In Firefox 24 and following, mark all versions of Java as unsafe

#1

Post by y0ghur7_xxx » Tue, Oct 22, 2013, 7:56 AM UTC

In Firefox 24 and following, mark all versions of Java as unsafe
bugzilla.mozilla.org

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#2

Post by Gonzih » Tue, Oct 22, 2013, 8:36 AM UTC

Great news, I'm always paranoid about java plugin. Now I can relax a little bit.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#3

Post by chris_wot » Tue, Oct 22, 2013, 8:36 AM UTC

I'm trying to find a summary of why this was done. This is a pretty high impact change!!!

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#4

Post by codeflo » Tue, Oct 22, 2013, 8:43 AM UTC

chris_wot wrote: post #3

I'm trying to find a summary of why this was done. This is a pretty high impact change!!!

Maybe Oracle's "only once per quarter" patch day policy has something to do with it.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#5

Post by tga_d » Tue, Oct 22, 2013, 8:44 AM UTC

chris_wot wrote: post #3

I'm trying to find a summary of why this was done. This is a pretty high impact change!!!

I hate to state the obvious, but... https://bugzilla.mozilla.org/show_bug.cgi?id=914690#c0 That seems like pretty straight-forward reasoning to me.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#6

Post by RyanZAG » Tue, Oct 22, 2013, 8:54 AM UTC

This will have a pretty bad effect on Firefox's market-share if it goes live.

That said, it's a solution for the current problem and should really be applied to all plugins - I'm not sure why java is singled out here, many of the other browser plugins are just as bad. Java has likely the most widely publicized security vulnerabilities, yet I can guarantee you that many many 0-days are traded daily for practically every single other browser plugin as well.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#7

Post by y0ghur7_xxx » Tue, Oct 22, 2013, 8:56 AM UTC

RyanZAG wrote: post #6

This will have a pretty bad effect on Firefox's market-share if it goes live. That said, it's a solution for the current problem and should really be applied to all plugins - I'm not sure why java is singled out here, many of the other browser plugins are just as bad. Java has likely the most widely publicized security vulnerabilities, yet I can guarantee you that many many 0-days are traded daily for practically eve…

> This will have a pretty bad effect on Firefox's market-share if it goes live.

It's already live. ff24 is the current stable.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#8

Post by NKCSS » Tue, Oct 22, 2013, 8:56 AM UTC

Very nice :) Maybe this will nudge Oracle a bit (we can always hope, but know it won't do anything...)

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#9

Post by dmpk2k » Tue, Oct 22, 2013, 8:58 AM UTC

RyanZAG wrote: post #6

This will have a pretty bad effect on Firefox's market-share if it goes live. That said, it's a solution for the current problem and should really be applied to all plugins - I'm not sure why java is singled out here, many of the other browser plugins are just as bad. Java has likely the most widely publicized security vulnerabilities, yet I can guarantee you that many many 0-days are traded daily for practically eve…

Will it? I've been browsing without Java for years, and I can only remember problems with one site (some hilarious throwback from the late 90s). For general browsing, I doubt anyone will notice a difference.

Maybe for corporate use, but isn't that mostly IE anyway?

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#10

Post by edwintorok » Tue, Oct 22, 2013, 8:59 AM UTC

Did they also disable Flash? (well I don't have the plugin installed anyway, so I wouldn't know)