11–20 of 80 posts
I dont understand all the fus around these exploits. Are they exploits? Yes. Do people actually use java in the web? Not really. Maybe im in the minority but i never see java applets, and i think i browse ~ the avg. Of course i also disable all plugins until i click on something.
what browser are you using and how are you disabling the plugins?
I have all mine ether set to not allow or only after click to play.
I dont understand all the fus around these exploits. Are they exploits? Yes. Do people actually use java in the web? Not really. Maybe im in the minority but i never see java applets, and i think i browse ~ the avg. Of course i also disable all plugins until i click on something.
I dont understand all the fus around these exploits. Are they exploits? Yes. Do people actually use java in the web? Not really. Maybe im in the minority but i never see java applets, and i think i browse ~ the avg. Of course i also disable all plugins until i click on something.
User googles for 'digital camera nokia review' and ends up on a site containing a specially crafted 1x1 pixel Java applet. User doesn't even know it's there but due to the 0-day exploit, the applet can now download a remote executable to the user's machine and execute it. User's computer is now part of a botnet and all the user did was perform an innocuous google search.
Update: I wrote up my recent experience of a shady advertising buy that appears to have spreading malware (likely via Java) as a goal http://news.ycombinator.com/item?id=5305092
Earlier quoted context omitted.
what browser are you using and how are you disabling the plugins?
Google Chrome, under Settings, Advance Settings, Content Settings. I have all mine ether set to not allow or only after click to play.
Earlier quoted context omitted.
Google Chrome, under Settings, Advance Settings, Content Settings. I have all mine ether set to not allow or only after click to play.
click to play is not a security feature and will not prevent malicious plugins from running.
Earlier quoted context omitted.
click to play is not a security feature and will not prevent malicious plugins from running.
Are you sure? As far as i understand it until you click on the plugin the plugin is not loaded at all.
the only way to have proper security is to disable the plugin. there is a button on the address bar that allows you to enable plugins on a page when they have been disabled. this gives you a similar experience to click2play but it is quite annoying especially if you are used to click2play.
I dont understand all the fus around these exploits. Are they exploits? Yes. Do people actually use java in the web? Not really. Maybe im in the minority but i never see java applets, and i think i browse ~ the avg. Of course i also disable all plugins until i click on something.
what browser are you using and how are you disabling the plugins?
Earlier quoted context omitted.
Are you sure? As far as i understand it until you click on the plugin the plugin is not loaded at all.
If you visit a malicious site and click anywhere on the page (not on a plugin) then you could enable a click 2 play plugin. i raised this as a chrome bug and they said click 2 play is not a security feature. there may be even worse bypasses :( the only way to have proper security is to disable the plugin. there is a button on the address bar that allows you to enable plugins on a page when they have been disabled. th…
That is really misleading! :\
Earlier quoted context omitted.
click to play is not a security feature and will not prevent malicious plugins from running.
Are you sure? As far as i understand it until you click on the plugin the plugin is not loaded at all.
Earlier quoted context omitted.
It makes no difference how prevalent they are in common web apps, the problem is that the Java plugin is still installed and active for a large number of users. This is not the attack sequence: * site has pre-existing Java * site gets compromised somehow * site now infects users This is how it usually plays out: * site gets compromised somehow * exploit includes a 0-day Java attack * site now infects users Literally…
Yes - also even a user who only wants to use client side Java outside of the browsers may be in trouble because of the automatically installed browser plugins that are part of the Java installation process. It's incredible how far and fast client side Java has fallen because of Oracle's tepid response to security concerns. I've developed many internal apps for client-side Java and supported them for over a decade. I…
This doesn't mean that Java for client-side applications is broken, as long as you don't rely on web based distribution and browser sandboxing.