Apple Angers Mac Users With Silent Shutdown of Java 7

An anonymous reader writes in with news of the continuing saga of Java patches and exploits. "If you're a Mac user who suddenly can't access websites or run applications that rely on Java, you're not alone. For the second time in a month, Apple has silently blocked the latest version of Java 7 from running on OS X 10.6 Snow Leopard or higher via its XProtect anti-malware tool. Apple hasn't issued any official statements advising users of the change or its reasons, but it's a safe bet that the company has deemed Oracle's most recent update to Java insecure. That's why the company stealthily disabled Java on Macs back on Jan. 10, the same day a Java vulnerability was being exploited in the wild."

Comments

Run Linux

[Anonymous Coward]

If you ran Linux you wouldn't have to worry about software not being able to run.

Re:Run Linux

[DarkOx]

Unfortunately not entirely true. Mozilla has been taking it upon themselves to decide which java plugins you can and can't use. Obviously its just the plugin and nothing FF or Seamonkey does affects local java code from using whatever JRE I happen to have installed. Still I think its an over-reach.

Fortuitously both are open source and it would be pretty trivial to disable that version check and do my own build if I needed to do so; but I would still say I am not pleased. Really they should just offer a warning or something and let you continue.

It should not be the case but lets face reality here there thousands of Java applications out there that only work correctly on specific platform releases. If you depend on these and your main system is a Mac you might be really screwed by this. Do any Mac users know if you can override? If you can does it mean you have to give up functionality like disabling XProtect entirely?

Re:Run Linux

[MrEricSir]

If you ran Linux you wouldn't have to worry about software not being able to run.

10/10. This is how proper trolling is done.

Re:Run Linux

[vlm]

It should not be the case but lets face reality here there thousands of Java applications out there that only work correctly on specific platform releases. If you depend on these and your main system is a Mac you might be really screwed by this.

Here let me help summarize

It should not be the case but lets face reality here there thousands of Java applications out there that only work correctly on specific platform releases. If you depend on these ... you might be really screwed....

Re:Run Linux

[dririan]

Almost all of the plugins are soft blocked. They'll be automatically disabled when you start Fx, but you can easily re-enable them without patching or updating anything. In fact, the same dialog that tells you about the soft block lets you uncheck "Disable" to prevent it from being disabled. Very nearly all plugins that are blacklisted are soft blocked. Their criteria for hard blocking plugins (which means the plugin cannot be re-enabled) is that the plugin either "is malicious" or "a soft-block will not resolve the issue in question, such as a start-up crash". See Mozilla's wiki for more information, especially the sections "A High Bar", "Block Conditions", and "Block Severity".

Please don't spread misinformation and FUD about Mozilla's blocklisting when it really is done properly.

Re:Run Linux

[Anonymous Coward]

If you ran Linux you wouldn't have to worry about software not being able to run.

10/10. This is how proper trolling is done.

If you ran Linux you would have no idea what it's like to experience the mysterious wonders of the malware world. Do you even know what it feels like to have a fuckin' sweeeet .dll hack invade your inner workings? I'll bet not. Like gettin' head from a porn star while smokin' blunts these days...they're so damn smooth, especially the Chinese. You hardly feel it.

A fast personal computer is a terrible thing to waste. - Anonymous Botnet Operator

(And THAT is how a proper troll response is done.)

Re:Run Linux

[kenh]

Or Windows. This is the result of a decision made by Apple Corp. to make this happen.

This came just as several hundred school teachers in my district were sitting down to enter grades into their Infinite Campus gradebooks at the end of the marking period. Apple's decision is playing havoc with their ability to use this Java-based application on their Apple MacBook Pros.

Re:Run Linux

[Anonymous Coward]

Get it right, please.

Mozilla give you the ultimate choice of whther the plugin is disabled or not.

Apple just arbitrarily blocked Java without give the user, or in Apples case, the inmate, the option to continue running Java code after acknowledging the risk. There is no way for the user to change this. The condemned have had sentence passed on then without the writ of trial. The dictatorship has spoken and has severed the bruised fingernail bed off at the shoulder. There is no escape. Unlike the Matrix, Apple's users are in a steel tank entombed under 100 km of granite.

Re:Run Linux

[smash]

In the past 15 years, I've personally dealt with more rooted Linux boxes than rooted Windows servers. Sure, the Linux boxes are probably more exposed to teh internet, but to claim that if you run/deal with Linux you're never likely to experience malware is a bit of a reach.

Re:Run Linux

[torsmo]

Yep...I mean it took a whole week for xulrunner, openjdk and other assortments to compile on my Pentium, so by the time new bugs sprout out, I'm compiling fixes again. Never has any Java vulnerability ever affected me. But since this means I don't get much use out of firefox, I'm using elinks for my browsing, and elinks's java plugin is rock solid. I think it's made by IBM.

Re:Run Linux

[Runaway1956]

AC should be modded +5 funny plus +5 informative and +5 insightful.

A fast personal computer is a terrible thing to waste. - Anonymous Botnet Operator

That would make a good sig . . .

Re:Run Linux

[Runaway1956]

I'll ASSume that you read all the release notes prior to beginning an upgrade. I've borked a couple of systems by jumping into an upgrade, without first checking the known problems. After screwing things up, I checked those release notes, discovered the known problems, then realized that it was entirely my fault that the upgrade didn't go smoothly.

That said - I'm not all that happy with Ubuntu any more. It used to be cool, but they've lost the cool factor. Rolling releases are the cool thing today. Sabayon Linux, Linux Mint Debian, Debian, and more seem to be getting it right.

Re:Run Linux

[Runaway1956]

Dump the shit computer from the 1990's. No one gives a damn about a pentium taking twelve months to compile a modern operating system.

A week to compile xulrunner? Are you sure you're not using an 8086, and blaming the problem on Pentium?

Re:Run Linux

[Savage-Rabbit]

Honestly, when using Ubuntu, unless you are willing to troubleshoot problems, you should stick with the LTS releases only. I run the interim releases in VMs, but never on production systems.

I can't speak for Gnome 3 on Fedora, because I have not tried it yet. My strategy (with Ubuntu) has been to use olvwm or LXDE. I really did like Gnome 2 though, but other WMs are fine, and to me they are more easy-to-use than Gnome 3.

I was trying to get a root certificate to work with apt-get only to discover that one of the APIs apt-get relies upon had a SSL bug that was fixed in 12.10 but for some reason not in 12.04 after several weeks of waiting (incidentally that was another thing that just worked on Fedora). That's SSL bug was pretty much the only reason I upgrated to 12.10. Well that and the fact that the entire X installation on Ubuntu was dog slow, the desktop configurtation files were full of bugs, the tweaking utilities would crash and corrupt the configuration data for the desktop environment. Ubuntu 12.10 only made the performace issue worse. Not that it really matters, Fedora for all it's faults has so far made a better impression than Ubuntu, their quality assurance certainly seemt to be better. The whole sorry episode just goest to my point that the OP was blowing smoke when he claimed that on Linux you don't have to worry about software not working and no amount of modding me down is going to change that. There are Linux distros whose QA just plain sucks ass and Ubuntu is one of them. I have had better upgrade experienceos on both OS X, Windows and several other Linux distros that I have had with Ubuntu.

Re:Run Linux

[Bongo]

Out of interest, how's the compromise usually discovered?

Re:Run Linux

[JDG1980]

Translation: Firefox provides secure behavior by default; if you want to do insecure stuff with plugins, you can, but you have to explicitly tell it so in the configuration settings.

Why is this a problem?

Re:Run Linux

[dririan]

So you're complaining because there's click-to-play, even though they implemented that for all plugins (except the most recent version of Flash). Go complain over here about that, as it has nothing to do with the blocklist. As you so kindly pointed out, though, if you want to be dumb you can shoot yourself in the foot and turn the blocklist off entirely.

Re:Run Linux

[dririan]

Either:
1. There's a bug in blocklisting
2. You are talking about click-to-play
3. You are making it up

Since you couldn't bother logging in, or providing any details other than "wtf it didnt work firefox sux", I can't bother assuming anything other than option 3. Of course, as the courteous AC below you pointed out, you can disable blocklisting entirely.

Re:Run Linux

[painandgreed]

This is the result of a decision made by Apple Corp. to make this happen.

The Beatles did this? I had no idea their agreement with Apple Computers gave them so much control.

Re:Run Linux

[Tharkkun]

Translation: Firefox provides secure behavior by default; if you want to do insecure stuff with plugins, you can, but you have to explicitly tell it so in the configuration settings.

Why is this a problem?

Yet they don't force you to upgrade their own web browser to the latest version. Seems fairly hypocritical to me.

Re:Run Linux

[Tharkkun]

Or Windows. This is the result of a decision made by Apple Corp. to make this happen.

This came just as several hundred school teachers in my district were sitting down to enter grades into their Infinite Campus gradebooks at the end of the marking period. Apple's decision is playing havoc with their ability to use this Java-based application on their Apple MacBook Pros.

Tim Cook's son pushed this through so he could escape being grounding for poor grades for 1 more week!

Re:Run Linux

[dririan]

It's about user choice. See how the parent said "explicitly tell it so"? Yes, you can run vulnerable plugins but only after you are aware that it's vulnerable, and explicitly request to be be re-enabled. The automatic updater is much more effective now than it was before, but it still doesn't force people to update. Mozilla forces almost nothing, including blocklisting (hard blocks aren't possible to override, but those are only used for plugins that crash on startup or are outright malware). If you want someone making your choices for you and not letting you work around them, then perhaps Firefox isn't your browser.

Re:Run Linux

[Gr8Apes]

My biggest problem with FF is that they need to fix their JS engine. The entire mess about a single page blocking all browser activity due to it hogging the JS engine is BS. Then again, FF isn't the only browser with that problem (or at least the last time I tried several)

Re:Run Linux

[dririan]

That has never happened to me ever. Any script hogging the CPU should trigger the long-running script warning, giving you the option to kill it. Even when that happens, I still can use the rest of the browser, it's just sluggish. I have no idea why it would block everything else. You're right though, only browsers that use one process per tab are immune to that (such as Chrome).

Re:Run Linux

[smash]

Yes, I have dealt with boxes that were neglected with regards to updates, that were connected directly to the internet. Clients who paid for a box to be set up and then stopped paying maintenance until they were hacked.

The point is this: simply running Linux is not going to make you any more secure than anything else. Muppet admin or lack of admin means you get hacked. Irrespective of OS. In the past, Windows update and the general assumption that Windows boxes needed to be firewalled, and Linux boxes were suitable to place in the internet because they were "Secure" and that was all that was required (i.e., the exact assumption that "it's linux, it will be secure") is exactly why I've had to un-fuck more Linux boxes than Windows boxes.

Re:Run Linux

[smash]

In the case of both operating systems; the root cause of all security breaches is the human operator, not the operating system.

My point exactly.

Re:Run Linux

[smash]

"Our link is slow". "We can't send email".

Stuff like that.

Admittedly, I haven't had to deal with one for some years now, but I've not had to deal with a rooted windows box in that time either. And I currently administer a network with over 100 of them. As mentioned above - competent administration is more relevant than OS selection.

I used to be a contractor doing per hour unix support.

Re:Run Linux

[smash]

By windows box, i mean servers in this context. A number of rooted Windows workstations of course. But almost all of those were caused by a user running as admin and installing "free" shit. Group policy, Windows firewall, UAC and WSUS on a corporate network make keeping WIndows boxes reasonably secure pretty easy. Many people turn all that shit off and run as admin which is where the problems start.

