Hacker News Reader

Comment by Shank | Hacker News Reader

I was under the impression that Java still prompts the user to allow applets to start before they're even called - is this still true, or am I missing something? The dialog always advises not running applets from places you don't trust, last I checked.

View on HN

This doesn't mean much to most users, like my parents.

There's a generation of computer users who were dragged into the technology. Sure, now they may or may not love it, but throughout that time they were conditioned to just click 'OK' if it got in the way of whatever they were trying to do.

This isn't an exploit targeted towards the security experts, much less people who know what "not running applets from places you don't trust" even means.

For signed applets which get full privileges anyway, yes, Java will prompt you to accept the certificate. However, Java does not prompt before running unsigned applets (which run with limited privileges), and the actual security issue allows unsigned applets to gain more privileges than they should have. So, unfortunately, the prompt doesn't help.

I think you're confused, because the Java plugin has never behaved the way you describe.

All of the sites with Applets I go to do this in Chrome on OSX (unless I've explicitly said the site is trusted after the first time I run it) (Can't recall a site off the top of my head, else I'd post a screenshot)

It's probably a browser feature, not a Java feature. Firefox also does this.

That's the browser, not the plugin. We added it to Chrome a few years ago for out-of-date plugins, and plugins that have a bad track record on fixing their vulnerabilities (e.g. Java). Firefox recently added the same thing for out-of-date plugins, and just this week started doing it for all versions of Java.

Reply on news.ycombinator.com