Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

In Firefox 24 and following, mark all versions of Java as unsafe

bugzilla.mozilla.org

Post reply on HN
Print view View original

151–160 of 184 posts

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#151

Post by jasonlotito »

johnchristopher wrote: post #77
kristofferR wrote: post #58

A lot of the commenters here seem to misunderstand this change. You can still easily run Java applets in Firefox 24 and beyond, you just need to click the red lego block in the upper left corner and allow it. [1] It's much less strict than in Chrome (on OS X), where Java doesn't run at all anymore. [1] https://support.mozilla.org/en-US/kb/how-to-enable-java-if-i...

> You can still easily run Java applets in Firefox 24 and beyond, you just need to click the red lego block in the upper left corner and allow it. [1] Allow me to disagree and to tell you what happened last weekend: Last Sunday I had a call from my stepfather who "couldn't run the website to order agro food" anymore. This website runs a Java applet to manage agro food orders on-line and the code isn't signed (it's a…

You should update your comment to reflect the reality learned here:

https://news.ycombinator.com/item?id=6591531

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#152

Post by camus2 »

Silhouette wrote: post #131
nknighthb wrote: post #123

Earlier quoted context omitted.

The problem is entirely of Oracle's and your own creation. Oracle is not adequately supporting their software, and you have failed to notice the signs over the past several years that browsers were headed in exactly this direction and adapt accordingly. Mozilla is taking the only responsible course to protect the vast majority of their users. It's been a long time coming, and absolutely no one should be surprised tha…

Adapt or die. An unfortunate comment, because some of the devices I had in mind when writing those last few posts are in fact medical equipment. If Java-based UIs are no longer readily available to clinical staff the way they were last week, then effectively their instruments just got broken. Delays and increased suffering for patients are all but certain consequences until the IT staff have chance to fix things agai…

> Delays and increased suffering for patients are all but certain consequences

If the product you are building is not future proof it is your problem not Mozilla's.

Dont blame Mozilla for your poor technology choices. Applets will eventually stop working, and you'll be responsible if your product fails , not Mozilla.

Dont blame anybody else but you. You broke the medical staff instruments by choosing or maintaining a dead technology thus putting patient lives in danger. Do you think they'll sue you ? or Mozilla if there is an accident? You are responsible.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#153

Post by Yoric »

johnchristopher wrote: post #149
Yoric wrote: post #110

Earlier quoted context omitted.

Interesting point. How would you rephrase the warning?

I had a look at the mozilla website and the english phrasing seems okay to me. I think the french is too verbose (and it adds nuances that are confusing like "some versions of the plugin is disabled", "trusted sites": does it mean sites that are guaranteed to be trusted because of a certificate or sthg or sites I trust because I know who coded it or it's so universally known (eg: google) that I should trust it anyway…

As someone point out, this is not a Firefox warning. This is a Java warning installed by Oracle. Please complain with them :)

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#154

Post by Groxx »

sigzero wrote: post #137
kristofferR wrote: post #79

Earlier quoted context omitted.

Java actually installs malware (the Ask toolbar) unless you are careful enough to deselect it during the installation/update process.

Uh no. That is not "malware". Unwanted software yes but not malware.

The difference? Be sure to point out why tricking you into installing it isn't malicious, why it's not malicious that after that it changes your default search provider to send your searches to them (privacy much?), and why it's not malicious that it's abnormally hard to remove (a quick Google will demonstrate the normal 'remove toolbar' steps don't work, even Wikipedia has a note and several links on this: https://en.wikipedia.org/wiki/Ask.com ).

It tricks people to installing it, reports your search activity (maybe other data? I can't find details, not installing it myself), and takes major, unnecessary steps to make it hard to uninstall it. Sounds like malware to me.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#155

Post by johnchristopher »

johnchristopher wrote: post #77
kristofferR wrote: post #58

A lot of the commenters here seem to misunderstand this change. You can still easily run Java applets in Firefox 24 and beyond, you just need to click the red lego block in the upper left corner and allow it. [1] It's much less strict than in Chrome (on OS X), where Java doesn't run at all anymore. [1] https://support.mozilla.org/en-US/kb/how-to-enable-java-if-i...

