New Java Vulnerability Found Affecting Java 5, 6, and 7 SE

← Back to Stories (view on slashdot.org)

New Java Vulnerability Found Affecting Java 5, 6, and 7 SE

Posted by Unknown on Tuesday September 25, 2012 @07:15AM from the everything-is-compromised dept.

jcatcw writes "Just as Oracle is ramping up for the September 30 start of JavaOne 2012 in San Francisco, researchers from the Polish firm Security Explorations disclosed yet another critical Java vulnerability that might 'spoil the taste of Larry Ellison's morning ... Java.' According to Security Explorations researcher Adam Gowdiak, who sent the email to the Full Disclosure Seclist, this Java exploit affects one billion users of Oracle Java SE software, Java 5, 6 and 7. It could be exploited by apps on Chrome, Firefox, Internet Explorer, Opera and Safari. Wow, thanks a lot Oracle."

74 of 121 comments (clear)

Min score:

Reason:

Sort:

Java runtime vs. .NET runtime by Nsks · 2012-09-25 07:17 · Score: 5, Funny

What is with Java and all these exploits? It's the most exploited piece of software on planet. I think they should learn something from Microsoft's .NET runtime. It's installed on pretty much every Windows computer out there. Still there are no exploits against it! Microsoft seems to know what they're doing much better than Oracle
1. Re:Java runtime vs. .NET runtime by sgrover · 2012-09-25 07:21 · Score: 4, Funny
  
  Dude!!! You almost made pop come out my nose! I laughed so hard!
2. Re:Java runtime vs. .NET runtime by Anonymous Coward · 2012-09-25 07:22 · Score: 1
  
  Really, somebody better tell Microsoft so they can stop issuing worthless security updates: http://technet.microsoft.com/en-us/security/bulletin/ms12-016
3. Re:Java runtime vs. .NET runtime by gagol · 2012-09-25 07:24 · Score: 4, Informative
  
  You mean like this?
  
  --
  Tomorrow is another day...
4. Re:Java runtime vs. .NET runtime by scorp1us · 2012-09-25 07:29 · Score: 4, Interesting
  
  Nah, I'd say Flash is the most exploited runtime.
  I never liked Java, but .NET is even worse for a web platform as it only supports a fraction of the platforms. Java was invented to be portable, .NET was invented to be less portable Java.
  
  --
  Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.
5. Re:Java runtime vs. .NET runtime by Tharkkun · 2012-09-25 07:35 · Score: 2
  
  What is with Java and all these exploits? It's the most exploited piece of software on planet. I think they should learn something from Microsoft's .NET runtime. It's installed on pretty much every Windows computer out there. Still there are no exploits against it! Microsoft seems to know what they're doing much better than Oracle
  All of the present exploits have come from Sun, prior to being acquired by Oracle. Did you expect Oracle to go back and regression test for exploits? I thought the code being open source would allow these things to be found?
6. Re:Java runtime vs. .NET runtime by Anonymous Coward · 2012-09-25 07:47 · Score: 1
  
  [.NET is] just like Java, except without an evil corporation yanking the carpet out from under the devs every three months.
  LOLWUT?
7. Re:Java runtime vs. .NET runtime by Anonymous Coward · 2012-09-25 07:56 · Score: 1
  
  Moonlight is dead. It hasn't been updated in nearly 2 years. Moonlight never supported drms, authentication and such, unlike SilverLight.
  I used to belong to Netflix (back when they had a good selection of movies) but couldn't stream movies from their website to Linux.
8. Re:Java runtime vs. .NET runtime by HiThere · 2012-09-25 07:57 · Score: 1
  
  Have YOU heard about how compatible they were?
  If they had been successful, MS had already pledged to sue them "To defend our intellectual property". Now that was only an MS vice-president, so while he's an official spokesman, he might not know the true plan. But it was said, and never denied.
  
  --
  
  I think we've pushed this "anyone can grow up to be president" thing too far.
9. Re:Java runtime vs. .NET runtime by Anonymous Coward · 2012-09-25 08:00 · Score: 1
  
  http://www.microsoft.com/openspecifications/en/us/programs/community-promise/default.aspx
  Yeah, so much for suing. BTW, care to provide reference to your claim while you're at it?
10. Re:Java runtime vs. .NET runtime by hoggoth · 2012-09-25 08:04 · Score: 1
  
  At first glance I thought you said 'pop corn out of my nose'. I was picturing kernels going in one nostril and fully popped corn shooting out the other.
  
