Hacker News Reader

Comment by 1ris | Hacker News Reader

Yes, that's way I said "end-user". If you don't know what java is, this does not affect you.

The only way to file a (mandatory under penalty of huge fines) monthly tax report for a business here where I live is a web service that requires Java (or ActiveX) to do a digital signature for filed documents. There is currently no alternative (JavaScript APIs for that do not exist). Same goes for all other digital banking - requests have to be cryptographically signed and Java is pretty much the only widely portable way to do it.

Is that "end-user" enough for you? All busness owners in the country and all other general population doing eGovernment?

These governments and institutions should be called to task, PMs/ministers/MPs impeached if need be. Their negligence or refusal to act on this matter is a threat to national security. Literally.

PMs impeeched over java applets? get real.

I don't understand - there are end-users in those institutions using java applets. They have to use java applets because their institutions mandate their use for anything from bug tracking software (yes really, I've seen it with my own eyes) to expenses software.

But almost all of these end-users have admins. People that activated java in the browser form them. And these can take care of the updates.

I'm still not sure what you're getting at here. It's a zero-day exploit. Updates won't help with that.

Java-applets in the internet are not used anymore as i explained. And if quite a few poeple use it in their intranets they don't care particular for a 0day. If their intranet is used to deploy these, everything is already lost.

Even if the webbrowser that displays the intranet applets is used to surf the internet it's not a attac surface as you have to whitelist every site that's able to use applets.

If you live in Denmark, you are all but guaranteed to be an "end-user": https://en.wikipedia.org/wiki/NemID

Since the Javascript NemID client was introduced last year, most users don't need Java anymore.

That's for OTP though, users with tokens or keyfile have to use the OpenSign applet still. Haven't seen any stats, but OpenSign usage is probably pretty small compared to standard NemID/OTP.

Reply on news.ycombinator.com