10 ms·

Java Runtime updater now installs ask.com toolbar on Macs

330 points by pje 12y ago

tkinom 12y ago
Just add "127.0.0.1 ask.com" to /etc/hosts? While you're in it, add 127.0.0.1 doubleclick.com 127.0.0.1 doubleclick.net also.
roma1n 12y ago
Whoa... Stay classy, Oracle.
- ianlevesque 12y ago
  Stay classy? They've been doing this to Windows users for ages.
  - cnvogel 12y ago
    So they've done their users a favor by providing a consistent experience over all supported platforms? I'd really like to listen in to one of the meetings where decisions to do such kind of blatant platform-abuse is being discussed. Possibly alternatives A/B/C (you always have to have 3 alternatives, right?) are the Ask-Toolbar, a bitcoin-miner or adding the end-user-PC to a botnet for DDOS-extortion, so we can be lucky that they agreed to do "A".
  - eloisant 12y ago
    That's pretty much the definition of "to stay", e.g. keep doing what you've been doing.
moondowner 12y ago
TL;DR If the user keeps to the default installer settings and goes next, next, next... AND in Safari deliberately selects "Install" (not pre-selected) in the confirmation window, the ask.com toolbar will be installed.
- smhenderson 12y ago
  So similar to Windows and avoidable but still annoying. I can kind of understand some small software developers out there doing this stuff to make a few extra dollars but Oracle? It just seems so unnecessary. I guess they just can't get their head around giving something away for free.
  - powertower 12y ago
    Some more information... "When you have a commercial relationship like this, not only are you dealing with your [own] corporate policies on communication, and revenue recognition and all that kind of stuff, but you also have a commercial partnership and agreement that you have to abide by and follow," said Smith during the call. Smith also defended the practice by saying Oracle had inherited the deal when it acquired Sun Microsystems, the creator of Java, in 2010. "This is not a new business, this is not something that Oracle started," Smith said. "This is a business that Sun initiated a long time ago." Sun had bundled third-party software with Java since at least 2005, when it offered a Google toolbar. In the following years, Sun made similar arrangements with Microsoft and Yahoo, before switching to Ask.com. With Java, it's true our installer waits 10 minutes before running the install process, but this to ensure the JRE [Java Runtime Environment] updates properly without additional strain on a user's computer," an Ask.com spokeswoman said in an email reply to questions Monday. "This is not intended to trick users." http://www.computerworld.com/article/2494794/malware-vulnerabilities/oracle-will-continue-to-bundle--crapware--with-java.html http://www.computerworld.com/article/2494794/malware-vulnera...
    - yellowapple 12y ago
      The defense that "hurr durr Sun did it and we just haven't removed it yet" doesn't apply when you're actively adding it to installers on other platforms.
- eloisant 12y ago
  It still changes your browser homepage with an opt-out checkbox, it's pretty bad.
shylor 12y ago
Steve jobs would build an uninstaller that ran right after to remove the shit.
- lawnchair_larry 12y ago
  Probably not, he couldn't code.
0x0 12y ago
I hope Apple adds it to XProtect and revokes their code signing certificate.
jdalgetty 12y ago
I installed this yesterday on my father in laws mac and don't remember seeing the ask thing...
sauere 12y ago
How much $ does one make with this kind of crapware-bundling? Like how much would i get for 1000 toolbar installs?
- saganus 12y ago
  I think the point is not for the user to make money, but the people bundling the toolbar. I think ask.com pays whoever bundles their toolbar so it's basically advertising money, at least it seems like that for me.
  - takeda 12y ago
    That's what he is asking: How much money Oracle gets per install?
  - dtparr 12y ago
    Yes, I'm fairly certain that's what the parent meant. If he was running a company doing the bundling, how much would he get paid if his bundle installed the toolbar 1000 times, now how much would he as an end user get if he installed it 1000 times on his own machines.
    - saganus 12y ago
      Aha! that makes more sense. I read that as if the user would get money for using ask.com toolbar. But yeah, thanks to both of you. Now that I think about it, I'm not sure if ask.com is willing to bundle their toolbar with any product. Maybe they select only high-volume products?
  - deleted 12y ago
    [deleted]
- actsasbuffoon 12y ago
  Unfortunately, I imagine it'd be a fair bit of money. Many toolbars track every site you visit, how long you're there, what you type on the site (including personally identifying information), and a host of other Orwellian things. I can't imagine anyone feels good about trying to trick their users into installing this crap. If the money wasn't good, only completely amoral psychopaths would do it. As it stands, the financial incentives bring it to the point where greedy asshats are also willing to get in on the action.
Gonzih 12y ago
As far as I know if you install JDK and not JRE there should not be any additional adware. At least for now.
- Tunecrew 12y ago
  I installed the JRE and JDK (on diff machines) from the downloadable installers (not the updater) and neither installed the adware, nor had the option to.
  - pohl 12y ago
    This makes me wonder if they're doing a partial rollout to some small percentage of users to test the waters.
  - lmb 12y ago
    Same here, installed both JDK and JRE today and no crapware screns.
- __m 12y ago
  I guess the target group are less tech savvy users that install it because they don't really know what they are doing, like less law savvy people who agree every terms of use. Kind of shady but accepted practice. JDK users are probably less exploitable.