  --
  - For the complete works of Shakespeare: cat /dev/random (may take some time)
11. Re:Java runtime vs. .NET runtime by Joce640k · 2012-09-25 08:23 · Score: 1
  
  I certainly hope .Net is secure...because the '.Net security updates' utterly fail to install themselves on any machine I own. Doesn't matter what version (v1.0 to whatever they're at now), doesn't matter what OS version (I've got XP and 7), I don't think a single one has ever installed. These days I don't even bother trying unless I'm already in a bad mood.
  
  --
  No sig today...
12. Re:Java runtime vs. .NET runtime by Joce640k · 2012-09-25 08:25 · Score: 2
  
  What does ActiveX have to do with .Net?
  
  --
  No sig today...
13. Re:Java runtime vs. .NET runtime by Tough+Love · 2012-09-25 08:43 · Score: 1
  
  Congratulations on joining the *whoosh* club for this thread.
  
  --
  When all you have is a hammer, every problem starts to look like a thumb.
14. Re:Java runtime vs. .NET runtime by TeknoHog · 2012-09-25 08:45 · Score: 1
  
  Man, all these years I've wondered what the big boys mean by "compiling the kernel". Thank you sir!
  
  --
  Escher was the first MC and Giger invented the HR department.
15. Re:Java runtime vs. .NET runtime by shutdown+-p+now · 2012-09-25 09:06 · Score: 2
  
  .NET actually has a bigger attack surface when it comes to sandbox exploits, because its type system is much more complicated, and so its bytecode verifier has to be more complex as well to deal with that, with more corner cases that it can potentially get wrong. For example, .NET has the concept of managed pointers (aka byref) for parameter passing. It also has the concept of vararg methods on VM level (with a variable number of argument actually being pushed on the execution stack - not like Java array-based varargs). I was exoerimenting in that area to do something unrelated, and found an exploit where you could pass a byref-to-byref (something that's normally verboten, verifier just didn't catch it that time) to a vararg method, and mutate the reference to point to the stack frame that's about to be teared down - eventually letting you to hijack an object's vtable pointer, for example, and execute arbitrary code.
16. Re:Java runtime vs. .NET runtime by cbhacking · 2012-09-25 10:37 · Score: 1
  
  Um, no. Not even slightly.
  There was a patch for three of the (~20) vulnerabilities that were reported. When Oracle neglected to patch the rest in a timely manner, another 3 of the vulns were chained together to make a full applet-sandbox-bypass exploit. That was in the wild for several days before Oracle finally released an out-of-band patch to fix it... and even then, they haven't yet patched all the other reported issues.
  Oracle knew about the vulns, and may even have had an internal patch, bu they did not publish it before a working (on the current released patch level) exploit was published.
  
  --
  There's no place I could be, since I've found Serenity...
17. Re:Java runtime vs. .NET runtime by Trogre · 2012-09-25 14:30 · Score: 1
  
  We could all just bypass Oracle and Microsoft, and move to Dalvik.
  
  --
  "Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
18. Re:Java runtime vs. .NET runtime by Whalou · 2012-09-25 23:07 · Score: 1
  
  I had read 'poop' instead of 'pop' and thought that I never wanted to laugh that hard.
  
  --
  English is not this .sig mother tongue...
19. Re:Java runtime vs. .NET runtime by HiThere · 2012-09-26 03:07 · Score: 1
  
  My understanding was that the basic .NET features were covered by the promise, but that some of the basic libraries weren't. I'll admit that I was never interested enough to remember the details. Something like "it didn't cover the window manager classes from the library".
  
  --
  
  I think we've pushed this "anyone can grow up to be president" thing too far.
20. Re:Java runtime vs. .NET runtime by toddestan · 2012-09-27 13:05 · Score: 1
  
  Actually, the way I see it is that Microsoft learned their lesson 10-15 years ago the hard way with things like ActiveX, leading them make vast improvements with regards to security in their products. Lessons that a lot of other companies are just learning now.
21. Re:Java runtime vs. .NET runtime by rubycodez · 2012-09-30 13:52 · Score: 1
  
  nonsense, Microsoft still lets security flaws go for years without patch. Their pseudo "operating system" and major wares still install malware without any user interaction needed. Microsoft's softwares are not business grade and have no place in the corporate world.
IcedTea, anyone? by Anonymous Coward · 2012-09-25 07:20 · Score: 1

