "security" is not Java's Achilles' heel, and it's Swiss cheese all the way down if you at most web-facing software unfortunately...
neya 14y ago
Ladies and gentlemen, introducing THE fugliest company of all time - ORACLE. The company that sued Android unsuccessfully, The company that fucked up JAVA, The company that fucked up MySQL, The company that fucked up OpenOffice, The company that doesn't like anything good happening within the tech sector. I really miss those days when Oracle was highly respected and used to be a great workplace to be a part of.
- colanderman 14y ago
  Don't forget the OpenOffice.org clusterfuck.
  - neya 14y ago
    Thanks, edited to include OO (how could I forget this one?).
- webreac 14y ago
  I started working in 1994 and Oracle was already the database provider that did not want to comply with standards (Sql92). They were already greedy.
  - hnriot 14y ago
    SQL standards were and are a joke. Real app developers can't wait for the standards boards to ratify a syntax, they have to actually get on and build things. Oracle SQL is what it is, and if you don't like it use something else. The old dream of making the database a commodity and easily switching thanks to the SQL standards was always unrealistic. I doubt that Oracle "didn't want to comply with standards" but what is much more likely was that they had better things to do than pander the syntax nerds. Like making the database faster, more reliable, more secure etc. Like TPC benchmarks, SQL standards have never mattered to real developers.
    - smsm42 14y ago
      Unless you are a real developer that has to write app supporting 4 databases. And you discover that simplest and most common use cases like implementing paginated query results work radically different in each DB and sometimes it's like "oh, you really want to limit result set from 100K-row query and view it piece-by-piece and not all at once? We didn't think about it..."
nodata 14y ago
A sleeping add-on installer that waits ten minutes? Sounds kind of rootkit-y, opt-in or not.
doctorpangloss 14y ago
Isn't it a little ironic that we're reading an article about foistware where the author searches for his own book on multiple search engines?
mpweiher 14y ago
So are the Feds going to go after Oracle and Larry for "unauthorized access to a computer" and "wire fraud"? With, like, real jail time?
- lawnchair_larry 14y ago
  Considering I clicked Java Installer.exe and got Ask.com toolbar installing, it sounds like a clear cut case of identity fraud as well. Taking up real estate in my toolbar is basically criminal trespassing, so throw that in. I mean, it's not like in real life you can just say to an inattentive person, "I'm about to break into your house unless you tell me no" and have it be okay.
edgesrazor 14y ago
I'm glad this was said in a much larger avenue than my paltry Twitter account. To bundle a toolbar installation in with a major security fix is not only dishonest, it's unethical and who's to say that toolbar isn't the next piece to contain a security hole?
kahawe 14y ago
I used to work with Sun for quite some time; I can say without failure every single Sun tech I came across was pretty damn cool, knew what they were doing and was hooked up in the Sun-universe enough so they could provide excellent pointers and ultimately that translated into happy customers. On top of that a lot of their enterprise-y software wasn't half bad to begin with, it was just always terrible getting good documentation and information as an "outsider" oh and there were a couple of years when you could just forget the sorry excuse they passed off as "support". But there was always the possibility of going "black-ops", just de-compiling and providing your own fix and although this is far from great, things just worked and everyone was happy. Sun's suits didn't really matter from our point of view anway, they did no harm, stood in nobody's way, shook hands and invited folks to dinner when appropriate. Fair enough, you cannot really ask for more, anymore and it would literally be paradise, so I was happy with that. Even-though I never got that project manager I was basically paying for... Enter big red. Talking to brain-washed zombies cannot feel very different from talking to Oracle's sales drones and customer relation dummies. You were talking about "A", they would start trying to sell you pricey-addon for the database when you weren't even talking databases in the first place. Whoever was a useful tech contact inside Sun before now turned into a walled-off zombie as well and I guess I was lucky they didn't just slap a price tag on picking-up the phone or simply answering an email. And to top it off I had to suffer one of their pre-sales dummies loudly telling an oh-so-ridiculous story how, can you imagine, bigcorpA was running tomcat(!) in their production environment! And not the abomination from hell that Oracle gets away with charging huge amounts of money for!! Well can you imagine that!!! Another case of too-big-to-fail and nobody ever got fired for buying Oracle, hm?
- VonGuard 14y ago
  Bit Torrent makes all its money through Ask's tool bar. Ask props up a whole economy, it seems. But hey, at least Oracle figured out how to make money on Java! Sun never did that.
  - bunderbunder 14y ago
    Which raises an interesting question - how do you make money on a platform like this? I've been wondering because I think that my preferred managed environment (.NET) is doomed if Microsoft continues keeping it tied to Windows. On the Microsoft side, I suspect that Microsoft's market share in the server and enterprise space is going to continue dwindling for the foreseeable future, which means that their current plan for making profit is far from certain. But neither Sun nor Oracle seem to have figured out a way to distribute Java for free to the world at large and make a profit off of it, and it's hard to imagine that Microsoft is any more capable of pulling that rabbit out of its hat. Perhaps the trick is that you don't try to make money on it, at least not directly. And there's a great project out there that's trying to do it that way. But, well. . . . ugh. I love Mono; it seems like it has everything going for it. From a technical standpoint it's been rapidly closing the gap with Microsoft's implementation, which I suspect means it's probably already ahead of the Java platform in many respects. The flagship language is certainly way ahead. And it has the singular distinction of being the only Free platform in this sector, which would make you think that folks would be extremely interested in seeing it win. Why that doesn't seem to be the case continues to mystify me. I know it's still got a few Big Business cooties on it, but it's got way, way, way less of them than Java does.
