Yes. I share your frustration at articles such as this that report a "Java 0 day" vulnerability without clarifying they are speaking of Java on client computer

Yes. I share your frustration at articles such as this that report a "Java 0 day" vulnerability without clarifying they are speaking of Java on client computers which is presumably launched via the Java browser plugin. Here in this community (HN) full of application builders, we generally think of Java and the JVM as a server-side application platform. And we're surprised to hear that enterprises and institutions have Java desktop or browser applications deployed to real users. But it's true, and they generally cannot just disable the Java plugin as advised until they can abandon these old applications. I had to do work with a client once that used a VPN, I can't remember the vendor but it was recognizable at the time, that required the Java plugin to authenticate. Totally ridiculous but thankfully something I could quarantine to a VM. The irony of using something so reliably insecure as a prerequisite for a security system such as a VPN was delicious.