logn 12y ago
Desktop Java apps should just bundle a JRE. Launch4j: http://launch4j.sourceforge.net/ http://launch4j.sourceforge.net/ Legality: http://www.oracle.com/technetwork/java/javase/readme-142177.html#redistribution http://www.oracle.com/technetwork/java/javase/readme-142177....
- joosters 12y ago
  Nothing in that link claims that apps have to 'just' bundle the JRE only.
- sp332 12y ago
  At the rate Java has been fixing exploitable vulnerabilities lately, I would rather have just one copy to keep up-to-date. I know that's not a very Mac-like attitude though.
  - tormeh 12y ago
    But you only need to update the JRE's that interface with the outside world, and unless there are bugs in the JVM's network code that would be only your Java browser plugin.
    - makomk 12y ago
      There have been bugs in networking related code in the JRE. For example, I believe it was recently discovered that their SSL implementation was completely and utterly broken and enabled a MITM attacker to totally disable encryption (the SKIP-TLS attack). Guess what most software is probably relying on to protect their auto-updater?
      - tomjen3 12y ago
        They SSL implementation was broken against an active attacker - this is very different from being broken totally. Obviously it is still very, very bad but it doesn't mean you shouldn't use it if you are not going to replace it with anything else.
  - 12y ago
na85 12y ago
Business as usual for Java, king of bloat.
xenadu02 12y ago
You aren't Oracle's customer. The Fortune 1000 are their customers. Oracle doesn't care about nerd outrage, the developer community, or end users. Former Oracle employee, via acquisition. Horrible place to work. This post is my own opinion and does not relflect insider or confidential information from Oracle.
- kossmoboleat 12y ago
  I don't think any customer would like this.
  - gtufano 12y ago
    As a former Oracle employee (also there via acquisition) I can confirm that they don't care at all about anything but the money. If adware makes money, that's OK for them. And, yes, they don't care about nerd outrage and I'm also sure that CxOs of Fortune 1000 companies don't care about adware (or us) too. Even if they care (and they probably not), they cannot afford to avoid Oracle DB and/or Java in any case. I'm sure they try in many ways to avoid to spend the insane amount of money Oracle products cost. Ah, and yes: it is an awful place to work. For the same reason: they don't care about anything but money... Employees are COGs, nothing more, nothing less. If you find the right niche, you can live a quiet salaried life there for some years, btw... like probably in any other giant company.
    - gentlebend 12y ago
      Anyone care to explain how they somehow haven't ruined VirtualBox yet?
      - hrktb 12y ago
        It's on the way. The performance and feature gap between VMWare and Virtualbox is widening everyday.
    - rogerbinns 12y ago
      I highly recommend a section of Bryan Cantrill's talk where he covers Oracle - https://www.youtube.com/watch?v=-zRN7XLCRhc&t=2100 https://www.youtube.com/watch?v=-zRN7XLCRhc&t=2100 lasts two or three minutes.
fecak 12y ago
There was a similar story relating to Java updates and Ask toolbars in 2013. There is some history to this. http://www.zdnet.com/article/a-close-look-at-how-oracle-installs-deceptive-software-with-java-updates/ http://www.zdnet.com/article/a-close-look-at-how-oracle-inst...
jkot 12y ago
Could someone please confirm that original JRE installer downloaded from www.oracle.com contains this? (I dont have a mac). On Windows you often get modified installers, if you download from 3td party website.
- JohnTHaller 12y ago
  The official Java updater on Windows includes offers. It usually tries to install Chrome and will do so unless you unselect it during the upgrade process.
ttflee 12y ago
FYI, Oracle installs Baidu (Nasdaq BIDU) bloat wares in Java Updater here in China.
- nmc 12y ago
  On Mac?
  - nmc 12y ago
    Why the downvote? I was just checking.
morphyn 12y ago
Finally! I've been waiting for this for so long! It seemed so unfair that only Windows users could get the Ask.com toolbar for free...
- bigdubs 12y ago
  /s?
nmc 12y ago
As some commenters pointed out, the installer is now an APP instead of a PKG. The original PKG is inside the APP at Contents/Resources/JavaAppletPlugin.pkg (right click on APP -> Show package contents).
kasajian 12y ago
I think everyone using the Java runtime should install and use the ask.com toolbar. Why not?
javajosh 12y ago
This certainly poisons the Java well a little bit more in general, and desktop Java in particular. Android and a sea of line-of-business webapps will keep the Java platform healthy for a very long time, but this kind of thing makes me shake my head in sadness. More positively, this is a an excellent data point for both free software advocates ("look at the abuse closed source enables") and Apple ("do you really want to foist crapware on your users? just use our awesome native tools to write apps!") I imagine that this move infuriates much of the Google Android team (because it weakens the developer story slightly) and makes them very glad that they have "Android plan B" with Go.
- mike_hearn 12y ago
  Developers don't install the consumer JRE anyway. They install the JDK which doesn't do this. I doubt it'd make any difference to Android. Meanwhile, for apps like Minecraft that want to distribute consumer Java apps, just bundle the JRE. It's quite easy these days.
  - javajosh 12y ago
    You really don't think stuff like this moves the dial at all in a developers mind when deciding whether to focus on Android or iOS?
vinceyuan 12y ago