brown9-2 14y ago
You would think that a company Oracle's size wouldn't need to resort to install commissions from something like this. You would think that after several years of conning people into using their search engine, the employees at Ask would feel dirty to have to engage in such tactics.
- spyder 14y ago
  Even Google is supporting these shady practices by powering some of the search toolbars and probably paying the toolbar owners for ad clicks. See MyWebSearch (http://home.mywebsearch.com/ http://home.mywebsearch.com/) mentioned in the article.
- lilsunnybee 14y ago
  Humans have an amazing capacity to rationalize and self-justify, as long as they are getting some personal benefit.
facorreia 14y ago
I think the Java plugin should start to be flagged as malware given the persistent presence of holes that allow remote execution of arbitrary code, the clever bundling of questionable software and the update wizard behavior.
thesis 14y ago
Last update I received I clicked the next button a little to fast. I realized after I went through the dialogs too quick and I figured no big deal I'd just cancel it when the McAfee dialog came up. It never did... all of the installation was in the background. Shady!
andmarios 14y ago
I do not have any such issue. Are you sure this sidebar comes with the official java installer from www.java.com? From what I've heard, I guess it comes with Java installers from 3rd party sites.
aydoubleyou 14y ago
And this is why Apple creates their own install packages for Java.
- otterley 14y ago
  Not anymore, they don't. (Source: http://bit.ly/947yQJ http://bit.ly/947yQJ)
jiggy2011 14y ago
I think this is in a large part due to the way programs install on Windows perhaps. These programs seem to rely on getting the user to make a choice during installation time. Windows is the only major OS that seems to rely on "installers" being programs in their own right. For example on debian, .deb packages provide a standard installation process. Whilst it would still certainly be possible to inject all types of crapware into a .deb the actual install process is not really conductive to this, because there is no way (AFAIK) to pop a custom screen during the install.
peapicker 14y ago
Interesting how many comments about desktop Java being dead, when the highest selling video game still available and being developed is Minecraft, written in Java, which runs on the desktop... (over 9 million registered users, and still increasing... enough to make it the #9 all-time selling video game) I will admit tho, for traditional desktop apps, it is very dead.
adamkochanowicz 14y ago
This seriously changes my opinion of Oracle.
d4vlx 14y ago
Too bad Google missed out on buying Sun.
alayne 14y ago
Sun was installing toolbars before Oracle bought them. I remember them bundling the Yahoo toolbar with Java.
gus_massa 14y ago
I really hate the crapware, and I hate more the "opt-out" crapware. But the "summary" of the article is a little unfair: Oracle's Java plugin for browsers is a notoriously insecure product. Over the past 18 months, the company has released 11 updates, six of them containing critical security fixes. [...] The updates and security fixes include not only the plugin, but all the Java runtime that is much bigger and complex. (For example, one of the updates was: http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html#AppendixJAVA http://www.oracle.com/technetwork/topics/security/javacpuoct... ). This is like accusing Chome or Dropbox of being insecure, because they do a lot of updates (that are automatic, invisible and don't offer crapware).
pasbesoin 14y ago
One reason I always download the full installer (even to upgrade), rather than using the Java update notification service (it runs, but when it prompts with an update -- if it does so before I manually upgrade -- I use that notification as a cue to go download the full installation; I don't let the service upgrade me).
kjackson2012 14y ago
Fuck Oracle. And unfortunately, I guess that means Fuck Java too. This is the exact kind of stupid behavior that kills great technologies like Java, by stupid, greedy people that care more about money than technology. If this is how they expect to treat their users, I'll switch permanently to Python, PHP, and anything else besides Java.
bhauer 14y ago
I can't sympathize with this article and most users in this thread because I don't understand why anyone uses Java within web browsers. Today, Java is for server-side code. Full stop. Okay, I know some people still have to use Applets, but none of us here, right? Kidding aside, I've installed the Oracle JDK on dozens of Windows machines and not once have I been prompted to install a toolbar or bloatware. 1. Navigate to java.oracle.com 2. Select Java SE. 3. Select to download JDK SE 7u11 4. Accept license agreement 5. Download Windows x64 6. Open installer 7. Select to install "Development Tools" and "Source Code" (disable "Public JRE") 8. Wait and then close installer 9. Run c:\java\bin\java.exe 10. Review Windows' "Programs" and note only JDK has been installed; no toolbars 11. Celebrate I suspect many people are installing the JRE, which is something I've never done. Since the JDK can run Java code, why install the JRE at all?
- bskap 14y ago
  Because many people are still stuck using applets in the browser. The JDK won't run those.
DHowett 14y ago
I was just about to decry ZDNet for calling the kettle black here, but it seems they removed the scummy invisible pop-up ad click target they used to put in the negative space next to the column.
suyash 14y ago
Do not take this article Seriously. This is garbage post and problem is with ASK and not Oracle here.
fencepost 14y ago
Crapware-free downloads ARE available. If you go to Oracle's Technology Network area to download (or Google for the specific version e.g. "java 6u38" or "java 7u11 oracle" because of all the press) you can agree to their binary license and download crap-free offline installers. The link for 6u38 is http://www.oracle.com/technetwork/java/javase/downloads/jre6u38-downloads-1877409.html http://www.oracle.com/technetwork/java/javase/downloads/jre6... and the link for 7u11 is http://www.oracle.com/technetwork/java/javase/downloads/jre7-downloads-1880261.html http://www.oracle.com/technetwork/java/javase/downloads/jre7...
emmelaich 14y ago
My experience is that the one from java.sun.com does not have the crapware. Especially if you install jdk? The one from java.com does. I'm not 100% certain though. BTW, there is a process to install java without the installer and without admin rights on Windows. The process is described on say StackOverflow but I have it scripted. I should put it up on github sometime!

