Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

In Firefox 24 and following, mark all versions of Java as unsafe

bugzilla.mozilla.org

Post reply on HN
Print view View original

71–80 of 184 posts

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#71

Post by eterm »

calibwam wrote: post #35
DZittersteyn wrote: post #29

Wow, this is really irresponsible behavior, I would've expected something better from Mozilla.. Until now they've first offered an alternative (e.g. pdf.js) before trying to move away from a tech. Marking a current version as unsafe, even when there are no known exploits is simply ridiculous. I'd love to see the reaction of Mozilla if Microsoft decided to mark all Firefox releases as unsafe, and give a big security w…

Well, when you download the .exe file in IE, you do get a warning that it might be unsafe from Windows. And you need to verify that you want to install it. The way to verify that the installer is legit, verifying the checksum, is not done by Windows, and must be done manually. Users don't do that, and flagging everything as unsafe is a good way of notifying the user that they must be careful.

No, it's a good way to ensure that users click OK without reading message boxes ever.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#72

Post by GyrosOfWar »

_random_ wrote: post #66

Why stop on the Java? Mark all Java* languages as unsafe.

What do you even mean with that? Marking all JVM languages as unsafe? Marking JavaScript as unsafe (because it has so much to do with Java, right?) The issues Mozilla has with Java are limited to browser applets and the lack of security updates from Oracle (which, coincidentally, mainly affect the browser applets)

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#73

Post by Silhouette »

ivan_gammel wrote: post #53
puzzlingcaptcha wrote: post #21

Earlier quoted context omitted.

Still, many users [ http://geeksbynature.dk/2013/03/28/plugins-usage-distributio... ] have only Flash, Java and Windows Media plugins installed, maybe also Reader and Office. With Mozilla's efforts to replace Reader with pdf.js and Flash with Shumway (or HTML5), Java is a reasonable next target.

Their PDF replacement is far from good - buggy and unusable. We have to show PDF documents to our customers directly in browser, so we need good UX, and it was disappointing to see how it works in FF compared to other browsers with Reader and how much effort do we need to fix it. I'm not surprised they screwed up with Java too.

It's disappointing that comments like the parent are getting downvoted here. Objective, factual observations should be encouraged, not censored.

The Reader "replacement" PDF viewer in Firefox is limited and buggy compared to the real thing. We also found it literally unusable for our purposes when it launched, and we routinely disable it on new installations where we still use Firefox at all (which is basically only test machines for web developers now anyway, because of exactly the recent attitude from Mozilla illustrated by this discussion).

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#74

Post by Silhouette »

belorn wrote: post #70
Silhouette wrote: post #65

Earlier quoted context omitted.

You can still easily run Java applets in Firefox 24 and beyond, you just need to click the red lego block in the upper left corner and allow it. I've had multiple calls in the past week from Java users who didn't know that and just thought the page in question had stopped working. Your idea of "easily" and theirs are very different. It's much less strict than in Chrome, where Java doesn't run at all anymore. I've spe…

Are those actually users, or developers/testers who run test suits on their products and noticed a change?

They are actually users, and those users paid a very large amount of money for very expensive equipment that happens to use Java applets as part of its remote management interface.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#75

Post by lambda »

kristofferR wrote: post #69
Silhouette wrote: post #65

Earlier quoted context omitted.

You can still easily run Java applets in Firefox 24 and beyond, you just need to click the red lego block in the upper left corner and allow it. I've had multiple calls in the past week from Java users who didn't know that and just thought the page in question had stopped working. Your idea of "easily" and theirs are very different. It's much less strict than in Chrome, where Java doesn't run at all anymore. I've spe…

Yeah, it's true that lot of the sites still using Java hasn't been updated with the correct instructions about how to enable it in FF 24 yet - and they should fix that as soon as possible of course. Still, it's a much easier thing for normal users to figure out than how to update Java (which they must do quite regularly to get Java to run at all). I did a little Googling and it turns out that Java still runs in Chrom…

Yep, banned on OS X, kind of frustrating since I need to use Java for work occasionally, and when I click on the link and it redirects after opening in Chrome I need to go back, copy and paste the link into Firefox.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#76

Post by Silhouette »

kristofferR wrote: post #69
Silhouette wrote: post #65

Earlier quoted context omitted.

