INTERACT FORUM

More => Old Versions => JRiver Media Center 18 for Windows => Topic started by: nwboater on January 13, 2013, 03:18:05 pm

Title: Java Scare!
Post by: nwboater on January 13, 2013, 03:18:05 pm
In a very unusual move the US Department of Homeland Security has advised all computer users to disable Java because of security vulnerabilities.

 http://www.techradar.com/news/software/applications/u-s-government-advises-users-to-disable-java-1124717

I have already done this on my desktop and would also like to on our HTPC and it's Clients. Wondering if there is anything in MC18 that may require Java? There is apparently no fix available short of disabling or uninstalling Java.

I strongly suggest that everyone Google this issue and act upon it appropriately.

Rod
Title: Re: Java Scare!
Post by: HTPC4ME on January 13, 2013, 03:27:36 pm
thanks.
 http://www.pcmag.com/article2/0,2817,2414238,00.asp
Title: Re: Java Scare!
Post by: nwboater on January 13, 2013, 03:29:35 pm
Apparently Oracle has been working hard on this over the weekend. They just came out with Java 7 Update 11 which replaces the vulnerable Update 10. Hope it does the trick! Installing now.

Rod
Title: Re: Java Scare!
Post by: InflatableMouse on January 13, 2013, 03:42:40 pm
I never use Java and I even have Java script disabled in my browsers.

Never had an issue with MC18, I don't think it depends on it but it might be in a part that I don't use.

Title: Re: Java Scare!
Post by: nwboater on January 13, 2013, 03:45:55 pm
I never use Java and I even have Java script disabled in my browsers.

Never had an issue with MC18, I don't think it depends on it but it might be in a part that I don't use.



Thanks IM. So I'm wondering what the heck it is used for on a PC? Except to help Larry Ellison buy a bigger MegaYacht!

Cheers,
Rod
Title: Re: Java Scare!
Post by: MrC on January 13, 2013, 04:08:42 pm
You have to love that Oracle still tries to sneak McAfee into the install.
Title: Re: Java Scare!
Post by: nwboater on January 13, 2013, 04:27:55 pm
You have to love that Oracle still tries to sneak McAfee into the install.

Yup, I have really had to learn to slow down on these freebie software installs. I used to go through them so quickly I'd miss the opt out check-boxes. Then I would waste a bunch of time uninstalling the junk.

Rod
Title: Re: Java Scare!
Post by: AoXoMoXoA on January 13, 2013, 04:47:04 pm
I really hate those 'Opt-Out' setups, seems they should be 'Opt-Ins' but then they could not sneak in crap you don't want behind your back.

I usually catch them on mine, but get tired of cleaning up friend's & relative's computers.
Title: Re: Java Scare!
Post by: DoubtingThomas on January 13, 2013, 07:45:56 pm
I remove so much crapware from my Mom's pc whenever I visit or remote connect.

I need Java installed... I'll try the update.
Title: Re: Java Scare!
Post by: nwboater on January 13, 2013, 08:01:00 pm
I remove so much crapware from my Mom's pc whenever I visit or remote connect.

I need Java installed... I'll try the update.

Would you mind telling us what you need Java for? Anything to do with Media Center 18?

Thanks,
Rod
Title: Re: Java Scare!
Post by: MrC on January 13, 2013, 08:17:24 pm
Here, Device Spy requires it, so I keep it in a virtual machine.

Also, my wife's remote access software uses it.
Title: Re: Java Scare!
Post by: rjm on January 13, 2013, 09:25:08 pm
Would you mind telling us what you need Java for? Anything to do with Media Center 18?
Air Video server (which transcodes and sends video to my iPad) seems to require Java.
Title: Re: Java Scare!
Post by: InflatableMouse on January 14, 2013, 12:09:40 am
Thats right. My htpc did have java installed for that too but I haven't reinstalled airvideo after I upgraded my htpc (yet).
Title: Re: Java Scare!
Post by: Trumpetguy on January 14, 2013, 01:18:20 am
Would you mind telling us what you need Java for? Anything to do with Media Center 18?

Thanks,
Rod

In some countries (at least mine), login security in web banking is built on Java. Ironic...
Title: Re: Java Scare!
Post by: glynor on January 14, 2013, 12:01:16 pm
Air Video server (which transcodes and sends video to my iPad) seems to require Java.

It is written in Java, as is SageTV.  But that DOES NOT mean you have to have it enabled in your browser, which is where the security problems originate.

I keep Java disabled in all of my browsers by default.  If I ever encounter a website that actually does something useful that needs it, it is a simple matter to re-enable it for just long enough to get my work done, and then turn it back off.
Title: Re: Java Scare!
Post by: InflatableMouse on January 14, 2013, 12:05:29 pm
It is written in Java, as is SageTV.  But that DOES NOT mean you have to have it enabled in your browser, which is where the security problems originate.

