And, it's not just the number of exploits. It's the nature of the exploits. They're usually very reliable, and often don't even rely on accidental corruption so much as "features that accidentally expose all of runtime memory to the Java sandbox".

Java was iffy in 1998 when it was just the applet sandbox and a graphics context. But today, OS vendors have bridged Java into all sorts of systems code. It's a debacle. Just don't enable it.

Yep, no flash plugin, no silverlight, and no java plugin on my macs. Java is disabled and only used on chrome if I need to use it. Which has been once in a year, and only to get results for the bufferbloat project. So basically, not all that useful outside of clojure/jruby/etc...

Java isn't that widely used on the web anymore, and you will probably know if a site will require Java, so you'll be prepared to allow it. If Java spontaneously pops up when you're not expecting it, you'll generally want to deny it. It's more a question of whether you trust the site and you legitimately expect it to use Java at that point rather than simply whether you trust it in general.