4 ms·

> You can still easily run Java applets in Firefox 24 and beyond, you just need to click the red lego block in the upper left corner and allow it. [1] Allow me

> You can still easily run Java applets in Firefox 24 and beyond, you just need to click the red lego block in the upper left corner and allow it. [1] Allow me to disagree and to tell you what happened last weekend: Last Sunday I had a call from my stepfather who "couldn't run the website to order agro food" anymore. This website runs a Java applet to manage agro food orders on-line and the code isn't signed (it's a small structure). He tried to understand what was going on with the warning before clicking "ok/yes/run". He googled the warning and unfortunately ended up installing malwares from ads running on some PC help website/forums that promised to fix "2 just found vulnerabilities": he thought that was related since the warning actually preventing him from accessing his "working-fine-yesterday" website seemed to be about security and vulnerabilities in the plug-in. He then tried to update Java but canceled it at the end of the process because the window with the Java propaganda ("it powers 3 billions of applications, your car, your website, etc.") looked too much like the one with malwares from before and those didn't fix the problem (not being able to access his website). When I finally could go to his house to fix it I realized what had happened. It is definitely not user-friendly. It was working before and in his eyes Mozilla made it not working anymore. edit: typo and grammar

kristofferR 13y ago
Java actually installs malware (the Ask toolbar) unless you are careful enough to deselect it during the installation/update process.
- johnchristopher 13y ago
  There was a bunch of other crap: a lollipop promotion app, a trojan and internet explorer settings changed. Funny, but he didn't installed the Ask toolbar :). I did when uninstalling/reinstalling Java and clicking a little bit too fast :). Hopefully it's not as tedious to remove as a trojan.
- sigzero 13y ago
  Uh no. That is not "malware". Unwanted software yes but not malware.
  - Groxx 13y ago
    The difference? Be sure to point out why tricking you into installing it isn't malicious, why it's not malicious that after that it changes your default search provider to send your searches to them (privacy much?), and why it's not malicious that it's abnormally hard to remove (a quick Google will demonstrate the normal 'remove toolbar' steps don't work, even Wikipedia has a note and several links on this: https://en.wikipedia.org/wiki/Ask.com https://en.wikipedia.org/wiki/Ask.com ). It tricks people to installing it, reports your search activity (maybe other data? I can't find details, not installing it myself), and takes major, unnecessary steps to make it hard to uninstall it. Sounds like malware to me.
  - kristofferR 13y ago
    It's a malicious software that hijacks the browser, displays unwanted ads and changes the search engine/start page. Most common search suggestions for Cydoor (well known adware): http://i.imgur.com/iXqJdzU.png http://i.imgur.com/iXqJdzU.png Most common search suggestions for Ask Toolbar: http://i.imgur.com/HziYjkZ.png http://i.imgur.com/HziYjkZ.png Looks pretty similar to me.
- btipling 13y ago
  Heh. I guess that makes me a malware writer as I worked on the Ask Toolbar for Firefox when I worked at Ask.com.
z92 13y ago
This one needs a separate post. Please make a blog entry and post it here and on reddit.
nknighthb 13y ago
This is clearly a person who would have wound up with malware regardless. It's as if you blamed telephones for allowing a scammer to call a gullible mark from the Official Credit Card Office.
- johnchristopher 13y ago
  He wouldn't have ended up on treacherous paths if that warning had been more explicit about what was going on. I agree he's not computer savy but I am not blaming Mozilla for his installing malware. I am blaming Mozilla for a confusing message about security. See https://news.ycombinator.com/item?id=6590686 https://news.ycombinator.com/item?id=6590686
  - nknighthb 13y ago
    There are thousands of "confusing" messages to be found on a typical computer. The messages Firefox presents for Java[1][2][3] aren't even competitive. You have a user who has not been trained to not install random software, is fooled by extremely common ads, and who does not have the basic judgement necessary to not flail about when presented with something they don't understand but to consult someone who will understand. This is a recipe for the exact scenario you described, but is in no way dependent on Firefox's Java messages. Any message appearing on their screen that they don't understand can be the trigger, including scammy ads encountered by millions of people in routine daily browsing. [1] https://dl.dropboxusercontent.com/u/1643240/outdated_java.png https://dl.dropboxusercontent.com/u/1643240/outdated_java.pn... [2] http://imgur.com/k94vEvB http://imgur.com/k94vEvB [3] 1 & 2 taken from this thread: https://news.ycombinator.com/item?id=6590877 https://news.ycombinator.com/item?id=6590877
    - bdamm 13y ago
      While I agree with your opening sentiment, and I agree regarding OP's dad not having the appropriate training and judgement, I disagree with the conclusion that he should be the resolution to that problem. The appropriate training is nothing less than years of experience working with computers or being in the IT business. Why do we believe that this ought to be standard knowledge for users? It seems to me that we're placing too much burden on the user to make good judgements in the face of insufficient application and operating system trustworthiness.
Yoric 13y ago
Interesting point. How would you rephrase the warning?
- johnchristopher 13y ago
  I had a look at the mozilla website and the english phrasing seems okay to me. I think the french is too verbose (and it adds nuances that are confusing like "some versions of the plugin is disabled", "trusted sites": does it mean sites that are guaranteed to be trusted because of a certificate or sthg or sites I trust because I know who coded it or it's so universally known (eg: google) that I should trust it anyway ?) even ignoring the fact french is de facto more verbose than english. Anyway, this is the warning my user was given : https://dl.dropboxusercontent.com/u/202857/java.png https://dl.dropboxusercontent.com/u/202857/java.png Unmovable window, can't close firefox without first actioning something in it, one checkbox+one butotn to allow "something scary" to run (something that wasn't scary yesterday). This is what prompted my user to google the warning.
  - Yoric 13y ago
    As someone point out, this is not a Firefox warning. This is a Java warning installed by Oracle. Please complain with them :)
    - johnchristopher 13y ago
      Yes, sorry about that :).
jasonlotito 13y ago
You should update your comment to reflect the reality learned here: https://news.ycombinator.com/item?id=6591531 https://news.ycombinator.com/item?id=6591531
johnchristopher 13y ago
I can't edit my message anymore so I reply here. After reviewing the facts by discussing them with nknighthb it appears the warning message that prompted me to blame Mozilla for a confusing warning message was due to Oracle and their Java warning pop-up. https://dl.dropboxusercontent.com/u/202857/java.png https://dl.dropboxusercontent.com/u/202857/java.png My apologies :], I am a little bit ashamed for not spotting it sooner.
- jtheory 13y ago
  Thanks for clarifying! This is honestly what makes the Firefox warnings even more damaging than they already are. If a brave user decides to click past the "DO NOT ENTER" sign on the Firefox warning, they are immediately presented with another worrying warning, popped up by the Java plugin. What kind of fool says "yes, please go ahead and do this dangerous thing" when two separate pieces of software have already told them not to? Not most, unfortunately. At least I can make the Java plugin warning dialog be relatively calm by signing my JARs. The Firefox one is completely beyond my control. I'd like to know if the Firefox developers have details on exploits that bypass the Java plugin dialogs. If they do, I'd like to know as well. If they don't, that means they're duplicating a security feature that's already in the plugin... what's the good of that? It just confuses and frightens the users of valid, secure Java applets.

