8 ms·

This will have a pretty bad effect on Firefox's market-share if it goes live. That said, it's a solution for the current problem and should really be applied t

• y0ghur7_xxx 13y ago
  > This will have a pretty bad effect on Firefox's market-share if it goes live. It's already live. ff24 is the current stable.
  • RyanZAG 13y ago
    Oh interesting - hard to keep track of which version Firefox is up to these days. They should really swap to a system like Ubuntu's - using the date for the version number. It was released over a month ago too. Has it had any effect on Firefox's market-share? Especially in enterprise? It's a pretty decent test bed for understanding how users react to these kinds of changes. If they just accept them and adapt when forced it shows that we can be more proactive in moving users to better yet incompatible software?
    • benatkin 13y ago
      That would (and probably does, with Ubuntu) annoy people who don't use the Gregorian calendar.
      • rtpg 13y ago
        out of curiosity, who isn't on Gregorian calendar for everyday usage nowadays? The only thing I can think of is that for official documents Japan uses the emperor-year, but the months stay the same
        • rmc 13y ago
          Thailand isn't AFAIR. Look at the Thai Railways website ( http://www.railway.co.th/home/default.asp?lenguage=Eng http://www.railway.co.th/home/default.asp?lenguage=Eng ), you can book tickets until 21/12/2556 )
          • deleted 13y ago
            [deleted]
          • riffraff 13y ago
            a few countries use buddhist calendar variations[0], but I don't think there is anyone using the julian calendar left (well, mount athos republic is one but I wouldn't count it) [0] http://en.wikipedia.org/wiki/Buddhist_Era http://en.wikipedia.org/wiki/Buddhist_Era
    • y0ghur7_xxx 13y ago
      > It was released over a month ago too. Has it had any effect on Firefox's market-share? No, the change went live Friday: https://bugzilla.mozilla.org/show_bug.cgi?id=914690#c20 https://bugzilla.mozilla.org/show_bug.cgi?id=914690#c20
  • josteink 13y ago
    Confirmed. It broke my SO's ability to do online banking yesterday and I was (as usual) called in as tech support. I just assumed Java was out of date (again) and was surprised to see it still blacklisted after updating to latest version. There's no part of the UI saying "We've permanently blocked all of Java by default". Even if you agree with the developer's ideological stance here (which you very well may not), the UX part of the job is completely botched.
    • Spittie 13y ago
      There should be a "plugin" icon in the address bar, showing you that java has been blocked (see https://news.ycombinator.com/item?id=6590650 https://news.ycombinator.com/item?id=6590650) Pressing on that icon should allow you to run java once, or allow if forever for that site. If the icon doesn't appear, I think you should file a bug on bugzilla.
      • josteink 13y ago
        You know those big, yellow bars that browser and websites tends to come up with when they want to be 100% certain that the user notices something is up? I've yet to see a single non-technical user even notice or react to its presence once. I see it instantly and can't understand why it doesn't alert or annoy them, but to them, it's just not there. In light of that sort of behaviour, adding a subtle icon to the location bar is meaningless. Heck, adding anything to the location bar is meaningless if the intent is to communicate with the user; most users never look there. So yeah. If that's Mozilla's stance, they will find out that nobody's going to notice. I certainly didn't see it. That is effectively dead code which they've written.
        • Yoric 13y ago
          So, with any luck, either the web developers will fix their websites or, one can dream, Oracle will actually start to pay attention to security :)
• dmpk2k 13y ago
  Will it? I've been browsing without Java for years, and I can only remember problems with one site (some hilarious throwback from the late 90s). For general browsing, I doubt anyone will notice a difference. Maybe for corporate use, but isn't that mostly IE anyway?
  • emil0r 13y ago
    Depends on where you are in the world. Java is required for online banking in Norway, while it's mostly unused in Sweden, the neighbouring country. Both use Java for online verification to government sites.
    • belorn 13y ago
      > Both use Java for online verification to government sites. Do they? I thought Sweden used the online bank identity system for verification (bankid), which is either a standalone downloadable application, a smartcard image, or an mobile app. Not sure how an Firefox policy would effect this even if some parts of the bankid uses Java.
      • emil0r 13y ago
        Bankid is based on java iirc.
    • integricho 13y ago
      and they should definitely stop doing that. for me seeing Java on the client side is a sign of bad development.
      • calibwam 13y ago
        They will. It was announced earlier this year that the Norwegian banks will move over to a HTML5/js authentication. The government identification has been the same as the banks, so that too will disappear.
      • josteink 13y ago
• InclinedPlane 13y ago
  Why? Java applets are extremely rare these days.