Re:Run Linux

[Gr8Apes]

Oh, that happens....eventually. But what if the script is on a tab you're not looking at? For some reason, as time goes on, I can't imagine why, the same number of open tabs seem to result in ever slower browsing experiences. And yes, that was an indirect plug for Chrome, the only one I know of that actually addresses this issue. Using a separate process may be a little heavy, I would assume that merely managing a pool of threads correctly for the JS engine would handle it without starving the rest (ie, forced time slicing / yielding - the scheduler would cycle the JS engine threads / tab processes so all of them get CPU time, preventing a single tab or small set of tabs from starving everyone else. Of course, separate processes are easier;)

Re:Run Linux

[Bongo]

Thanks

Re:Run Linux

[dririan]

Though this is fairly OT (given that this story is about Java blocking), the script being on another tab shouldn't matter. That sounds like a bug to me. Chrome for me uses far more memory than Firefox, because it spawns at least one process per page (as well as per extension!) but the multi-process model does have nice benefits, such as one page not being able to slow down the rest (unless your CPU is pegged/hard drive is thrashing). I'm also reasonably confident that the JS engine doesn't use threads either. They specifically mention not seeing any benefits in a multi-threaded model, just more complexity. Also, why are separate processes easier? With threads, you need to worry about thread-safe functions and mutexes. With processes, you need an entire IPC system to coordinate things between processes. Personally I find both a pain, but I certainly wouldn't call processes easier at all.

Re:Run Linux

[Gr8Apes]

We are getting off-topic - but that's fine by me. If a script is active on a tab in the background and has the JS engine locked, no other script will run, on any other tab or window. The process's JS engine is hosed, and there's only 1 process. 1 process per page - more memory, etc, but for WebPages, there's no IPC going on, so no issues. Child pages are part of the same process, IIRC. For multiple threads / threadpools, given that the operations only need to be synched within a single page, the single executor per page could easily be dealt with on a pool that manages pool threads, and keeps 1 thread from starving the others. No threadsafe functions are needed, because there are no cross-domain operations allowed.

Re:Run Linux

[dririan]

I get the concept of a script locking up the JS engine, but my point is that you should always get the unresponsive script warning, with the option to stop it. If you don't, then it's a bug.

I don't know why you say there's no IPC. Chrome uses IPC heavily as documented here. I don't see any way around it, either.

Again, I don't know why you say you wouldn't need thread-safe functions either. Imagine if one thread reads the cookie database, and another writes to it. You bet that needs to be thread-safe... even if you're talking about the JS engine. I'm not a big JavaScript developer, but I know you're still going to need thread safety. Hell, everything would need to be, at the very least, re-entrant. Also, for what it's worth, the OS normally schedules threads with common threading libraries (like pthreads, but NOT GNU Pth which only has one OS thread and does its own scheduling).

Re:Run Linux

[Gr8Apes]

At the risk of tl;dr, the initial sets of paras are more about backend browser threading than IPC. IPC is a whole different ball of wax from mere threading. Nothing there states anything about how the JS engine is run.

Generally, JS is single-threaded, especially within a page. You'll note there's no "thread" type, class, nor anything else you can access from within the browser (to stay on topic, Node.js etc are not in scope) You can achieve multi-threading via Ajax, which does run a separate I/O and "thread" in JS, and can cause some interesting behavior (race conditions) if you have multiple Ajax calls affecting the same element set. Going further - the I/O for cookies is handled underneath the JS engine, the JS engine itself, at least as far as page rendering and UI interaction goes, is single threaded. That's important, because that's the entire problem mentioned several posts ago. If you want to state "but wait, I know I can set the download threads to 'x'" that's true, and that's the JS engine handing off URL requests to the underlying network I/O stack, which is where the multithreading resides. The JS Engine merrily continues its processing until it has either 1) finished processing everything in the current stack and is waiting on I/O to return, or 2) it has run out of network I/O threads to pass requests to. (Simplistic, I know, again, far too much to write otherwise) Essentially that's how it works under the covers. So even in Chrome, which I haven't tested this hypothesis, the network I/O could be limited by a single network I/O process if they're sharing... via IPC. Again, that would be under the covers and not at a JS engine level.

I have had more fun than I can relate here about digging through various JS frameworks to debug web 2.0 issues in various browsers. Chrome's 1 process per page is a nice simple way to achieve separation so that 1 page cannot affect another, which is a browser sandbox design anyways. Only parent/child pages should be able to talk to one another, and IIRC in Chrome, those run in the same process.

To summarize - as far as the JS engine goes, there is no IPC, and even in Chrome, the JS engine is single-threaded for rendering/UI interaction and still subject to locking. It's just 1 page that's affected instead of everything in the browser.

Re:Run Linux

[dririan]

Generally, JS is single-threaded, especially within a page. You'll note there's no "thread" type, class, nor anything else you can access from within the browser (to stay on topic, Node.js etc are not in scope) You can achieve multi-threading via Ajax, which does run a separate I/O and "thread" in JS, and can cause some interesting behavior (race conditions) if you have multiple Ajax calls affecting the same element set.

Correct, but you were saying that the JS engine itself should have a pool of threads, and that is what I was addressing.

Going further - the I/O for cookies is handled underneath the JS engine, the JS engine itself, at least as far as page rendering and UI interaction goes, is single threaded.

Cookies were merely an example. There are plenty of cases where you need not only re-entrant functions, but thread-safe ones as well. Furthermore, even if the cookie I/O isn't handled by the JS engine itself, it's still irrelevant. If two pages are running (with one JS engine thread per page) and both try to access cookies, you really should hope the cookie accessors are thread-safe. Whether or not the access is done directly from the JS engine doesn't matter much as long as there are multiple threads running simultaneously.

as far as the JS engine goes, there is no IPC, and even in Chrome

I never claimed that there was IPC specifically in Chrome's JS engine. The point was that, as Chrome uses multiple processes, there is lots of IPC. Specifically, I was pointing out that for someone to add multi-processing to any given browser (in this case Firefox), even just for the JS engine, they'd need to do lots of work to get the IPC working. The only reason Chrome's JS engine doesn't do IPC is because it is part of the same processes as the renderer AFAIK.

Re:Run Linux

[Gr8Apes]

Correct, but you were saying that the JS engine itself should have a pool of threads, and that is what I was addressing.

Correct - that is what I'm saying, and I explain that on the whole, the only thing that changes is how the JS engine changes would be minimal from a page standpoint to support it. I'm not advocating multi-thread support within a page. But the underlying engine having thread management and being able to handle multiple pages, each in their own context, concurrently. That's a different beast, and your other points are below:

Going further - the I/O for cookies is handled underneath the JS engine, the JS engine itself, at least as far as page rendering and UI interaction goes, is single threaded.

Cookies were merely an example. There are plenty of cases where you need not only re-entrant functions, but thread-safe ones as well. Furthermore, even if the cookie I/O isn't handled by the JS engine itself, it's still irrelevant. If two pages are running (with one JS engine thread per page) and both try to access cookies, you really should hope the cookie accessors are thread-safe. Whether or not the access is done directly from the JS engine doesn't matter much as long as there are multiple threads running simultaneously.

You're missing the point - the JS engine code is single-threaded on a per page context, and contexts have no ability to speak or share with each other. Therefore there is no issue of thread safety in JS code. The discussion of underlying frameworks called by or on behalf of the JS engine is irrelevant. Those issues exist already, so there is 0 change. I'll bet the same is true for any scenario you'd care to post, since the core assumption, page contexts are single threaded, is unchanged.

as far as the JS engine goes, there is no IPC, and even in Chrome

I never claimed that there was IPC specifically in Chrome's JS engine. The point was that, as Chrome uses multiple processes, there is lots of IPC. Specifically, I was pointing out that for someone to add multi-processing to any given browser (in this case Firefox), even just for the JS engine, they'd need to do lots of work to get the IPC working. The only reason Chrome's JS engine doesn't do IPC is because it is part of the same processes as the renderer AFAIK.

See above, IPC is not relevant, thanks to the unchanged assumption about the scope of the change we're talking about. There will be some changes in the core JS Engine, and perhaps some synchronization imposed on calls the JS engine makes that are not there now, but that is all below the waterline, so to speak. No one's tackled this, and Chrome's approach is probably a least effort call. As for any IPC in Chrome, it's irrelevant to this discussion about the JS Engine as that IPC will exist in either configuration and is beneath the JS Engine.

Re:Run Linux

[dririan]

I think we're talking about completely different things. I agree with all of your points, but I'm saying that it is very non-trivial to run one thread per page, even just for the JS engine, because of the work that has to be done. You're saying that the JS engine itself doesn't need a ton of work, which is correct (although everything must be re-entrant, which does require work unless everything is already re-entrant). Please don't forget that while thread-safe functions aren't required if one context only has one thread, you still need re-entrant functions as soon as you get more than one thread.

Re:Run Linux

[Gr8Apes]

It all depends, if there's 1 thread assigned per context, then no. Nothing has to change, there is no context switching for a thread in general terms that thread management is concerned about. The JS Engine doesn't even need big changes in this scenario, and maybe none at all, as it already has at least some context set for handling multiple threads (See above Ajax discussion). The only thing we'd be doing is having the browser specify when a new context is created, and create and tie a new thread to that context for JS execution.

Explain how that scenario has different requirements from the current implementation in browsers, from the thread POV. I see none, other than the thread will only see JS for a single page and its children, which is what would happen if you only opened 1 top level window in your browser.

Re:Run Linux

[dririan]

Have you done multi-threaded programming? Everything needs to be re-entrant if it can possibly be called from more than one thread, even if there are different instances/contexts across threads. It's not as simple as "make new thread, hook things up, fire thread".

Explain how that scenario has different requirements from the current implementation in browsers, from the thread POV.

As I said, everything needs to be re-entrant (which there's no reason for it to be with only one thread), and everything shared across threads needs to be made thread-safe. Files, I/O, and everything with side effects needs to be locked so threads don't stomp on each other. Even with one thread per tab, lots of resources are shared across threads. Perhaps most of the work wouldn't be in the JS engine itself. It doesn't matter. This thread was about it being non-trivial to add threading or multiple processes to a single threaded, single process browser, which there's no way you can argue with.

Old News

[swimboy]

Update 13 is already out, and *not* blocked by Apple. All that's blocked are the old, insecure (well, more insecure) versions.

Re:Old News

[turkeyfeathers]

Not blocked... yet.

Re:Old News

[kthreadd]

If there are security vulnerabilities discovered in update 13 then it will likely be blocked as well.

Re:Old News

[exomondo]

If there are security vulnerabilities discovered in update 13 then it will likely be blocked as well.

So why don't they block older versions of their operating systems when they have vulnerabilities? That one in iOS where you could root the device from a website was pretty severe, seems if their goal is protecting the user from malicious software they probably should have blocked that from the app store and other services until the users updated.

Re:Old News

[msauve]

"Today, we celebrate the first glorious anniversary of the Information Purification Directives. We have created, for the first time in all history, a garden of pure ideologyâ"where each worker may bloom, secure from the pests purveying contradictory truths. Our Unification of Thoughts is more powerful a weapon than any fleet or army on earth. We are one people, with one will, one resolve, one cause. Our enemies shall talk themselves to death, and we will bury them with their own confusion. We shall prevail!" - Apple

Re:Old News

[Billly Gates]

Update 13 is already out, and *not* blocked by Apple. All that's blocked are the old, insecure (well, more insecure) versions.

Except all the corporate java apps rely on Java 1.4,5, and 6. I use Java 6 for Android SDK. It wont run on anything else. Java 7 is terrible and not as good as the more stable and secure version 6 which is mature. Does Cisco WebEX use Java 7 yet? I use Java 6 for that as well.