kristofferR 13y ago

Java actually installs malware (the Ask toolbar) unless you are careful enough to deselect it during the installation/update process.

johnchristopher 13y ago
There was a bunch of other crap: a lollipop promotion app, a trojan and internet explorer settings changed. Funny, but he didn't installed the Ask toolbar :). I did when uninstalling/reinstalling Java and clicking a little bit too fast :). Hopefully it's not as tedious to remove as a trojan.
sigzero 13y ago
Uh no. That is not "malware". Unwanted software yes but not malware.
- Groxx 13y ago
  The difference? Be sure to point out why tricking you into installing it isn't malicious, why it's not malicious that after that it changes your default search provider to send your searches to them (privacy much?), and why it's not malicious that it's abnormally hard to remove (a quick Google will demonstrate the normal 'remove toolbar' steps don't work, even Wikipedia has a note and several links on this: https://en.wikipedia.org/wiki/Ask.com https://en.wikipedia.org/wiki/Ask.com ). It tricks people to installing it, reports your search activity (maybe other data? I can't find details, not installing it myself), and takes major, unnecessary steps to make it hard to uninstall it. Sounds like malware to me.
- kristofferR 13y ago
  It's a malicious software that hijacks the browser, displays unwanted ads and changes the search engine/start page. Most common search suggestions for Cydoor (well known adware): http://i.imgur.com/iXqJdzU.png http://i.imgur.com/iXqJdzU.png Most common search suggestions for Ask Toolbar: http://i.imgur.com/HziYjkZ.png http://i.imgur.com/HziYjkZ.png Looks pretty similar to me.
btipling 13y ago
Heh. I guess that makes me a malware writer as I worked on the Ask Toolbar for Firefox when I worked at Ask.com.

