Comment by johnchristopher | Hacker News Reader

Comment by johnchristopher | Hacker News Reader

Parent Full thread

johnchristopher

> You can still easily run Java applets in Firefox 24 and beyond, you just need to click the red lego block in the upper left corner and allow it. [1]

Allow me to disagree and to tell you what happened last weekend:

Last Sunday I had a call from my stepfather who "couldn't run the website to order agro food" anymore. This website runs a Java applet to manage agro food orders on-line and the code isn't signed (it's a small structure).

He tried to understand what was going on with the warning before clicking "ok/yes/run". He googled the warning and unfortunately ended up installing malwares from ads running on some PC help website/forums that promised to fix "2 just found vulnerabilities": he thought that was related since the warning actually preventing him from accessing his "working-fine-yesterday" website seemed to be about security and vulnerabilities in the plug-in.

He then tried to update Java but canceled it at the end of the process because the window with the Java propaganda ("it powers 3 billions of applications, your car, your website, etc.") looked too much like the one with malwares from before and those didn't fix the problem (not being able to access his website).

When I finally could go to his house to fix it I realized what had happened.

It is definitely not user-friendly. It was working before and in his eyes Mozilla made it not working anymore.

edit: typo and grammar

Java actually installs malware (the Ask toolbar) unless you are careful enough to deselect it during the installation/update process.

There was a bunch of other crap: a lollipop promotion app, a trojan and internet explorer settings changed.

Funny, but he didn't installed the Ask toolbar :). I did when uninstalling/reinstalling Java and clicking a little bit too fast :). Hopefully it's not as tedious to remove as a trojan.

Uh no. That is not "malware". Unwanted software yes but not malware.

The difference? Be sure to point out why tricking you into installing it isn't malicious, why it's not malicious that after that it changes your default search provider to send your searches to them (privacy much?), and why it's not malicious that it's abnormally hard to remove (a quick Google will demonstrate the normal 'remove toolbar' steps don't work, even Wikipedia has a note and several links on this: https://en.wikipedia.org/wiki/Ask.com ).

It tricks people to installing it, reports your search activity (maybe other data? I can't find details, not installing it myself), and takes major, unnecessary steps to make it hard to uninstall it. Sounds like malware to me.

It's a malicious software that hijacks the browser, displays unwanted ads and changes the search engine/start page.

Most common search suggestions for Cydoor (well known adware): http://i.imgur.com/iXqJdzU.png

Most common search suggestions for Ask Toolbar: http://i.imgur.com/HziYjkZ.png

Looks pretty similar to me.

Heh. I guess that makes me a malware writer as I worked on the Ask Toolbar for Firefox when I worked at Ask.com.

I can't edit my message anymore so I reply here.

After reviewing the facts by discussing them with nknighthb it appears the warning message that prompted me to blame Mozilla for a confusing warning message was due to Oracle and their Java warning pop-up. https://dl.dropboxusercontent.com/u/202857/java.png

My apologies :], I am a little bit ashamed for not spotting it sooner.

Thanks for clarifying!

This is honestly what makes the Firefox warnings even more damaging than they already are.

If a brave user decides to click past the "DO NOT ENTER" sign on the Firefox warning, they are immediately presented with another worrying warning, popped up by the Java plugin. What kind of fool says "yes, please go ahead and do this dangerous thing" when two separate pieces of software have already told them not to? Not most, unfortunately.

At least I can make the Java plugin warning dialog be relatively calm by signing my JARs. The Firefox one is completely beyond my control.

I'd like to know if the Firefox developers have details on exploits that bypass the Java plugin dialogs. If they do, I'd like to know as well. If they don't, that means they're duplicating a security feature that's already in the plugin... what's the good of that? It just confuses and frightens the users of valid, secure Java applets.

This one needs a separate post. Please make a blog entry and post it here and on reddit.

This is clearly a person who would have wound up with malware regardless. It's as if you blamed telephones for allowing a scammer to call a gullible mark from the Official Credit Card Office.

He wouldn't have ended up on treacherous paths if that warning had been more explicit about what was going on.

I agree he's not computer savy but I am not blaming Mozilla for his installing malware. I am blaming Mozilla for a confusing message about security. See https://news.ycombinator.com/item?id=6590686

There are thousands of "confusing" messages to be found on a typical computer. The messages Firefox presents for Java[1][2][3] aren't even competitive.

