Topic: Java Scare! (Read 5076 times)

nwboater · « **on:** January 13, 2013, 03:18:05 pm »

In a very unusual move the US Department of Homeland Security has advised all computer users to disable Java because of security vulnerabilities.

http://www.techradar.com/news/software/applications/u-s-government-advises-users-to-disable-java-1124717

I have already done this on my desktop and would also like to on our HTPC and it's Clients. Wondering if there is anything in MC18 that may require Java? There is apparently no fix available short of disabling or uninstalling Java.

I strongly suggest that everyone Google this issue and act upon it appropriately.

Rod

HTPC4ME · « **Reply #1 on:** January 13, 2013, 03:27:36 pm »

thanks.
http://www.pcmag.com/article2/0,2817,2414238,00.asp

nwboater · « **Reply #2 on:** January 13, 2013, 03:29:35 pm »

Apparently Oracle has been working hard on this over the weekend. They just came out with Java 7 Update 11 which replaces the vulnerable Update 10. Hope it does the trick! Installing now.

Rod

InflatableMouse · « **Reply #3 on:** January 13, 2013, 03:42:40 pm »

I never use Java and I even have Java script disabled in my browsers.

Never had an issue with MC18, I don't think it depends on it but it might be in a part that I don't use.

nwboater · « **Reply #4 on:** January 13, 2013, 03:45:55 pm »

Quote from: InflatableMouse on January 13, 2013, 03:42:40 pm

I never use Java and I even have Java script disabled in my browsers.

Never had an issue with MC18, I don't think it depends on it but it might be in a part that I don't use.

Thanks IM. So I'm wondering what the heck it is used for on a PC? Except to help Larry Ellison buy a bigger MegaYacht!

Cheers,
Rod

MrC · « **Reply #5 on:** January 13, 2013, 04:08:42 pm »

You have to love that Oracle still tries to sneak McAfee into the install.

nwboater · « **Reply #6 on:** January 13, 2013, 04:27:55 pm »

Quote from: MrC on January 13, 2013, 04:08:42 pm

You have to love that Oracle still tries to sneak McAfee into the install.

Yup, I have really had to learn to slow down on these freebie software installs. I used to go through them so quickly I'd miss the opt out check-boxes. Then I would waste a bunch of time uninstalling the junk.

Rod

AoXoMoXoA · « **Reply #7 on:** January 13, 2013, 04:47:04 pm »

I really hate those 'Opt-Out' setups, seems they should be 'Opt-Ins' but then they could not sneak in crap you don't want behind your back.

I usually catch them on mine, but get tired of cleaning up friend's & relative's computers.

DoubtingThomas · « **Reply #8 on:** January 13, 2013, 07:45:56 pm »

I remove so much crapware from my Mom's pc whenever I visit or remote connect.

I need Java installed... I'll try the update.

nwboater · « **Reply #9 on:** January 13, 2013, 08:01:00 pm »

Quote from: BabyFace on January 13, 2013, 07:45:56 pm

I remove so much crapware from my Mom's pc whenever I visit or remote connect.

I need Java installed... I'll try the update.

Would you mind telling us what you need Java for? Anything to do with Media Center 18?

Thanks,
Rod

MrC · « **Reply #10 on:** January 13, 2013, 08:17:24 pm »

Here, Device Spy requires it, so I keep it in a virtual machine.

Also, my wife's remote access software uses it.

rjm · « **Reply #11 on:** January 13, 2013, 09:25:08 pm »

Quote from: nwboater on January 13, 2013, 08:01:00 pm

Would you mind telling us what you need Java for? Anything to do with Media Center 18?

Air Video server (which transcodes and sends video to my iPad) seems to require Java.

InflatableMouse · « **Reply #12 on:** January 14, 2013, 12:09:40 am »

Thats right. My htpc did have java installed for that too but I haven't reinstalled airvideo after I upgraded my htpc (yet).

Trumpetguy · « **Reply #13 on:** January 14, 2013, 01:18:20 am »

Quote from: nwboater on January 13, 2013, 08:01:00 pm

Would you mind telling us what you need Java for? Anything to do with Media Center 18?

Thanks,
Rod

In some countries (at least mine), login security in web banking is built on Java. Ironic...

glynor · « **Reply #14 on:** January 14, 2013, 12:01:16 pm »

Quote from: rjm on January 13, 2013, 09:25:08 pm

Air Video server (which transcodes and sends video to my iPad) seems to require Java.

It is written in Java, as is SageTV. But that DOES NOT mean you have to have it enabled in your browser, which is where the security problems originate.

I keep Java disabled in all of my browsers by default. If I ever encounter a website that actually does something useful that needs it, it is a simple matter to re-enable it for just long enough to get my work done, and then turn it back off.

InflatableMouse · « **Reply #15 on:** January 14, 2013, 12:05:29 pm »

Quote from: glynor on January 14, 2013, 12:01:16 pm

It is written in Java, as is SageTV. But that DOES NOT mean you have to have it enabled in your browser, which is where the security problems originate.

I keep Java disabled in all of my browsers by default. If I ever encounter a website that actually does something useful that needs it, it is a simple matter to re-enable it for just long enough to get my work done, and then turn it back off.

