Slashdot Mirror
Apple Angers Mac Users With Silent Shutdown of Java 7
An anonymous reader writes in with news of the continuing saga of Java patches and exploits. "If you're a Mac user who suddenly can't access websites or run applications that rely on Java, you're not alone. For the second time in a month, Apple has silently blocked the latest version of Java 7 from running on OS X 10.6 Snow Leopard or higher via its XProtect anti-malware tool. Apple hasn't issued any official statements advising users of the change or its reasons, but it's a safe bet that the company has deemed Oracle's most recent update to Java insecure. That's why the company stealthily disabled Java on Macs back on Jan. 10, the same day a Java vulnerability was being exploited in the wild."
If you ran Linux you wouldn't have to worry about software not being able to run.
Update 13 is already out, and *not* blocked by Apple. All that's blocked are the old, insecure (well, more insecure) versions.
Ask me how the Heisenberg Principle may or may not have saved my life.
Without Java applets, my plan to time travel back to 1997 and surf the web is completely ruined!
There's no -1 for "I don't get it."
This is why I run GNU Hurd, the only truly free operating system, on my Lemote Yeeloong. My freedom is incredible. I can run ls and cat and EVERYTHING. I look forward to support for manpages in 2017.
You do realise you can disable this right?
https://discussions.apple.com/thread/4762386?start=0&tstart=0
Quite amazing what a google search for 'disable XProtect' turns up..
Ehm, doesn't Firefox also block vulnerable versions of Java? I guess maybe they are fascist as well.
It's monitoring in the same sense that antivirus software is monitoring.
SJWs are the new boogeyman. -Me
Java... free. VirtualBox... free. Oracle Linux... free. How can you say they're greedy?
On Windows, Java installs the Ask Toolbar (for now - other times it installs other shit) every time it updates to a new version unless the user realizes Oracle is a two bit hole in the wall company and unchecks the default boxes to opt out. That's greedy. To an even greater extent that's sleazy and just...trashy.
"I zero-index my hamsters" - Willtor (147206)
Let's not let the facts get in our way.
Thirty four characters live here.
There is very little reason to offer such option since users should not use vulnerable versions of plugins. The plugin vendor should fix the problem and update the plugin.
a) it's old news ;)
b) both the Java 7 (from Oracle) and Java 6 (from Apple) updates that address this are already out . Is the new motto Recycling obselete news that matters
c) if you want to opt out from Xprotect, how to guides abound
d)it's the Safari plugin only - other browsers are not effected
e) Apple have pulled the trigger on Xprotect maybe 4 times in 3 years, its not like they are shotgunning
The vulnerabilities from Java 7 were hideously large, and Apple probably did the right thing for the 99 percent who don't know any better. Driveby root access isn't all that fun for the target.
The 1 percent who care, can disable Xprotect temporarily if they want to.
For anyone in between, they could always use another browser.
If you are using a Mac , you are not generally the IT equivalent of a Yukon Frontiersman
Wow... Apple can't catch a break... You know damn well people would be bitching if they hadn't done this... Apple Fails To Disable Java 7. Millions of Macs Vulnerable. News at 11.
The real Sig captains the Northwestern. This one captains
Two issues. Firstly Apple didn't just disable web applets. They disabled Java Web Start too, so whole corporations and government departments are suddently shut down. Secondly, they didn't provide any announcement, or a gui tool to re-enable at your own risk. It was just nuke everyone in silence.
...Oracle [...] unchecks the default boxes to opt out. That's greedy. To an even greater extent that's sleazy and just...trashy.
Thank you! It's amazing how many customers bring in their computers for a tuneup who have no idea how they got the Ask toolbar. Granted it is just as much the user's fault for not reading, but at the same time, the user puts a lot of trust in such a major-name product and shouldn't have to worry about having something slipped by them.
Your information is woefully out of date. Oracle is where you get Java for OS X, and it's been that way for a couple years.
The summary is incorrect with saying Apple blocked Java 7 on 10.6. Actually, Snow Leopard can't run the new Java from Oracle, it can only run the Apple version of it which is still the 6 series. With this last round of blocking, Apple also blocked their own version on Snow Leopard and Apple has not yet released an update for it last time I checked. Now, in my opinion, this whole blocking thing without notice was extremely unprofessional and made me disappointed in Apple, and that's coming from a Mac fan. I got hit with it the other day and spent hours trying to figure out why in the world Java wasn't working on my machines. Ended up finding a work around editing a .plist file using a console text editor. Definitely not a solution for anyone not familiar with the command line.
maybe
Depends on how it works, if it sends a list of installed software to Apple to check it's bad, but if it downloads a list of plugin signatures to disable because they're outdated and insecure that's not any worse or different than the antivirus downloading virus signatures. I don't see the privacy implications of that, would you elaborate?
Live today, because you never know what tomorrow brings
Is worse than Hitler.
Goodwin was an optimist.