You can still easily run Java applets in Firefox 24 and beyond, you just need to click the red lego block in the upper left corner and allow it. I've had multiple calls in the past week from Java users who didn't know that and just thought the page in question had stopped working. Your idea of "easily" and theirs are very different. It's much less strict than in Chrome, where Java doesn't run at all anymore. I've spe…

Yeah, it's true that lot of the sites still using Java hasn't been updated with the correct instructions about how to enable it in FF 24 yet - and they should fix that as soon as possible of course. Still, it's a much easier thing for normal users to figure out than how to update Java (which they must do quite regularly to get Java to run at all). I did a little Googling and it turns out that Java still runs in Chrom…

Yeah, it's true that lot of the sites still using Java hasn't been updated with the correct instructions about how to enable it in FF 24 yet - and they should fix that as soon as possible of course.

Unfortunately, the applets I work on at the moment run on embedded web servers in network-enabled devices. You can't just roll out a quick update to this software every time Mozilla or Oracle break things.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#77

Post by johnchristopher »

kristofferR wrote: post #58

A lot of the commenters here seem to misunderstand this change. You can still easily run Java applets in Firefox 24 and beyond, you just need to click the red lego block in the upper left corner and allow it. [1] It's much less strict than in Chrome (on OS X), where Java doesn't run at all anymore. [1] https://support.mozilla.org/en-US/kb/how-to-enable-java-if-i...

> You can still easily run Java applets in Firefox 24 and beyond, you just need to click the red lego block in the upper left corner and allow it. [1]

Allow me to disagree and to tell you what happened last weekend:

Last Sunday I had a call from my stepfather who "couldn't run the website to order agro food" anymore. This website runs a Java applet to manage agro food orders on-line and the code isn't signed (it's a small structure).

He tried to understand what was going on with the warning before clicking "ok/yes/run". He googled the warning and unfortunately ended up installing malwares from ads running on some PC help website/forums that promised to fix "2 just found vulnerabilities": he thought that was related since the warning actually preventing him from accessing his "working-fine-yesterday" website seemed to be about security and vulnerabilities in the plug-in.

He then tried to update Java but canceled it at the end of the process because the window with the Java propaganda ("it powers 3 billions of applications, your car, your website, etc.") looked too much like the one with malwares from before and those didn't fix the problem (not being able to access his website).

When I finally could go to his house to fix it I realized what had happened.

It is definitely not user-friendly. It was working before and in his eyes Mozilla made it not working anymore.

edit: typo and grammar

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#78

Post by Sanddancer »

hrjet wrote: post #64
Yoric wrote: post #56

Earlier quoted context omitted.

The real world would be nicer if Oracle actually worked on fixing Java security issues. They have a bad history of pretending that security holes have been fixed and/or pretending that they do not exist, while exploits run rampant.

Most of Java is open-source now. I wonder why the dependence on Oracle is so high. If Apache or a similar foundation would fork(+) and adopt it, it will benefit the Java eco-system tremendously. + Fork if legally required.

Apache did try to fork it with Harmony ( http://harmony.apache.org/ ), but Sun pulled every trick in the book to keep people from contributing and/or adopting it. Then again, the code is still extant, could be time to pull it out of the attic.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#79

Post by kristofferR »

johnchristopher wrote: post #77
kristofferR wrote: post #58

A lot of the commenters here seem to misunderstand this change. You can still easily run Java applets in Firefox 24 and beyond, you just need to click the red lego block in the upper left corner and allow it. [1] It's much less strict than in Chrome (on OS X), where Java doesn't run at all anymore. [1] https://support.mozilla.org/en-US/kb/how-to-enable-java-if-i...

> You can still easily run Java applets in Firefox 24 and beyond, you just need to click the red lego block in the upper left corner and allow it. [1] Allow me to disagree and to tell you what happened last weekend: Last Sunday I had a call from my stepfather who "couldn't run the website to order agro food" anymore. This website runs a Java applet to manage agro food orders on-line and the code isn't signed (it's a…

Java actually installs malware (the Ask toolbar) unless you are careful enough to deselect it during the installation/update process.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#80

Post by z92 »

johnchristopher wrote: post #77
kristofferR wrote: post #58

A lot of the commenters here seem to misunderstand this change. You can still easily run Java applets in Firefox 24 and beyond, you just need to click the red lego block in the upper left corner and allow it. [1] It's much less strict than in Chrome (on OS X), where Java doesn't run at all anymore. [1] https://support.mozilla.org/en-US/kb/how-to-enable-java-if-i...

> You can still easily run Java applets in Firefox 24 and beyond, you just need to click the red lego block in the upper left corner and allow it. [1] Allow me to disagree and to tell you what happened last weekend: Last Sunday I had a call from my stepfather who "couldn't run the website to order agro food" anymore. This website runs a Java applet to manage agro food orders on-line and the code isn't signed (it's a…

This one needs a separate post. Please make a blog entry and post it here and on reddit.
Post reply on HN