Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

In Firefox 24 and following, mark all versions of Java as unsafe

bugzilla.mozilla.org

Post reply on HN
Print view View original

101–110 of 184 posts

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#101

Post by jtheory »

kristofferR wrote: post #69
Silhouette wrote: post #65

Earlier quoted context omitted.

You can still easily run Java applets in Firefox 24 and beyond, you just need to click the red lego block in the upper left corner and allow it. I've had multiple calls in the past week from Java users who didn't know that and just thought the page in question had stopped working. Your idea of "easily" and theirs are very different. It's much less strict than in Chrome, where Java doesn't run at all anymore. I've spe…

Yeah, it's true that lot of the sites still using Java hasn't been updated with the correct instructions about how to enable it in FF 24 yet - and they should fix that as soon as possible of course. Still, it's a much easier thing for normal users to figure out than how to update Java (which they must do quite regularly to get Java to run at all). I did a little Googling and it turns out that Java still runs in Chrom…

From what I've read, Java isn't banned from Chrome on OS X, but it doesn't work because OS X Java 7 is 64-bit only and Chrome is 32-bit only.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#102

Post by nknighthb »

johnchristopher wrote: post #100
nknighthb wrote: post #89

Earlier quoted context omitted.

This is clearly a person who would have wound up with malware regardless. It's as if you blamed telephones for allowing a scammer to call a gullible mark from the Official Credit Card Office.

He wouldn't have ended up on treacherous paths if that warning had been more explicit about what was going on. I agree he's not computer savy but I am not blaming Mozilla for his installing malware. I am blaming Mozilla for a confusing message about security. See https://news.ycombinator.com/item?id=6590686

There are thousands of "confusing" messages to be found on a typical computer. The messages Firefox presents for Java[1][2][3] aren't even competitive.

You have a user who has not been trained to not install random software, is fooled by extremely common ads, and who does not have the basic judgement necessary to not flail about when presented with something they don't understand but to consult someone who will understand.

This is a recipe for the exact scenario you described, but is in no way dependent on Firefox's Java messages. Any message appearing on their screen that they don't understand can be the trigger, including scammy ads encountered by millions of people in routine daily browsing.

[1] https://dl.dropboxusercontent.com/u/1643240/outdated_java.pn...

[2] http://imgur.com/k94vEvB

[3] 1 & 2 taken from this thread: https://news.ycombinator.com/item?id=6590877

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#103

Post by Silhouette »

nknighthb wrote: post #98
Silhouette wrote: post #74

Earlier quoted context omitted.

They are actually users, and those users paid a very large amount of money for very expensive equipment that happens to use Java applets as part of its remote management interface.

Did any of that money go to Mozilla or any other organization seeking to advance and secure the internet for the vast majority of people who did not waste money on overpriced products from a company that doesn't want to take responsibility for its poor judgement and inflexibility?

Please take your obvious trolling somewhere else. Not all software that runs in web browsers was written in the last year or two, after HTML5 and CSS3 and all the related new technologies became viable options for doing heavily interactive graphics on web sites. For many years before that, tools like Flash and Java applets were the only games in town, and a lot of production software with many years of development behind it that is still widely useful was built using those tools.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#104

Post by nknighthb »

Silhouette wrote: post #103
nknighthb wrote: post #98

Earlier quoted context omitted.

Did any of that money go to Mozilla or any other organization seeking to advance and secure the internet for the vast majority of people who did not waste money on overpriced products from a company that doesn't want to take responsibility for its poor judgement and inflexibility?

Please take your obvious trolling somewhere else. Not all software that runs in web browsers was written in the last year or two, after HTML5 and CSS3 and all the related new technologies became viable options for doing heavily interactive graphics on web sites. For many years before that, tools like Flash and Java applets were the only games in town, and a lot of production software with many years of development be…

> your obvious trolling

You're not helping your case at all.

Accept responsibility for supporting your customers, and stop lashing out at others for not doing it for you.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#105

Post by jtheory »

Does anyone want to write a user-friendly walk-through to help normal users get Java running? I may have the time to assist, though I'm doubtful I could do the whole thing.

ScreenLeap has a good start: http://www.screenleap.com/troubleshooting-java

The advice they give varies based on the detected browser and OS (as it must) but it's somewhat out of date, and isn't intended for a general audience.

The applets on my educational site are signed JARs (a wasted expense, it seems), and they are explicitly run within the sandbox, but every few months it gets harder and harder for students and their parents to get Java to run.

And now in Firefox my interactive components have just become scary-looking blocks of DO-NOT-ENTER signs and warnings that are totally unwarranted for my site. If you work up the courage to click through the browser's warnings, then of course you get round 2, the warnings that the plugin itself pops up.