If I owned a Mac I would BE PISSED OFF. I am not stupid and know how to disable it for web browsing, but many apps use older java versions.

Re:Old News

[R.Mo_Robert]

I am not stupid and know how to disable it for web browsing, but many apps use older java versions.

First, I'm not sure why Slashdot chose to run this article as opposed to any of dozens of others that actually explain the situation better, not that it matters because nobody reads them. Apple is not blocking Java applications. They are blocking only the plug-in. Further, from what I've read, they were not blocking Java 6, only insecure (well, more insecure) versions of Java 7 applets. Additionally, you can get around this with just about any Web browser besides Safari. Finally, at the moment, at least, the latest version of the plug-in is once again perfectly capable of running.

For competent reporting on this subject, see, among others, the MacRumors article about the most recent block.

Re:Old News

[alcmena]

I'm sure that the fact that Java is the key technology behind Android development had nothing to do with Apple's decision.

Re:Old News

[Anonymous Coward]

[rant deleted]

If I owned a Mac I would BE PISSED OFF.

In other words, you are PISSED OFF even though you don't even own a Mac and therefore cannot be affected by this. There's no pleasing some people.

On /. there is no clickbait like Apple stories and the best part is that you get an army of slashbots crawling out of the woodwork regardless of whether the story is positive or negative.

Re:Old News

[BasilBrush]

Well for one thing, blocking an entire operating system would prevent you from downloading a replacement operating system.

They do actually do something in that direction though. Once iOS is updated to a new version, it can't be downgraded again.

Re:Old News

[exomondo]

Well for one thing, blocking an entire operating system would prevent you from downloading a replacement operating system.

Obviously you wouldn't block the OS update mechanism, simple.

Re:Old News

[BasilBrush]

Unless you are trying to do Android development in a browser, it certainly has nothing to do with it.

Only the exploitable Java browser plugin is disabled, not Java apps.

Re:Old News

[fyngyrz]

Don't touch that! It's a pixel! A dirty, dirty pixel!

That's right. Just put it in the cloud. We'll take "care" of it for you. That's right. Sleep now.

Re:Old News

[exomondo]

Since you mention it, they do.

I don't remember any forced upgrade, seemed they were quite happy to let me use vulnerable software as long as I like, so long as it's their vulnerable software.

Re:Old News

[Paradise Pete]

Except all the corporate java apps rely on Java 1.4,5, and 6.

Apps are not affected. Im running one right now. It's only the browser plugin. If the app didn't run I would be pissed off.

Re:Old News

[rs79]

No, it was a security hole big enough to drive a truck though. You think they wanted to do this?

Android isn't really Java. It's similar, but so are a lot of IL code languages going back 30 years.

Re:Old News

[GuldKalle]

Android only uses Java the Language, not Java the VM or Java the Compiler.

Re:Old News

[DKlineburg]

This statement seems to contradict the above statements that home run java apps for entire governments aren't running. I don't know either way.

Re:Old News

[DKlineburg]

So you get one button to push? "Update". That would be a funny boot screen. Would it play the wave file "That was easy" when done?

Re:Old News

[DKlineburg]

I like my dirty pixel. You can't have it.

Re:Old News

[Bill_the_Engineer]

I'm sure the fact that a Java plugin is not the same as the Java JDK has nothing to do with your troll.

Re:Old News

[JDG1980]

If there are security vulnerabilities discovered in update 13 then it will likely be blocked as well.

As well it should be. People have been putting up with Oracle's lackadaisical approach to bug-fixing for far too long already. Playing nice hasn't worked, now it is time to haul out the big guns.

Re:Old News

[JDG1980]

Except all the corporate java apps rely on Java 1.4,5, and 6. I use Java 6 for Android SDK. It wont run on anything else. Java 7 is terrible and not as good as the more stable and secure version 6 which is mature. Does Cisco WebEX use Java 7 yet? I use Java 6 for that as well.

You can still run that shit on Windows. Macs are aimed towards non-technical home users, and to a lesser extent graphical artists. Legacy compatibility has never been Apple's strong point.

Re:Old News

[Tharkkun]

If there are security vulnerabilities discovered in update 13 then it will likely be blocked as well.

As well it should be. People have been putting up with Oracle's lackadaisical approach to bug-fixing for far too long already. Playing nice hasn't worked, now it is time to haul out the big guns.

You mean Sun. Oracle has been pushing hard to rectify bugs, security holes, etc in Sun's software.

Re:Old News

[Plumpaquatsch]

This statement seems to contradict the above statements that home run java apps for entire governments aren't running. I don't know either way.

Only if you don't know that it's actually a Java Applet running in the browser.

Re:Old News

[BasilBrush]

I haven't seen those statements. But if anyone says that it's disabled any Java apps outside a browser, then they are wrong.

Re:Old News

[exomondo]

No, I thought it was quite clear, obviously you're having trouble comprehending it:
they probably should have blocked that from the app store and other services until the users updated, not blocking every function.

Re:Old News

[Desty]

So why don't they block older versions of their operating systems when they have vulnerabilities? That one in iOS where you could root the device from a website was pretty severe, seems if their goal is protecting the user from malicious software they probably should have blocked that from the app store and other services until the users updated.

Because people still run those operating systems, and there are good reasons why they don't want to, or can't "upgrade" to the next version.

1. They may need to run software which is currently incompatible with newer versions of the OS.
2. Apple charges money for their somewhat incremental upgrades. You're suggesting that they automatically "block" your OS until you pay them money for the newer version? Sounds like extortion... no thanks. This is not to say that I think it'd be okay to silently block Java just because it is free.
3. Worse still, Apple go out of their way to make new OS releases incompatible with even a four or five year old perfectly-functional Macbook.

The same policy of planned obsolescence applies with iOS. My trusty iPod Touch can't use the latest iOS and won't work with the new version of iTunes... why? I don't know. But my iPhone 5 won't work with the older version of iTunes.
So they've actually made it so that you can't even use a 4 year old iPod Touch and a new iPhone on the same computer. Amazing.

Re:Old News

[exomondo]

1. They may need to run software which is currently incompatible with newer versions of the OS.

Like Java.

2. Apple charges money for their somewhat incremental upgrades.

Not on iOS devices anymore.

3. Worse still, Apple go out of their way to make new OS releases incompatible with even a four or five year old perfectly-functional Macbook.

My suggestion was for iOS devices, i'm talking about where there is no reason not to upgrade - like the Java situation.

Good

[Anonymous Coward]

Oracle is probably the greediest company on the planet.

Re:Good

[kthreadd]

I've read their EULA. Didn't found anything mentioning souls. Could you be more vague?

Re:Good

[Colonel Korn]

Java... free. VirtualBox... free. Oracle Linux... free. How can you say they're greedy?

On Windows, Java installs the Ask Toolbar (for now - other times it installs other shit) every time it updates to a new version unless the user realizes Oracle is a two bit hole in the wall company and unchecks the default boxes to opt out. That's greedy. To an even greater extent that's sleazy and just...trashy.

Re:Good

[bearded_yak]

...Oracle [...] unchecks the default boxes to opt out. That's greedy. To an even greater extent that's sleazy and just...trashy.

Thank you! It's amazing how many customers bring in their computers for a tuneup who have no idea how they got the Ask toolbar. Granted it is just as much the user's fault for not reading, but at the same time, the user puts a lot of trust in such a major-name product and shouldn't have to worry about having something slipped by them.

Re:Good

[Anonymous Coward]

maybe

Re:Good

[vlm]

Sorry, can't diss VirtualBox :)

Its USB support isn't free. Donno why, don't care, just find it to be a PITA.

Whats the one reason a linux guy wants to run virtual windows, besides games? Well, weirdo USB hardware like programming proprietary radio memories, or burning eproms in a USB eprom burner or whatever other USB peripheral madness you can imagine. I've got an old Windoze only USB film scanner. Not that I have much film left to scan.... Come on guys, make it easier?

Re:Good

[leenks]

Try buying a licence for it so you can use the USB pass through support in a commercial context. Nada.

Re:Good

[maxwell demon]

You know, if you xor the file with the right key, you'll get a text demanding your soul and your first-born. :-)

Re:Good

[93 Escort Wagon]

Since Apple is clearly not from this planet and Microsoft inhabits its own universe...

I suppose the Seven Circles of Hell can be considered another universe...

Re:Good

[ColdWetDog]

No, you have to read it backwards as well.

Re:Good

[rubycodez]

what about that McAfee crapware that almost got installed with the java update, good thing I caught that checkbox. what about OpenSolaris (DESTROYED!), what about mysql (buggy unreliable garbage that EATS DATA), what about Java no longer being backwards compatible with 1.6 and cause busniesses major clusterfucks?

Re:Good

[MisuVir]

I like how Adobe Reader comes with the very useful software "McAfee Security Scan Plus".

Re:Good

[colinrichardday]

Actually, I would want it to run Microsoft Office (yeah, hate me). I have Windows on my hard drive, but I don't know what the Windows boot image is.

Re:Good

[SilverJets]

Java... free.

Rebranded Sun Java that was already free.

VirtualBox... free.

Rebranded Sun VirtualBox that was already free.

Oracle Linux... free.

Rebranded Linux distro that was already free.

How can you say they're greedy?

Look at the products Oracle made themselves and not those they acquired from Sun. They're greedy.

Re:Good

[FoolishOwl]

Good to know.

Re:Good

[smash]

Also, they shit-canned opensolaris. So, on balance, they've gone backwards in free-ness with the software they acquired from Sun.

Re:Good

[Kalriath]

Actually, the GPL does not bind the copyright owner - even the FSF makes this clear. It can only bind people who require a license from the copyright owner in order to do something with a work. Oracle is well within their rights to dual license, just as you are with anything you independently create.

Re:Good

[devent]

Oh please, that is the standard behaviour of anything on Windows. Everything installs a bar or updater or notification thingy.

Re:Good

[Runaway1956]

The entertainment is free, just like Linux. Your lack of understanding is of no concern to us - take that up with your spiritual advisor, or whatever the hell those fruitcakes are called these days.

Re:Good

[Runaway1956]

So use OpenJDK instead?

Re:Good

[DKlineburg]

Only a little

Re:Good

[DKlineburg]

I get Java free where I work. Of course it is the liquid kind I drink to keep me up all night so I can post on /.

Re:Good

[fatp]

USB support is free (as speech). USB 2 support is free (as beer). USB 3 support is?? (non-existent?)

Re:Good

[Bigbutt]

USB support is free last time I checked (a few weeks ago). When I needed to read a tape off of my Sony, I had to install Windows XP in VirtualBox and then load the software. USB support is an extra but it's free.

[John]

Re:Good

[zzyzyx]

That annoyance has been there for a very long time, before Sun's acquisition. Oracle said they would remove it eventually. They're not being greedier than Sun in this matter.

Re:Good

[Tharkkun]

Java... free. VirtualBox... free. Oracle Linux... free. How can you say they're greedy?

On Windows, Java installs the Ask Toolbar (for now - other times it installs other shit) every time it updates to a new version unless the user realizes Oracle is a two bit hole in the wall company and unchecks the default boxes to opt out. That's greedy. To an even greater extent that's sleazy and just...trashy.

It hasn't been installing the ASK now toolbar for months. Try grabbing the latest version from Oracle's website.

Re:Good

[Tharkkun]

Java... free.

Rebranded Sun Java that was already free.

VirtualBox... free.

Rebranded Sun VirtualBox that was already free.

Oracle Linux... free.

Rebranded Linux distro that was already free.

How can you say they're greedy?

Look at the products Oracle made themselves and not those they acquired from Sun. They're greedy.

You mean that company Sun which was bleeding $$$ and soon to go bankrupt? Oracle gave them new life, jobs and a chance to develop the products and bring them to market again.