As with previous exploits, what about IcedTea (OpenJDK)? Are Linux users yet again kicking back and enjoying the show?
1. Re:IcedTea, anyone? by Tough+Love · 2012-09-25 08:50 · Score: 1
  
  IcedTea is really, really close to being a viable replacement for Oracle's JRE. Some crappy webapps from vendors who should know better (Juniper, looking at you) fail on IcedTea probably because of stupid reasons that could be fixed instantaeously if the vendor bothered with even the slighted QA on the open JRE. This issue is rapidly elevating to critical because as everybody can see, relying on Oracle for anything is just bad business.
  
  --
  When all you have is a hammer, every problem starts to look like a thumb.
Every big SW package has bugs by davidwr · 2012-09-25 07:24 · Score: 2

While I commend their efforts, they could've reduced unneeded panic, FUD, and distraction by giving Oracle a few weeks to patch it before the big announcement.
Now customers everywhere will be concerned about this bug instead of the disclosed-to-the-vendor-only bug that gives you full administrative rights but which won't be made public until a reasonable time after the vendor was notified.
Apologies in advance if Oracle was notified a few weeks before this was made public and didn't disclose it themselves.

--
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
1. Re:Every big SW package has bugs by colinrichardday · 2012-09-25 15:04 · Score: 1
  
  instead of the disclosed-to-the-vendor-only bug
  And if other parties (black hats) are also aware the problem?
Report exploits to Debian and Red Hat too by David+Gerard · 2012-09-25 07:24 · Score: 4, Insightful

The OpenJDK teams at Debian (who also do Ubuntu) and Red Hat are good people to notify as well. Unlike Oracle, they won't sit on bugs.

--
http://rocknerd.co.uk
1. Re:Report exploits to Debian and Red Hat too by Anonymous Coward · 2012-09-25 12:09 · Score: 2, Insightful
  
  you do realize that installing a package as root does not automatically cause the binary to be run AS root. I could chown every file on a linux system to be owned by root:root and still be able to run programs as a non-privileged account.
  I don't know if you're trolling or misinformed, but there is nothing inherently insecure about installing packages as root. RUNNING them as root is something completely different.
  The Captha was "Audited" ... funny.
2. Re:Report exploits to Debian and Red Hat too by viperidaenz · 2012-09-25 15:03 · Score: 2
  
  You don't need to be admin to run Java on Windows. You can do it with 7zip, the exe installer can be opened as an archive and the tools.zip file inside is effectively the JDK. Unzip and enjoy. You just can't install it as the system JRE or install the browser plugin. Both of which should always require admin rights.
3. Re:Report exploits to Debian and Red Hat too by colinrichardday · 2012-09-25 15:12 · Score: 1
  
  Does one need to be root to install relocatable packages in a user's directory? That depends on the package.
Pop by Anonymous Coward · 2012-09-25 07:25 · Score: 1

Your dad came out of your nose?
http://www.popvssoda.com Fight!
"Wow, thanks a lot Oracle." by Anonymous Coward · 2012-09-25 07:26 · Score: 5, Insightful

Release of Java 5: September 30, 2004
Oracle's acquisition of Sun: January 27, 2010
I know it's fun to hate on Oracle (commencing Ellison yacht joke in 5, 4, 3...), but it makes you look a little imbalanced to blame them for a vulnerability that exists in a product created by a different company almost 5+ years before Oracle even bought them.
Shouldn't we at least wait until after we find out that Oracle knew all about this for months on end, chose to tell no one, and then ported it forward into Java 7 before we lambaste them?
1. Re:"Wow, thanks a lot Oracle." by Anonymous Coward · 2012-09-25 07:35 · Score: 2, Insightful
  
  No! Fuck Oracle! They are the 1%!
2. Re:"Wow, thanks a lot Oracle." by Nimey · 2012-09-25 07:58 · Score: 4, Informative
  
  Java 5 was even EOL'd well before Oracle bought Sun.
  
  --
  Hail Eris, full of mischief...
  
