That said, it's a solution for the current problem and should really be applied to all plugins - I'm not sure why java is singled out here, many of the other browser plugins are just as bad. Java has likely the most widely publicized security vulnerabilities, yet I can guarantee you that many many 0-days are traded daily for practically every single other browser plugin as well.
Maybe for corporate use, but isn't that mostly IE anyway?
(And if this really is just a click-to-play type inconvenience, well, that's a hell of a lot less than the hoops that users are used to going through in order to get into their BankID banks here.)
Exhibit A: healthcare.gov
Do they? I thought Sweden used the online bank identity system for verification (bankid), which is either a standalone downloadable application, a smartcard image, or an mobile app. Not sure how an Firefox policy would effect this even if some parts of the bankid uses Java.
I think the commenter shiloh.enriquez on that Mozilla thread had a decent point in that many users just want the thing to work, won't necessarily understand or have the patience to understand and will move from FF to Chrome or IE.
It's already live. ff24 is the current stable.
It was released over a month ago too. Has it had any effect on Firefox's market-share? Especially in enterprise? It's a pretty decent test bed for understanding how users react to these kinds of changes. If they just accept them and adapt when forced it shows that we can be more proactive in moving users to better yet incompatible software?
No, the change went live Friday: https://bugzilla.mozilla.org/show_bug.cgi?id=914690#c20
I just assumed Java was out of date (again) and was surprised to see it still blacklisted after updating to latest version.
There's no part of the UI saying "We've permanently blocked all of Java by default". Even if you agree with the developer's ideological stance here (which you very well may not), the UX part of the job is completely botched.
Pressing on that icon should allow you to run java once, or allow if forever for that site.
If the icon doesn't appear, I think you should file a bug on bugzilla.
I've yet to see a single non-technical user even notice or react to its presence once. I see it instantly and can't understand why it doesn't alert or annoy them, but to them, it's just not there.
In light of that sort of behaviour, adding a subtle icon to the location bar is meaningless. Heck, adding anything to the location bar is meaningless if the intent is to communicate with the user; most users never look there.
So yeah. If that's Mozilla's stance, they will find out that nobody's going to notice. I certainly didn't see it. That is effectively dead code which they've written.
I hate Java applets as much as the next guy, but lets not ignore that there's a real world out there.
+ Fork if legally required.
The Reader "replacement" PDF viewer in Firefox is limited and buggy compared to the real thing. We also found it literally unusable for our purposes when it launched, and we routinely disable it on new installations where we still use Firefox at all (which is basically only test machines for web developers now anyway, because of exactly the recent attitude from Mozilla illustrated by this discussion).
I have avoided Reader for years by using Safari, and later Chrome, which each have their own built in PDF renderers. I'm glad that Firefox has caught up, it's one of the things that has kept me from using Firefox. I read a lot of PDFs, and loading the big, slow, clunky Reader plugin, or downloading the PDF, is a non-starter.
A lot of corporates and financial applications require Java.
This action by Mozilla raises awareness of the fact that Java security updates are too slow and too opaque and it's time to change to something else.
That said, users of these plugins are not just going to stop using these services. They need these services to make bank payments or trade their shares. Getting hacked is a smaller worry than being unable to use those services. That just means they will swap to a different browser. The web becomes no safer, and only Firefox loses market share.
If you get hacked and someone steals from your bank account, the bank will reimburse you and the police will (try) track down the hackers. Same way as if someone broke into a bank vault and stole the money. Being unable to sell off your shares because Firefox blocked your trading app means you are forced to switch browsers.
Basically it's a pointless display. Just show a warning if a website tries to use a plugin (any plugin, including flash - there are numerous undisclosed 0-days) and move on.
It also raises awareness of the fact that you can't trust some of the big names in the browser industry not to break stuff every few weeks just because they don't like it and then push the changes on you whether you want them or not.
Introducing restrictions so tight that you can't actually do your useful work any more isn't security, it's just broken.
That sounds like a long time if you're reading this in Firefox on your home PC, but if you're responsible for a large corporate network with thousands of users and a hundred critical intranet applications to keep working, many of which have a measurable dollar amount attached for every hour of downtime, different rules apply.
There is a reason so many large organisations stuck with IE6 for so long: having tried and tested, stable software is far more valuable in that kind of environment than having the latest shiny features that none of the in-house applications you're actually providing the computers/browsers to use need anyway.
If you support the company where most of the users just know to click and login, and one day they just can't, you aren't going to like it, to quote one of the post from the bugzilla:
"I haven't been able to get VPN-ed in for days, until I figured I could still use the Juniper SSL VPN from Internet Explorer. I find it amazing the casualness with which a small group of developers just shut off an entire set of functionality with no regard for its size, utility... You just broke millions of peoples software, and then you complain about this being a bug list, and you can simply do this, or simply do that."
It doesn't help that "advanced users" would know, ordinary users after the automatic update can't do what they were able to do.
A few users are inconvenienced. That few being the intersection of those who rely on java applets for something they care about (already a tiny fraction) and those who lack the knowledge to solve the problem on their own (an even smaller fraction). Even losing that fraction of users is unlikely to affect firefox's marketshare to any significant degree.
In the context of a company's IT department, they should be competent enough to know how to set default browser configurations and to provide walk-through documentation. If an IT department thinks that user convenience is a good enough excuse to expose the company's employees to some of the most serious and hard to prevent web-based exploits out there then I say fuck 'em. They have their priorities all wrong and if they want to continue to have their priorities all wrong then they are welcome to their own private hell.
Yes, but unfortunately when they do occur they tend to be rather important; Eurocontrol's air-traffic flow management site, for example. If you need to file or change a flight-plan...