363 points by Hagelin 14y ago

What really upsets me about this is that it's Java that they are stuffing this adware into... Java a previously legitimate requirement that many applications have chosen to build on top of as a language/platform. For the average user it looks like all of these other programs are promoting this... I'm surprised that they can get away with it.

manaskarekar 14y ago

Can someone comment on how .NET platform + tools compare? As someone who is not invested in either camp, between the two, .NET seems like a much better place to be invested in right now. Edit: Thanks a lot for the replies, I'm much better informed.

sc0rb 14y ago
I've been a professional Java developer for just over 2 years now. Let me give you a simple example. The three leading Ecommerce platforms (Oracle ATG, Hybris and IBM WebSphere) are all done in Java. There is huge demands for Java developers working on Web and Enterprise systems the world over. The average Salary for Java developers is pretty high in most places (london and Sydney) and the day rates you can charge as a contractor are very good. There also seems to be more open source and technical community in Java. I am glad that I went down the Java route. also, Most Java development jobs nowadays focus on the web and server side stuff, this is followed by mobile (such as android) and embedded (such as TIVO boxes).
- KumarAseem 14y ago
  Java isn't what it used to be. The products written in Java are slow, bad looking and less secure. The days of Java are anyways numbered.
  - sc0rb 14y ago
    That's an incredibly ignorant response and you have no idea what you're talking about. Java looks bad? You're probably talking about certain swing applications which are now very rare on the desktop. Java is slow? You clearly have no idea how fast the JVM can interpret and JIT java nowadays. Java is insecure? You're mainly talking about applets which are an ancient technology on their way out (slowly). In terms of actual JVM security. Every product has its security issues. You seem very ignorant, your java experience is probably from the past e.g. J2EE1.4 and old swing apps. Modern Java is an good language on a great platform. There's a reason why it runs some of the worlds biggest ecommerce sites and worlds fastest trading desks.
    - jbm 14y ago
      While I think the parent was overplaying it, I do find most of the Java applications on my mac are slow and irritating to run. Pycharm is an example of one of the apps I am talking about. It just feels like it struggles at times, eventhough I have a fairly new machine. Java was the first language I learned while going through college but I find the verbosity to be irritating.
      - sc0rb 14y ago
        Your experience is not necessarily because Java is slow. It could just be the applications you are running that are slow for reason that have nothing to do with the language. Swing is probably going to be slower (maybe?) than some native windowing framework. But Java as a language running on the JVM is certainly not slow. I've just been looking up pycharm and it seems that the slowness issues are to do with things like opening files and doing parsing. These things are likely to be slow for anything but the language they are written in.
      - matwood 14y ago
        Desktop java is dead. Actually desktop anything that's not web is going to end up dying. The server is where the languages will duke it out next and Java is fine there. C# is also fine on the server. The nice thing about Java is it easily runs on linux and has many OSS libraries to help quickly standup server applications.
- kabdib 14y ago
  I went from writing client-server code in Java to writing similar things in .NET. After two months of C#, I remember thinking to myself, quite clearly, "Oh, thank God, the nightmare is over." Debuggers that worked. Native calling systems that actually interoperated well. A set of classes that weren't horribly overdesigned and under-implemented. Best of all, no culture that insisted on factories that made factories that made factories. Writing Java on phone platforms is fine. But the enterprisey stuff is death on roller skates. Hey, if you can stand it (my cousin does), then you might make a bunch of money. My cousin spends six months hacking Java for a bank, then six months vacationing. I prefer to do stuff that doesn't make me contemplate washing dishes for a living again. .NET has its warts, but it's not cancerous the way Java turned out to be in the hands of the architecture astronauts.
  - sc0rb 14y ago
    Interesting experience you have. I have spend most of my career doing Java6 JEE6 and modern Spring and it all feels quite modern. I did a lot of C# at University and it is a good language and platform but I don't think it's better than Java. New / modern Java is fine, it's old java that you want to avoid.
    - chaostheory 14y ago
      If you ever try any of the modern stuff (django, rails, play, grails, any node.js framework) in depth, j2ee / Spring and java just feels old and ancient. Spring has gotten better over the years, but there's still just too much work and too much unnecessary complexity and cruft with Spring. It's really telling when even Spring's creator jumped ship to work with TypeSafe and jvm7 has huge improvements designed for other languages. imo C# is an improved java, but C# open source ecosystem is just anemic compared to java.
      - DoubleCluster 14y ago
        I actually like old and ancient. That means all bugs have been fixed already. Systems become complex quickly enough and you need to use the most boring bricks imaginable if you want to build something sturdy.
TimGebhardt 14y ago
For the newest versions of Windows (Server 2012, Windows 8) .NET comes installed -- I forget if it's installed by default or installs as a Windows component. If it's the latter you install it from the same screens you install IIS or the SMTP server from. After you install it updates to the .NET framework show up in the "optional" windows updates. There are certainly standalone installers as well: http://www.microsoft.com/net/download http://www.microsoft.com/net/download But if you're producing client-side software that's dependent on the .NET framework then you most certainly will make your installer "bootstrap" the installation of the correct framework for your OS language and hardware.
edandersen 14y ago
You never have to worry about drive-by installers with .NET updates - security updates just come down with Windows Updates. .NET is seeing a small renaissance with ASP.NET MVC and what the Server teams are putting out, but Java is also gaining popularity again as a way of running Rails apps quickly and with Scala. Both platforms have enough legacy apps out there for a lifetime of maintenance work, if that's your sort of thing. Cleaning up after outsourcing companies is lucrative.
chaostheory 14y ago
In terms of just the languages themselves, .NET is very solid. C# is definitely a better version of Java, and the rest of the # languages in general are decent or good. However, the .NET open source ecosystem (while greatly improved from years back) still really really sucks. Historically, this is directly MS's fault (codeplex helped but it still will never be able to undo the damage MS did early on). I just think it's a waste of time having to reinvent wheels that pretty much every other major platform (Java, PHP, Ruby, Python, etc...) has plenty of. I always hate having to do extra work that I feel is entirely unnecessary, which happens a lot on .NET.
davesims 14y ago