z92 13y ago

This one needs a separate post. Please make a blog entry and post it here and on reddit.

nknighthb 13y ago

This is clearly a person who would have wound up with malware regardless. It's as if you blamed telephones for allowing a scammer to call a gullible mark from the Official Credit Card Office.

johnchristopher 13y ago
He wouldn't have ended up on treacherous paths if that warning had been more explicit about what was going on. I agree he's not computer savy but I am not blaming Mozilla for his installing malware. I am blaming Mozilla for a confusing message about security. See https://news.ycombinator.com/item?id=6590686 https://news.ycombinator.com/item?id=6590686
- nknighthb 13y ago
  There are thousands of "confusing" messages to be found on a typical computer. The messages Firefox presents for Java[1][2][3] aren't even competitive. You have a user who has not been trained to not install random software, is fooled by extremely common ads, and who does not have the basic judgement necessary to not flail about when presented with something they don't understand but to consult someone who will understand. This is a recipe for the exact scenario you described, but is in no way dependent on Firefox's Java messages. Any message appearing on their screen that they don't understand can be the trigger, including scammy ads encountered by millions of people in routine daily browsing. [1] https://dl.dropboxusercontent.com/u/1643240/outdated_java.png https://dl.dropboxusercontent.com/u/1643240/outdated_java.pn... [2] http://imgur.com/k94vEvB http://imgur.com/k94vEvB [3] 1 & 2 taken from this thread: https://news.ycombinator.com/item?id=6590877 https://news.ycombinator.com/item?id=6590877
  - bdamm 13y ago
    While I agree with your opening sentiment, and I agree regarding OP's dad not having the appropriate training and judgement, I disagree with the conclusion that he should be the resolution to that problem. The appropriate training is nothing less than years of experience working with computers or being in the IT business. Why do we believe that this ought to be standard knowledge for users? It seems to me that we're placing too much burden on the user to make good judgements in the face of insufficient application and operating system trustworthiness.

Yoric 13y ago

Interesting point. How would you rephrase the warning?

johnchristopher 13y ago
I had a look at the mozilla website and the english phrasing seems okay to me. I think the french is too verbose (and it adds nuances that are confusing like "some versions of the plugin is disabled", "trusted sites": does it mean sites that are guaranteed to be trusted because of a certificate or sthg or sites I trust because I know who coded it or it's so universally known (eg: google) that I should trust it anyway ?) even ignoring the fact french is de facto more verbose than english. Anyway, this is the warning my user was given : https://dl.dropboxusercontent.com/u/202857/java.png https://dl.dropboxusercontent.com/u/202857/java.png Unmovable window, can't close firefox without first actioning something in it, one checkbox+one butotn to allow "something scary" to run (something that wasn't scary yesterday). This is what prompted my user to google the warning.
- Yoric 13y ago
  As someone point out, this is not a Firefox warning. This is a Java warning installed by Oracle. Please complain with them :)
  - johnchristopher 13y ago
    Yes, sorry about that :).

jasonlotito 13y ago

You should update your comment to reflect the reality learned here: https://news.ycombinator.com/item?id=6591531 https://news.ycombinator.com/item?id=6591531

johnchristopher 13y ago

I can't edit my message anymore so I reply here. After reviewing the facts by discussing them with nknighthb it appears the warning message that prompted me to blame Mozilla for a confusing warning message was due to Oracle and their Java warning pop-up. https://dl.dropboxusercontent.com/u/202857/java.png https://dl.dropboxusercontent.com/u/202857/java.png My apologies :], I am a little bit ashamed for not spotting it sooner.

jtheory 13y ago
Thanks for clarifying! This is honestly what makes the Firefox warnings even more damaging than they already are. If a brave user decides to click past the "DO NOT ENTER" sign on the Firefox warning, they are immediately presented with another worrying warning, popped up by the Java plugin. What kind of fool says "yes, please go ahead and do this dangerous thing" when two separate pieces of software have already told them not to? Not most, unfortunately. At least I can make the Java plugin warning dialog be relatively calm by signing my JARs. The Firefox one is completely beyond my control. I'd like to know if the Firefox developers have details on exploits that bypass the Java plugin dialogs. If they do, I'd like to know as well. If they don't, that means they're duplicating a security feature that's already in the plugin... what's the good of that? It just confuses and frightens the users of valid, secure Java applets.