  • acqq 13y ago
    If you're 20-something doing "the startup game" you probably don't see it on the next cool site demos. If you support the company where most of the users just know to click and login, and one day they just can't, you aren't going to like it, to quote one of the post from the bugzilla: "I haven't been able to get VPN-ed in for days, until I figured I could still use the Juniper SSL VPN from Internet Explorer. I find it amazing the casualness with which a small group of developers just shut off an entire set of functionality with no regard for its size, utility... You just broke millions of peoples software, and then you complain about this being a bug list, and you can simply do this, or simply do that." It doesn't help that "advanced users" would know, ordinary users after the automatic update can't do what they were able to do.
    • cubsink 13y ago
      Well, the reality goes forward and the customers that doesn't know how to fix this will probably be mad at the vendor for good reasons. They still use old, crappy software and it'time for an update since it will no longer work in modern browsers.
    • munimkazia 13y ago
      I think they should have just made their click-to-play UI a bit more obvious and easy to understand. It would have stopped a lot of these complaints.
    • InclinedPlane 13y ago
      This has to be balanced against the extreme risk of turning on java for every site out there. A few users are inconvenienced. That few being the intersection of those who rely on java applets for something they care about (already a tiny fraction) and those who lack the knowledge to solve the problem on their own (an even smaller fraction). Even losing that fraction of users is unlikely to affect firefox's marketshare to any significant degree. In the context of a company's IT department, they should be competent enough to know how to set default browser configurations and to provide walk-through documentation. If an IT department thinks that user convenience is a good enough excuse to expose the company's employees to some of the most serious and hard to prevent web-based exploits out there then I say fuck 'em. They have their priorities all wrong and if they want to continue to have their priorities all wrong then they are welcome to their own private hell.
• puzzlingcaptcha 13y ago
  Still, many users [http://geeksbynature.dk/2013/03/28/plugins-usage-distribution-and-future-in-firefox/ http://geeksbynature.dk/2013/03/28/plugins-usage-distributio...] have only Flash, Java and Windows Media plugins installed, maybe also Reader and Office. With Mozilla's efforts to replace Reader with pdf.js and Flash with Shumway (or HTML5), Java is a reasonable next target.
  • josteink 13y ago
    Except it's not getting replaced, it's getting blocked and disabled. While lots of code deployed still depends on it. I hate Java applets as much as the next guy, but lets not ignore that there's a real world out there.
    • Yoric 13y ago
      The real world would be nicer if Oracle actually worked on fixing Java security issues. They have a bad history of pretending that security holes have been fixed and/or pretending that they do not exist, while exploits run rampant.
      • hrjet 13y ago
        Most of Java is open-source now. I wonder why the dependence on Oracle is so high. If Apache or a similar foundation would fork(+) and adopt it, it will benefit the Java eco-system tremendously. + Fork if legally required.
        • Sanddancer 13y ago
          Apache did try to fork it with Harmony ( http://harmony.apache.org/ http://harmony.apache.org/ ), but Sun pulled every trick in the book to keep people from contributing and/or adopting it. Then again, the code is still extant, could be time to pull it out of the attic.
          • hrjet 13y ago
• iand 13y ago
  I doubt it. Apart from the odd algorithm demonstration I haven't found a need to enable Java in my browser for the past 10 years.
  • RyanZAG 13y ago
    Sure, and I haven't used Internet Explorer in years. That doesn't mean that suddenly disabling Internet Explorer is going to have no effect even if I (and probably most of us here on HN) would not even notice. A lot of corporates and financial applications require Java.
    • iand 13y ago
      So you think perpetuating the use of Java in the browser is a reasonable response to the security risks it presents to those corporates? This action by Mozilla raises awareness of the fact that Java security updates are too slow and too opaque and it's time to change to something else.
      • RyanZAG 13y ago
        I'd personally say the same about Flash and any other browser plugin - they should all be disabled. The amount of money traded on the black market for 0 days for all of these plugins is staggering. That said, users of these plugins are not just going to stop using these services. They need these services to make bank payments or trade their shares. Getting hacked is a smaller worry than being unable to use those services. That just means they will swap to a different browser. The web becomes no safer, and only Firefox loses market share. If you get hacked and someone steals from your bank account, the bank will reimburse you and the police will (try) track down the hackers. Same way as if someone broke into a bank vault and stole the money. Being unable to sell off your shares because Firefox blocked your trading app means you are forced to switch browsers. Basically it's a pointless display. Just show a warning if a website tries to use a plugin (any plugin, including flash - there are numerous undisclosed 0-days) and move on.
      • Silhouette 13y ago
        This action by Mozilla raises awareness of the fact that Java security updates are too slow and too opaque and it's time to change to something else. It also raises awareness of the fact that you can't trust some of the big names in the browser industry not to break stuff every few weeks just because they don't like it and then push the changes on you whether you want them or not. Introducing restrictions so tight that you can't actually do your useful work any more isn't security, it's just broken.
• im3w1l 13y ago
  Java is singled out because it is "too big to fail".