Will it happen on Mac? http://static.spiceworks.com/images/how_to_steps/0000/3886/too_many_toolbars.jpg http://static.spiceworks.com/images/how_to_steps/0000/3886/t...
rjohnk 12y ago
Crapware in installations must end.I made a desktop PC for my sister with nothing but Windows 8.1. It only took my sister, an otherwise competent computer user, 48 hours for her computer to become infested with some web-ad hijacker and numerous IE toolbars.
- Frozenlock 12y ago
  "an otherwise competent computer user" "numerous IE toolbars" IE?
  - smhenderson 12y ago
    Internet Explorer...
    - drewbug 12y ago
      Yeah, Frozenlock's snarkily trying to imply that "otherwise competent" computer users don't use IE.
      - RaleyField 12y ago
        Technically rjohnk didn't claim his sister used IE, only that IE toolbars were installed.
    - smhenderson 12y ago
      Wow, my bad, I thought the parent was genuinely asking.
- btzll 12y ago
  It won't end. If there's money somewhere (adware in software), it will happen whether you want it or not.
- spyder 12y ago
  http://unchecky.com/ http://unchecky.com/
hellbanner 12y ago
I knew I clicked "remind me later" for a reason.. what the hell. Did Oracle run out of money in its lawsuit with Google?
muraiki 12y ago
The bigger context is this: jamf makes software to help manage fleets of Macs, by providing abilities such as deploying a package to a group of Macs. It's quite good and IIRC Apple uses it for configuration management. If a vendor gives you a normal package, as Java once was, it was fairly easy to deploy. Contrast deploying the JRE with a simple package vs deploying it on Windows, which usually required an ever-evolving set of hacks to extract MSIs from the installer and install it in an automated fashion without installing bloatware, having it sit in the taskbar, auto-updating (which is a no-no in an enterprise environment), etc. Now, thanks to this change, people on the Mac side will get to experience all the joys of deploying the JRE on Windows.
- TazeTSchnitzel 12y ago
  Isn't there a crapware-free version you can get on the developer site?
- dubya 12y ago
  For what it's worth, the installer app contains a .pkg for the JRE that you can install by the normal methods. OTOH, the Flash installer used to contain a normal package, but no longer does.
kevin_thibedeau 12y ago
I suppose this system could be crashed by automatically installing hundreds of millions of instances of the Ask toolbar to the point that it is economically infeasible for them to pay Oracle.
pesnk 12y ago
This is really f&ed up. They are clearly against the common user that only wants to use their software. They advocate so much about security but embed a undesired software with their runtime. I really can't understand.
Sarkie 12y ago
Does this still work? How to disable offers in the control panel. https://www.java.com/en/download/faq/disable_offers.xml https://www.java.com/en/download/faq/disable_offers.xml
jstoiko 12y ago
JRE is the new Flash
krisgenre 12y ago
Even though I love Java and the ecosystem, this is one time I feel really embarrassed asking a non tech person to install Java. Is Oracle really getting substantial money out of this deal?
bluedino 12y ago
My fear would be: brew install java-runtime ==> Downloading http://oracle.com/osx/java-osx-8-x86_64.tgz ######################################################################## 100.0% ==> Downloading http://ask.com/osx/asktoolbar-2.4.tgz
- jagger27 12y ago
  No worries, the maintainers will surely include a --no-junk flag
- TeMPOraL 12y ago
  This is my fear too, and I'm pretty convinced we'll get there at some point, if and when the *nix-on-desktop scene gets more competetive. This seems to be a common pattern - after you delivered all the value you could and you still have competition, eventually you and everyone else will start one-up each other on abusing your users for additional profit.
- Zopieux 12y ago
  More like: $ real-pkg-manager install jre-openjdk ==> Downloading http://trustedmirror.somerealdistrib.org/openjdk.tgz ==> Checking openjdk.tgz signature ==> Installing ==> Done You just need the right tools and community.
MiddleEndian 12y ago
It's been awhile since I've used OS X, but I don't recall there being any bundled installers on anything. Hopefully there will be some backlash; that was one of my favorite parts of the platform.
Friedduck 12y ago
I worked on a couple of large Oracle projects, and they were probably the worst vendor I've dealt with in the last decade. They had the potential to solve really compelling problems, but it was overshadowed by how poor their products were and the eye-watering costs. Once you're hooked of course on their financial stack you have little choice but to remain. I'm watching with interest the adoption of Workday as a replacement for Peoplesoft, and wonder aloud if someone will unseat them in their related product groups.
- nobleach 12y ago
  I have seen this in so many cases. Somehow Oracle convinced people of their never-ending superiority. I know in 8i and 9i days, we were very happy with its performance and feature set. That's not to say that SQL Server (or hell, even DB2 or Sybase) couldn't have given it competition. But when I hear executive types pushing Oracle these days, I have to ask, "really? REALLY?? do you even know WHY you're pushing that monstrous heap of garbage?? Does it give you something you can't get with Postgres? Oh yes... a flatter wallet. Touche. As far as Workday, I'm intrigued that someone would chosen Adobe Flex as a platform. (we just converted last year)
bmoresbest55 12y ago
This is the number one thing that I uninstall from my computer and friends and families computers when they accidentally click too fast. These kinds of add-ons are incredibly annoying.
reberhardt 12y ago
Obligatory http://bad.solutions http://bad.solutions
ocdtrekkie 12y ago
Welcome to the club, Apple snobs. :)
