Disclaimer

Any opinions expressed here are my own and not necessarily those of my employer (I'm self-employed).

Oct 22, 2011

Update Java — or just remove it

Oracle recently released an update to its Java software, fixing more than 20 critical security issues in the software. Krebs has a good post on the update, briefly discussing the vulnerabilities and the fact that Java vulnerabilities are exploited for real.

I have to say that in recent years I've installed Java more due to habit than because of an actual need for the software. So when I got the update bubble in the corner of my screen, I figured "of course". I knew they, among other things,  fixed the same-origin-policy bypass used in the BEAST attack (You'll find a straight forward explanation of the Java vulnerability here, and links to resources on BEAST here). So I started the update process, and this was one of the first screens I was presented.



Oracle is clearly working to improve the image of Java:
Java provides safe and secure access to the world of amazing Java content.
Does it now? And they go on to claim:
Java makes your internet experience come to life.
 We'll see about that. Why? Because clicking "Install" took me to the next screen:


This is an unwelcome blast from the past. Not only is this free add-on stuff an extra step that clutters the update process — the direct opposite of what e.g. the browser vendors are working towards these days. This step also changes your default search provider and installs new and unrelated software that probably needs to be updated too. Ten years ago I was used to click through two or three screens with "do you want this free and amazing add-on?" during a software installation. Now it feels more like malware.

Being asked to install the Ask browser add-on depleted my patience. I cancelled the update, went to the control panel and removed the Java installation. It'll be interesting to see how it goes the next couple of week since I now risk that my internet experience won't "come to life".

Even though I don't have Java installed anymore, many people have and many people actually need it installed. To keep these users safe I would urge Oracle to:

  • Keep fixing security vulnerabilities in Java
  • Work towards a smoother update process, like the rest of the big players do
  • Stop polluting browsers with "free add-ons" in the process
It should be hassle free for users to keep your software safe and secure.
Posted by at
Labels: , , ,

18 comments:

  1. No Java, no Internet banking in Norway for you. (Unless you are using BankID on your mobile phone, something only a minority as access to). Please, prove me wrong. :-)

    ReplyDelete

  2. No Java means limited options for Internet banking in Norway, there we agree. And just for the record, my intention is not to start a mass "uninstall Java" movement with this post. :)

    Since many users actually need Java installed, because of e.g. online banking applications, I hope Oracle will put some effort into streamlining the update procedure. A natural first step would be to stop pushing the add-ons! :)

    ReplyDelete

  3. Oracle? Smooth install? You must be kidding..

    ReplyDelete

  4. First time I am visiting this blog. I found so many entertaining stuff in this blog, especially its discussion. From the tons of comments on your articles, I guess I am not the only one having all the leisure here! Keep up the excellent work. Check for essay writing service reviews

    ReplyDelete

  5. This comment has been removed by the author.

    ReplyDelete

  6. Well, sometimes, you need earlier version of Java. For example, I neede some Java programming help and I visited some courses where we were passing old MIT tutorials. There was a great template for understand how algorythms work and it was builded on 6 Java. SO we neede to downgrade our machines to that version.

    ReplyDelete

  7. Thanks for this article. I think you should also see this post on cell phone spying app.

    ReplyDelete

  8. This good to use words with friends cheat.

    ReplyDelete

  10. I've wrote my first site's backend on Java https://narrativeessays.org/. Check it!

    ReplyDelete

  11. Thanks for writing such a quality write-up! I hope other people get much help from this writing piece as well. Students struggling to write their assignments can opt for our online assignment help and get their coursework written by qualified assignment experts.

    ReplyDelete

  12. Pocket Mortys is the role-playing game based on Rick and Morty theme. The game is also known as Rick and Morty: Pocket Mortys.

    Pocket Mortys Recipes

    ReplyDelete

  13. This is really very nice blog and so informative. Thanks a lot for sharing this article. www.hotmail.com

    ReplyDelete

  14. Thanks for this article. Kingroot is available free of cost on online site https://kingrootapkapp.com/

    ReplyDelete

  15. First time I am visiting this blog. I found so many entertaining stuff in this blog, especially its discussion. From the tons of comments on your articles, I guess I am not the only one having all the leisure here! Keep up the excellent work.

    ReplyDelete

  17. It is a good and amazing article. Your information is very useful for me and for others. thank you so much.
    Hotmail Login

    It is a good and amazing article. Your information is very useful for me and for others. thank you so much.
    Hotmail Login

    It is a good and amazing article. Your information is very useful for me and for others. thank you so much.
    Login Hotmail


    It is a good and amazing article. Your information is very useful for me and for others. thank you so much.
    Create Hotmail account

    ReplyDelete

Subscribe to: Post Comments (Atom)

Copyright notice

© André N. Klingsheim and www.dotnetnoob.com, 2009-2018. Unauthorized use and/or duplication of this material without express and written permission from this blog’s author and/or owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to André N. Klingsheim and www.dotnetnoob.com with appropriate and specific direction to the original content.

Read other popular posts