3 ms·
Yes, that's way I said "end-user". If you don't know what java is, this does not affect you.
by 1ris 11y ago
Yes, that's way I said "end-user". If you don't know what java is, this does not affect you.
- philbarr 11y agoI don't understand - there are end-users in those institutions using java applets. They have to use java applets because their institutions mandate their use for anything from bug tracking software (yes really, I've seen it with my own eyes) to expenses software.
- 1ris 11y agoBut almost all of these end-users have admins. People that activated java in the browser form them. And these can take care of the updates.
- philbarr 11y agoI'm still not sure what you're getting at here. It's a zero-day exploit. Updates won't help with that.
- 1ris 11y agoJava-applets in the internet are not used anymore as i explained. And if quite a few poeple use it in their intranets they don't care particular for a 0day. If their intranet is used to deploy these, everything is already lost. Even if the webbrowser that displays the intranet applets is used to surf the internet it's not a attac surface as you have to whitelist every site that's able to use applets.
- izacus 11y agoThe only way to file a (mandatory under penalty of huge fines) monthly tax report for a business here where I live is a web service that requires Java (or ActiveX) to do a digital signature for filed documents. There is currently no alternative (JavaScript APIs for that do not exist). Same goes for all other digital banking - requests have to be cryptographically signed and Java is pretty much the only widely portable way to do it. Is that "end-user" enough for you? All busness owners in the country and all other general population doing eGovernment?
- ackalker 11y agoThese governments and institutions should be called to task, PMs/ministers/MPs impeached if need be. Their negligence or refusal to act on this matter is a threat to national security. Literally.
- throwaway2048 11y agoPMs impeeched over java applets? get real.
- reinhardt 11y agoIf you live in Denmark, you are all but guaranteed to be an "end-user": https://en.wikipedia.org/wiki/NemID https://en.wikipedia.org/wiki/NemID
- kjetil 11y agoSince the Javascript NemID client was introduced last year, most users don't need Java anymore. That's for OTP though, users with tokens or keyfile have to use the OpenSign applet still. Haven't seen any stats, but OpenSign usage is probably pretty small compared to standard NemID/OTP.