TeMPOraL 12y ago
And people are suddenly surprised there is strong anti-vaccine movement. This kind of things is the real reason for it. From the producer who decides to reduce the amount of good in a box, while keeping the packaging and price tag the same, to the grocery store clerk that sells you meat that was already twice washed with dishwashing liquid to appear fresh (a very common practice), to the company that regularly sends you 4W LEDs when you order 5W hoping you won't notice, and if you challenge them they'll tell you it was a factory labeling mistake, to the smartphone vendor that tells you about amazing experience and then sells you equipment loaded with so much crapware that you cringe every time you turn it on - everyone around you is out there to get you. So many businesses try to fuck you over, all the time, and they totally get away with it. And then everyone is surprised people have trust issues. It's hard enough to get people to install any kind of updates in the first place - and how we're expected to have a secure Internet if people have a very good reason not to install new versions of things? Seriously - companies like Oracle, like Ask.com, like Lenovo, SuperFish, like Uber and like so many, many others - start-ups, mom&pop's, medium companies, big corporations - they all found a very profitable business model: taking the common value of trust we have in society and burning it to earn money. And I guess it works well - if you're an executive who's going to get a pay raise and maybe a promotion for literally shitting on the faces of your customers, when why wouldn't you do it? Well, except of having any decency at all? Whoever decided to bundle this crapware with Java Runtime, if you're reading this - you're actively contributing to one of the biggest problems our civilization is facing. You should feel responsible. The next time someone dies because he refused to follow established procedures out of lack of trust, this is - in a small but important part - on you. It may feel like I'm exaggerating here, but just look around and think for a minute. The collapse of trust we see in contemporary society is raising to the level of becoming an existential threat for our civilization. And I wish I knew a way how to reverse it...
- Shank 12y ago
  A bit of a slippery slope to associate the installation of adware with the anti-vaccine movement.
  - api 12y ago
alanl 12y ago
If you download from java.oracle.com as apposed to java.com these nasty toolbars aren't included.
deleted 12y ago
[deleted]
foreign-inc 12y ago
Ironic? https://www.techdirt.com/articles/20130115/17343321692/why-are-y-combinator-andreessen-horowitz-backing-drive-by-toolbaradware-installer.shtml https://www.techdirt.com/articles/20130115/17343321692/why-a...
josteink 12y ago
So everyone who said "Windows just has all these problems. Just get a Mac instead! Nobody creates viruses or crapware for mac"... Guess what you just did? Yup. You gave Mac enough market-share for it to be profitable to bundle crapware there as well. This is probably just the start and more will follow. Whatever you do, please don't tell people to install Linux. I like it the way it is and I don't want any of this shit coming here.
craigasketch 12y ago
Maybe I should go work at ask.com if I could make it suck less this wouldn't be so bad...
unabridged 12y ago
If you are developing products that require Java you are a huge part of the problem. Learn a new language and start porting. I am tired of 100% of the blame for these situations going to Oracle and Adobe, they are just doing what they were designed to do, make money by any means necessary. The developers who voluntarily learned a language and joined a community that is controlled by a for-profit company are the only thing keeping them alive. Every new product they make entices another end user to install crap on their computer.
cagriaksay 12y ago
It's mind boggling that they pay as much as $2 per install but can't afford decent design. I've never seen a good looking toolbar, it's as if they try to make them ugly.
Animats 12y ago
Search companies now have to pay third parties to get their product out. Google pays Apple to be on the iPhone. Yahoo pays Mozilla to be on Firefox. Bing is on Microsoft products because they're the same company. Now Ask is paying Oracle to push their search. This is strange. Google, Bing, Ask, Yandex, and Baidu provide very useful services and put vast resources behind organizing the world's information. Two decades ago people would have paid serious money for any of those services. Yet now, search companies resort to expensive or, in this case rather pathetic, measures to get people to use their product. Even the social companies (Facebook, Instagram, etc.) don't need to do that.
stolsvik 12y ago
Oracle could have made a fantastic app ecosystem, with a great AppStore application, given how their vm is installed on very many PCs around the world. They could have done the 30/70 split and potentially gotten heaps of money out of it. Sun was even up to it at some point, but it was horrible, the way that only Sun could make UX horrible. But still, the potential is so enormous that I cannot fathom how they miss it. And this Ask-crap is what they do instead, making pretty much every user in the world hate them. (Not to mention the insanity of how they handled the security problems they found themselves in right after acquiring Sun and Java)
t0mas88 12y ago
Smells a lot like Adobe... Stupid move killing credibility of their software.
pc2g4d 12y ago
I don't understand why OpenJDK hasn't been able to supplant Oracle as the standard Java distribution. That would eliminate reliance on the corporate whim of Oracle.
irascible 12y ago
Why does Oracle want to kill Java so badly? Buncha fuckin assholes if you ask me...

