Hacker News Reader

Comment by philbarr | Hacker News Reader

> It's dead for the end-user for every meaningful definition of "dead".

Unfortunately not, there are MANY institutions that still rely on Java Applets.

That's why this might be a noble thing for Oracle to do. Institutions around the world are harming their users using this tool, and it's possible Oracle could encourage them to stop doing that. (Although frankly just mentioning the possibility that an action might be the right thing to do, seems to make it less likely that Oracle would do it.)

Practically nobody is exploitable! Only signed Java applets on a whitelist can be run: https://www.java.com/en/download/help/jcp_security.xml

You must be either exaggerating or not up to date (not aware that not every applet is automatically run). I don't think anybody is getting harmed. What do you think a realistic attack scenario using Java applets looks like? You'll have to break RSA, or how are you going to fool the browser plugin to run your exploit?

GGP comment observed that many people can't avoid using Java applets. Others have observed that the Java people have to use for applets is often quite old, so it is perhaps as old as the Java I used the last time I had to use Java applets. I'm sure that very few of us are "up to date"; that's kind of the point. Perhaps there are strange applet fetishists who keep their Java package installs at the bleeding edge of postmodern Java applet specialness. Even so, forcing normal people to use Java applets is harming your users, because normal people turn it off.

As recently as last year I've seen browser apps that require Java 1.3. As in they won't work with Java 1.4+. Until browsers kick Java out, Java applets aren't going anywhere.

"I can't think of any applications that couldn't be made with JS and html5, so institutions must have no reason to use Java besides wanting to harm their users"

https://developer.chrome.com/apps/usb

The thesis says nothing about access to the underlying hardware. Incidentally, Java has it and Javascript does not have it.

Have you ever programmed in java or javascript.

don't worry, its just a freshman that learned about the church-turing thesis a few weeks ago and wants to sound smart.

k from now on write all your web apps in assembly.

Wait are you trying to say that java has less boilerplate than javascript?

Yes, that's way I said "end-user". If you don't know what java is, this does not affect you.

The only way to file a (mandatory under penalty of huge fines) monthly tax report for a business here where I live is a web service that requires Java (or ActiveX) to do a digital signature for filed documents. There is currently no alternative (JavaScript APIs for that do not exist). Same goes for all other digital banking - requests have to be cryptographically signed and Java is pretty much the only widely portable way to do it.

Is that "end-user" enough for you? All busness owners in the country and all other general population doing eGovernment?

These governments and institutions should be called to task, PMs/ministers/MPs impeached if need be. Their negligence or refusal to act on this matter is a threat to national security. Literally.

PMs impeeched over java applets? get real.

I don't understand - there are end-users in those institutions using java applets. They have to use java applets because their institutions mandate their use for anything from bug tracking software (yes really, I've seen it with my own eyes) to expenses software.

But almost all of these end-users have admins. People that activated java in the browser form them. And these can take care of the updates.

I'm still not sure what you're getting at here. It's a zero-day exploit. Updates won't help with that.

Java-applets in the internet are not used anymore as i explained. And if quite a few poeple use it in their intranets they don't care particular for a 0day. If their intranet is used to deploy these, everything is already lost.

Even if the webbrowser that displays the intranet applets is used to surf the internet it's not a attac surface as you have to whitelist every site that's able to use applets.

If you live in Denmark, you are all but guaranteed to be an "end-user": https://en.wikipedia.org/wiki/NemID

Since the Javascript NemID client was introduced last year, most users don't need Java anymore.

That's for OTP though, users with tokens or keyfile have to use the OpenSign applet still. Haven't seen any stats, but OpenSign usage is probably pretty small compared to standard NemID/OTP.

Reply on news.ycombinator.com