Firefox implemented 'click to play' for Java, Silverlight, and Flash. That just means that it only runs them is the user specifically requests it. There's a big difference between blocking outright and suggesting strongly not running it and then letting the user decide.
Depends on how it works, if it sends a list of installed software to Apple to check it's bad, but if it downloads a list of plugin signatures to disable because they're outdated and insecure that's not any worse or different than the antivirus downloading virus signatures. I don't see the privacy implications of that, would you elaborate?
Apple has been using a blacklist that is updated daily to stop dangerous software from running. It is mostly used against trojans, but also to block Java running as a Safari plugin, which has some rather serious exploits (basically, an applet can replace the default Java security manager with its own, and from then on anything goes), _and_ it is known that these exploits are actually for sale.
So there are no privacy problems whatsoever, and while blocking Java applets might be annoying, the alternative would be highly dangerous. By the way, Oracle has released a new software version fixing about 50 security problems, which is not blocked.
i love the Hurd logo - representing all 4 of it's users.
again, If i run a 3rd party monitoring system, I allowed them into my system. If this is on by default, then I am not sure I am ok with this..
It's updating a blacklist because people have auto-update on, nothing more. You are not 'allowing them into your system'.
What if apple decides one day that they dont want YY running on macs anymore
That would obviously be pointless given the only thing going on here is updating a blacklist - which is editable by the user - when automatic update is on. So clearly if they were to do that for some reason then the information would be disseminated pretty damn quickly about the simple fix to avoid it.
You know, if you xor the file with the right key, you'll get a text demanding your soul and your first-born. :-)
The Tao of math: The numbers you can count are not the real numbers.
Hey, look on the bright side. At least people don't think you're a putz.
Maybe you don't have the latest MacBook with Mountain Lion. But you also don't wear pleather pants with the butt cut out.
You are welcome on my lawn.
No, you are the IT equivalent of the cast of Glee.
You are welcome on my lawn.
Yeah well, as someone tasked with fixing this for a government department, Apple hasn't told me how to do it. Yes, some hackers figured it out. Yes, I can google and get their knowledge. But Apple didn't give me any way to push the fix out. Nor did they give a gui tool so I can email the users with instructions. In short, we're a bit screwed right now. We'll get over it sure, but in the mean time, tons of legal centres are out of action. is this good enough behavior? Surely not! Please don't defend this crap.
The logo looks to me like someone tried, and failed miserably, to map out a token ring network.
If you can't convince them, convict them.
I like how Adobe Reader comes with the very useful software "McAfee Security Scan Plus".
No, you are the IT equivalent of the cast of Glee.
Young, geeky, bullied by retards who hate them for liking something that the retards don't like? ;)
Its really easy for some nerd to say your a fool for using Java, but when you have a business line application line Sungard Banner (which uses Oracle Forms which is Java based) with 30 years of prior use its not so simple to just move on - yes we may be foolish, but what can one do at this point?
Apple shuts off Java and they essentially killed off our front line application.
Really all this does is make us move more towards Windows and Linux desktops for anyone who has a business need for a computer.
I would up-mod this had I the points. I can just see the whole appendix thing; awesome visualization. My guess is that some prude downmodded you. Or some PR flunkies. Too bad you went with the Anonymous thing.
It sounds like his users require Java for some crucial work-related application. So, if the choice was expose users to possibility of an exploit, or not get any work done, enabling a vulnerable Java is probably the less costly measure to take.
I find it funny how yet another Windows8 story ran last week, and there were many suggestions that businesses should all switch to the Mac.
So why didn't the fools at Apple allow disabling for applets, but enabling for Java web start and regular Java apps? If we are exposed unnecessarily to exploits, it is now Apple's fault.
I have no problem with Apple disabling Java. I would like them to provide some notice and I would like them to provide a way to whitelist trusted applications. That doesn't seem unreasonable.
Well they disabled it, and would only permit a version that wasn't even released - no documentation or anything.
I think us big customers could have been treated a bit nicer.
Anyhow yes I want it to still be enabled - our front desk machines can't browse anywhere they want ;).
Java != Javascript
The "fools at Apple" make the security system a standard XML file which is editable by admins. You can do anything you want with it.
AC is a total D-bag for ripping such a sweet, fast, open-hardware, low-power device. If any grownups are interested in the specs on this 12-watt, 4-core laptop that runs without any proprietary bios or drivers, check here: http://www.lemote.com/en/products/Notebook/2010/0310/112.html
No, you are the IT equivalent of the cast of Glee.
Young, geeky, bullied by retards who hate them for liking something that the retards don't like? ;)
Disproportionately gay?
Jesus was all right but his disciples were thick and ordinary. -John Lennon
Apple hasn't told me how to do it. Yes, some hackers figured it out.
Did you call Apple Enterprise support? Does your organization have the proper agreements in place with Apple, for them to support use of OS X by a business (instead of ordinary consumer use) ?
Did you voice the concerns with your Apple rep?