I keep Java disabled in all of my browsers by default.  If I ever encounter a website that actually does something useful that needs it, it is a simple matter to re-enable it for just long enough to get my work done, and then turn it back off.

Same here. If you're into Mozilla based browsers, there's a very nice addon that helps with that, its called NoScript. Per site you can allow which scripts (sources) are allowed to run. You can permanently allow/disallow certain sources etc.
Title: Re: Java Scare!
Post by: rjm on January 14, 2013, 02:45:15 pm
It is written in Java, as is SageTV.  But that DOES NOT mean you have to have it enabled in your browser, which is where the security problems originate.

I keep Java disabled in all of my browsers by default.  If I ever encounter a website that actually does something useful that needs it, it is a simple matter to re-enable it for just long enough to get my work done, and then turn it back off.
Great tip, thanks.
Title: Re: Java Scare!
Post by: gappie on January 14, 2013, 04:54:16 pm
You have to love that Oracle still tries to sneak McAfee into the install.
its the reason why i threw all java stuff of my machine. when there is a website needing it, i go to an otherone. i do the same with all those googlebarthing pushes. i dont care to pay a bit for something i use. but dont sneak up to me..

 :)
gab
Title: Re: Java Scare!
Post by: MrC on January 18, 2013, 02:33:24 pm
The madness will end... the madness will end.

http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+arstechnica%2Findex+%28Ars+Technica+-+All+content%29 (http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+arstechnica%2Findex+%28Ars+Technica+-+All+content%29)
Title: Re: Java Scare!
Post by: dean70 on January 18, 2013, 07:13:04 pm
They really need to get their act together. The auto update process is broken - it prompts to install update with UAC, then proceeds to do the install as a restricted user and fails.   ::)
Title: Re: Java Scare!
Post by: contium on January 19, 2013, 05:22:40 pm
I disabled java in the browser and just about every website I visited required. From BofA, to stevehoffman.tv to bhphoto to ebay etc. Needless to say, its now enabled. How are you guys getting away without using it?
Title: Re: Java Scare!
Post by: nwboater on January 19, 2013, 05:30:14 pm
I disabled java in the browser and just about every website I visited required. From BofA, to stevehoffman.tv to bhphoto to ebay etc. Needless to say, its now enabled. How are you guys getting away without using it?

 
Same here. If you're into Mozilla based browsers, there's a very nice addon that helps with that, its called NoScript. Per site you can allow which scripts (sources) are allowed to run. You can permanently allow/disallow certain sources etc.

As InflatableMouse said if you use a Mozilla based browser - I use Firefox - you can get the NoScript plugin for free for it. That's what I do. You allow web pages to use Java when you go to them. You can do this on a temporary or permanent basis per website. Sometimes it's a bit of a nuisance, but I think well worth it.

For other browsers I don't know how to deal with it.

Cheers,
Rod
Title: Re: Java Scare!
Post by: glynor on January 19, 2013, 07:38:20 pm
I disabled java in the browser and just about every website I visited required. From BofA, to stevehoffman.tv to bhphoto to ebay etc. Needless to say, its now enabled. How are you guys getting away without using it?

You mean JavaScript.

Java and JavaScript aren't the same thing.  Despite the name, they aren't even very closely related at all.

JavaScript was named that as a bandwagon-jumping move.  Now, of course, it is used on essentially all websites.  Java is rare.
Title: Re: Re: Java Scare!
Post by: contium on January 20, 2013, 12:45:12 pm
Thanks for clearing that up. Now how do you disable Java in the browser?
Title: Re: Java Scare!
Post by: MrC on January 20, 2013, 01:01:29 pm
Java Control Panel > Security > Enable Java content in the browser

Un-check it.
Title: Re: Java Scare!
Post by: glynor on January 20, 2013, 03:54:31 pm
Java Control Panel > Security > Enable Java content in the browser

Un-check it.

That turns it off globally for all of your browsers (which is fine if you never need it, and you probably don't).

If you want to keep most of your browsers java-free, but keep on specific browser that you only use with a trusted site that does use Java (which is what I do, because I use it for a couple things at work), there are instructions for most of the major browsers here:
http://www.infoworld.com/t/web-browsers/how-disable-java-in-your-browsers-210882
Title: Re: Re: Re: Java Scare!
Post by: JimCo06 on January 20, 2013, 04:44:09 pm
That turns it off globally for all of your browsers (which is fine if you never need it, and you probably don't).

If you want to keep most of your browsers java-free, but keep on specific browser that you only use with a trusted site that does use Java (which is what I do, because I use it for a couple things at work), there are instructions for most of the major browsers here:
http://www.infoworld.com/t/web-browsers/how-disable-java-in-your-browsers-210882

Thanks for the link, those were the best instructions I have come across.
Title: Re: Java Scare!
Post by: rjm on January 21, 2013, 12:38:43 am
It seems the latest version of Firefox is disabling Java automatically as a precaution with a nice message explaining that they did it. Good on them.