  E pluribus sanguinem
3. Re:"Wow, thanks a lot Oracle." by Cid+Highwind · 2012-09-25 08:08 · Score: 4, Insightful
  
  Number of fscks Larry Ellison has given about Java since finding out owning it doesn't mean Google owes him a ton of money for Dalvik: 0
  
  --
  0 1 - just my two bits
4. Re:"Wow, thanks a lot Oracle." by LourensV · 2012-09-25 08:14 · Score: 2
  
  Actually, after the acquisition Sun Microsystems, Inc. and Oracle USA, Inc. were merged to form Oracle America, Inc. So strictly speaking, Oracle is Sun. I wholly agree though that we need to know for how long they knew about this before passing judgement.
5. Re:"Wow, thanks a lot Oracle." by Trepidity · 2012-09-25 08:32 · Score: 4, Insightful
  
  They've owned the product for almost three years now, so I'd say that bugs in current versions are their fault for not doing sufficient QA to find/fix, regardless of where they originated. When you own something, you own the responsibility too.
  
  --
  10 PRINT CHR$(205.5+RND(1)); : GOTO 10
6. Re:"Wow, thanks a lot Oracle." by Billly+Gates · 2012-09-25 08:32 · Score: 2
  
  Part of this is not Oracle's or Sun's fault. It is the customers who uses 10 year old software that relies on these exploits to provide functionality like COM integration with Excel and other useless features.
  The more Oracle plugs these holes the more users will demand to keep XP and Java 1.4.2 around the office. Corporate customers hate change and fixes make them nervous.
  Java does run on every platform. The problem is it does not run on past versions of itself and like ancient versions of IE they create lockin. Most regular users do not use it as an applet. Chrome and Firefox wont even let you run Java applets believe it or not by default if you have Java installed. Just IE because no one uses it.
  Sadly I use eclipse and Aptana and I know many users who use Vuze for bittorents so java i snot going away but at least most of us can upgrade. I use the insecure version but double check to make sure it wont work on my browser so I am good.
  
  --
  http://saveie6.com/
7. Re:"Wow, thanks a lot Oracle." by Billly+Gates · 2012-09-25 08:37 · Score: 2
  
  Worse I have to clean machines which use Java 1.4.2 on the clients using IE 7. They get infected ALOT but use them for their banking apps online. Can't upgrade them because the 9 year old Kronos app is not compatible with any other version and this would hurt the shareprice.
  
  --
  http://saveie6.com/
8. Re:"Wow, thanks a lot Oracle." by afidel · 2012-09-25 09:00 · Score: 1
  
  Hell one of those companies is Oracle themselves. In fact the current version of several of the products we use still have the JRE 1.5.0 as the bundled version.
  
  --
  There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
9. Re:"Wow, thanks a lot Oracle." by Billly+Gates · 2012-09-25 09:51 · Score: 1
  
  How much do you want to bet vendors like Oracle and others will still be selling software that requires XP long after the EOL on 3/2014?
  
  --
  http://saveie6.com/
10. Re:"Wow, thanks a lot Oracle." by Trogre · 2012-09-25 14:38 · Score: 2
  
  Number of viable alternative desktop implementations? Ditto.
  
  --
  "Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
11. Re:"Wow, thanks a lot Oracle." by fatp · 2012-09-25 22:42 · Score: 1
  
  Oracle 11gR2 bundles jdk 5.
Is Java the new Flash? by blahbooboo · 2012-09-25 07:29 · Score: 4, Funny

Please discuss.
1. Re:Is Java the new Flash? by Anonymous Coward · 2012-09-25 07:54 · Score: 3, Funny
  
  No, Java is the old Flash.
2. Re:Is Java the new Flash? by malignant_minded · 2012-09-25 08:08 · Score: 1
  
  I can't I'm verklempt
3. Re:Is Java the new Flash? by Anonymous Coward · 2012-09-25 08:14 · Score: 1
  
  wabbit season
4. Re:Is Java the new Flash? by X0563511 · 2012-09-25 08:26 · Score: 1
  
  Post subjects are like headlines:
  If they end with a question mark, the answer is always "no."
  
  --
  For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
5. Re:Is Java the new Flash? by Chris+Mattern · 2012-09-25 08:34 · Score: 2
  
  He'll save every one of us!
6. Re:Is Java the new Flash? by Tough+Love · 2012-09-25 08:56 · Score: 1
  
  Not that bad but could be better. Unfortunately, in Oracle's hands its more likely to get worse.
  Actually, Javascript needs to be the new Java. Which seems to actually be happening. Sure, Javascript sucks seriously in its own way and can't touch Java in performance, but it does the job, blows Java out of the water in responsivess, and has multiple implementations not under the control of any one company.
  
