Slashdot Mirror
Apple Updates Java To Include Flashback Removal
Fluffeh writes "In the third update to Java that Apple has released this week, the update now identifies and removes the most common variants of the Flashback malware that has infected over half a million Apple machines. 'This Java security update removes the most common variants of the Flashback malware,' Apple wrote in the support document for the update. 'This update also configures the Java web plug-in to disable the automatic execution of Java applets. Users may re-enable automatic execution of Java applets using the Java Preferences application. If the Java web plug-in detects that no applets have been run for an extended period of time it will again disable Java applets.'"
You'd think would have been offline or something. ;)
I thought this was only the initial number put out to draw ad-clicks. The revised number is now half of that.
Macs don't get viruses!
...I was wondering why the art department at work and the guy who makes my coffee was pissed.
So to fix the problem, they say lets disable java by default. They are new to the security game.
Lets say using adobe photoshop had a vulnerability, apple's defense is disable the running of photoshop when launching a ps file withotut prompting?
It's like preventing your child walking without your permission every time and then when their grown up and able to make their own decisions and decide to walk, you say, oh you have not walked in a while, you can't walk again.
apple's "security through scarcity" is starting to fade away as they gain marketshare. any popular OS will get viruses, malware, trojans, etc.
will mac os get a stonger walled garden as a result? i hope not as i was about to buy my first mac.
And the problem will persists once a user's experience is interrupted by allowing various applets and allows any to run any time, or blindly accepts the running of unknown applets.
Except for Macs running Leopard or earlier of course. Those will probably never be patched.
Most of the problems have been related to people installing software from the internet manually and things like Java. I'm not saying anything pro or con about Apple I own both Mac and Windows machines so I have no horse in this race. Like Linux the core OS is pretty sound I just wish Microsoft had bitten the bullet and made the leap when they did the Vista overhaul. It was a pretty brave move for Apple at the time to switch the OS and it paid off in the long run. Add ons like Java are always going to be a source of headaches. All I know is I rarely have trouble with my Macs but the PCs are another story. One of mine I had to surrender for internet use because it got nailed by a redirect and I tried everything and short of redoing the OS there was no way to scrub it out. I find it safer to use Mac for web surfing and downloading things like software and I use a lot of licensed photos in my work. It's just my personal experience that I run into far fewer issues with the Macs.
Honestly I can't possibly fathom a single good reason to allow Java in your web browser. Anyone dev incorporating applets for even the smallest, optional web functionality should raise eyebrows amongst his peers.
They have managed to get a 'Flash' application going on their machines.
When this debarcle started, I mis-parsed an article heading and was worried Apple was trying to erradicate Flashblock, and had grave fears for the web.
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
that you were infected? I'd like to know, I checked myself but could have missed it
flash and java, worst shit since windows
They're trying to prevent malware by installing their own malware.
It is absolutely right to disable Java by default. Even the behaviour of disabling it if not used for a while COULD have been a useful feature IF they turned that behaviour on by default then provided an option to disable it. By taking it out of the user's hands they're just playing nanny. But like any nanny stuck in an office many years and many miles away they can't anticipate the needs of their entire userbase very well. They have just made it a pain for any user to use Java in a browser on their platform. No one needs a computer that decides not to obey settings the user had set (no matter how long ago). Think of what would happen if every setting on your computer set to defaults every week or two.
I can think of ways around this that don't require any technical savvy. Put a local Java applet in as your homepage for instance. But this is clunky. You should be able to say "no I really do know better" and turn on Java.
This is the problem when applying the principle of least privilege. It is also the principle of least innovation and the principle of most annoyance. The bottom line is no one needs access to a computer just to live and breath. Least privilege is oxygen, water, basic food. Wouldn't be much of a fun life.
They disabled automatic execution of Java applets (automatic execution can be re-enabled by the user). This is a good thing and is not malware. The issue here is that very few users "set" the initial setting, it was either automatic execution enabled (the previous default), or automatic execution disabled (the new default).
This patch then only effects users who have: 1. disabled automatic execution, 2. re-enabled it. This is probably a handful of users at most.
The issue here is that they probably did not store that the user had previously changed the setting. And so have no idea that the user isn't simply using the default setting — which is what it looks like. The only option this patch has is to set the new default and allow the user to change it back.
By your definition any software that changes its default settings after the user has set them is malware. While I would agree in some cases it is undesirable (key bindings, for instance), in this case it is a good thing and possibly the only option due to the current implementation of the feature.
I just tried the update, and all you have to do is to click on the bock labeled "Addin Disabled" to turn it back on so not very much of a pain at all.
It is absolutely right to disable Java by default. Even the behaviour of disabling it if not used for a while COULD have been a useful feature IF they turned that behaviour on by default then provided an option to disable it. By taking it out of the user's hands they're just playing nanny.
What, like firefox? There are some programs that I need to have on my computer for development (including java & .net), but I DON'T want them as browser plugins, ever. Firefox makes it very difficult to remove these plugins - you either have to modify the registry, or go through some obscure about:config entries.
I want to click on the plugin, choose delete, and it's GONE, never to return to firefox.
Within a day of the attack being announced various security blogs (and then Ars Technica) were posting directions for finding if you were infected. Each of those assumed that you'd left Safari and Firefox (and any other browser you might have been using) in the Applications folder. Since I get pissed off wading through jumbled, alphabetical lists of totally different programs, I organise my Applications folder into sub-folders. While I can go and check the programs myself from the command line, from my own experience talking even with other scientists let alone my parents, many others won't be able to do so... but might have the know-how to rearrange their Applications folder.
Does anyone know whether Apple actually search through the installed directories of browers, or just default locations?
Oh, you're one of those users that takes it upon themselves to "organize" their Apps folder. You make your Mac support people cry and die a little bit inside.
But... I don't *have* any Mac support people! Maybe I should go and get some - I'd hate to disappoint them.
Within a day of the attack being announced various security blogs (and then Ars Technica) were posting directions for finding if you were infected. Each of those assumed that you'd left Safari and Firefox (and any other browser you might have been using) in the Applications folder. Since I get pissed off wading through jumbled, alphabetical lists of totally different programs, I organise my Applications folder into sub-folders. While I can go and check the programs myself from the command line, from my own experience talking even with other scientists let alone my parents, many others won't be able to do so... but might have the know-how to rearrange their Applications folder.
Does anyone know whether Apple actually search through the installed directories of browers, or just default locations?
Boris dude, make aliases. Yes, it's bad practice for developers (or Apple) to assume that an app file will stay at a fixed path, but it's very common.
Make your own apps folder, fill it with aliases, categorize them to your hearts content, and get on with you life.
Obviously I could, and probably should, have done this, I agree. In future I think I actually will. It was just a lot quicker to quickly drag and drop things around in Finder than to make a load of links - well, by "a lot" I mean "marginally", but it was quicker. It also didn't occur to me that Apple might occasionally need to patch or scan application folders and might assume a set location...
Pity you posted AC, any of those reading this with mod points should probably give you a few.