I dearly wish to see some of the details on the evil that's being done with Java applets, and if all of these aggressive measures are actually doing anything to stop real risks, or if the main effect is to kill sites like mine.

These do not seem to be actions based on data anymore.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#106

Post by josteink »

adamtulinius wrote: post #99
josteink wrote: post #96

Earlier quoted context omitted.

> In both, with my existing old build of Java, I got a placeholder image like this: > https://dl.dropboxusercontent.com/u/1643240/outdated_java.pn... The problem is that this dialog box is outright lying . It will show that placeholder even with the latest version of Java installed. Firefox is open source software. Open source software should be trustworthy. Software which lies to you is by definition not. As things…

I just want to confirm 'gfritzsche' in you being wrong, and ranting about a lot of stuff that is just wrong . You should delete your comment.

I went through this routine yesterday. Updated Java and restarted Firefox. I can 100% vouch for seeing a warning about Java being outdated. The warning was still there. I stand by it and I wont delete or edit my comment.

As a dedicated Firefox-user who dislikes the direction Chrome is taking, I still say Firefox has a problem here. This is something real users are experiencing.

I believe this as a whole will have a very negative impact on Firefox's perception in the java-heavier regions of the internet.

And damage done is hard to repair. Mozilla should think carefully and very quickly about what they just have done.

Edit: My bank's facebook page is already filling up with customers saying they can't log in. When the bank's reply is "Dont use Firefox. Firefox is broken" and the customer indeed can log in with other browsers, what chance do you think there is for the user going back to Firefox?

Mozilla needs to get 24.1 java-enabled-edition out there now, until it gets its UI/UX story straight.

Edit 2: Down-vote as you like. If you don't think this will affect Firefox's perception, you are a tad more optimistic than I am.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#108

Post by Silhouette »

iand wrote: post #92
Silhouette wrote: post #68

Earlier quoted context omitted.

This action by Mozilla raises awareness of the fact that Java security updates are too slow and too opaque and it's time to change to something else. It also raises awareness of the fact that you can't trust some of the big names in the browser industry not to break stuff every few weeks just because they don't like it and then push the changes on you whether you want them or not. Introducing restrictions so tight th…

If you need control over the version and features of the browser your employees use then disable automatic updating and use a management tool instead.

That's a nice theory, but Mozilla's idea of "long term" support is still forcing an upgrade more than once a year just to maintain security patches, and with only a 12-week overlap between a new version starting testing and the complete end of support for the previous version.

That sounds like a long time if you're reading this in Firefox on your home PC, but if you're responsible for a large corporate network with thousands of users and a hundred critical intranet applications to keep working, many of which have a measurable dollar amount attached for every hour of downtime, different rules apply.

There is a reason so many large organisations stuck with IE6 for so long: having tried and tested, stable software is far more valuable in that kind of environment than having the latest shiny features that none of the in-house applications you're actually providing the computers/browsers to use need anyway.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#109

Post by adamtulinius »

josteink wrote: post #106
adamtulinius wrote: post #99

Earlier quoted context omitted.

I just want to confirm 'gfritzsche' in you being wrong, and ranting about a lot of stuff that is just wrong . You should delete your comment.

I went through this routine yesterday. Updated Java and restarted Firefox. I can 100% vouch for seeing a warning about Java being outdated. The warning was still there. I stand by it and I wont delete or edit my comment. As a dedicated Firefox-user who dislikes the direction Chrome is taking, I still say Firefox has a problem here. This is something real users are experiencing. I believe this as a whole will have a v…

Weird. It appears to be working as claimed in my Firefox build from yesterday (26.0a2 (2013-10-21)). Most likely a bug then, and should be treated as such, instead of assuming Mozilla is lying about updates being available, or not.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#110

Post by Yoric »

johnchristopher wrote: post #77
kristofferR wrote: post #58

A lot of the commenters here seem to misunderstand this change. You can still easily run Java applets in Firefox 24 and beyond, you just need to click the red lego block in the upper left corner and allow it. [1] It's much less strict than in Chrome (on OS X), where Java doesn't run at all anymore. [1] https://support.mozilla.org/en-US/kb/how-to-enable-java-if-i...

> You can still easily run Java applets in Firefox 24 and beyond, you just need to click the red lego block in the upper left corner and allow it. [1] Allow me to disagree and to tell you what happened last weekend: Last Sunday I had a call from my stepfather who "couldn't run the website to order agro food" anymore. This website runs a Java applet to manage agro food orders on-line and the code isn't signed (it's a…

Interesting point. How would you rephrase the warning?
Post reply on HN