I had about a decade in both, and really they're two very different worlds. From a code standpoint I'd much rather be in C#. It's one thing that MS has done really, really well over the last 10 years. They've taken a pretty aggressive stance towards adopting new features and although it's become fairly complex as of 4.0 and on, it really has some great features, some functional-inspired things like closures and collections api stuff that reminds me of Ruby in a lot of ways, and a great web framework in MVC that is honestly almost as fun to code for as any of the open source web frameworks out there. If you had to choose between one of the big J2EE stacks and MVC, no question, MVC is far, far better. The infrastructure is still a big 'ol MS GUI world, and I'd rather do <badPainfulThing> than spend a lot of time configuring and deploying IIS apps, but then TomCat and WAR files et. al. ain't exactly fun either. Java's JVM/bytecode infrastructure on the other hand has undergone a renaissance as a VM platform for a lot of very cool languages: Scala and Clojure being the two big examples there. But that's Really not the same thing as Java, obviously. And there's Android -- a completely different ecosystem, and somewhat truncated as a Java dialect, but still basically the Java language and able to employ most of the libs you're used to having: Guava, Guice and so on. No dynamic code gen, which stinks, but I know why they did it. So if you have Java under your belt and want to get into mobile stuff, that's a huge plus. So, as a general-purpose language skill, Java is still really, really important to know and will have legs for a long time to come. ASP MVC is a great framework, and if you can't work in something like Django or Rails or the like, it comes in nice 3rd or 4th place in terms of making for general coder happiness. C# is a far more progressive and interesting language than Java, but that's a philosophical difference between the gatekeepers of the two languages: Java intentionally moves slow for the sake of stability and continuity, C#'s minders have apparently embraced a little of the 'move fast break things' attitude of some parts of the open source world. I prefer the latter, but understand the rationale of the former. Me, I'm a Rails coder these days but also get to hop back into Java for Android dev and the rare foray into ASP work and they all have strengths and tradeoffs and they'll all be around a long time. The only thing I think I would avoid on principle, for my own sanity, is any enterprisey J2EE framework. That truly does feel like a massive leap backwards.
- untog 14y ago
  Agreed with this. I used to code C# for a living but have moved on- however, I'm now playing around with MonoTouch in my spare time and I'm loving using C# again. MonoDevelop is a poor man's Visual Studio, but it's a lot less demanding and runs on OSX. Backend frameworks like Nancy.fx are really great for being even simpler versions of MVC, too.
darklajid 14y ago
You got a lot of replies already, but let me join the crowd. Disclaimer: Was a Java guy, working with C# exclusively now by day (F# and Clojure - not Clojure-Clr - are my pet languages at night). In my opinion the languages (specifically Java vs. C# now, ignoring other languages for now) started out really, really close when C# was new. C# gained a lot of nice features, while Java was - euphemistically - 'stable'. Thinks that made my day and made every sporadic try to get back to Java (or work on Android) a chore: .Net events, properties (later automatic properties), usable generics, delegates, yield based generators/enumerators and the reason they were added: LINQ. Type inference aka 'var'. Basically every release brought half a dozen interesting features (and new technology, WCF/WPF/Silverlight/Workflow), while Java was sleeping as far as I could tell. I understand the latest release of Java now came closer again, but C# is still quite ahead in my opinion. Tooling: Visual Studio. Now, I'm not a total fan and some releases are better (2008, 2012) than others (2003, 2005, 2010), but it's a decent tool for most all your developing needs and ranges from free to 'includes the kitchen sink and costs $$$'. It supports three languages out of the box (F# is very interesting and a fully supported language!). I like IntelliJ and sympathize with the Eclipse project, but for me the VS experience is more streamlined, simple and nicer in general. Libraries: If it's _really_ popular in the Java world, you'll find a port (think nhibernate, log4net) or something equivalent. I wouldn't want to go back (C# -> Java), but I DO have the jdk around for Clojure (and I'm still watching Scala from a distance).
- chaostheory 14y ago
  > Tooling: Visual Studio. It's a decent tool but I think the alternatives for other platforms are either equal or better. imo MS is typically playing catchup in this area now. > Libraries: If it's _really_ popular in the Java world, you'll find a port (think nhibernate, log4net) or something equivalent. This is what truly makes .NET a no go for me. There's just too few non-paid and open library equivalents compared to almost any other platform. Not mention the libraries in other platforms tend to have more features. The .NET open source community is still pretty small and weak, and I just don't see that changing (even with CodePlex it hasn't really had any drastic changes).
- edwinnathaniel 14y ago
edwinnathaniel 14y ago
I used to intern at MS and have used .NET platform for a while (on and off, including not too long ago doing a bit of ASP.NET, ASP.NET MVC, and Sharepoint for one-week project). I've used VS.NET 2005, 2008, and 2010. I've also used Java for a while, the whole Spring MVC, JEE6, Eclipse, IntelliJ. If you're willing to live in Windows OS platform, you should go with .NET, no question asked. Forget about tooling and everything else. If you want more flexibility, more choices, etc, Java is your choice. (There's also Python, Ruby, and the rest but let's scope it to Java). .NET culture is heavily influenced by the culture of Microsoft which means: 1) Less Open Source, More mISV (more "pay" products) 2) Windows/GUI, less command-line (has changed a bit but still not there) 3) Fire and Motion http://www.joelonsoftware.com/articles/fog0000000339.html http://www.joelonsoftware.com/articles/fog0000000339.html #3 is important because MS makes money from tooling as well. When I was there, the internal chatter was "tool will be out of date every 2-3 years". Please make your own conclusion. Some people said Java had this period of "sleeping" which was true. But during that time frame, we've seen TONS of open source projects that are very mature, battle-tested, and probably everlasting. We've also learned a better way to write Java code (HN made such a big deal of Factories yet HN never acknowledge the best breed of Java code out there, it's a typical of a community like this anyway). Thus that "sleeping" period is being used efficiently to stabilize things. When it comes to tooling, Java beats .NET by miles. Java deployment packaging (JAR for library and WAR for web-app) is one of the best out there and it's been stable for many many years. (http://dirtsimple.org/2004/12/java-is-not-python-either.html http://dirtsimple.org/2004/12/java-is-not-python-either.html) Java build and dependency management tool is also far ahead of what the .NET has. Maven is far beyond NuGET and MSBuild (shrudder). Integrating Java build with popular Continuous Integration server like Jenkins, TeamCity is waaaay easier than .NET. Eclipse foster a good community of open source and free tools/plugins which put VS.NET to shame BUT BUT BUT experience may vary when using Eclipse. Eclipse is like black magic and moody: if somehow you're in the position that your Eclipse is stable, it's one of the best IDE out there. Eclipse has its own built-in "app-store" that makes installing plugins sooo much easier, seamlessly, and faster. m2clipse, a Maven plugin for Eclipse can perform the following steps: 1) Download dependencies 2) Download the dependencies javadoc (auto-complete will show the code documentation) 3) Download the dependencies source code (#1 only download the compiled code) if you ever wanted to "navigate to the implementation of a method" It does this seamlessly without you breaking a sweat. Tools like FindBugs and CheckStyle helped to improve your code hygine/style and EclEmma can tell your Code Coverage. All of these are free. Java has rich and mature tools and libraries: 1) Sonar => http://www.sonarsource.org/ http://www.sonarsource.org/ 2) Jenkins => http://jenkins-ci.org/ http://jenkins-ci.org/ To put it simply, the Java community has a very strong Software Engineering discipline and continue to find better ways to develop whereas the .NET/C# community is either following Java lead or serving its own master: Microsoft. I'm glad I'm out the .NET world because it was soo much limiting and "capping" your day-to-day productivity.