  --
  When all you have is a hammer, every problem starts to look like a thumb.
7. Re:Is Java the new Flash? by dkf · 2012-09-25 10:12 · Score: 2
  
  Actually, Javascript needs to be the new Java. Which seems to actually be happening.
  Shit. Swapping something that's extremely well defined (even anal-retentively so) for something with as... err... whimsical set of variations as Javascript is such a huge step forward. Not.
  
  Sure, Javascript sucks seriously in its own way and can't touch Java in performance, but it does the job, blows Java out of the water in responsivess, and has multiple implementations not under the control of any one company.
  On the other hand, the main reason that JS is responsive is that it's got a fully warmed up engine going by the time your browser actually loads any script code. There's a large class of things that you can't do in JS (well, not the JS that's in browsers) and the multiple implementations vary in subtle ways that bite you on the ass.
  It isn't just manipulating graphics or DOM trees that people want to do in browsers.
  
  --
  "Little does he know, but there is no 'I' in 'Idiot'!"
8. Re:Is Java the new Flash? by Tough+Love · 2012-09-25 10:29 · Score: 1
  
  See, Javascript sucks but Java fails. Pick your poison.
  
  --
  When all you have is a hammer, every problem starts to look like a thumb.
9. Re:Is Java the new Flash? by Tough+Love · 2012-09-25 13:39 · Score: 1
  
  Actually, Javascript needs to be the new Java.
  I can assure you that you don't wanna see that happen.
  It already happened, clientside... can you spell Ajax? But I agree, it would be nuts to use Javascript serverside for a project of any scope. And also nuts to use Oracle's Java. You should be using GCJ or TowerJ.
  
  --
  When all you have is a hammer, every problem starts to look like a thumb.
Java, it's the new Flash by BLToday · 2012-09-25 08:01 · Score: 2

for malware.
Re:the java plugin? by rbrausse · 2012-09-25 08:02 · Score: 2

So when was the last time you actually needed that Java-plugin in your browser?
10 minutes ago. even twice (Barracuda's SSL VPN tunneling thingy is based on Java, and our web-based CPOE uses Java to print barcodes*)
If you have an IT job you might need it. by Anonymous Coward · 2012-09-25 08:04 · Score: 4, Interesting

Java plugins won't help you flip burgers, but if you work in a large corporation you will find about fifty mission-critical apps you definitely will need that plug-in for.
And the sysadmins hate EVERY SINGLE ONE OF THEM.
Because they SUCK to admin... end users who don't have to use or admin the codebase love them, because they are pretty and sound like coffee.
1. Re:If you have an IT job you might need it. by Trogre · 2012-09-25 14:45 · Score: 2
  
  I thought that the Google Dalvik case would have ended all fear about repercussions from developing a viable alternative implementation. And with Oracles horrible, horrible track record I would have thought people would have been scrambling to do so.
  So far we have... nothing I can think of.
  
  --
  "Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
Re:the java plugin? by codealot · 2012-09-25 08:24 · Score: 3, Informative

I just RTFA, from what I can tell this affects anyone who needs to run untrusted code in a JVM with a SecurityManager, not just applets.
That said, I can't think of any reason to do that besides applets, so most vulnerable users are those with browser plugins. Virtually everyone I know who runs Java deploys it within a servlet container where untrusted code is not normally a concern. Given that, the story seems a bit overblown.
Wowzers by Billly+Gates · 2012-09-25 08:26 · Score: 5, Funny

Good thing we use Java 1.4.2 at work. Looks like I am safe

--
http://saveie6.com/
Re:the java plugin? by Billly+Gates · 2012-09-25 08:28 · Score: 1

You haven't supported corporate America yet.
Java and ancient browsers are EVERYWHERE. Worse they all use Java 1.4.2 which is like the holy grail of CISCO equipment and some bank websites. It wont work on any other browser besides IE 6/7 with that java combo. Unless of course you want to upgrade ... HA that would cost money silly.

--
http://saveie6.com/
Re:the java plugin? by Chris+Mattern · 2012-09-25 08:36 · Score: 1

So when was the last time you actually needed that Java-plugin in your browser?
Today. I use on a daily basis browser-based Java software that I could not do my job without.
Is Betteridge's Law of Headlines Ever True? by TeknoHog · 2012-09-25 08:47 · Score: 1

No?

