In Firefox 24 and following, mark all versions of Java as unsafe

Re: In Firefox 24 and following, mark all versions of Java a... by kevingadd on Tuesday October 22, 2013 @06:44AM (#6590877)

A lot of the angry comments about this seem to be coming from uninformed people who haven't actually tried it - that or something about this change isn't actually rolled out. I just tried it in an up-to-date version of Firefox 24, along with Firefox Nightly.

In both, with my existing old build of Java, I got a placeholder image like this:

https://dl.dropboxusercontent.com/u/1643240/outdated_java.pn...

Clicking it took me to the update page. Exactly what you want. There was an option in the top-left corner to forcibly load it, which is fine - updating is the right move.

Once I updated and uninstalled the old JRE, in Firefox 24 the applet I was trying loaded silently without any confirmation. It was not blacklisted.

In Firefox Nightly, once Java is updated, I see this placeholder where the applet would have been:

https://dl.dropboxusercontent.com/u/1643240/activate_java.pn...

Clicking the placeholder opens a prompt asking if I want to allow the plugin once or allow it always on this site. Very straightforward.

Other than the fact that modern Java 7 is not blocked by default in Firefox 24 for me (maybe they didn't roll that out yet?), everything works fine here, and I don't see any catastrophic UI mistakes, developer/enterprise-hostile design, or attempts at destroying the web.

[ Parent | on HN ]

Re: In Firefox 24 and following, mark all versions of Java a... by gfritzsche on Tuesday October 22, 2013 @06:56AM (#6590926)

The applet loading without user action after the Java update sounds like you had already allowed it for that site before (or maybe you haven't got the blocklist update yet for some reason?).

What you are seeing on Firefox 26+ is all plugins except Flash becoming click-to-play by default: https://blog.mozilla.org/futurereleases/2013/09/24/plugin-ac...

[ Parent | on HN ]

Re: In Firefox 24 and following, mark all versions of Java a... by Fuxy on Tuesday October 22, 2013 @08:33AM (#6591371)

Allowing java to run is not very intuitive. I predict a lot of people believing It can't be run getting frustrated and using a different browser.

I know it's to protect the users from themselves but if you're going to warn on all versions make it easier to allow the applet to run.

[ Parent | on HN ]

Re: In Firefox 24 and following, mark all versions of Java a... by josteink on Tuesday October 22, 2013 @06:59AM (#6590937)

> In both, with my existing old build of Java, I got a placeholder image like this:

> https://dl.dropboxusercontent.com/u/1643240/outdated_java.pn...

The problem is that this dialog box is outright lying. It will show that placeholder even with the latest version of Java installed.

Firefox is open source software. Open source software should be trustworthy. Software which lies to you is by definition not.

As things stand here, right now, it's Firefox which has a problem.

[ Parent | on HN ]

Re: In Firefox 24 and following, mark all versions of Java a... by adamtulinius on Tuesday October 22, 2013 @07:10AM (#6590986)

I just want to confirm 'gfritzsche' in you being wrong, and ranting about a lot of stuff that is just wrong. You should delete your comment.

[ Parent | on HN ]

Re: In Firefox 24 and following, mark all versions of Java a... by josteink on Tuesday October 22, 2013 @07:31AM (#6591080)

I went through this routine yesterday. Updated Java and restarted Firefox. I can 100% vouch for seeing a warning about Java being outdated. The warning was still there. I stand by it and I wont delete or edit my comment.

As a dedicated Firefox-user who dislikes the direction Chrome is taking, I still say Firefox has a problem here. This is something real users are experiencing.

I believe this as a whole will have a very negative impact on Firefox's perception in the java-heavier regions of the internet.

And damage done is hard to repair. Mozilla should think carefully and very quickly about what they just have done.

Edit: My bank's facebook page is already filling up with customers saying they can't log in. When the bank's reply is "Dont use Firefox. Firefox is broken" and the customer indeed can log in with other browsers, what chance do you think there is for the user going back to Firefox?

Mozilla needs to get 24.1 java-enabled-edition out there now, until it gets its UI/UX story straight.

Edit 2: Down-vote as you like. If you don't think this will affect Firefox's perception, you are a tad more optimistic than I am.

[ Parent | on HN ]

Re: In Firefox 24 and following, mark all versions of Java a... by gfritzsche on Tuesday October 22, 2013 @07:40AM (#6591118)

If you do see that, please file a bug with details on the steps to trigger this: https://bugzilla.mozilla.org/enter_bug.cgi?product=Core&comp...

[ Parent | on HN ]

Re: In Firefox 24 and following, mark all versions of Java a... by adamtulinius on Tuesday October 22, 2013 @07:35AM (#6591096)

Weird. It appears to be working as claimed in my Firefox build from yesterday (26.0a2 (2013-10-21)). Most likely a bug then, and should be treated as such, instead of assuming Mozilla is lying about updates being available, or not.

[ Parent | on HN ]

Re: In Firefox 24 and following, mark all versions of Java a... by alistair75 on Tuesday October 22, 2013 @09:41AM (#6591773)

Is there a chance that you have more than one instance of Java installed? I've seen this on a few machines. An up to date copy of Java in "c:\Program Files" and an outdated version still sitting in "c:\Windows". Try about:plugins in the address bar, I think that should list all installed versions.

[ Parent | on HN ]

Re: In Firefox 24 and following, mark all versions of Java a... by gfritzsche on Tuesday October 22, 2013 @07:05AM (#6590968)

It will show a different placeholder with the latest Java (no update link & text): http://imgur.com/k94vEvB

Given Javas security history, this seems correct.

[ Parent | on HN ]