jakub_g 14y ago

One additional note regarding the installer: to opt out of the toolbar installation, you have to click the checkbox itself. You can't click the text label associated to it. I call it a bug, but certainly it's a feature in this context.

talmand 14y ago
Actually, that's very common. It's one of my pet peeves for web design but I see it often in installers and the applications themselves.

edandersen 14y ago

Looks like YC should make an investment!

bobsy 14y ago
It does seem to meet PG's critera 1. The user has an opportunity to opt out. 2. Calling Ask Toolbar "crapware" is only an opinion. Someone may actually want it. sniggers I think bundling software is fine so long as it is relevant and genuinely useful. Ask Toolbar fails on both accounts. Bundled software shouldn't be offered during minor updates or security fixes... or at the very least, during these minor updates, it should be opt-in instead of opt-out.

regularfry 14y ago

This problem has been known and complained about for ages. What's the community response? We have OpenJDK, why does anyone put up with an abusive installer from Oracle?

jarito 14y ago
Because Windows is not a supported platform? You have to find an unofficial build or build it yourself.
- mathnode 14y ago
  Is anyone distributing 64bit OpenJDK builds for windows? EDIT: I found: https://github.com/alexkasko/openjdk-unofficial-builds https://github.com/alexkasko/openjdk-unofficial-builds
  - untog 14y ago
    Just the word 'unofficial' is enough to stop most large companies using them. It is (was?) the same with Firefox- they never offered an MSI installer for use on corporate networks. There were unofficial versions, but you could never be sure that someone hadn't bundled something extra in there.
    - mamcx 14y ago
      "but you could never be sure that someone hadn't bundled something extra in there". Irony, With Oracle, your are SURE.
    - klez 14y ago
      Well, this thing about Java shows that you can trust not even official versions...
- eumenides1 14y ago
  Is there an OpenJRE(or even a need)? or do we just run OpenJDK?

Aardwolf 14y ago

This sums up everything I find wrong about the Windows philosophy. Software whining for updates. Unwanted background programs. Installers that want to install more than you ask for. Usage of the phrase "We recommend" where recommend means "we get money if you". I've never seen any of those terrible anti-user behaviours in a Linux package manager, or makefile. I would be fine with an actual security fix being downloaded and installed silently (without any other payload of course).

kevingadd 14y ago
This has nothing to do with Windows specifically and everything to do with software developers prioritizing profit over all else. What does the 'Windows Philosophy' have to do with the decisions Oracle makes about Java anyway? Do you really think Java follows the 'Windows Philosophy'?
- steveklabnik 14y ago
  > This has nothing to do with Windows specifically and everything to do with software developers prioritizing profit over all else. Sounds like Windows to me.
- sc0rb 14y ago
  I have a feeling he means bundling crap with installers. This has been done for a long time on Windows and not so much on Linux or OSX.
  - bmj 14y ago
    Likely because Windows has enjoyed a rather massive installation base, particularly among folks who are not terribly knowledgeable. I'm sure as other platforms become more dominant, we'll see similar shenanigans.
    - bad_user 14y ago
      Having a user base of folks that aren't very knowledgeable is no excuse for abuse. Also, I do not think other platforms can be as plagued as Windows is, because it's a matter of culture and user expectations being driven by that culture. The size of the user base has nothing to do with it. On Windows users wishing to get anything done resort to installing some crap, even for basic things like uncompressing an archive, watching a movie, listen to some MP3 or viewing a PDF or an Office document. Things got better with open-source software that was ported to Windows, but considering that Windows is the dominant operating system, the ecosystem is actually kind of lame. If you want quality software, the few exceptions are some open-source apps and some products being sold by some big publishers and that's it. I have a theory that this is because Microsoft itself encouraged piracy and bundling of crapware, while discouraging indie developers, communities and open-source.

