(no subject)

[theweaselking]

If you're not running NoScript, you should be. And you should probably disable Java on web pages regardless for at least a few days.

(New vulnerability in the Java plugin allows a website to run arbitrary code, regardless of your browser and OS.)

Comments

[glaurung-quena.livejournal.com]

Or I could, you know, just not have Java installed at all.

[theweaselking.livejournal.com]

True. You could do that.

Most people have it, though, since lots of useful things require it.

[duskwuff.livejournal.com]

It's disabled by default on current versions of OS X (and I believe it'll actually re-disable itself if you don't use it for a while).

So far, I only think I've had to turn it back on once. It's less important than you might think.

[theweaselking.livejournal.com]

The Java plugin, very much not commonly useful outside business applications. Java, commonly useful. Installing Java installs the Java plugin unless you're careful.

[rbarclay.livejournal.com]

It's .. complicated, even on OS X. Safari should disable plugins that ain't used for a month, but sometimes it doesn't. Also other browsers on OS X might not be safe.

[duskwuff.livejournal.com]

This is separate from Safari. It's a global "kill switch" on the Java / Java Web Start plugin, in the Java Preferences app.

[rbarclay.livejournal.com]

Thanks. I'll beat our OS X guy with that info tomorrow.

[rbarclay.livejournal.com]

Don't confuse Jane Average Enduser with tech workers. The latter mostly have the Java plugin because kitchen&sink require it for all kinds of remote-control software. Real endusers tend to either not have the Java plugin at all (eg. they're on Win7) or some version of Ye Ancient Origin (like 1.4 through 1.6), which ain't vulnerable to this bug.

FF, with an update a week or two ago, disabled all versions <=1.6 per default (at least the stock version from Mozilla, the current Ubuntu one didn't).

[jerril]

I'm not even running 1.7.

Of course, my firefox is busted-ass and crashes every 5-30 minutes still (crashes so hard the crash report is busted) - even on a fresh installation with no plugins or extensions or addons or themes and a fresh profile. So go me :P

[pappy-legba.livejournal.com]

Strictly speaking, this horrible, glaring bug is limited to the Oracle version of the Java runtime. There are other runtimes that are not so retarded; I believe several Unix distros are bundled with less terrible runtimes.

The gradual erosion of MySQL, the Google lawsuit, the numerous corruptions of Java... I've lost count of the times I cursed Sun's acquisition. Sun was an excellent company and Oracle is a horrible one. It was llike watching Larry Ellison take a baby unicorn, slaughter it and devour it raw (which I'm sure he would do if he had the chance).