Same here. If you're into Mozilla based browsers, there's a very nice addon that helps with that, its called NoScript. Per site you can allow which scripts (sources) are allowed to run. You can permanently allow/disallow certain sources etc.

rjm · « **Reply #16 on:** January 14, 2013, 02:45:15 pm »

Quote from: glynor on January 14, 2013, 12:01:16 pm

It is written in Java, as is SageTV. But that DOES NOT mean you have to have it enabled in your browser, which is where the security problems originate.

I keep Java disabled in all of my browsers by default. If I ever encounter a website that actually does something useful that needs it, it is a simple matter to re-enable it for just long enough to get my work done, and then turn it back off.

Great tip, thanks.

gappie · « **Reply #17 on:** January 14, 2013, 04:54:16 pm »

Quote from: MrC on January 13, 2013, 04:08:42 pm

You have to love that Oracle still tries to sneak McAfee into the install.

its the reason why i threw all java stuff of my machine. when there is a website needing it, i go to an otherone. i do the same with all those googlebarthing pushes. i dont care to pay a bit for something i use. but dont sneak up to me..

gab

MrC · « **Reply #18 on:** January 18, 2013, 02:33:24 pm »

The madness will end... the madness will end.

http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+arstechnica%2Findex+%28Ars+Technica+-+All+content%29

dean70 · « **Reply #19 on:** January 18, 2013, 07:13:04 pm »

They really need to get their act together. The auto update process is broken - it prompts to install update with UAC, then proceeds to do the install as a restricted user and fails.

contium · « **Reply #20 on:** January 19, 2013, 05:22:40 pm »

I disabled java in the browser and just about every website I visited required. From BofA, to stevehoffman.tv to bhphoto to ebay etc. Needless to say, its now enabled. How are you guys getting away without using it?

nwboater · « **Reply #21 on:** January 19, 2013, 05:30:14 pm »

Quote from: contium on January 19, 2013, 05:22:40 pm

I disabled java in the browser and just about every website I visited required. From BofA, to stevehoffman.tv to bhphoto to ebay etc. Needless to say, its now enabled. How are you guys getting away without using it?

Quote from: InflatableMouse on January 14, 2013, 12:05:29 pm

Same here. If you're into Mozilla based browsers, there's a very nice addon that helps with that, its called NoScript. Per site you can allow which scripts (sources) are allowed to run. You can permanently allow/disallow certain sources etc.

As InflatableMouse said if you use a Mozilla based browser - I use Firefox - you can get the NoScript plugin for free for it. That's what I do. You allow web pages to use Java when you go to them. You can do this on a temporary or permanent basis per website. Sometimes it's a bit of a nuisance, but I think well worth it.

For other browsers I don't know how to deal with it.

Cheers,
Rod

glynor · « **Reply #22 on:** January 19, 2013, 07:38:20 pm »

Quote from: contium on January 19, 2013, 05:22:40 pm

I disabled java in the browser and just about every website I visited required. From BofA, to stevehoffman.tv to bhphoto to ebay etc. Needless to say, its now enabled. How are you guys getting away without using it?

You mean JavaScript.

Java and JavaScript aren't the same thing. Despite the name, they aren't even very closely related at all.

JavaScript was named that as a bandwagon-jumping move. Now, of course, it is used on essentially all websites. Java is rare.

contium · « **Reply #23 on:** January 20, 2013, 12:45:12 pm »

Thanks for clearing that up. Now how do you disable Java in the browser?

MrC · « **Reply #24 on:** January 20, 2013, 01:01:29 pm »

Java Control Panel > Security > Enable Java content in the browser

Un-check it.

glynor · « **Reply #25 on:** January 20, 2013, 03:54:31 pm »

Quote from: MrC on January 20, 2013, 01:01:29 pm

Java Control Panel > Security > Enable Java content in the browser

Un-check it.

That turns it off globally for all of your browsers (which is fine if you never need it, and you probably don't).

If you want to keep most of your browsers java-free, but keep on specific browser that you only use with a trusted site that does use Java (which is what I do, because I use it for a couple things at work), there are instructions for most of the major browsers here:
http://www.infoworld.com/t/web-browsers/how-disable-java-in-your-browsers-210882

JimCo06 · « **Reply #26 on:** January 20, 2013, 04:44:09 pm »

Quote from: glynor on January 20, 2013, 03:54:31 pm

That turns it off globally for all of your browsers (which is fine if you never need it, and you probably don't).

If you want to keep most of your browsers java-free, but keep on specific browser that you only use with a trusted site that does use Java (which is what I do, because I use it for a couple things at work), there are instructions for most of the major browsers here:
http://www.infoworld.com/t/web-browsers/how-disable-java-in-your-browsers-210882

Thanks for the link, those were the best instructions I have come across.

rjm · « **Reply #27 on:** January 21, 2013, 12:38:43 am »

It seems the latest version of Firefox is disabling Java automatically as a precaution with a nice message explaining that they did it. Good on them.

INTERACT FORUM

Author Topic: Java Scare! (Read 5076 times)