NelsonMinar 14y ago

It's a nice racket Oracle has. Every time they release a security fix, they make a few hundred thousand bucks on drive-by installs. Security holes as business model.

nhebb 14y ago
They don't even need to release a fix. I have been prompted to update several times in the past year, where I go through the install process (including having to uncheck the Ask box), only to get the message at the end that version x.y.x is already installed. The updater is just plain buggy. Ed Bott mentioned the problems with limited user accounts, but I didn't see him mention the issue with jucheck ignoring the update settings: http://superuser.com/questions/130961/how-to-stop-jucheck-from-running-java-wont-remember-check-for-updates-automat http://superuser.com/questions/130961/how-to-stop-jucheck-fr... I also had an XP system where the %appdata% environment variable somehow got deleted. This completely breaks the installer.
- niggler 14y ago
  Is the Ask.com toolbar installed before or after Java, and if java fails will ask.com be rolled back?
  - noselasd 14y ago
    When you check for the Ask toolbar and click next in the Java installer, the toolbar installer is fired off in the background, and installs itself after 10 minutes, regardless of what you do with the Java installer.
    - niggler 14y ago
      That's incredibly shady.
    - kaffiene 14y ago
      I don't get this. I install Java updates regularly and I've never had this toolbar installed. (I do agree that Oracle are jerks, however)

visualcsharp 14y ago

When I first saw that the Java installer has bundled shitware, I just couldn't believe it. Oracle? As in the global giant megacorp? Why would they need to bundle the Ask.com toolbar with a software platform installer? The whole thing just makes no sense!

chrisacky 14y ago

Just to tell my experiences on this, I was forced to install the crapware last week. There was no way for me to uncheck or opt out of the checkbox. I have a machines which I connect to that do not have any mouse connected. I have no problem in navigating systems with a keyboard and can run through installers probably quicker than most people with a mouse can, but when this dialog popped up for me, I was stumped for about 10 minutes. I employed every shortcut in my keyboard-shortcut arsenal and fell short. I genuinely felt like this was not just some programming mistake (because the "Next" control was already highlighted waiting for me to hit Enter). It is a dark pattern that was purposefully introduced to their installer to make it impossible for users like me to opt-out of their installer. A consequence of their deception was that they did get a dozen installs from me, but my dislike for Oracle increased tenfold, and in a quiet-protest, I'll make damned sure that I suggest any alternative to an Oracle product when I have reasonable alternatives (Without cutting off my nose to spite my face).

corresation 14y ago
It absolutely wasn't a mistake. Most legitimate software makes the descriptive text for a checkbox (the label) a trigger for the checkbox. The Ask Toolbar installer option, however, disables this, forcing you to specifically target the checkbox itself. It is incredibly scummy, and worse it actually encourages Oracle to create insecure software -- at least in the short term -- because each fix is another spin of the wheel.
- iuguy 14y ago
  That's weird, I thought Oracle have been making insecure software for decades and this was just business as usual for them.
  - hnriot 14y ago
    clearly, you haven't been paying attention.
- talmand 14y ago
  There are examples of legitimate software failing in this aspect as well. Not to suggest that Oracle does not do this on purpose for nefarious reasons or that other software is being scummy somehow. I don't work at Oracle so I can't say if it's intentional or just part of the problem that's more common then you think.

deleted 14y ago

[deleted]

DoubleMalt 14y ago

Well when after the last security issue there were articles calling end users for uninstalling java completely, I was pretty mad at the missing distinction between the plugin and the runtime. But now I really think this is a good thing to recommend under windows. I will still continue using OpenJDK for server projects under Linux, but will press for different solutions whenever installation of Jav on a Windows machine might be required.

king_magic 14y ago

I happily uninstalled Java from all of my machines/OSes last week. Glad to be rid of it.

neumann_alfred 14y ago
I decided to try the same. It's been ages since I last played Minecraft, and I have frankly no idea what other apps I'm using might be using Java; the only way to find out is to uninstall it. It's not like I can't install it again if I need it.. but the days of just having it installed "just in case" are over for me. I might even uninstall Flash just for kicks.

nnq 14y ago

Java could have been such a good thing, even in the browser (ok, as platform, ignoring the language's shortcomings, but still...). Whys did both Sun and Oracle strive so hard to fuck it up? It's as if these guys have a "how to fuck things up for the end user" brainstorming meeting every week!

brazzy 14y ago
I think the last few years have shown conclusively that the it is not a good thing in the Browser because the sandbox security model is too complex to be implemented correctly.
- nnq 14y ago
  > the sandbox security model is too complex to be implemented correctly ...is there any other simpler security model than this? Java even seems a simpler and more "well behaved" language than JavaScript, and JVM bytecode is said to be even simpler (though I'm not an expert on this...), and browsers had they own share of Javascript related exploits but people rolled updates quickly, acted responsibly and didn't do anything particularly stupid (as opposed to the described crapware incident perpetuated by Oracle). EDIT+: one can buy browser exploits cheaper on "the x market" and they are more useful than JVM exploits so "security" is not Java's Achilles' heel, and it's Swiss cheese all the way down if you at most web-facing software unfortunately...

