Computer Update Query

[tony_mac]

It's not that there is a problem with Java as such, but that it allows programs (Applets) to be downloaded and run automatically via your browser.
They were supposed to have limited access to your system, but that is where the vulnerability lies - this protection can be broken.
So, by visiting a webpage, it is possible to have a program run automatically that could do just about anything it liked with your computer.

In more recent versions, Applets need explicit permission to run every time. If you allow an applet to run, you should be sure that you trust the website it is hosted on - in the same way that you should be sure that you trust the publisher before you download and run any software.

If you need the Java runtime installed to support some program, then to be safe you can completely disable Java content in the browser (this is enabled by default when you install Java). On Windows, this option is in the Security settings of the Java Control panel.

 

[Xenophon PCDGS]

If you need the Java runtime installed to support some program, then to be safe you can completely disable Java content in the browser (this is enabled by default when you install Java). On Windows, this option is in the Security settings of the Java Control panel.

Indeed this so applies in my case. I never have had any Java-related problems.

 

[yorkie]

Indeed this so applies in my case. I never have had any Java-related problems.

Out of interest, can you say what applications you use which require Java?

 

[Xenophon PCDGS]

Sorry, I refuse to reveal such personal information upon an open access forum, for obvious reasons, much as I respect you and the position that you hold upon it.

I will ask if Java are being untruthful in their claims that their product is used in ATM machines, parking meters, cable boxes, etc.

 

[Emyr]

I will ask if Java are being untruthful in their claims that their product is used in ATM machines, parking meters, cable boxes, etc.

https://en.wikipedia.org/wiki/OpenCable_Application_Platform

 

[yorkie]

Sorry, I refuse to reveal such personal information upon an open access forum, for obvious reasons, much as I respect you and the position that you hold upon it.

A simple no will suffice , but I certainly wasn't asking for details.

There's only one thing that requires it at my work, and that's the interface for the building management system, so only required on a small number of PCs.
--- old post above --- --- new post below ---

You do not simply "outgrow" Minecraft and I'm not exactly young either. But that is the only thing I use Java for and I am switched on enough to know what is happening to my computer.

Is Java 8 just as bad?

https://heimdalsecurity.com/blog/slow_software_vulnerability_patching/

Java has an average of roughly 9 new vulnerabilities discovered every month

it's not yet clear if that number has reduced significantly in Java 8, but I suspect not.

Also if interest http://nakedsecurity.sophos.com/201...-java-but-here-comes-a-sea-of-patches-anyway/

Java in practice

Remember that there are two sorts of Java program.

There are full-blown applications, which you download and install locally, just as you might install any other software such as Microsoft Word, Apple Keynote or the Apache web server.

And there are Java applets, which are delivered directly into your browser as you use the internet, and run in a deliberately restricted version of the Java environment inside your browser.

The browser is where most of the risk from Java presents itself, because that "deliberately restricted environment" doesn't always impose the limitations it should, due to software vulnerabilities in Java.

→ Example: an applet arriving from a remote website shouldn't be able to read files stored locally on your hard disk. But if cybercrooks find a way to trick the Java runtime into letting applets access files that ought to be invisible, you have a false sense of security, not to mention an exploitable information disclosure or data leakage vulnerability.​

and just in case anyone was in any doubt...
http://www.javaworld.com/article/2104862/java-security/report-half-of-all-exploits-target-java.html

A blog post from Trusteer explains why Java is so highly targeted by malware developers: “Java is a high risk application that exposes organizations to advanced attacks. It has numerous vulnerabilities that can be exploited to deliver malware and compromise users’ machines. Once on the endpoint, it is extremely difficult to prevent its malicious execution.”

The problem with Java goes deeper than the software itself being vulnerable. Because Java runs within its own virtual environment (Java Virtual Machine, or JVM), an exploit just has to break the Java security model in order to execute malicious code

If you do need to use Java for internal systems (the "intranet zone"), it is wise to configure it to be disabled in the internet zone.

 

[STEVIEBOY1]

Now then young scallywag, in my days we went to work..to work...not to involve in such frivolities...

Yes that's true, I got into trouble some years ago at work when using the computer, but not for work reasons

 

[krus_aragon]

The only thing I use Java for is a certain video game with blocks. I think some of our younger members might know what I'm referring to.

Ah, that'll be Tetris, then. :P

 

[DownSouth]

Ah, that'll be Tetris, then. :P

He said younger members

 

[Xenophon PCDGS]

He said younger members

Many of the elderly fraternity such as I have used Tetris as a way of testing our reactions.