Re:Good

[krakelohm]

Actually it is continuing to do this as of today, right from the java.com page. If you have a super secret link whereas the java installer does not come with ASK checked by default by all means share share share!!

Oh no, I can't run Java applets?!

[MrEricSir]

Without Java applets, my plan to time travel back to 1997 and surf the web is completely ruined!

Re:Oh no, I can't run Java applets?!

[hendridm]

You could always e-mail copies of web sites to yourself and view them in Microsoft Outlook's HTML renderer which has almost non-existant CSS support.

Re:Oh no, I can't run Java applets?!

[Anonymous Coward]

In Denmark you cannot log into online banking or goverment pages (tax reports) without the java browser add-on. They have danish standard "secure" login java applet called nem id (danish for "easy id") - oh the irony In Norway it is more or less the same, in Norway the java applet is called "Bank ID". A fun fact is that the only way to log on to banks in Denmark if you do not want to install java is to buy an ipad and install an ios applet that does not rely on java. I wonder why they can manage to code a native app for ios but not for OSX/WIN/Linux - oh yes I know is Java so is it code once run on all platforms.. wohhahaha haha

Re:Oh no, I can't run Java applets?!

[emt377]

Install Chrome as a workaround, then fix the problem by finding a broker with software technology that dates to this century.

Re:Oh no, I can't run Java applets?!

[rastos1]

Excuse my ignorance, but ... what is the current state of the art for including something into a web page that can access local system?

I sure the EULA will tell me I cant do anything..

[ganjadude]

But How is it ok for apple to disable software on MY computer, without my permission? I never told apple I wanted XX blocked, so apple should not know I have XX running to begin with. IF apple is blocking XX from my computer, without my permission, then is apple breaking any laws? unauthorized access to a PC for example? As My sig says, im sure its hidden in the EULA somewhere that apple can do this but to me, it is apple breaking into MY PC, and disabling software. That just makes me wonder what else apple has access to???

Re:Good for them.

[Anonymous Coward]

This is why I run GNU Hurd, the only truly free operating system, on my Lemote Yeeloong. My freedom is incredible. I can run ls and cat and EVERYTHING. I look forward to support for manpages in 2017.

Re:I sure the EULA will tell me I cant do anything

[SteveTheNewbie]

You do realise you can disable this right?

https://discussions.apple.com/thread/4762386?start=0&tstart=0

Quite amazing what a google search for 'disable XProtect' turns up..

Re:Good for them.

[kthreadd]

Ehm, doesn't Firefox also block vulnerable versions of Java? I guess maybe they are fascist as well.

Anger whom ? physicists ?

[burni2]

Those people which rely heavily on using java applets(*) .. and well that must be .. malware devellopers and physicists that actually try to teach physicists in an understandable way.

And I only sympathise with the physicists!

(*)(there indeed are some java applicatIONS that are very good, Jdownloader, JBidwatcher2, for example, and well eclipse)

And what about Mozilla?

[drcagn]

Mozilla did the same thing with blocking Java on Firefox on January 10th.

Java 7 Update 13 is out already and works on Macs again anyway.

Re:I sure the EULA will tell me I cant do anything

[drcagn]

What browser do you run on OpenBSD, FreeBSD, Linux, or Hurd? If you said Firefox (the usual default browser in most distros)... guess what? Mozilla blocked Java too!

Re:I sure the EULA will tell me I cant do anything

[Anonymous Coward]

But at least you didn't let the fact that you don't know shit about shit stop you from talking!

Re:I sure the EULA will tell me I cant do anything

[dugancent]

It's monitoring in the same sense that antivirus software is monitoring.

Not blocked...

[Anonymous Coward]

WTF is up with the old news on slashdot? Java 7 Update 13 came out the day after this "block" went into affect. Update 13 is NOT blocked and fixes the relevant vulnerabilities:

http://www.macrumors.com/2013/02/01/oracle-releases-java-7-update-13-to-address-security-issues-reenable-web-plug-in-on-os-x/

Re:I sure the EULA will tell me I cant do anything

[kthreadd]

What is actually the problem here? This is no different from a regular antivirus/antimalware software update. Most users will find it valuable that vulnerable plugins are disabled until the user actively reenables them.

Re:This Mac user not angered.

[Indigo]

It would be more responsible to give users a choice on the matter. Especially for those using Macs for work, teleworking, etc where not running Java may not be an option. Fine, disable it by default to be safe, but give an option to re-enable it besides Googling for random XProtect plist hacks.

Re:Java compilation?

[kthreadd]

This only affects Java applets running within the Safari web browser.

Re:Good for them.

[tysonedwards]

Let's not let the facts get in our way.

Re:I sure the EULA will tell me I cant do anything

[swillden]

companies who sell electronic devices must have these types of things opt in rather than opt out

Opt-in security on mass-market devices generally equates to no security. I don't like Apple's walled garden approach, but I think secure-by-default is the right decision.

Re:This Mac user not angered.

[kthreadd]

There is very little reason to offer such option since users should not use vulnerable versions of plugins. The plugin vendor should fix the problem and update the plugin.

Re:Good for them.

[Anonymous Coward]

a) it's old news
b) both the Java 7 (from Oracle) and Java 6 (from Apple) updates that address this are already out . Is the new motto Recycling obselete news that matters ;)
c) if you want to opt out from Xprotect, how to guides abound
d)it's the Safari plugin only - other browsers are not effected
e) Apple have pulled the trigger on Xprotect maybe 4 times in 3 years, its not like they are shotgunning

The vulnerabilities from Java 7 were hideously large, and Apple probably did the right thing for the 99 percent who don't know any better. Driveby root access isn't all that fun for the target.

The 1 percent who care, can disable Xprotect temporarily if they want to.

For anyone in between, they could always use another browser.

If you are using a Mac , you are not generally the IT equivalent of a Yukon Frontiersman

Wow... Apple can't catch a break...

[thestudio_bob]

Wow... Apple can't catch a break... You know damn well people would be bitching if they hadn't done this... Apple Fails To Disable Java 7. Millions of Macs Vulnerable. News at 11.

Re:Wow... Apple can't catch a break...

[Phelony]

*Apple* fails to disable Java so Macs are vulnerable? So Oracle is not responsible for Java making Macs vulnerable??? It's Apple's fault??? Huh???

Re:Wow... Apple can't catch a break...

[smash]

In slashdot groupthink, yes.

Re:Wow... Apple can't catch a break...

[Anonymous Coward]

You must be new to the world of computing. If anything undesirable happens on an Apple device, it's wholly Apple's fault. This includes Oracle's Java.

It's one of those double standards you get when trashing a company (Apple, in this case) becomes fashionable.

In such a case, it makes sense for Apple to keep its users safe from a malware vector, it being the lesser of PR disasters.

Re:Wow... Apple can't catch a break...

[jo_ham]

*Apple* fails to disable Java so Macs are vulnerable?

So Oracle is not responsible for Java making Macs vulnerable??? It's Apple's fault???

Huh???

That's exactly what happened when Apple decided to stop shipping a Java VM by default with OS X, instead falling back to the position that every other OS uses - that if you need it, you get it from Oracle. That didn't stop slashdot frothing about how Apple was "killing Java" and "taking it away from Mac users" when it was really the opposite - shipping and updating their own version meant that the Mac version was always behind the current release, especially with bug fixes. Leaving it to Oracle meant it was better for everyone.

Just look at the way the driveby jailbreaking exploit was reported. It wasn't "Apple fixes exploit that allows remote root access on iOS" it was "Apple closes hole that allows people to Jailbreak" while simultaneously hammering Apple for relying on security through obscurity in their products.

Re:Wow... Apple can't catch a break...

[colinrichardday]

Felching Fanboy Reality Rearrangement Realm

Reverse Reality Distortion Field?

Re:Wow... Apple can't catch a break...

[smash]

False.

Re:Wow... Apple can't catch a break...

[thegarbz]

In slashdot groupthink, yes.

As if. Oracle is hated far more than Apple on Slashdot.

You must be new here.

Re:Good for them.

[countach]

Two issues. Firstly Apple didn't just disable web applets. They disabled Java Web Start too, so whole corporations and government departments are suddently shut down. Secondly, they didn't provide any announcement, or a gui tool to re-enable at your own risk. It was just nuke everyone in silence.

Re:I sure the EULA will tell me I cant do anything

[ganjadude]

Maybe im just so stuck on the privacy issues going on in the industry today that I am lumping in something unrelated. It is possible. I dont like that windows "phones home" (niether does anyone here) so why is this ok to many here based on the thread so far??

Re:I'm Pretty Sure They Just Needed An Excuse

[FreakyGeeky]

Your information is woefully out of date. Oracle is where you get Java for OS X, and it's been that way for a couple years.

Still not working on 10.6

[g1powermac]

The summary is incorrect with saying Apple blocked Java 7 on 10.6. Actually, Snow Leopard can't run the new Java from Oracle, it can only run the Apple version of it which is still the 6 series. With this last round of blocking, Apple also blocked their own version on Snow Leopard and Apple has not yet released an update for it last time I checked. Now, in my opinion, this whole blocking thing without notice was extremely unprofessional and made me disappointed in Apple, and that's coming from a Mac fan. I got hit with it the other day and spent hours trying to figure out why in the world Java wasn't working on my machines. Ended up finding a work around editing a .plist file using a console text editor. Definitely not a solution for anyone not familiar with the command line.

Re:Still not working on 10.6

[Billly Gates]

Is 6 still supported with patches? Oracle is so desperate to EOL it but practically any java software relies on it and can't run on Java 7. I am thankful I did not get a mac as I chose a PC for Android development. Android SDk wont run on anything newer than java 6.

Re:Still not working on 10.6

[smash]

Complain to oracle...

Re:So you were able to run Linux.

[Savage-Rabbit]

Just not 12.10.

PS what is it with all you idiots talking about that one? It's been how long since we've all found out the release was a bit shite?

Yet still you come along with a story about how you have just changed over and it got all wrong.

Either
a) old news, you've whined time and time again about it. You've got your fix now shut the fuck up or we'll bring up apple failures from bloody years ago and see how you like it
b) made up, because you know it's both believable (because of the history of 12.10) and never going to be verified
c) redundant, you used to have this problem then either Ubuntu fixed it a couple of weeks later, but you still want mileage out of it, or you moved to some other distro. But still want more mileage out of it.

I'm figuring (b) myself.

No, I actually did this and that is a real story. If i'ts any consolation the upgrade from 11.04 to 12.04 also blew up in my face although not as badly as the upgrade to 12.10. If I was lying I would have posted AC... like you.

Re:I sure the EULA will tell me I cant do anything

[Kjella]

Depends on how it works, if it sends a list of installed software to Apple to check it's bad, but if it downloads a list of plugin signatures to disable because they're outdated and insecure that's not any worse or different than the antivirus downloading virus signatures. I don't see the privacy implications of that, would you elaborate?

Re:Larry Ellision

[Anonymous Coward]

Is worse than Hitler.

Goodwin was an optimist.

Re:I sure the EULA will tell me I cant do anything

[ganjadude]

again, If i run a 3rd party monitoring system, I allowed them into my system. If this is on by default, then I am not sure I am ok with this.. What if apple decides one day that they dont want YY running on macs anymore (they have remote wiped IOS apps that were not "harmful" in the past) they have that ability. I am sure most mac users dont even know about this. I asked a few of my friends who are die hard mac users in the past hour if they knew about this they had no idea.

Re:I sure the EULA will tell me I cant do anything

[John Hasler]

I dont like that windows "phones home" (niether does anyone here)

It doesn't bother me at all. You know why? Because I don't use Windows. You don't have to use it either. If you choose to do so, well, that's your choice. I have no objection to that, but I do get a little sick of people griping about the consequences of their own actions.