neya 14y ago

Ladies and gentlemen, introducing THE fugliest company of all time - ORACLE. The company that sued Android unsuccessfully, The company that fucked up JAVA, The company that fucked up MySQL, The company that fucked up OpenOffice, The company that doesn't like anything good happening within the tech sector. I really miss those days when Oracle was highly respected and used to be a great workplace to be a part of.

colanderman 14y ago
Don't forget the OpenOffice.org clusterfuck.
- neya 14y ago
  Thanks, edited to include OO (how could I forget this one?).
webreac 14y ago
I started working in 1994 and Oracle was already the database provider that did not want to comply with standards (Sql92). They were already greedy.
- hnriot 14y ago
  SQL standards were and are a joke. Real app developers can't wait for the standards boards to ratify a syntax, they have to actually get on and build things. Oracle SQL is what it is, and if you don't like it use something else. The old dream of making the database a commodity and easily switching thanks to the SQL standards was always unrealistic. I doubt that Oracle "didn't want to comply with standards" but what is much more likely was that they had better things to do than pander the syntax nerds. Like making the database faster, more reliable, more secure etc. Like TPC benchmarks, SQL standards have never mattered to real developers.
  - smsm42 14y ago
    Unless you are a real developer that has to write app supporting 4 databases. And you discover that simplest and most common use cases like implementing paginated query results work radically different in each DB and sometimes it's like "oh, you really want to limit result set from 100K-row query and view it piece-by-piece and not all at once? We didn't think about it..."

nodata 14y ago

A sleeping add-on installer that waits ten minutes? Sounds kind of rootkit-y, opt-in or not.

doctorpangloss 14y ago

Isn't it a little ironic that we're reading an article about foistware where the author searches for his own book on multiple search engines?

mpweiher 14y ago

So are the Feds going to go after Oracle and Larry for "unauthorized access to a computer" and "wire fraud"? With, like, real jail time?

lawnchair_larry 14y ago
Considering I clicked Java Installer.exe and got Ask.com toolbar installing, it sounds like a clear cut case of identity fraud as well. Taking up real estate in my toolbar is basically criminal trespassing, so throw that in. I mean, it's not like in real life you can just say to an inattentive person, "I'm about to break into your house unless you tell me no" and have it be okay.

edgesrazor 14y ago

I'm glad this was said in a much larger avenue than my paltry Twitter account. To bundle a toolbar installation in with a major security fix is not only dishonest, it's unethical and who's to say that toolbar isn't the next piece to contain a security hole?

kahawe 14y ago

I used to work with Sun for quite some time; I can say without failure every single Sun tech I came across was pretty damn cool, knew what they were doing and was hooked up in the Sun-universe enough so they could provide excellent pointers and ultimately that translated into happy customers. On top of that a lot of their enterprise-y software wasn't half bad to begin with, it was just always terrible getting good documentation and information as an "outsider" oh and there were a couple of years when you could just forget the sorry excuse they passed off as "support". But there was always the possibility of going "black-ops", just de-compiling and providing your own fix and although this is far from great, things just worked and everyone was happy. Sun's suits didn't really matter from our point of view anway, they did no harm, stood in nobody's way, shook hands and invited folks to dinner when appropriate. Fair enough, you cannot really ask for more, anymore and it would literally be paradise, so I was happy with that. Even-though I never got that project manager I was basically paying for... Enter big red. Talking to brain-washed zombies cannot feel very different from talking to Oracle's sales drones and customer relation dummies. You were talking about "A", they would start trying to sell you pricey-addon for the database when you weren't even talking databases in the first place. Whoever was a useful tech contact inside Sun before now turned into a walled-off zombie as well and I guess I was lucky they didn't just slap a price tag on picking-up the phone or simply answering an email. And to top it off I had to suffer one of their pre-sales dummies loudly telling an oh-so-ridiculous story how, can you imagine, bigcorpA was running tomcat(!) in their production environment! And not the abomination from hell that Oracle gets away with charging huge amounts of money for!! Well can you imagine that!!! Another case of too-big-to-fail and nobody ever got fired for buying Oracle, hm?

VonGuard 14y ago
Bit Torrent makes all its money through Ask's tool bar. Ask props up a whole economy, it seems. But hey, at least Oracle figured out how to make money on Java! Sun never did that.
- bunderbunder 14y ago
  Which raises an interesting question - how do you make money on a platform like this? I've been wondering because I think that my preferred managed environment (.NET) is doomed if Microsoft continues keeping it tied to Windows. On the Microsoft side, I suspect that Microsoft's market share in the server and enterprise space is going to continue dwindling for the foreseeable future, which means that their current plan for making profit is far from certain. But neither Sun nor Oracle seem to have figured out a way to distribute Java for free to the world at large and make a profit off of it, and it's hard to imagine that Microsoft is any more capable of pulling that rabbit out of its hat. Perhaps the trick is that you don't try to make money on it, at least not directly. And there's a great project out there that's trying to do it that way. But, well. . . . ugh. I love Mono; it seems like it has everything going for it. From a technical standpoint it's been rapidly closing the gap with Microsoft's implementation, which I suspect means it's probably already ahead of the Java platform in many respects. The flagship language is certainly way ahead. And it has the singular distinction of being the only Free platform in this sector, which would make you think that folks would be extremely interested in seeing it win. Why that doesn't seem to be the case continues to mystify me. I know it's still got a few Big Business cooties on it, but it's got way, way, way less of them than Java does.

