Re:New Zero Day Java Vulnerability Being Exploited in the Wild
by nwh on Thursday January 10, 2013 @01:24PM
(#5038706)
I've literally never seen Java in the wild that's not part of an exploit kit. I've disabled Java in every browser / OS since about 2007, and I'm yet to be unconvinced by not having it.
Can you show me any examples of what I might be missing out on?
Re:New Zero Day Java Vulnerability Being Exploited in the Wild
by Chris_Newton on Thursday January 10, 2013 @01:47PM
(#5038880)
The applet I’m working on is rather specialised, so talking about that isn’t going to prove much. Others have pointed out some common examples from among the fields I mentioned, such as Minecraft, WebEx, and Danish government web sites. Each of these has a significant user base relying on Java applets.
Re:New Zero Day Java Vulnerability Being Exploited in the Wild
by SiVal on Friday January 11, 2013 @06:38AM
(#5042261)
Does Minecraft use applets or is it just a standalone desktop Java app? Does installing Minecraft create any vulnerability to this bug on a machine whose browsers have deactivated any Java plugin?
Re:New Zero Day Java Vulnerability Being Exploited in the Wild
by Aticus_Finch on Friday January 11, 2013 @07:15AM
(#5042352)
There are unrelated.
Besides downloading the Java app, you can play Minecraft in the browser through an applet at https://minecraft.net/play.
So no, if you are not running Java in the browser, a malicious web page can't run neither Minecraft nor other Java apps that you have locally installed.
Re:New Zero Day Java Vulnerability Being Exploited in the Wild
by bashinator on Thursday January 10, 2013 @04:37PM
(#5039929)
Just about every out-of-band management card (e.g. HP iLO, Dell iDRAC) for server-class computers, uses the Java plug-in to present a KVM (keyboard/video/mouse) console through a web browser.
Re:New Zero Day Java Vulnerability Being Exploited in the Wild
by mrgoldenbrown on Thursday January 10, 2013 @02:38PM
(#5039225)
You don't mention where you work, but I'm guessing it's not an "enterprisey" or "corporatey" kind of place. Count your blessings :)
Re:New Zero Day Java Vulnerability Being Exploited in the Wild
by nitrogen on Friday January 11, 2013 @01:30AM
(#5041635)
Things like this are pretty useful: http://hb9leb.no-ip.info/dspic/html/KaiserFilterDesign.html
Re:New Zero Day Java Vulnerability Being Exploited in the Wild
by Swannie on Thursday January 10, 2013 @05:34PM
(#5040203)
Currently using it daily for Citrix/Juniper "Java Secure Application Manager" for remote XenDesktop access into a customer.
Re:New Zero Day Java Vulnerability Being Exploited in the Wild
by asdf1011 on Thursday January 10, 2013 @09:15PM
(#5040991)
Online tax payments in Hong Kong uses a java applet.
Re:New Zero Day Java Vulnerability Being Exploited in the Wild
by philbarr on Friday January 11, 2013 @03:23AM
(#5041898)
Documentum from EMC uses Java as part of it's browser interface (webtop). It's used to download and manage documents on the user's machine.
Re:New Zero Day Java Vulnerability Being Exploited in the Wild
by Angostura on Friday January 11, 2013 @09:25AM
(#5042760)
You don't know anyone who plays Minecraft?
Re:New Zero Day Java Vulnerability Being Exploited in the Wild
by foohbarbaz on Thursday January 10, 2013 @01:41PM
(#5038839)
JVM is pretty much the only platform, unless you want to be Windows-only. This however has absolutely nothing to do with Java browser plugin. The sooner that thing dies the better. Just disable the "Java plugin" in the browser and forget about it.
The likes of Google and Mozilla might want us all to drop these tried and tested technologies and move to shiny new ones like HTML5 and the latest JS and CSS developments, but realistically, it takes time for users to move on. Most of us don’t have the luxury of controlling our customers’ platforms so we can ensure they run up-to-date builds of Firefox or Chrome with all the latest toys.
It takes time for developers to move on, too. I’m currently working on a project that uses a Java applet for a client. If I were starting the same project today, I’d probably chose different tools, but it wasn’t started today, and not so many years ago when the architectural decisions were being made, those new tools didn’t exist yet.
The main thing holding Java applets back today seems to be the second rate support they now get from the major browsers and/or Oracle, assuming they are supported at all. The number of blatant, show-stopping bugs in browser/Java interactions is getting silly, and code that has worked for years is breaking because someone installed a software “upgrade”. That’s a pity, IMHO, because the JVM is still a decent platform, and there are several interesting modern programming languages other than Java itself that we could be using to develop web apps otherwise.