And that includes the "privacy issues".

Re:Fuck Java

[leenks]

Given the recent problems are due problems in the class library, how do you conclude the language is at fault?

Re:I sure the EULA will tell me I cant do anything

[ganjadude]

AS LONG as the information is presented in a way that users know what they are giving up. Meaning a fully secured system is close to useless because the onyl secure system is an unplugged system. We all know this, we are here on /. now having said that. In this day it is only right for these things to be made aware to the user. Instead of silently removing java, How about a popup explaining why it was disabled and options the user has? or a popup explaining that java is vulnerable, do you want to block it or continue to let it run. Silently blocking ANYTHING is wrong. just as silently installing anything is wrong.

Re:Good for them.

[sjames]

Firefox implemented 'click to play' for Java, Silverlight, and Flash. That just means that it only runs them is the user specifically requests it. There's a big difference between blocking outright and suggesting strongly not running it and then letting the user decide.

Re:I sure the EULA will tell me I cant do anything

[exomondo]

it is apple breaking into MY PC

so if you have automatic updates on - in any operating system or application - that means your system is getting 'broken into'?

Re:I'm Pretty Sure They Just Needed An Excuse

[leenks]

No. Apple do not provide Java any longer. Oracle is where you get Java for OSX from. Historically you got Java from Apple - and it was BIG on their list of priorities - it was a major part of the platform (WebObjects).

Re:I sure the EULA will tell me I cant do anything

[gnasher719]

Depends on how it works, if it sends a list of installed software to Apple to check it's bad, but if it downloads a list of plugin signatures to disable because they're outdated and insecure that's not any worse or different than the antivirus downloading virus signatures. I don't see the privacy implications of that, would you elaborate?

Apple has been using a blacklist that is updated daily to stop dangerous software from running. It is mostly used against trojans, but also to block Java running as a Safari plugin, which has some rather serious exploits (basically, an applet can replace the default Java security manager with its own, and from then on anything goes), _and_ it is known that these exploits are actually for sale.

So there are no privacy problems whatsoever, and while blocking Java applets might be annoying, the alternative would be highly dangerous. By the way, Oracle has released a new software version fixing about 50 security problems, which is not blocked.

Re:Good for them.

[mug funky]

well, on one hand i think big software companies really need to get their act together (java especially!) and fill in the wholes before releasing. a certain amount of unforseen patching is probably needed, but with something that's not used very often like Java (not used often = once a week or so at work) we run up against the very annoying problem of updating a boatload of things every time you run it.

given the fanatical dependence mac users have on their apple masters, if i were apple i'd want to disable as much third party stuff as possible that stands a chance of making me look bad.

in windows land, every fault is blamed on windows, when most problems are either third party software or third party drivers. with apple it's the same, though they have more (too much?) control over what runs, and so can do something about it.

i'd be on Oracle's case to fix their shit so they don't have to keep releasing patches that appear to be introducing more holes for spamfucks to crawl through.

Re:Good for them.

[mug funky]

i love the Hurd logo - representing all 4 of it's users.

Because...

[PopeRatzo]

You can't handle the truth!

Re:Good for them.

[mug funky]

your spelt "fascists" wrong...

Re:I sure the EULA will tell me I cant do anything

[exomondo]

again, If i run a 3rd party monitoring system, I allowed them into my system. If this is on by default, then I am not sure I am ok with this..

It's updating a blacklist because people have auto-update on, nothing more. You are not 'allowing them into your system'.

What if apple decides one day that they dont want YY running on macs anymore

That would obviously be pointless given the only thing going on here is updating a blacklist - which is editable by the user - when automatic update is on. So clearly if they were to do that for some reason then the information would be disseminated pretty damn quickly about the simple fix to avoid it.

Re:Good for them.

[PopeRatzo]

This is why I run GNU Hurd, the only truly free operating system, on my Lemote Yeeloong.

Hey, look on the bright side. At least people don't think you're a putz.

Maybe you don't have the latest MacBook with Mountain Lion. But you also don't wear pleather pants with the butt cut out.

OpenJDK Runtime Environment ..

[dgharmon]

"Apple hasn't issued any official statements advising users of the change or its reasons, but it's a safe bet that the company has deemed Oracle's most recent update to Java insecure"

Does this apply to the OpenJDK Runtime Environment

Re:Good for them.

[PopeRatzo]

If you are using a Mac , you are not generally the IT equivalent of a Yukon Frontiersman

No, you are the IT equivalent of the cast of Glee.

Re:I sure the EULA will tell me I cant do anything

[maxwell demon]

Did they hack your password?

Worse: They installed their own code on your computer. At root level, no less. They did so before sending the computer to you. It takes over the complete computer, so I'd say it's clearly a root kit. The name of that root kit is OS X. :-)

Re:This Mac user not angered.

[maxwell demon]

And in the mean time, the employee cannot work. This may well be more costly than the risk of a malware attack in that time frame.

Re:Good for them.

[countach]

Yeah well, as someone tasked with fixing this for a government department, Apple hasn't told me how to do it. Yes, some hackers figured it out. Yes, I can google and get their knowledge. But Apple didn't give me any way to push the fix out. Nor did they give a gui tool so I can email the users with instructions. In short, we're a bit screwed right now. We'll get over it sure, but in the mean time, tons of legal centres are out of action. is this good enough behavior? Surely not! Please don't defend this crap.

Re:Good for them.

[Cinder6]

The logo looks to me like someone tried, and failed miserably, to map out a token ring network.

Re:I sure the EULA will tell me I cant do anything

[rrohbeck]

If you ask this then maybe you shouldn't run Apple (or Microsoft for that matter) software.

Re:Good for them.

[ColdWetDog]

Ehm, doesn't Firefox also block vulnerable versions of Java? I guess maybe they are fascist as well.

Yes. FF puts up a nice warning and then lets you click through it if you so desire.

That's fine. No problems. Shutting down Java without any user identifiable explanation is a dick move. Interesting it's just on 10.6. 10.7 seems to trundle along just fine.

Re:Good for them.

[hairyfeet]

I think the bigger deal is they don't ask before they do it and while its been awhile since i ran vanilla FF I seem to remember it asking about such things before flipping any switches.

But you should already know what you are getting into if you buy Apple and their being the largest corp on the planet obviously means more people are happy about their way of doing things than not, so if that level of top down control makes you happy? Good for you, I sincerely mean that. I'm all for voting with your wallet and Apple is obviously doing what their customers want or their sales figures would be dropping, so good for them.

Re:Larry Ellision

[rubycodez]

if you mean in the realm of data processing automating, yeah Hitler didn't roll his own systems, he contracted IBM to do it for him.

Re:Good for them.

[jo_ham]

If you are using a Mac , you are not generally the IT equivalent of a Yukon Frontiersman

No, you are the IT equivalent of the cast of Glee.

Young, geeky, bullied by retards who hate them for liking something that the retards don't like? ;)

Re:Good for them.

[gigaherz]

Firefox DOES warn you about vulnerable versions of plugins and suggests disabling as the better option. Here is a list of blocked versions: https://addons.mozilla.org/en-US/firefox/blocked/

Secure by default

[smash]

Is to be commended. Unless, of course you are apple.

Re:Secure by default

[kenh]

Mnor issue - they weren't safe by default, they became safe through a change silently sent out to millions of Macs running OS X and didn't tell anyone.

How many Mac users called their IT departments and complained about needed apps not working, only to eventually find out it wasn't their IT group or their applications, but a decision by Apple?

Re:Secure by default

[smash]

So you're saying that being proactive about security devices with known remote exploits is bad? If you are running a fleet of machines in an enterprise and not controlling updates to them centrally, as can be done with OS X server quite easily, you deserve what you get, regardless of OS. For home users (the vast majority of Apple's user base) this is a good thing.

Re:Secure by default

[smash]

security updates, i mean.

Re:Secure by default

[butchersong]

If you own apple products you have to expect this... really it's a feature. The average user has no interest in what java (or to an extent even a plugin) is. OSX is a valid OS for these users. They have a safe and secure little word to work in that allows them to be productive and a -usually- benevolent dictator that maintains that world. This is what people buy apple products for no?

Re:I sure the EULA will tell me I cant do anything

[aklinux]

It's NOT your computer. You're just renting it from Steve. You could rent one from Bill instead, if you think it'l help any ;)

Re:Good for them.

[Skuld-Chan]

Its really easy for some nerd to say your a fool for using Java, but when you have a business line application line Sungard Banner (which uses Oracle Forms which is Java based) with 30 years of prior use its not so simple to just move on - yes we may be foolish, but what can one do at this point?

Apple shuts off Java and they essentially killed off our front line application.

Really all this does is make us move more towards Windows and Linux desktops for anyone who has a business need for a computer.

Re:Good for them.

[Skuld-Chan]

Its old news now, but they disabled Java and only let you run a version that wasn't even out yet.

Re:Good for them.

[solidraven]

And there I was thinking it was FDDI...

Re:I sure the EULA will tell me I cant do anything

[Skuld-Chan]

I'm pretty sure Microsoft would at least announce they are disabling Java before actually doing it.

Re:Good for them.

[ne0n]

Spelt is a noun. Ask any hippie. /ot

Re:Good for them.

[Nefarious Wheel]

If you are using a Mac , you are not generally the IT equivalent of a Yukon Frontiersman

No, you are the IT equivalent of the cast of Glee.

You owe me a new keyboard, mate. *And* a cup of tea. I will not charge you for the damage to my nasal mucosa.

Disturbing move

[daq man]

Firstly, I have nothing against Apple. I bought my first Mac, a Mac Plus in 1985 and I've owned one or more ever since. I find the current track that Apple is following to be very disturbing. Apple always used to be about the customer experience but that seems to be dead and gone. Yes, there was/is a security hole in the Java plugin but completely disabling the plugin is NOT a customer friendly solution and is disproportionate to the risk. Despite the vulnerability I have yet to hear of ANYONE who has been the victim on a Mac. Despite this Apple disabled a plugin that is critical to many people ranging from people running games like Runescape to companies who have legacy point of sale and inventory systems that use Java applets to access database backends. What is next? Disable Flash because of "security risks" what about OSX Applications? They are already forcing sandboxing and draconian rules on developers wanting to sell via the App store.

Keep this up and this is one Apple customer who is going to be looking for alternatives, and where there is one there are probably many.

Re:Disturbing move

[jbolden]

Company systems should be using Apple's server support solution and their admin can make an informed decision about it and do what they want. People running Runescape can just run in another browser.

Re:Disturbing move

[smash]

Despite the vulnerability I have yet to hear of ANYONE who has been the victim on a Mac.

I guarantee you that if this hole was not closed, with the lack of Java updates for various old mac platforms like 10.6, and Oracle's lethargy in getting updates out, there would sooner or later be plenty of examples of Apple users getting owned by this.

Hence, apple took the proactive step of disabling it. If you need it, you can re-enable it. the vast majority of their users are likely better off with it disabled, but irrespective of platform, the majority of end users are not pro-active about security unless their hand is forced.

Apple did the right thing here. Sure it would have been nice to have been given the option via a pop up, but that would likely have requried additional testing and likely been erroneously left enabled by a large portion of the userbase.

Apple seems to have an attitude problem with Java

[reluctantjoiner]

This is not the first time they've done stuff like this.

If you update your JDK using Software Update, it overwrites all previous versions and turns them into symbolic links to the current version. You then receive an unpleasant surprise when software which relies on a particular JDK breaks for no apparent reason.