brown9-2 14y ago

You would think that a company Oracle's size wouldn't need to resort to install commissions from something like this. You would think that after several years of conning people into using their search engine, the employees at Ask would feel dirty to have to engage in such tactics.

spyder 14y ago
Even Google is supporting these shady practices by powering some of the search toolbars and probably paying the toolbar owners for ad clicks. See MyWebSearch (http://home.mywebsearch.com/ http://home.mywebsearch.com/) mentioned in the article.
lilsunnybee 14y ago
Humans have an amazing capacity to rationalize and self-justify, as long as they are getting some personal benefit.

facorreia 14y ago

I think the Java plugin should start to be flagged as malware given the persistent presence of holes that allow remote execution of arbitrary code, the clever bundling of questionable software and the update wizard behavior.

thesis 14y ago

Last update I received I clicked the next button a little to fast. I realized after I went through the dialogs too quick and I figured no big deal I'd just cancel it when the McAfee dialog came up. It never did... all of the installation was in the background. Shady!

andmarios 14y ago

I do not have any such issue. Are you sure this sidebar comes with the official java installer from www.java.com? From what I've heard, I guess it comes with Java installers from 3rd party sites.

aydoubleyou 14y ago

And this is why Apple creates their own install packages for Java.

otterley 14y ago
Not anymore, they don't. (Source: http://bit.ly/947yQJ http://bit.ly/947yQJ)

jiggy2011 14y ago

I think this is in a large part due to the way programs install on Windows perhaps. These programs seem to rely on getting the user to make a choice during installation time. Windows is the only major OS that seems to rely on "installers" being programs in their own right. For example on debian, .deb packages provide a standard installation process. Whilst it would still certainly be possible to inject all types of crapware into a .deb the actual install process is not really conductive to this, because there is no way (AFAIK) to pop a custom screen during the install.

peapicker 14y ago

Interesting how many comments about desktop Java being dead, when the highest selling video game still available and being developed is Minecraft, written in Java, which runs on the desktop... (over 9 million registered users, and still increasing... enough to make it the #9 all-time selling video game) I will admit tho, for traditional desktop apps, it is very dead.

adamkochanowicz 14y ago

This seriously changes my opinion of Oracle.

d4vlx 14y ago

Too bad Google missed out on buying Sun.

alayne 14y ago

Sun was installing toolbars before Oracle bought them. I remember them bundling the Yahoo toolbar with Java.

gus_massa 14y ago

I really hate the crapware, and I hate more the "opt-out" crapware. But the "summary" of the article is a little unfair: Oracle's Java plugin for browsers is a notoriously insecure product. Over the past 18 months, the company has released 11 updates, six of them containing critical security fixes. [...] The updates and security fixes include not only the plugin, but all the Java runtime that is much bigger and complex. (For example, one of the updates was: http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html#AppendixJAVA http://www.oracle.com/technetwork/topics/security/javacpuoct... ). This is like accusing Chome or Dropbox of being insecure, because they do a lot of updates (that are automatic, invisible and don't offer crapware).

pasbesoin 14y ago

One reason I always download the full installer (even to upgrade), rather than using the Java update notification service (it runs, but when it prompts with an update -- if it does so before I manually upgrade -- I use that notification as a cue to go download the full installation; I don't let the service upgrade me).

kjackson2012 14y ago

Fuck Oracle. And unfortunately, I guess that means Fuck Java too. This is the exact kind of stupid behavior that kills great technologies like Java, by stupid, greedy people that care more about money than technology. If this is how they expect to treat their users, I'll switch permanently to Python, PHP, and anything else besides Java.

bhauer 14y ago

I can't sympathize with this article and most users in this thread because I don't understand why anyone uses Java within web browsers. Today, Java is for server-side code. Full stop. Okay, I know some people still have to use Applets, but none of us here, right? Kidding aside, I've installed the Oracle JDK on dozens of Windows machines and not once have I been prompted to install a toolbar or bloatware. 1. Navigate to java.oracle.com 2. Select Java SE. 3. Select to download JDK SE 7u11 4. Accept license agreement 5. Download Windows x64 6. Open installer 7. Select to install "Development Tools" and "Source Code" (disable "Public JRE") 8. Wait and then close installer 9. Run c:\java\bin\java.exe 10. Review Windows' "Programs" and note only JDK has been installed; no toolbars 11. Celebrate I suspect many people are installing the JRE, which is something I've never done. Since the JDK can run Java code, why install the JRE at all?

bskap 14y ago
Because many people are still stuck using applets in the browser. The JDK won't run those.

DHowett 14y ago

I was just about to decry ZDNet for calling the kettle black here, but it seems they removed the scummy invisible pop-up ad click target they used to put in the negative space next to the column.

suyash 14y ago

Do not take this article Seriously. This is garbage post and problem is with ASK and not Oracle here.

fencepost 14y ago

Crapware-free downloads ARE available. If you go to Oracle's Technology Network area to download (or Google for the specific version e.g. "java 6u38" or "java 7u11 oracle" because of all the press) you can agree to their binary license and download crap-free offline installers. The link for 6u38 is http://www.oracle.com/technetwork/java/javase/downloads/jre6u38-downloads-1877409.html http://www.oracle.com/technetwork/java/javase/downloads/jre6... and the link for 7u11 is http://www.oracle.com/technetwork/java/javase/downloads/jre7-downloads-1880261.html http://www.oracle.com/technetwork/java/javase/downloads/jre7...

emmelaich 14y ago

My experience is that the one from java.sun.com does not have the crapware. Especially if you install jdk? The one from java.com does. I'm not 100% certain though. BTW, there is a process to install java without the installer and without admin rights on Windows. The process is described on say StackOverflow but I have it scripted. I should put it up on github sometime!