 

[DownSouth]

Many of the elderly fraternity such as I have used Tetris as a way of testing our reactions.

"Testing my reactions" sounds like a nice convenient line for explaining it to the boss!

I'm just old enough to remember Tetris in a context other than EA's reprise of it that was released on iOS last year. With my first computer (a Macintosh LC inherited from my great aunt … because she upgraded to a new Power Mac G3) it was pretty well the best game I could play.

The blocky game used by current youth is Minecraft, not Tetris.

 

[Xenophon PCDGS]

"Testing my reactions" sounds like a nice convenient line for explaining it to the boss!

Do not forget for the last twenty five years before I retired, I was the boss...

 

[SS4]

Linux and Mac users better check their erm computers & servers


'But Apple are perfect and never have any security issues' I hear you cry

http://www.bbc.co.uk/news/technology-29361794

At least it was quickly patched, the update landed in the repos yesterday and I updated.

Those of you who have Java installed, can you say what applications you use that require Java?

I have js17 and qt5-declartive packages sadly these have been installed as dependencies for polkit (authentication) and solid (for sound)

Browser plugins aren't necessary for modern computers and browsers and I have none. HTML5 will play video just fine

 

[Strathclyder]

Browser plugins aren't necessary for modern computers and browsers and I have none. HTML5 will play video just fine

I have Flash installed on my Windows 8.1 machine as a force of habit. Not sure if it's installed in my Chromebook, though.

 

[Xenophon PCDGS]

A simple no will suffice , but I certainly wasn't asking for details.

Sorry if my reply was somewhat brusque. I have sent a PM to you with fuller details, as I still retain certain links to the consultancy and when I have referred to "my computer engineer" in past postings, it is the same company as used by the consultancy, but I will say no more on here.

 

[Crossover]

2 major versions of Flash out of date?! Yikes.

I have just noticed that at home we are now on Flash 15 - that means at work we are 4 major versions behind - really should schedule in to look at that sometime!

 

[Xenophon PCDGS]

I have just noticed that at home we are now on Flash 15 - that means at work we are 4 major versions behind - really should schedule in to look at that sometime!

My version at present is 15.0.0.167

 

[SS4]

I have just noticed that at home we are now on Flash 15 - that means at work we are 4 major versions behind - really should schedule in to look at that sometime!

Unless your work is using non-Chrom{e,ium} Linux of course in which case 11 is the last one.

Out of interest what do people use Flash for? I find YouTube to work just fine using HTML5, the odd BBC article using video doesn't work too well

 

[Xenophon PCDGS]

Unless your work is using non-Chrom{e,ium} Linux of course in which case 11 is the last one.

Out of interest what do people use Flash for? I find YouTube to work just fine using HTML5, the odd BBC article using video doesn't work too well

I read your posting, then saw your forum signature.

Are you intending this signature as a comment of sarcasm...

 

[SS4]

I read your posting, then saw your forum signature.

Are you intending this signature as a comment of sarcasm...

I suppose saving the galaxy from Ming the Merciless is a good use of Flash but in reality it was a coincidence

 

[Crossover]

Unless your work is using non-Chrom{e,ium} Linux of course in which case 11 is the last one.

Nah, we're a slave to the Microsoft Corporation :P

 

[DownSouth]

Nah, we're a slave to the Microsoft Corporation :P

… now there's a can of worms!

Flash is bad enough, but anyone who chooses to use Silverlight should be taken into a dark room and beaten.

 

[maniacmartin]

Unless your work is using non-Chrom{e,ium} Linux of course in which case 11 is the last one.

Which basically means you can't use the Adobe-branded Flash player on Linux any more, unless you want to use a version with known vulnerabilities.

I would instead recommend using the Pepper Flash Player that ships with Chrom{e,ium}, inside Firefox, which is now possible. Debian derivatives can follow these instructions

 

[Emyr]

Flash is bad enough, but anyone who chooses to use Silverlight should be taken into a dark room and beaten.

Amazon Prime Instant Video (nee Lovefilm) switched from Flash (fine on Linux) to Silverlight (using components not available in Moonlight for Linux).

Turns out they still have a Flash-based player for US accounts, but not for European ones.

 

[Crossover]

Well, unfortunately by stealth I ended up having to update Java at work this afternoon (a supplier site relies on it and users were just getting redirected to the Java update page anytime they tried to use it...browser being too clever for its own good!)
Did have to chuckle though as whilst updating it, I removed Java 6 which was never removed on the last major update!

Flash will be next on the hit list...yay!