The problem is not the changes themselves, but just unilaterally making these decisions and then not telling anyone. If I was working in an enterprise environment and this happened, I too would be incandescent with rage.

Apple killed flash, Java next?

[EmperorOfCanada]

Steve Jobs took flash out behind the woodshed and flash didn't come back for dinner. I can say without a doubt that flash is dead, yet if I wanted to counter my own statement I could easily pullup a massive pile of stats that would show Flash on a huge percentage of machines and websites but I can see clearly that no even vaguely bleeding edge websites use it. Flash is just not where the cool kids are. HTML5 has almost entirely taken over all the basic requirements of making a dazzling website that dances about on your screen. I also won't argue that feature for feature HTML+Javascript is better. I know my HTML5 will work on the tidalwave of mobile devices and that is enough for most people.

That all said Jobs killed it because Flash bugs were making him look bad. So now we have round 2 and Java is the one on the Apple chopping block. I think we can all agree that Java in the browser is dead and killing Java on Apple machines might not seem like it is going to ruin things marketshare-wise but keep in mind that many top top top executives are running Apple machines (often to the chagrin of their IT people) these same executives will now resent Java at tiny more than they did before (which might have been zero).

But all that said, I am pretty sure that 90% of the Java being written these days is for the server side of things in large organizations and thus is completely unaffected in theory.

A simple example of how irrelevant such an Apple technology choice can be would be the penetration of Objective-C outside of the Apple ecosystem. I code Objective-C every day and would never consider using it one inch outside of the apple ecosystem. But Apple's move underlines my experience that Java is just not the "Hot" language it was; not dead just not "hot". The mathematical problem with not being the "Hot" language is that it is starting to be nibbled away at the edges without any growth to replace this nibbling. I am seeing Python replacing it as the defacto learning language much as I watched Java replace Pascal as one of the defacto learning languages of the pre 2000's. In science Python is taking over, in finance I am seeing the academic world switching over but not the business world; the business world has a full on love of all things Java.

But before you cast any stones these are all trends; you can yell Hey Mindcraft is Java and it is cool. But what I am saying is that the surface area of Java is retreating toward a core of the business world and it is severely losing its grip on the "programming 101" world; which is where hearts and minds are won. Also keep in mind that many of the kids who may have been learning Java in their programming 101 classes just had all their code die seeing that university students so love their Apple laptops. Hearts and minds baby.

Re:Apple killed flash, Java next?

[mark-t]

This is about Macs, not iOS. Flash still works on Macs.

Re:Apple killed flash, Java next?

[smash]

For generous defitions of "works". It's still a piece of shit. Play high def video in flash - massive CPU consumption. Play 1080p 60 fps video in quicktime - 3% cpu load on my MBP 2011...

Re:Apple killed flash, Java next?

[Gen_Music]

Now compare filesizes..... FLV is web optimized to be high CPU high compression media. Granted flash on Mac is terrible, but a comparison to Quicktime isn't really fair.

Try downloading that file and running it in Adobe Media Player... CPU use back down to 5-7%.... strange.

RIP Slashdot

[niw3]

Goodbye old friend.

Re:Can you feel that Apple users

[EmperorOfCanada]

I would up-mod this had I the points. I can just see the whole appendix thing; awesome visualization. My guess is that some prude downmodded you. Or some PR flunkies. Too bad you went with the Anonymous thing.

Re: Good for them.

[PrimaryConsult]

It sounds like his users require Java for some crucial work-related application. So, if the choice was expose users to possibility of an exploit, or not get any work done, enabling a vulnerable Java is probably the less costly measure to take.

Re:Fuck Java

[jones_supa]

If you write Java, to hell with you. Worst language on the planet.

C++11 is the best language on the planet. Well, at least a very good candidate.

Fast compiled language, great toolchain, expressive, classy, and you can write any type of programs.

Re:Good for them.

[Waccoon]

I find it funny how yet another Windows8 story ran last week, and there were many suggestions that businesses should all switch to the Mac.

Re:Good for them.

[Stewie241]

I obtained a patch from my IT department that reversed the change. My understanding is that it modified a PLIST to change the minimum version of Java required.

Our VPN software uses Java, so it is a pain to not have it.

What is still annoying about it is that there is no way to selectively enable it. I understand that it is secure, that's fine. Consequently, I'd like to be able to whitelist Java applications that I trust (i.e. ones that come from corp) and not become vulnerable to ones that aren't trusted. Firefox has accomplished this by replacing the app with an 'Enable Javascript' button. With Safari you're either unable to work or you're letting it all hang out there.

Re: Good for them.

[countach]

So why didn't the fools at Apple allow disabling for applets, but enabling for Java web start and regular Java apps? If we are exposed unnecessarily to exploits, it is now Apple's fault.

Re:Good for them.

[Stewie241]

I have no problem with Apple disabling Java. I would like them to provide some notice and I would like them to provide a way to whitelist trusted applications. That doesn't seem unreasonable.

That kind of bit me today...

[AmazingRuss]

... I had a cloud server get funky on me and the java console for it ran in java. I had used it before, but suddenly...nothing.

Good thing I had a trusty Ubuntu box nearby.

Re:Good for them.

[Skuld-Chan]

Well they disabled it, and would only permit a version that wasn't even released - no documentation or anything.

I think us big customers could have been treated a bit nicer.

Anyhow yes I want it to still be enabled - our front desk machines can't browse anywhere they want ;).

Re:I sure the EULA will tell me I cant do anything

[AmazingRuss]

How was I supposed to know to search for 'disable XProtect' when the Java download link failed? I was cursing Oracle.

Re:Larry Ellision

[colinrichardday]

Not until he uses prisoners at Auschwitz to develop software.

Apples and Oracles

[oDDmON oUT]

So, in the name of security, Apple XProtects users of Snow Leopard and higher from the evil Java.

In the meantime Oracle's update is only good for Lion or better.

But usage numbers from last month showed 10.6 and lower as being the largest installed base of Mac OS.

I'm not seeing how either action works to the greater good of Mac users, especially since Oracle has updates good for XP.

Re:Good for them.

[DeathElk]

Java != Javascript

Re:Good for them.

[kenh]

so whole corporations and government departments are suddently shut down.

Woo-Hoo! Good one!

Whole corporations and government agencies? Which corporation other than Apple relies exclusively on Apple computers? I'm very curious which government departments are exclusively Apple shops...

Re:I sure the EULA will tell me I cant do anything

[kenh]

On Windows (and most other OS I've ever worked with) there would be an audit trail a system admin could follow that would document the changes to the OS. Did this change require users to "opt-in" to automatic updates, or was it done without notice to the end-user/system admins?

How to fix

[jbolden]

I'm not seeing this here. But since this is /. if you want to override:

look for your /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist
downgrade the java version. So for today this means change:
from:<string>1.6.0_37-b06-435</string>
to: <string>1.6.0_37-b06-434</string>

Re:How to fix

[thestuckmud]

That fix did not work for me. It changed the behavior (no more "invalid plug-in" message), but applets did not run. Apple published a system update (on OS X 10.6 at least) yesterday that repaired Java and upped its version above the XProtect.meta.plist minimum.

Re:Larry Ellision

[kenh]

Card sorters, punches, and printers... The IBM emplyees that strung them together were German.

Re:Good for them.

[jbolden]

You shouldn't be emailing this to users. Apple offers administrative servers that allow you to make the change directly. The charge is I think $50.

Re: Good for them.

[jbolden]

The "fools at Apple" make the security system a standard XML file which is editable by admins. You can do anything you want with it.

Re:Good for them.

[gutnor]

As I see it around here, the elite (i.e. the ones best placed on the political game) are the one that get fancy apple hardware (plebs get cheapo Dell and keep it for 6 years - getting a company Blackberry instead of continuing to use your iPhone is a sure sign of disgrace). There are maybe few of them, but when something wrong happens to them, all the work stop suddenly with everybody put into crisis meeting with additional status meeting 4 times a day.

Re:That's IMPOSSIBLE

[MadMaverick9]

Design as in: Apple controls what you can and can not do on "your" device.

Re:Good for them.

[kimvette]

The dictionary disagrees with you:

http://dictionary.reference.com/browse/spelt

spelt1 [spelt] verb
a simple past tense and past participle of spell1 .

spelt2 [spelt] noun
a wheat, Triticum aestivum spelta, native to southern Europe and western Asia, used chiefly for livestock feed.

http://www.merriam-webster.com/dictionary/spelt

1. chiefly British past and past participle of spell

2. Subspecies (Triticum aestivum spelta) of wheat that has lax spikes and spikelets containing two light red kernels. A related species, Triticum dicoccon, commonly known as emmer wheat or farro, was cultivated by the ancient Babylonians and the ancient Swiss lake dwellers; it is now grown for livestock forage and used in baked goods and cereals.

Mad as Hell

[thestuckmud]

I called AppleCare as soon as the plug-in showed up as invalid. The two most infuriating aspects of the call were the impression I got that Apple could hack into my Mac at any time (assuming a network connection to Apple) and the claim that Apple had not installed Java on my machine in the first place. After the call, I checked and indeed Java was installed when I bought the computer, directly contradicting the support supervisor's assertion, but I still have no proof of whether or not Apple has the power to silently force updates.

The security implications of promiscuously running Java applets, so Apple was right to do something. The problem is that they did so without warning; without asking permission; and with no obvious way to re-enable the plug-in. I understand that some people successfully re-enable applets by modifying XProtect.meta.plist, but all I managed was to eliminate the "inactive plug-in" message, leaving a completely empty gray rectangle.

Now, with Apple having repaired the problem, I'm calming down, but I've set up a blog, AppleHackedMyMac to discuss this, the possibly encroaching walled garden, security, and the like.

Re:Mad as Hell

[MadMaverick9]

https://www.apple.com/softwareupdate/

In addition to releasing new versions of the system software at regular intervals, Apple also releases a stream of free software updates to enrich your computing experience. Mac OS X automatically checks weekly for software updates provided you have an internet connection.

geez - set up a blog !?!?!? For what ??? Because you don't understand what YOUR computer is doing ???

This is exactly the same as Microsoft's Windows Update - it's a process running on YOUR computer that checks for updates on a regular basis. This has nothing to do with some company hacking into your computer.

If you don't like this, you should be asking the question how to disable this auto update service, instead of complaining that some company is hacking into your computer.

Now, on Microsoft Windows it's simple enough to disable Auto Updates and check manually whenever you feel like it. I don't know about Macs.

Yes - companies may include stuff in these updates that you don't like, but it's still YOUR computer downloading and installing these updates. Learn how to take control of YOUR computer instead of complaining, Sir.

Re:Mad as Hell

[smash]

Unless you are still running 10.5 (in which case, this is the least of your worries), or migrated applications from a previous install, no it was not installed when you received the computer from apple. Java on OS X has been classed as "deprecated" since 10.6 and only installed by the user manually or semi-automatically (prompted to download) when software that requires it is run.

Re:Mad as Hell

[thestuckmud]

Not so. Java was distributed as part of OS X 10.6.6. It is there in a nearly virgin partition set up for troubleshooting when I first got the computer. It's also on the 10.6.6 install DVD as Java.pkg and JavaTools.pkg in System/Installation/Packages.

(MadMaverick9: you completely missed the point. See the reply in my blog if you care, I'm not going to encourage a bad thread here.)

Re:Mad as Hell

[MadMaverick9]

Quotes copied from your blog:

when Apple silently pushed an update

http://developers.slashdot.org/comments.pl?sid=3430321&cid=42782627
Nothing silent about that.

What really got under my skin was the feeling that apple had a remote kill switch capable of disabling software on my computer, and that they had used it.

I left that support call convinced that Apple had hacked my Mac.