330 points by pje 12y ago

Just add "127.0.0.1 ask.com" to /etc/hosts? While you're in it, add 127.0.0.1 doubleclick.com 127.0.0.1 doubleclick.net also.

roma1n 12y ago

Whoa... Stay classy, Oracle.

ianlevesque 12y ago
Stay classy? They've been doing this to Windows users for ages.
- cnvogel 12y ago
  So they've done their users a favor by providing a consistent experience over all supported platforms? I'd really like to listen in to one of the meetings where decisions to do such kind of blatant platform-abuse is being discussed. Possibly alternatives A/B/C (you always have to have 3 alternatives, right?) are the Ask-Toolbar, a bitcoin-miner or adding the end-user-PC to a botnet for DDOS-extortion, so we can be lucky that they agreed to do "A".
- eloisant 12y ago
  That's pretty much the definition of "to stay", e.g. keep doing what you've been doing.

moondowner 12y ago

TL;DR If the user keeps to the default installer settings and goes next, next, next... AND in Safari deliberately selects "Install" (not pre-selected) in the confirmation window, the ask.com toolbar will be installed.

smhenderson 12y ago
So similar to Windows and avoidable but still annoying. I can kind of understand some small software developers out there doing this stuff to make a few extra dollars but Oracle? It just seems so unnecessary. I guess they just can't get their head around giving something away for free.
- powertower 12y ago
  Some more information... "When you have a commercial relationship like this, not only are you dealing with your [own] corporate policies on communication, and revenue recognition and all that kind of stuff, but you also have a commercial partnership and agreement that you have to abide by and follow," said Smith during the call. Smith also defended the practice by saying Oracle had inherited the deal when it acquired Sun Microsystems, the creator of Java, in 2010. "This is not a new business, this is not something that Oracle started," Smith said. "This is a business that Sun initiated a long time ago." Sun had bundled third-party software with Java since at least 2005, when it offered a Google toolbar. In the following years, Sun made similar arrangements with Microsoft and Yahoo, before switching to Ask.com. With Java, it's true our installer waits 10 minutes before running the install process, but this to ensure the JRE [Java Runtime Environment] updates properly without additional strain on a user's computer," an Ask.com spokeswoman said in an email reply to questions Monday. "This is not intended to trick users." http://www.computerworld.com/article/2494794/malware-vulnerabilities/oracle-will-continue-to-bundle--crapware--with-java.html http://www.computerworld.com/article/2494794/malware-vulnera...
  - yellowapple 12y ago
    The defense that "hurr durr Sun did it and we just haven't removed it yet" doesn't apply when you're actively adding it to installers on other platforms.
eloisant 12y ago
It still changes your browser homepage with an opt-out checkbox, it's pretty bad.

shylor 12y ago

Steve jobs would build an uninstaller that ran right after to remove the shit.

lawnchair_larry 12y ago
Probably not, he couldn't code.

0x0 12y ago

I hope Apple adds it to XProtect and revokes their code signing certificate.

jdalgetty 12y ago

I installed this yesterday on my father in laws mac and don't remember seeing the ask thing...

sauere 12y ago

How much $ does one make with this kind of crapware-bundling? Like how much would i get for 1000 toolbar installs?

saganus 12y ago
I think the point is not for the user to make money, but the people bundling the toolbar. I think ask.com pays whoever bundles their toolbar so it's basically advertising money, at least it seems like that for me.
- takeda 12y ago
  That's what he is asking: How much money Oracle gets per install?
- dtparr 12y ago
  Yes, I'm fairly certain that's what the parent meant. If he was running a company doing the bundling, how much would he get paid if his bundle installed the toolbar 1000 times, now how much would he as an end user get if he installed it 1000 times on his own machines.
  - saganus 12y ago
    Aha! that makes more sense. I read that as if the user would get money for using ask.com toolbar. But yeah, thanks to both of you. Now that I think about it, I'm not sure if ask.com is willing to bundle their toolbar with any product. Maybe they select only high-volume products?
- deleted 12y ago
  [deleted]
actsasbuffoon 12y ago
Unfortunately, I imagine it'd be a fair bit of money. Many toolbars track every site you visit, how long you're there, what you type on the site (including personally identifying information), and a host of other Orwellian things. I can't imagine anyone feels good about trying to trick their users into installing this crap. If the money wasn't good, only completely amoral psychopaths would do it. As it stands, the financial incentives bring it to the point where greedy asshats are also willing to get in on the action.

Gonzih 12y ago

As far as I know if you install JDK and not JRE there should not be any additional adware. At least for now.