> You can still easily run Java applets in Firefox 24 and beyond, you just need to click the red lego block in the upper left corner and allow it. [1] Allow me to disagree and to tell you what happened last weekend: Last Sunday I had a call from my stepfather who "couldn't run the website to order agro food" anymore. This website runs a Java applet to manage agro food orders on-line and the code isn't signed (it's a…

I can't edit my message anymore so I reply here.

After reviewing the facts by discussing them with nknighthb it appears the warning message that prompted me to blame Mozilla for a confusing warning message was due to Oracle and their Java warning pop-up. https://dl.dropboxusercontent.com/u/202857/java.png

My apologies :], I am a little bit ashamed for not spotting it sooner.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#157

Post by Yoric »

josteink wrote: post #93
Spittie wrote: post #50

Earlier quoted context omitted.

There should be a "plugin" icon in the address bar, showing you that java has been blocked (see https://news.ycombinator.com/item?id=6590650 ) Pressing on that icon should allow you to run java once, or allow if forever for that site. If the icon doesn't appear, I think you should file a bug on bugzilla.

You know those big, yellow bars that browser and websites tends to come up with when they want to be 100% certain that the user notices something is up? I've yet to see a single non-technical user even notice or react to its presence once . I see it instantly and can't understand why it doesn't alert or annoy them, but to them, it's just not there. In light of that sort of behaviour, adding a subtle icon to the locat…

So, with any luck, either the web developers will fix their websites or, one can dream, Oracle will actually start to pay attention to security :)

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#158

Post by nknighthb »

Silhouette wrote: post #142
pyre wrote: post #136

Earlier quoted context omitted.

> If Java-based UIs are no longer readily available to clinical staff the way they were last week, then effectively their instruments just got broken. Would that be a failure of Firefox (or other browser vendors) or a failure of hospital IT staff to manage the medical devices / desktops / network effectively?

That's a fair question. However, I don't think some people posting in this discussion would like the equally fair answer. Logically, if Firefox is not going to support long term stability and compatibility -- and clearly it doesn't in the case we're discussing -- then the only possible conclusion is that Firefox can't be part of an effectively managed IT infrastructure for these kinds of organisations. That means the…

Yes, Mozilla has been pretty clear on this. If you want more stability, you need the ESR release, and if that's not enough, you're out of luck. Mainline Firefox is simply not intended for use within organizations that demand the kind of stability you want.

You need to evaluate the ESR release, and/or find a different browser entirely. IE may indeed be the best option if you only support Windows clients. Though Microsoft hasn't exactly been shy about forcing IE along more quickly of late, either.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#159

Post by johnchristopher »

nknighthb wrote: post #147
johnchristopher wrote: post #146

Earlier quoted context omitted.

Somehow I have the feeling we aren't talking about the same warning. It's french but I doubt the translation process would made the word count explode from 14 words to this: https://dl.dropboxusercontent.com/u/202857/java.png (and yes, it popped up on an up-to-date firefox with up-to-date java)

Congratulations, you've just lambasted Mozilla for a Java message. Java pops up that same message for applets in all browsers. Go talk to Oracle, it has absolutely nothing to do with Mozilla or Firefox.

Ah, I wouldn't go as far as "lambasted" but it is indeed not Mozilla's wrongdoing in any way.

Maybe I got caught by the fact I had never seen that pop-up before and Firefox just seemed to have been updated the day before.

While we are on the topic: that makes a lot of clicking to get an applet running for the first time.

Re: In Firefox 24 and following, mark all versions of Java as unsafe

#160

Post by johnchristopher »

Yoric wrote: post #153
johnchristopher wrote: post #149

Earlier quoted context omitted.

I had a look at the mozilla website and the english phrasing seems okay to me. I think the french is too verbose (and it adds nuances that are confusing like "some versions of the plugin is disabled", "trusted sites": does it mean sites that are guaranteed to be trusted because of a certificate or sthg or sites I trust because I know who coded it or it's so universally known (eg: google) that I should trust it anyway…

As someone point out, this is not a Firefox warning. This is a Java warning installed by Oracle. Please complain with them :)

Yes, sorry about that :).
Post reply on HN