Like I said before - this shows you have no understanding of what's running on your computer.

Vendors (Apple, Microsoft, McAfee, Avast, etc, etc) all run programs on your computer as part of their software that automatically check for updates and installs them. If you don't like that, either don't use their software, or find a way to disable these automatic updates.

And as a result of these automatic updates, which most people don't disable, vendors do control your computer.

If you don't like that, don't buy their stuff. It's that easy. Use an OS that does put you , the User, in control.

Re:Good for them.

[jbolden]

Apple doesn't write Java, Oracle does. If you want a work around you are talking to the wrong large company.

Re:I sure the EULA will tell me I cant do anything

[jbolden]

How is it OK? Because you are running Apple's anti-malware tool and have configured it to pull the list from Apple's servers. A list which you can at will. So if you don't like it.

a) Disable their anti-malware
b) Pull the definitions from somewhere else
c) Modify the file however you want.

That just makes me wonder what else apple has access to???

Yeah it is isn't like Apple writes books on the design on Darwin, documents the add on services and makes the whole things open source. Oh wait.

Re:I sure the EULA will tell me I cant do anything

[jbolden]

Apple runs dozens of these protection services. The average end user has no idea where they do. Apple's position is pretty clear. If you don't know enough to be able to use launchctl and see what Apple is loading you don't know enough to make an informed decision about what should be running.

Lemote Yeelong is an amazing device.

[Andy Prough]

AC is a total D-bag for ripping such a sweet, fast, open-hardware, low-power device. If any grownups are interested in the specs on this 12-watt, 4-core laptop that runs without any proprietary bios or drivers, check here: http://www.lemote.com/en/products/Notebook/2010/0310/112.html

Re:Lemote Yeelong is an amazing device.

[smash]

Looks like it's from 1995.

Re:Lemote Yeelong is an amazing device.

[smash]

Fucking clueless anonymous coward. Got anything to contribute?

Re:Good for them.

[Anonymous Coward]

Just so you know, Apple only adds versions of Java to this list that are actively being exploited in the wild. Are you sure you want to take this risk?

If so, you should probably be using an npapi wrapper that limits java plugin to your specific domain, and while you're rolling that out, you can bypass the xprotect setting.

Re:I sure the EULA will tell me I cant do anything

[jbolden]

The Enterprise SDK lets you push out new provisioning files to managed devices. If you were to send an invalid provisioning file the app wouldn't run. Presuming that Apple can do anything you can do with the Enterprise SDK... does that count as a cite?

Re:Good for them.

[kelemvor4]

Maybe you don't have the latest MacBook with Mountain Lion. But you also don't wear pleather pants with the butt cut out.

[citation needed]

Re:Good for them.

[Stewie241]

Ah, yeah, typo sorry. I meant Java.

Re:I sure the EULA will tell me I cant do anything

[rubycodez]

get real, OpenBSD and FreeBSD let you choose a browser; chromium for example is in the packages. HURD? pffft, who gives a shit

Re:Larry Ellision

[rubycodez]

IBM USA collected the profits made by Dehomag (the german subsidiary). what was your point?

Re:Good for them.

[rubycodez]

i thought that was all four of its device drivers

Re:Good for them.

[gmhowell]

If you are using a Mac , you are not generally the IT equivalent of a Yukon Frontiersman

No, you are the IT equivalent of the cast of Glee.

Young, geeky, bullied by retards who hate them for liking something that the retards don't like? ;)

Disproportionately gay?

Re:I sure the EULA will tell me I cant do anything

[exomondo]

I don't know, i'm aware automatic updates is on, i can't remember whether it asked directly about it. In any case that doesn't answer my question.

I hadn't noticed.

[Tangential]

I'm running ML I could be very upset but actually, I hadn't noticed the blocking of Java. Perhaps the fact that I have it and Flash (along with a lot of other cruft) disabled in my browsers masked that fact.

How Does Apple Control This?

[softcoder]

My wife has an an Apple MAC OS/X. I don't recall ever giving Apple permission to modify my machine. Does Apple have a back door built into all OS/X systems that allows them to disable whatever they want at will without me knowing? What else can they do? Should I be encrypting all my disk partitions?
pgmer6809

Re:How Does Apple Control This?

[MadMaverick9]

https://www.apple.com/softwareupdate/

In addition to releasing new versions of the system software at regular intervals, Apple also releases a stream of free software updates to enrich your computing experience. Mac OS X automatically checks weekly for software updates provided you have an internet connection.

Re:How Does Apple Control This?

[mysidia]

What else can they do? Should I be encrypting all my disk partitions?

If you run the software; then you trust the vendor. Full stop.

If you don't trust a software vendor, don't run their software, and especially not their operating system.

Java was blocked by an update to Apple XProtect Definitions.

Software update is responsible for providing the updated definitions.

Re:How Does Apple Control This?

[Gen_Music]

Encryption doesn't change anything. Apple made the operating system, the very thing you must give your password/hash to to decrypt the drive data in order to use it.

Re:Good for them.

[mysidia]

Apple hasn't told me how to do it. Yes, some hackers figured it out.

Did you call Apple Enterprise support? Does your organization have the proper agreements in place with Apple, for them to support use of OS X by a business (instead of ordinary consumer use) ?

Did you voice the concerns with your Apple rep?

Re:Good for them.

[mysidia]

with 30 years of prior use its not so simple to just move on - yes we may be foolish, but what can one do at this point?

Since Java was not commercially available until 1995; it's not possible that there is 30 years of prior use.

Although the point is well taken that Apple broke for some users a business line application with its security policy decision .

For consumer devices it's the right choice. IT needs to override Apple's policy decision, for their businesses; and not allow vendors to make configuration changes like blacklisting software -- without IT validating the change.

Apple's security policies should always be what will keep the greatest number of users in the safest situation -- even while inconveniencing the few who are using an uncommon functionality.

Change control 101. The proper response was for IT to disable blacklisting in the first place, and carefully monitor any blacklisting activity by the software vendor, to determine if they need to do anything for their Enterprise environment.

It's just one of the risks you take, if you allow an outside vendors to define patterns, version, or identity of applications that are not allowed to run, or patterns that are deemed risks; and change those patterns without review.

Re:Good for them.

[mysidia]

Uh this was a zero day active exploit. Are you saying you WANT to deal with that? Apple did you a favor. Are you so confident in your staff's ability to avoid getting owned. That's a lot of very sensitive info you would be compromising.

Sometimes being able to work, AND being vulnerable: is not as bad as a complete work stoppage.

There is a risk that you might be targetted by a zero day exploit, that might be successful. Say that risk is 1%; and the cost of a breach is 15 million$; mostly spent in legal fees, compliance fees -- sending letters to customers about the data breach, settling any legal complaints, etc.

Now let's say you rely on Java for many critical business functions, and you have a 50% work stoppage, if your workers can't start Java -- they can't access CRM, ERP, customer support systems, billing, Order taking, etc.

The work stoppage for 1 hour costs $3 million.

Now: What is worse: A 1% risk of losing $15 million, OR a 100% risk of losing $3 million, due to shuttering of the business applications, not being able to take orders, and losing customers, due to CSR unable to provide satisfaction, without working CSR applications?

Let's try a bank analogy....

A new zero-day vulnerability has just been discovered in a certain vendor's ATM; that allows a criminal to possibly use a simple technique to enumerate account numbers of other bank customers, and withdraw arbitrary amounts of money from their account without entering a PIN number.

Upon discovering this, does the bank immediately shut down all their ATMs, for fear, a thief will abuse it? [Despite angering all their customers, denying everyone access to their money, and losing 20+ millions of dollars a day due to account closures -- versus the 2 or 3 million in expected losses due to thievery]

or do they begin discretely working with the software vendor to develop a patch, while putting in place monitoring to search for signs of abuse?

Re:Good for them.

[thenextstevejobs]

Java != Javascript

If you're writing JavScript, don't forget to use the !== operator instead of !=

Re:I sure the EULA will tell me I cant do anything

[smash]

I think you're extremely misguided with regards to how xprotect works.

Re:I sure the EULA will tell me I cant do anything

[smash]

I'd go so far as to suggest not believing ANYTHING you read about apple posted on slashdot until you have verified the facts yourself.

Re:I sure the EULA will tell me I cant do anything

[smash]

And so you should be cursing oracle. If the software wasn't so hideously insecure, it wouldn't be on the blacklist.

Re:Java compilation?

[emt377]

See also: http://phys.org/news/2013-01-false-beliefs-persist-instant-online.html

Re:I sure the EULA will tell me I cant do anything

[smash]

but they make it easy and obvious how to turn it back on

thereby defeating the purpose of disabling it, if the click-drool uninformed end user can just turn it back on without having to look it up and perhaps be told why it is a bad idea.

Re:This Mac user not angered.

[emt377]

It's easy to override for those who need it. A competent IT department will do so remotely.

Re:This Mac user not angered.

[smash]

Well that depends doesn't it. If the end user is hacked and divulges sensitive information, it could cost the company millions in fines/lost business/etc.

Re:Apart from Jobs you mean?

[smash]

Jobs wasn't greedy. he just had a low tolerance for bullshit, and his view of what "bullshit" is may or may not align with others.

I too, after nearly 20 years in IT, have a very low tolerance for bullshit. I'm willing to pay extra for bullshit problems to go away. This is why I run a Mac at home these days.

Re:I thought Apple was immune

[smash]

It is mostly immune because apple is proactive about security by doing things like this. For the average end user who thinks passwords are too difficult to deal with and would rather just have a blank password, this helps protect end users from themselves. If you know you need otherwise, you can work around it.

Re:Good for them.

[EuclideanSilence]

...They disabled Java Web Start too, so whole corporations and government departments are suddently shut down...

That's terrible. Just terrible. So, hypothetically, how often would someone need to find Java bugs to keep them shut down?

Oracle makes the JVM.

[VortexCortex]

Oracle owns the rights to the Java VM, but Java language is also used with the Davlik VM on Android. The less people are able to use and develop for Java, the less potential they have to create code that is cross platform (runs on many OSs, not just targeting a single OS), and the less potential they might take up coding applications for Android.

Other languages can compile down to Java byte-code too.

I'm not saying this was Apple's motive, but they're not exactly strong points that would presuade Apple to not make it hard to use Java on Macs either...

Re:Oracle makes the JVM.

[jisatsusha]

It has literally nothing to do with Android, and it has basically nothing to do with Java development in general. All they did was disable the browser plugin because of a critical security bug in older versions, which Android doesn't anyway, and installing the latest update will reenable it.

Re:Good for them.

[rs79]

That's two more users that sites that still use Java.

I shut it off years ago. Every year or so it whines about a missing plugin. But realistically, at this point nobody sane uses Java and there's so little out there it's not worth worrying about.

Re: Good for them.

[Anonymous Coward]

Yeah you can quote Einstein in the XML or introduce the complete works of Shakespeare, anything you like, but that doesn't mean it will work.

Here's something for you to include in all your XML:
<Idiot />
 

Re:I sure the EULA will tell me I cant do anything

[Runaway1956]

If I owned a Mac, the first thing I would do is to investigate disabling automatic updates, remote control, and other internet access that I didn't approve of.

It's standard procedure. FFS, it's so standard, that even my sons do as much with all their devices. They demand that WHATEVER THE HELL they are running, it runs THE WAY THEY WANT IT to run.

There's this newfangled tool that you've likely never heard of: http://lmgtfy.com/?q=How+to+disable+automatic+updates+on+Mac

Re:Good for them.

[Joe Tie.]

Nice in theory. In practice you're describing almost every middle class person in western countries. And I'd wager to say most people in general. Even if the middle class in the west is the single greatest representation of it.

