Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

In Firefox 24 and following, mark all versions of Java as unsafe

bugzilla.mozilla.org

Post reply on HN
Print view View original

111–120 of 184 posts

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#111

Post by gfritzsche »

josteink wrote: post #106
adamtulinius wrote: post #99

Earlier quoted context omitted.

I just want to confirm 'gfritzsche' in you being wrong, and ranting about a lot of stuff that is just wrong . You should delete your comment.

I went through this routine yesterday. Updated Java and restarted Firefox. I can 100% vouch for seeing a warning about Java being outdated. The warning was still there. I stand by it and I wont delete or edit my comment. As a dedicated Firefox-user who dislikes the direction Chrome is taking, I still say Firefox has a problem here. This is something real users are experiencing. I believe this as a whole will have a v…

If you do see that, please file a bug with details on the steps to trigger this: https://bugzilla.mozilla.org/enter_bug.cgi?product=Core&comp...

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#112

Post by dingaling »

InclinedPlane wrote: post #15
RyanZAG wrote: post #6

This will have a pretty bad effect on Firefox's market-share if it goes live. That said, it's a solution for the current problem and should really be applied to all plugins - I'm not sure why java is singled out here, many of the other browser plugins are just as bad. Java has likely the most widely publicized security vulnerabilities, yet I can guarantee you that many many 0-days are traded daily for practically eve…

Why? Java applets are extremely rare these days.

> Java applets are extremely rare these days.

Yes, but unfortunately when they do occur they tend to be rather important; Eurocontrol's air-traffic flow management site, for example. If you need to file or change a flight-plan...

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#113

Post by Yoric »

jtheory wrote: post #105

Does anyone want to write a user-friendly walk-through to help normal users get Java running? I may have the time to assist, though I'm doubtful I could do the whole thing. ScreenLeap has a good start: http://www.screenleap.com/troubleshooting-java The advice they give varies based on the detected browser and OS (as it must) but it's somewhat out of date, and isn't intended for a general audience. The applets on my e…

Could you consider contributing this to http://support.mozilla.org ?

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#114

Post by marvin »

This will be more great publicity for Norwegian government-owned consultancy Evry, which has built the BankID Java Applet which is used for authentication of each and every online consumer money transaction performed in the country.

However, it is about time - I've heard online banking developers talk crap both about BankID and the underlying online banking infrastructure in the country, and security holes due to Java exploits are rampant. The banks have paid the bill for this until now, but it causes massive inconvenience for...every Norwegian who uses an online banking service. (Every adult Norwegian, more or less).

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#115

Post by Silhouette »

nknighthb wrote: post #104
Silhouette wrote: post #103

Earlier quoted context omitted.

Please take your obvious trolling somewhere else. Not all software that runs in web browsers was written in the last year or two, after HTML5 and CSS3 and all the related new technologies became viable options for doing heavily interactive graphics on web sites. For many years before that, tools like Flash and Java applets were the only games in town, and a lot of production software with many years of development be…

> your obvious trolling You're not helping your case at all. Accept responsibility for supporting your customers, and stop lashing out at others for not doing it for you.

We are supporting our users. The point is that in this case we shouldn't have to. The problem is an entirely artificial one of Mozilla's creation, and no support from anyone should ever have been necessary.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#116

Post by Yoric »

edwintorok wrote: post #10

Did they also disable Flash? (well I don't have the plugin installed anyway, so I wouldn't know)

A few years ago, Flash used to be a security nightmare and Java was shiny and solid. These days, it's pretty much the opposite. Flash security holes are fixed very quickly, Java security holes, slowly-to-never.

So, for the moment, we have not taken the decision to disable Flash.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#117

Post by tmilard »

I reported this big issue forme in the developper forum. al java version, even recent ones, ALL are considered, (not like flash...) as a "permanent unsecure virus" by Firefox.

- How can the Mozilla team can think they can get away with this ? This behavior is all but neutral from firefox ?

- So I have to drop my software that I programmed in 7 years ? Benjamin Smedberg (the guy at mozilla who made this shit) is an extremist. I went 4 days ago in the developper forum to discuss about this :

--------------------------------- Me: "A red no entry sign" is too radical for recent java player I think. My users give me a phone call to tell me "No way I will accept to install your software with this red warning"... Even the people who know me, tell me they got so scared they have really hesitated to accept java. Now I do understand at a time when java had urgent security issue this scary red-message was necessary. But I really wish that Firefox checks the java version installed ... and give a less-scary-warning-sign or a "go !" if the user has a recent java version (like the latest on java 1.7 update 30).

Benjamin Smedberg: "We fundamentally disagree about the risks of the Java plugin. We believe the Java plugin is unsafe, and we want to present that to our users".

-- Is there a boss at Mozilla ? someone who cares about developpers. And yea Benjamin, you know, java is open source by the way. Fuck you idiot ! Thierry

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#118

Post by marvin »

josteink wrote: post #31
integricho wrote: post #24

Earlier quoted context omitted.

and they should definitely stop doing that. for me seeing Java on the client side is a sign of bad development.

Seeing browser-developers ignore the real world and just go ahead with their agendas unconcerned about how it affects the actual users of their browser is also a sign of bad development.

You have to stop and think for a moment, though - it's kind of cool that the Firefox development team can basically say "Norwegian authorities - you need to ditch your $100 million outdated software solution because it is unsafe, and we are going to announce this to all your users".

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#119

Post by bdamm »

nknighthb wrote: post #102
johnchristopher wrote: post #100

Earlier quoted context omitted.

He wouldn't have ended up on treacherous paths if that warning had been more explicit about what was going on. I agree he's not computer savy but I am not blaming Mozilla for his installing malware. I am blaming Mozilla for a confusing message about security. See https://news.ycombinator.com/item?id=6590686

There are thousands of "confusing" messages to be found on a typical computer. The messages Firefox presents for Java[1][2][3] aren't even competitive. You have a user who has not been trained to not install random software, is fooled by extremely common ads, and who does not have the basic judgement necessary to not flail about when presented with something they don't understand but to consult someone who will under…

While I agree with your opening sentiment, and I agree regarding OP's dad not having the appropriate training and judgement, I disagree with the conclusion that he should be the resolution to that problem.

The appropriate training is nothing less than years of experience working with computers or being in the IT business. Why do we believe that this ought to be standard knowledge for users? It seems to me that we're placing too much burden on the user to make good judgements in the face of insufficient application and operating system trustworthiness.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#120

Post by tmilard »

I have reported this big issue forme in the developper forum last week. All java version, even recent ones, ALL are considered, (not like flash...) as a "permanent unsecure virus" by Firefox.

- How can the Mozilla team can think they can get away with this ? This behavior is all but neutral from firefox!

- So I have to drop my software that I programmed in 7 years ? I went 4 days ago in the developper forum to discuss about this :

--------------------------------- Me: "A red no entry sign" is too radical for recent java player I think. My users give me a phone call to tell me "No way I will accept to install your software with this red warning"... Even the people who know me, tell me they got so scared they have really hesitated to accept java. Now I do understand at a time when java had urgent security issue this scary red-message was necessary. But I really wish that Firefox checks the java version installed ... and give a less-scary-warning-sign or a "go !" if the user has a recent java version (like the latest on java 1.7 update 30).

Benjamin Smedberg (chef of this idiot change): "We fundamentally disagree about the risks of the Java plugin. We believe the Java plugin is unsafe, and we want to present that to our users".

-- Is there a boss at Mozilla ? someone who cares about developpers. And yea Benjamin, you know, java is open source by the way. Fuck you idiot ! Thierry

Post reply on HN