This is clearly a person who would have wound up with malware regardless. It's as if you blamed telephones for allowing a scammer to call a gullible mark from the Official Credit Card Office.
I agree he's not computer savy but I am not blaming Mozilla for his installing malware. I am blaming Mozilla for a confusing message about security. See https://news.ycombinator.com/item?id=6590686
You have a user who has not been trained to not install random software, is fooled by extremely common ads, and who does not have the basic judgement necessary to not flail about when presented with something they don't understand but to consult someone who will understand.
This is a recipe for the exact scenario you described, but is in no way dependent on Firefox's Java messages. Any message appearing on their screen that they don't understand can be the trigger, including scammy ads encountered by millions of people in routine daily browsing.
[1] https://dl.dropboxusercontent.com/u/1643240/outdated_java.pn...
[3] 1 & 2 taken from this thread: https://news.ycombinator.com/item?id=6590877
The appropriate training is nothing less than years of experience working with computers or being in the IT business. Why do we believe that this ought to be standard knowledge for users? It seems to me that we're placing too much burden on the user to make good judgements in the face of insufficient application and operating system trustworthiness.
We absolutely place too much burden on end-users -- one reason the iPad is such a hit -- but "don't believe everything you read on the Internet" and "ask me before you try to fix something you don't really understand" is not a heavy burden. If it were, we'd have a lot more mechanics and a lot fewer operable cars on the road.
That's quite a stretch.
I have a user who uses frequently one specific website and for no apparent reason Firefox decides to tell him it's now dangerous to use with fearful and technological terms (vulnerabilities, plug-in, risk, etc.).
If Mozilla decides its users are dumb and should not be trusted to allow Java applet to be run then they should not warn them with techno-cryptic messages they know their users can't understand (because if Mozilla thought they could then Mozilla would know users could make the difference between a good and a bad applet and that warning wouldn't be needed).
A shorter and less scarier note would have been a better message for everyone.
How would you rephrase the warning in fewer than 8 words that would have helped your stepfather understand the problem and how to deal with it?
http://support.mozilla.org/en-US/kb/how-to-enable-java-if-it...
edit: formatting.
It's french but I doubt the translation process would made the word count explode from 14 words to this: https://dl.dropboxusercontent.com/u/202857/java.png
(and yes, it popped up on an up-to-date firefox with up-to-date java)
Maybe I got caught by the fact I had never seen that pop-up before and Firefox just seemed to have been updated the day before.
While we are on the topic: that makes a lot of clicking to get an applet running for the first time.