Re:Good for them.

[mwvdlee]

Was this article about Apple blocking Java just in Safari or completely on their entire OS?

Re:So you were able to run Linux.

[Savage-Rabbit]

You're picking a fight with AC?

You just lost everything.

Yawn... my point still stands Linux software can be just as crappy as any other software. The OP pretty much lost everyting when he claimed the contrary. All you have to do to see that is visit the Ubuntu AQ site.

Re:Good for them.

[DKlineburg]

I want my bank to yank the machines. I don't want my money stolen because you can't plan ahead and visit a branch during business hours.

Re:Good for them.

[JonJ]

Oracle didn't block java, you tool

Re:Good for them.

[Anonymous Coward]

BiOS?

Very bad for Danish Mac users

[Waldeinburg]

In Denmark we have a login system (NemID) which is needed to log in to all home-banking systems and all government websites like administration of taxes, social security etc. The login is done with a Java applet (which doesn't even work in OpenJDK, only Oracle).

Re:Good for them.

[gl4ss]

Uh this was a zero day active exploit. Are you saying you WANT to deal with that? Apple did you a favor. Are you so confident in your staff's ability to avoid getting owned. That's a lot of very sensitive info you would be compromising.

if you're running it for webstart it doesn't matter that much if there's an exploit.

what apple should have done is that they should have added a "do you really want to run this applet??" dialog to their fuckin browser like every other decent browser has. that then again doesn't have as much to do with webstart, though that as well should have the same question because webstarted programs can do pretty much anything anyways(exploits or not!).

apple did no favors to anyone here. and they can still get and run a dmg with no warnings whatsoever. however they'll be sure to disable that in an osx update in 2014 "to protect users"(to get everone to download their apps from appstore exclusively).

Re:Good for them.

[jbolden]

How does Apple know what Java apps to whitelist?

Your number is too low for you to be acting this young.

Re:Good for them.

[blane.bramble]

Considering I had a commercially available, off the shelf java development environment in 1998/1999, I think you might like to reconsider - Java may not be 30 years old, but it's older than 10.

Re:Good for them.

[RaceProUK]

They don't ask unless by "ask" you mean "telling you about it afterwards".

Yes Mozilla is a little bit less fascist than Apple, but not much

It must be so hard for you, having to click the big grey warning Firefox shows to run Java applets. The effort required to move the mouse an inch and the button a millimetre is such a huge PITA I'm surprised it hasn't caused World War III.

Re:Good for them.

[ifrag]

I only realize a computer doesn't have Java installed when I try to start Minecraft.

Re:Good for them.

[sproketboy]

Keep apologising for Apple you dufus fanboi.

Re:Fuck Java

[jareth-0205]

If you don't know the difference between a language and a runtime, then you don't get to comment on the situation...

Re:"Stealthy" is misleading

[CrazyBusError]

That may work now, but it certainly wasn't the case at the beginning of last week.

My other half has a remote desktop system so she can work from home if required that uses a java plugin. Last week, all of a sudden, it didn't work, with just a 'plugin inactive' message on screen. Clicking on that took you to software update, which showed no available updates, because this is on a Snow Leopard machine that there wasn't an update for yet.

There was no explanation of what was going on (plugins showed as allowed in the preferences pane) or whether it was an issue with the remote desktop provider or Apple, or anything. Somewhat frustrating and took me far longer than it needed to have done to sort, including raising a ticket with remote desktop software provider, which we now have to cancel.

I do like Apple hardware and software under most circumstances, but this wasn't one of their better moves.

Makes sense for Apple's customer base

[JDG1980]

When judging this move, I think it's important to keep in mind the intended user base of MacOS systems. These are not intended to run legacy, mission-critical business apps. In fact, Apple has never really cared that much about legacy support – backwards compatibility has always been a Windows thing. (Steve Ballmer seems to be forgetting why people stick with his company, but that's a different issue.) Macs are aimed primarily at home users, with a secondary but still strong user base among graphics arts professionals. For both of these demographics, the risks of leaving obsolete, bug-ridden versions of Java enabled far outweigh any potential benefits. Most of these people will never run any Java applications at all, and of the few who do, almost all will be able to use the up-to-date version of Java to do so. Yes, I know there are crappy "enterprise" apps that only work on 1.4.2 beta or some such nonsense, but Apple doesn't care about that – and frankly, they shouldn't. That isn't their target market. If you run a business you should be using Windows 7 for your desktops – it's designed from the ground up to be suitable for both home users and enterprises, and lets you control all the security stuff through group policy.

Thanks for the late news, Slashdot

[jdavidb]

I spent all day Thursday troubleshooting one of our all-Mac customers with six other people in the room, all shouting different ideas. Only at the end of the day did we discover the news. I was really shocked Slashdot hadn't reported it.

I went home and had nightmares about installing and reinstalling Java on Mac.

Re:Good for them.

[Cro Magnon]

I'm at work during business hours, you insensitive clod!

Re:I sure the EULA will tell me I cant do anything

[Cro Magnon]

get real, OpenBSD and FreeBSD let you choose a browser; chromium for example is in the packages. HURD? pffft, who gives a shit

I'm sure it's a serious issue to the Hurd users. Both of them.

Re:Good for them.

[sumdumass]

So let them provide a pop up warning of the dangers instead of making the data completely inaccessible. And no, if the in house Java app is the only java running on the system, it no more compromising then it was before.

You can disable Java in most all browsers and still have it run applets and programs on the desktop. This is what I have done with windows machines so we aren't needing to replace $60k software packages because apple doesn't understand things.

Re:Good for them.

[helix2301]

A lot of people are mad because so many online banks use java. I understand Apple trying to protect there uses but people need to pay bills. At least make an announcement on apple.com or something.

Really

[TheSkepticalOptimist]

All 7 remaining people using Java are angered?

Re:I sure the EULA will tell me I cant do anything

[Plumpaquatsch]

Meaning a fully secured system is close to useless because the onyl secure system is an unplugged system.

Dude, do us all a favor, and make your system super safe.

Re: Good for them.

[countach]

Erk... does it even allow disabling only applets? Is it even documented anywhere?? Is there a gui for it? Nobody knows the answers to these questions. We only know about this XML because hackers found it.

Re:I sure the EULA will tell me I cant do anything

[drcagn]

And OS X doesn't let you choose a browser?

Re: Good for them.

[jbolden]

Does it even allow disabling only applets?

No.

Is it even documented anywhere??

It is a pretty clear file.

Is it even documented anywhere??

It is at the Darwin layer. Darwin is open source.

Is there a gui for it?

There are lots of XML editing GUIs.

Re:I sure the EULA will tell me I cant do anything

[rubycodez]

MINIX 3 ate all HURD's market share, what with its features including actually being functional

Re:Good for them.

[cheesybagel]

You would be surprised at how many sites still use it. It is fine as long as you are writing a servlet or using JSP or something like that. Just don't use EJBs. Please. Most abused misfeature I have ever seen.

Re:Good for them.

[cheesybagel]

Oh and if you check the TIOBE index Java is increasing the lead over C# again. Probably because C# popularity is falling like a rock. Even Miguel de Icaza has stopped pushing for it. I do not know if it is from all the Android programmers, or how Microsoft is falling out of grace even from general purpose computing applications, or what.

Re:LOL

[smash]

No, its because people KNOW not to put Windows on the internet. The thinking that "oh, it's linux it is secure, we can put it on the internet" by people without a clue means they get hacked.

Yes, the circumstances are different. It's the delusional thinking above that creates those circumstances.

Re:I sure the EULA will tell me I cant do anything

[Gen_Music]

Actually, he wasn't saying that, he was asking why people expect double standards for Apple when they are doing what he perceives as phoning home too.

Re:I sure the EULA will tell me I cant do anything

[Gen_Music]

The whole thing IS NOT open source. If you pulled the FOSS parts of OS X out of OS X you would have no boot, no interface (due to dsmos crypto), no sound or graphics (CoreAudio and Quartz are closed source), no code execution, and so many other things that need no mention.

The only part of OS X that is open source is the low level part and that's because they assimilated an Open Source project to make it in the first place. All edits and additions to the code are the result of needing to update the low level API and kernel infrastructure to support new functionality for themselves. All the mid-level API's are proprietary, and as a result OS X as a whole is NOT open source.

Disbelieve me, please post xprotects source.

Re:I sure the EULA will tell me I cant do anything

[jbolden]

I have to admit I'm not an expert but I believe they are just using: http://www.clamav.net/lang/en/ to implement File Quarantine.

"relies on a particular JDK" is the problem

[tepples]

Why would software written in 100% Pure Java or otherwise using the Java libraries correctly rely on a particular JDK?

How would animutations be made in HTML5?

[tepples]

Flash is just not where the cool kids are. HTML5 has almost entirely taken over all the basic requirements of making a dazzling website that dances about on your screen.

So where's HTML5 CS that can be used to make self-contained animations and games like what you see on Newgrounds? Let me know when something like French Erotic Film (safe for work, despite the name) is ported to HTML5 without bloating it by a factor of ten by rendering it to video

Re:I sure the EULA will tell me I cant do anything

[rubycodez]

I have that at work, with firefox and chrome also installed, but for some things the Safari just pops up. Apple controls your horizontal and your vertical....

Re: Good for them.

[countach]

>Does it even allow disabling only applets?
>
>No.

So it's completely broken then, and promotes insecurity.

And if the XML isn't documented, no matter how "clear" it may or may nor appear to be, then I risk in the future having entire companies shut down because some update assumed something I didn't know. Nice one Apple.

Re: Good for them.

[jbolden]

So it's completely broken then, and promotes insecurity.

How is it completely broken? It doesn't look inside applications and from Apple's perspective that's inside. If you want to enable specific things you turn them on.

And if the XML isn't documented, no matter how "clear" it may or may nor appear to be, then I risk in the future having entire companies shut down because some update assumed something I didn't know. Nice one Apple.

Apple provides a management interface to push updates on managed computers. You don't have any risk because managed computers update from the management servers not Apple.

Apple Brain Matrix

[aurizon]

My Mac users are childlike creative spirits, there are bad things out there, they will get eaten, I must protect my own, what else can I do?

Re:I sure the EULA will tell me I cant do anything

[Gen_Music]

Impossible. ClamAV uses Windows binary heuristics. Mac OSX would not be able to detect any viruses for itself with that but would detect Windows viruses, and I have tested first hand as to how well Mac OSX detects Windows viruses - it doesn't.

Re:I sure the EULA will tell me I cant do anything

[jbolden]

OK. Interesting so is your theory they are buying it from someone or just keeping it in house? And if so why?

Re:I sure the EULA will tell me I cant do anything

[Gen_Music]

Apple integrating third party software into their core would be like Labi Siffre making a record with Skrillex. Apple's main marketing line is that everything they make 'just works' and that is based on the fact that the entirety of OS X is made in house aside from the FOSS bits. Apple couldn't FOSS the antivirus as that would just invite workarounds, cracks and attack vectors to be developed. Apple's style would be to buy a small nimble security company and re-purpose their tech, and I've seen zero security tech purchases so far.

Apple Open-Sourcing their antivirus would be like sending North Korea a complete library of blueprints on American military equipment because hackers would have access to the source code so they could see any flaws or holes that exist. Sure after a couple of battles/major viruses those holes would be patched going forward, and that's why AVs like ClamAV are so robust, but Apple has share prices to think about and one major outbreak is all it takes for that to nosedive.

Right now I suspect Apple don't even have heuristics (scanning of application files for bits of code that look malicious in order to catch new virii), they work on sigs, where Apple find a virus then update your list silently. Java is now being identified and blocked in a similar manner.