Tunecrew 12y ago
I installed the JRE and JDK (on diff machines) from the downloadable installers (not the updater) and neither installed the adware, nor had the option to.
- pohl 12y ago
  This makes me wonder if they're doing a partial rollout to some small percentage of users to test the waters.
- lmb 12y ago
  Same here, installed both JDK and JRE today and no crapware screns.
__m 12y ago
I guess the target group are less tech savvy users that install it because they don't really know what they are doing, like less law savvy people who agree every terms of use. Kind of shady but accepted practice. JDK users are probably less exploitable.

logn 12y ago

Desktop Java apps should just bundle a JRE. Launch4j: http://launch4j.sourceforge.net/ http://launch4j.sourceforge.net/ Legality: http://www.oracle.com/technetwork/java/javase/readme-142177.html#redistribution http://www.oracle.com/technetwork/java/javase/readme-142177....

joosters 12y ago
Nothing in that link claims that apps have to 'just' bundle the JRE only.
sp332 12y ago
At the rate Java has been fixing exploitable vulnerabilities lately, I would rather have just one copy to keep up-to-date. I know that's not a very Mac-like attitude though.
- tormeh 12y ago
  But you only need to update the JRE's that interface with the outside world, and unless there are bugs in the JVM's network code that would be only your Java browser plugin.
  - makomk 12y ago
    There have been bugs in networking related code in the JRE. For example, I believe it was recently discovered that their SSL implementation was completely and utterly broken and enabled a MITM attacker to totally disable encryption (the SKIP-TLS attack). Guess what most software is probably relying on to protect their auto-updater?
    - tomjen3 12y ago
      They SSL implementation was broken against an active attacker - this is very different from being broken totally. Obviously it is still very, very bad but it doesn't mean you shouldn't use it if you are not going to replace it with anything else.
- 12y ago

na85 12y ago

Business as usual for Java, king of bloat.

xenadu02 12y ago

You aren't Oracle's customer. The Fortune 1000 are their customers. Oracle doesn't care about nerd outrage, the developer community, or end users. Former Oracle employee, via acquisition. Horrible place to work. This post is my own opinion and does not relflect insider or confidential information from Oracle.

kossmoboleat 12y ago
I don't think any customer would like this.
- gtufano 12y ago
  As a former Oracle employee (also there via acquisition) I can confirm that they don't care at all about anything but the money. If adware makes money, that's OK for them. And, yes, they don't care about nerd outrage and I'm also sure that CxOs of Fortune 1000 companies don't care about adware (or us) too. Even if they care (and they probably not), they cannot afford to avoid Oracle DB and/or Java in any case. I'm sure they try in many ways to avoid to spend the insane amount of money Oracle products cost. Ah, and yes: it is an awful place to work. For the same reason: they don't care about anything but money... Employees are COGs, nothing more, nothing less. If you find the right niche, you can live a quiet salaried life there for some years, btw... like probably in any other giant company.
  - gentlebend 12y ago
    Anyone care to explain how they somehow haven't ruined VirtualBox yet?
    - hrktb 12y ago
      It's on the way. The performance and feature gap between VMWare and Virtualbox is widening everyday.
  - rogerbinns 12y ago
    I highly recommend a section of Bryan Cantrill's talk where he covers Oracle - https://www.youtube.com/watch?v=-zRN7XLCRhc&t=2100 https://www.youtube.com/watch?v=-zRN7XLCRhc&t=2100 lasts two or three minutes.

fecak 12y ago

There was a similar story relating to Java updates and Ask toolbars in 2013. There is some history to this. http://www.zdnet.com/article/a-close-look-at-how-oracle-installs-deceptive-software-with-java-updates/ http://www.zdnet.com/article/a-close-look-at-how-oracle-inst...

jkot 12y ago

Could someone please confirm that original JRE installer downloaded from www.oracle.com contains this? (I dont have a mac). On Windows you often get modified installers, if you download from 3td party website.

JohnTHaller 12y ago
The official Java updater on Windows includes offers. It usually tries to install Chrome and will do so unless you unselect it during the upgrade process.

ttflee 12y ago

FYI, Oracle installs Baidu (Nasdaq BIDU) bloat wares in Java Updater here in China.

nmc 12y ago
On Mac?
- nmc 12y ago
  Why the downvote? I was just checking.

morphyn 12y ago

Finally! I've been waiting for this for so long! It seemed so unfair that only Windows users could get the Ask.com toolbar for free...

bigdubs 12y ago
/s?

nmc 12y ago

As some commenters pointed out, the installer is now an APP instead of a PKG. The original PKG is inside the APP at Contents/Resources/JavaAppletPlugin.pkg (right click on APP -> Show package contents).

kasajian 12y ago

I think everyone using the Java runtime should install and use the ask.com toolbar. Why not?

javajosh 12y ago

This certainly poisons the Java well a little bit more in general, and desktop Java in particular. Android and a sea of line-of-business webapps will keep the Java platform healthy for a very long time, but this kind of thing makes me shake my head in sadness. More positively, this is a an excellent data point for both free software advocates ("look at the abuse closed source enables") and Apple ("do you really want to foist crapware on your users? just use our awesome native tools to write apps!") I imagine that this move infuriates much of the Google Android team (because it weakens the developer story slightly) and makes them very glad that they have "Android plan B" with Go.

mike_hearn 12y ago
Developers don't install the consumer JRE anyway. They install the JDK which doesn't do this. I doubt it'd make any difference to Android. Meanwhile, for apps like Minecraft that want to distribute consumer Java apps, just bundle the JRE. It's quite easy these days.
- javajosh 12y ago
  You really don't think stuff like this moves the dial at all in a developers mind when deciding whether to focus on Android or iOS?

vinceyuan 12y ago

Will it happen on Mac? http://static.spiceworks.com/images/how_to_steps/0000/3886/too_many_toolbars.jpg http://static.spiceworks.com/images/how_to_steps/0000/3886/t...

rjohnk 12y ago

Crapware in installations must end.I made a desktop PC for my sister with nothing but Windows 8.1. It only took my sister, an otherwise competent computer user, 48 hours for her computer to become infested with some web-ad hijacker and numerous IE toolbars.