--
Escher was the first MC and Giger invented the HR department.
Oracle, did you learn from last time? by onyxruby · 2012-09-25 08:59 · Score: 4, Insightful

Oracle, did you learn from last time?
1. Have you publicly acknowledged the exploit?
2. Have you given at least some idea of how it works?
3. Have you given any mitigation instructions or will people simply have to uninstall your product since your not saying how to mitigate this?
4. Have you given any type of public communication along the lines of "were working on it"?
5. Are you giving any type of eta for a hot fix?
6. Have you learned that saying, we'll fix a critical exploit on one billion machines at the regular quarterly update schedule is not acceptable?
Home sick today or I would have been neck deep in this all bloody day. Haven't had a chance to look and see if they learned from their last royal clusterfuck or not.
1. Re:Oracle, did you learn from last time? by Anonymous Coward · 2012-09-25 09:20 · Score: 1
  
  Answer:
  They dropped all the vulnerable functions and re-added them with new names. As such, the exploits no longer work.
  Fixed!
  (And for the newbs who think this is a joke... guess again, true story. Thanks, Oracle!)
Thank you! by wurp · 2012-09-25 09:02 · Score: 1

Now I don't have to RTFA. IMO that simple statement "this only applies to running untrusted code in a JVM with a SecurityManager" is the most important thing to say about this exploit; sad it wasn't in the summary.
Re:the java plugin? by fa2k · 2012-09-25 09:05 · Score: 2

The good thing about the plugin is that Java is the only credible cross-platform sanboxed execution environment, and by having the plugin there's a large incentive to find any bugs in the sandbox. With every breach fixed, Java gets more secure.
Not that anyone is affected by Hentes · 2012-09-25 09:55 · Score: 1

Java was replaced by Flash long ago, and now even Flash is being replaced by HTML5. I have always disabled Java browser plugins exactly because it's unsecure. Five years ago this discovery may still have had some impact, but hardly anyone uses Java applets these days.
1. Re:Not that anyone is affected by Billly+Gates · 2012-09-25 15:32 · Score: 1
  
  Go to my workplace. HTML 5 can not happen as we and millions around the world still use IE 7 and are still working on partial CSS 2 support all with java applets that the beancounters see no need to upgrade as it would come out of the CEO's bonus.
  You expect us to replace our 200k Cisco equipment because CiscoConnect requires Java 1.4.x and XP? I THINK NOT.
  Bank of America's corporate portal, Manpower, KRONOS (if you had an hour job you used such a system), all require ancient java that is administred only by old IE and java applets. All which costs millions to replace and frankly work fine according to the accountants who set the IT budget.
  Maybe in your little world in your college dorm it is no biggie but expect a world of pain when you enter the real world.
  
  --
  http://saveie6.com/
2. Re:Not that anyone is affected by Billly+Gates · 2012-09-26 06:47 · Score: 1
  
  What about the java problem?
  
  --
  http://saveie6.com/
Thanks a lot Oracle? by i_ate_god · 2012-09-25 10:15 · Score: 1

I didn't realize Oracle made Java 5

--
I'm god, but it's a bit of a drag really...
Re:the java plugin? by i_ate_god · 2012-09-25 10:16 · Score: 1

Cisco AnyConnect :(

--
I'm god, but it's a bit of a drag really...
Re:the java plugin? by MysteriousPreacher · 2012-09-25 10:34 · Score: 1

So when was the last time you actually needed that Java-plugin in your browser?
About an hour ago. Still plenty of enterprise applications reliant upon Java. For home use, never. My only personal usage of Java comes from a Java remake of Dungeon Master.

--
-- Using the preview button since 2005
Re:the java plugin? by colinrichardday · 2012-09-25 15:22 · Score: 1

Today I finally got Aleks (an online learning system that uses Java) to work in Linux (I had the jar file in the wrong directory).
Re:Who cares? by V+for+Vendetta · 2012-09-25 21:41 · Score: 1

Another hole in browser plugin. Who cares? Disable the plugin and forget. It's not used for anything these days.

I (unfortunately) beg to differ. The two major (Sabre (Sabre.Red), Amadeus (Selling Platform)) GDS' reservation platforms are Java based. Once upon a time they had dedicated (Windows) clients, but as with anything in the 2000s, they had to go "to the Internet", make it "browser-based". Bad move.