You have a user who has not been trained to not install random software, is fooled by extremely common ads, and who does not have the basic judgement necessary to not flail about when presented with something they don't understand but to consult someone who will understand.

This is a recipe for the exact scenario you described, but is in no way dependent on Firefox's Java messages. Any message appearing on their screen that they don't understand can be the trigger, including scammy ads encountered by millions of people in routine daily browsing.

[1] https://dl.dropboxusercontent.com/u/1643240/outdated_java.pn...

[2] http://imgur.com/k94vEvB

[3] 1 & 2 taken from this thread: https://news.ycombinator.com/item?id=6590877

While I agree with your opening sentiment, and I agree regarding OP's dad not having the appropriate training and judgement, I disagree with the conclusion that he should be the resolution to that problem.

The appropriate training is nothing less than years of experience working with computers or being in the IT business. Why do we believe that this ought to be standard knowledge for users? It seems to me that we're placing too much burden on the user to make good judgements in the face of insufficient application and operating system trustworthiness.

The appropriate training has been given by me to the various family members I have to support. They started out just like his stepfather. It did not require them to have years of experience before they stopped trusting random websites, installing whatever came across their screen. It required me explaining the relevant concepts a few times. That was it.

We absolutely place too much burden on end-users -- one reason the iPad is such a hit -- but "don't believe everything you read on the Internet" and "ask me before you try to fix something you don't really understand" is not a heavy burden. If it were, we'd have a lot more mechanics and a lot fewer operable cars on the road.

edit: here I should replace firefox and mozilla with oracle

That's quite a stretch.

I have a user who uses frequently one specific website and for no apparent reason Firefox decides to tell him it's now dangerous to use with fearful and technological terms (vulnerabilities, plug-in, risk, etc.).

If Mozilla decides its users are dumb and should not be trusted to allow Java applet to be run then they should not warn them with techno-cryptic messages they know their users can't understand (because if Mozilla thought they could then Mozilla would know users could make the difference between a good and a bad applet and that warning wouldn't be needed).

A shorter and less scarier note would have been a better message for everyone.

The warnings are 8-14 and 5-8 words respectively, and state the case concisely. The word "risk" appears nowhere, and is a common English word anyway, and "vulnerable" and its derivatives are also common English words.

How would you rephrase the warning in fewer than 8 words that would have helped your stepfather understand the problem and how to deal with it?

"Java is disabled in Firefox. [More Info]()"

http://support.mozilla.org/en-US/kb/how-to-enable-java-if-it...

edit: formatting.

Somehow I have the feeling we aren't talking about the same warning.

It's french but I doubt the translation process would made the word count explode from 14 words to this: https://dl.dropboxusercontent.com/u/202857/java.png

(and yes, it popped up on an up-to-date firefox with up-to-date java)

Congratulations, you've just lambasted Mozilla for a Java message. Java pops up that same message for applets in all browsers. Go talk to Oracle, it has absolutely nothing to do with Mozilla or Firefox.

Ah, I wouldn't go as far as "lambasted" but it is indeed not Mozilla's wrongdoing in any way.

Maybe I got caught by the fact I had never seen that pop-up before and Firefox just seemed to have been updated the day before.

While we are on the topic: that makes a lot of clicking to get an applet running for the first time.

You should update your comment to reflect the reality learned here:

https://news.ycombinator.com/item?id=6591531

Interesting point. How would you rephrase the warning?

I had a look at the mozilla website and the english phrasing seems okay to me. I think the french is too verbose (and it adds nuances that are confusing like "some versions of the plugin is disabled", "trusted sites": does it mean sites that are guaranteed to be trusted because of a certificate or sthg or sites I trust because I know who coded it or it's so universally known (eg: google) that I should trust it anyway ?) even ignoring the fact french is de facto more verbose than english.

Anyway, this is the warning my user was given : https://dl.dropboxusercontent.com/u/202857/java.png

Unmovable window, can't close firefox without first actioning something in it, one checkbox+one butotn to allow "something scary" to run (something that wasn't scary yesterday). This is what prompted my user to google the warning.

As someone point out, this is not a Firefox warning. This is a Java warning installed by Oracle. Please complain with them :)

Yes, sorry about that :).

Reply on news.ycombinator.com