Frozenlock 12y ago
"an otherwise competent computer user" "numerous IE toolbars" IE?
- smhenderson 12y ago
  Internet Explorer...
  - drewbug 12y ago
    Yeah, Frozenlock's snarkily trying to imply that "otherwise competent" computer users don't use IE.
    - RaleyField 12y ago
      Technically rjohnk didn't claim his sister used IE, only that IE toolbars were installed.
  - smhenderson 12y ago
    Wow, my bad, I thought the parent was genuinely asking.
btzll 12y ago
It won't end. If there's money somewhere (adware in software), it will happen whether you want it or not.
spyder 12y ago
http://unchecky.com/ http://unchecky.com/

hellbanner 12y ago

I knew I clicked "remind me later" for a reason.. what the hell. Did Oracle run out of money in its lawsuit with Google?

muraiki 12y ago

The bigger context is this: jamf makes software to help manage fleets of Macs, by providing abilities such as deploying a package to a group of Macs. It's quite good and IIRC Apple uses it for configuration management. If a vendor gives you a normal package, as Java once was, it was fairly easy to deploy. Contrast deploying the JRE with a simple package vs deploying it on Windows, which usually required an ever-evolving set of hacks to extract MSIs from the installer and install it in an automated fashion without installing bloatware, having it sit in the taskbar, auto-updating (which is a no-no in an enterprise environment), etc. Now, thanks to this change, people on the Mac side will get to experience all the joys of deploying the JRE on Windows.

TazeTSchnitzel 12y ago
Isn't there a crapware-free version you can get on the developer site?
dubya 12y ago
For what it's worth, the installer app contains a .pkg for the JRE that you can install by the normal methods. OTOH, the Flash installer used to contain a normal package, but no longer does.

kevin_thibedeau 12y ago

I suppose this system could be crashed by automatically installing hundreds of millions of instances of the Ask toolbar to the point that it is economically infeasible for them to pay Oracle.

pesnk 12y ago

This is really f&ed up. They are clearly against the common user that only wants to use their software. They advocate so much about security but embed a undesired software with their runtime. I really can't understand.

Sarkie 12y ago

Does this still work? How to disable offers in the control panel. https://www.java.com/en/download/faq/disable_offers.xml https://www.java.com/en/download/faq/disable_offers.xml

jstoiko 12y ago

JRE is the new Flash

krisgenre 12y ago

Even though I love Java and the ecosystem, this is one time I feel really embarrassed asking a non tech person to install Java. Is Oracle really getting substantial money out of this deal?

bluedino 12y ago

My fear would be: brew install java-runtime ==> Downloading http://oracle.com/osx/java-osx-8-x86_64.tgz ######################################################################## 100.0% ==> Downloading http://ask.com/osx/asktoolbar-2.4.tgz

jagger27 12y ago
No worries, the maintainers will surely include a --no-junk flag
TeMPOraL 12y ago
This is my fear too, and I'm pretty convinced we'll get there at some point, if and when the *nix-on-desktop scene gets more competetive. This seems to be a common pattern - after you delivered all the value you could and you still have competition, eventually you and everyone else will start one-up each other on abusing your users for additional profit.
Zopieux 12y ago
More like: $ real-pkg-manager install jre-openjdk ==> Downloading http://trustedmirror.somerealdistrib.org/openjdk.tgz ==> Checking openjdk.tgz signature ==> Installing ==> Done You just need the right tools and community.

MiddleEndian 12y ago

It's been awhile since I've used OS X, but I don't recall there being any bundled installers on anything. Hopefully there will be some backlash; that was one of my favorite parts of the platform.

Friedduck 12y ago

I worked on a couple of large Oracle projects, and they were probably the worst vendor I've dealt with in the last decade. They had the potential to solve really compelling problems, but it was overshadowed by how poor their products were and the eye-watering costs. Once you're hooked of course on their financial stack you have little choice but to remain. I'm watching with interest the adoption of Workday as a replacement for Peoplesoft, and wonder aloud if someone will unseat them in their related product groups.

nobleach 12y ago
I have seen this in so many cases. Somehow Oracle convinced people of their never-ending superiority. I know in 8i and 9i days, we were very happy with its performance and feature set. That's not to say that SQL Server (or hell, even DB2 or Sybase) couldn't have given it competition. But when I hear executive types pushing Oracle these days, I have to ask, "really? REALLY?? do you even know WHY you're pushing that monstrous heap of garbage?? Does it give you something you can't get with Postgres? Oh yes... a flatter wallet. Touche. As far as Workday, I'm intrigued that someone would chosen Adobe Flex as a platform. (we just converted last year)

bmoresbest55 12y ago

This is the number one thing that I uninstall from my computer and friends and families computers when they accidentally click too fast. These kinds of add-ons are incredibly annoying.

