Adobe: Click-to-Play Would Have Avoided Flood of Java Zero-days

mask.of.sanity writes: Oracle could have saved mountains of cash and bad press if Click-to-Play was enabled before Java was hosed by an armada of zero day vulnerabilities, Adobe security boss Brad Arkin says. The simple fix introduced into browsers over the last year stopped the then zero day blitzkrieg in its tracks by forcing users to click a button to enable Java.

Comments

also applies to flash and acrobat

[slashdice]

how's them apples?

Re:also applies to flash and acrobat

[i kan reed]

That's why we all have flashblock, right?

Re:also applies to flash and acrobat

[tepples]

To run Chromium without the proprietary extras that come with Google Chrome, Google's solution is "compile it yourself", as far as I can find. Many GNU/Linux distributors provide Chromium, but the "Beta or Dev channel" link on Google's "getting involved" page points at Google Chrome including proprietary extras. Or are Windows and OS X "big brother operating systems" that defeat the purpose of running open source Chromium?

Re:also applies to flash and acrobat

[bill_mcgonigle]

That's why we all have flashblock, right?

This is actually a problem. I've been running Flashblock, then NoScript, for probably 8 if not 10 years. The problem was well-known then, and Google and Netscape (and Safari?) did something about it a year or two ago.

I miss the days when browser vendors weren't afraid to rapidly innovate and take bold, important steps. For all that time, the Internet was much, much less safe for their cowardice.

Re:also applies to flash and acrobat

[Anonymous Coward]

I miss the days when browser vendors weren't afraid to rapidly innovate and take bold, important steps.

That's crazy talk. Browser vendors *are* innovating. Why just yesterday my computer automatically upgraded to Firefox ESR 31. I was surprised to discover in this new version that Mozilla has rearranged the browser display and hidden more options and buttons behind a single menu button. If you thought it was easy to get to a button with a single click, just wait until you have to make several more clicks to do the same thing. Now that's innovation and forward thinking!

And I can't forget to mention that the browser tabs now have rounded edges. Browser vendors are at the cutting edge of innovation, bringing the public the things they need most. You just weren't paying attention.

Pot, This is Kettle

[Anonymous Coward]

Adobe isn't exactly in the best position to be lobbing stones at others' houses of security.

Hindsight...

[MCROnline]

...is such a beautiful thing.

Click-to-Play Would Improve Flash, Too

[Lilith's Heart-shape]

Click-to-Play makes flash videos better by making them less useful as advertisements. Content like Flash and Java should always, always require the user's consent before running. There's no excuse for doing otherwise. Any code that doesn't await the user's consent before running is malware, and should be handled as such by any means available.

Re:Click-to-Play Would Improve Flash, Too

[Anonymous Coward]

If you think Java is JavaScript then you're wrong. And on the other hand, if you think JavaScript on Slashdot is "code that doesn't await the user's consent before running", I'd say you give consent for Slashdot to run JavaScript when you visit the site. Any third party JavaScript, however, is quite often pretty close to spyware/malware, but there are tools such as NoScript and Ghostery to limit when and how these scripts are run if they're even run at all.

Comment removed

[account_deleted]

Comment removed based on user account deletion