reberhardt 12y ago

Obligatory http://bad.solutions http://bad.solutions

ocdtrekkie 12y ago

Welcome to the club, Apple snobs. :)

TeMPOraL 12y ago

And people are suddenly surprised there is strong anti-vaccine movement. This kind of things is the real reason for it. From the producer who decides to reduce the amount of good in a box, while keeping the packaging and price tag the same, to the grocery store clerk that sells you meat that was already twice washed with dishwashing liquid to appear fresh (a very common practice), to the company that regularly sends you 4W LEDs when you order 5W hoping you won't notice, and if you challenge them they'll tell you it was a factory labeling mistake, to the smartphone vendor that tells you about amazing experience and then sells you equipment loaded with so much crapware that you cringe every time you turn it on - everyone around you is out there to get you. So many businesses try to fuck you over, all the time, and they totally get away with it. And then everyone is surprised people have trust issues. It's hard enough to get people to install any kind of updates in the first place - and how we're expected to have a secure Internet if people have a very good reason not to install new versions of things? Seriously - companies like Oracle, like Ask.com, like Lenovo, SuperFish, like Uber and like so many, many others - start-ups, mom&pop's, medium companies, big corporations - they all found a very profitable business model: taking the common value of trust we have in society and burning it to earn money. And I guess it works well - if you're an executive who's going to get a pay raise and maybe a promotion for literally shitting on the faces of your customers, when why wouldn't you do it? Well, except of having any decency at all? Whoever decided to bundle this crapware with Java Runtime, if you're reading this - you're actively contributing to one of the biggest problems our civilization is facing. You should feel responsible. The next time someone dies because he refused to follow established procedures out of lack of trust, this is - in a small but important part - on you. It may feel like I'm exaggerating here, but just look around and think for a minute. The collapse of trust we see in contemporary society is raising to the level of becoming an existential threat for our civilization. And I wish I knew a way how to reverse it...

Shank 12y ago
A bit of a slippery slope to associate the installation of adware with the anti-vaccine movement.
- api 12y ago

alanl 12y ago

If you download from java.oracle.com as apposed to java.com these nasty toolbars aren't included.

deleted 12y ago

[deleted]

foreign-inc 12y ago

Ironic? https://www.techdirt.com/articles/20130115/17343321692/why-are-y-combinator-andreessen-horowitz-backing-drive-by-toolbaradware-installer.shtml https://www.techdirt.com/articles/20130115/17343321692/why-a...

josteink 12y ago

So everyone who said "Windows just has all these problems. Just get a Mac instead! Nobody creates viruses or crapware for mac"... Guess what you just did? Yup. You gave Mac enough market-share for it to be profitable to bundle crapware there as well. This is probably just the start and more will follow. Whatever you do, please don't tell people to install Linux. I like it the way it is and I don't want any of this shit coming here.

craigasketch 12y ago

Maybe I should go work at ask.com if I could make it suck less this wouldn't be so bad...

unabridged 12y ago

If you are developing products that require Java you are a huge part of the problem. Learn a new language and start porting. I am tired of 100% of the blame for these situations going to Oracle and Adobe, they are just doing what they were designed to do, make money by any means necessary. The developers who voluntarily learned a language and joined a community that is controlled by a for-profit company are the only thing keeping them alive. Every new product they make entices another end user to install crap on their computer.

cagriaksay 12y ago

It's mind boggling that they pay as much as $2 per install but can't afford decent design. I've never seen a good looking toolbar, it's as if they try to make them ugly.

Animats 12y ago

Search companies now have to pay third parties to get their product out. Google pays Apple to be on the iPhone. Yahoo pays Mozilla to be on Firefox. Bing is on Microsoft products because they're the same company. Now Ask is paying Oracle to push their search. This is strange. Google, Bing, Ask, Yandex, and Baidu provide very useful services and put vast resources behind organizing the world's information. Two decades ago people would have paid serious money for any of those services. Yet now, search companies resort to expensive or, in this case rather pathetic, measures to get people to use their product. Even the social companies (Facebook, Instagram, etc.) don't need to do that.

stolsvik 12y ago

Oracle could have made a fantastic app ecosystem, with a great AppStore application, given how their vm is installed on very many PCs around the world. They could have done the 30/70 split and potentially gotten heaps of money out of it. Sun was even up to it at some point, but it was horrible, the way that only Sun could make UX horrible. But still, the potential is so enormous that I cannot fathom how they miss it. And this Ask-crap is what they do instead, making pretty much every user in the world hate them. (Not to mention the insanity of how they handled the security problems they found themselves in right after acquiring Sun and Java)

t0mas88 12y ago

Smells a lot like Adobe... Stupid move killing credibility of their software.

pc2g4d 12y ago

I don't understand why OpenJDK hasn't been able to supplant Oracle as the standard Java distribution. That would eliminate reliance on the corporate whim of Oracle.

irascible 12y ago

Why does Oracle want to kill Java so badly? Buncha fuckin assholes if you ask me...