Apple again blocks latest version of Java through OS X anti-malware system

2

Comments

  • Reply 21 of 49

    Quote:

    Originally Posted by Gazoobee View Post


     


    Yeah, but this is exactly one of those areas when you shouldn't be using a Java based program.  In a school situation, you are legally responsible for that information. You can be sued.  You can even attract criminal charges if something happens to the students info.  It's a very sensitive area. 


     


    School is the very last place that Java should be used.  



    Stop it, you scold. Get off your high horse.


     


    People are required to use what they have access to or are told to.

  • Reply 22 of 49
    gqbgqb Posts: 1,934member

    Quote:

    Originally Posted by lkrupp View Post



    I completely understand that Apple is acting to protect the vast majority of its users, users who have no idea what Java is or even if they have it installed.



    But shouldn't they also have an option for users who know the risks but want Java anyway, an option to allow the installation of the plugin?


    Made sense when your machine was stand-alone. But now its like sharing a hot-tub with someone with a communicable disease.


    The question isn't why Apple is blocking it, but why others aren't.

  • Reply 23 of 49
    jragostajragosta Posts: 10,473member
    Stop it, you scold. Get off your high horse.

    People are required to use what they have access to or are told to.

    Understood, but I think he's referring to the developers. The developers shouldn't be making programs like that in Java and school districts should be very cautious about buying it. Obviously, it's not the poor student's fault that they have to use Java.

    It's much like the Flash issues from a few years ago. Lots of people used Flash because it was easy, but it was a resource hog and a security problem. Apple pointed out how terrible it was and the industry slowly moved away from it - to the point that you don't get many "Flash is an essential part of the Internet and we can't live without it" claims any more.

    Same thing will probably happen with Java.
  • Reply 24 of 49

    Quote:

    Originally Posted by maffk View Post



    Some of us still use Snow Leopard, you know!



    This has affected my team's work today. We rely on using a Java applet to do our work. We have resorted to using a Windows 7 VM!



    By the way, it is NOT just Safari. Firefox is affected too.



    Apple, please sort it out.


    Firefox is independently blocking Java: http://www.informationweek.com/security/application-security/firefox-moves-to-block-java-silverlight/240147408

  • Reply 25 of 49

    Quote:

    Originally Posted by jragosta View Post



    Understood, but I think he's referring to the developers. 


    Yes, but to go on a finger-waving rant about "developers should..... blah blah" with some poor teacher who is just trying to do his/her job is quite unwarranted, unhelpful, and snotty.


     


    Also, I agree that it will/should go the way of Flash. Unfortunately, there is still the issue of "in the meantime, what do we do"?

  • Reply 26 of 49


    Initially, I thought it was Firefox that was blocking the plug-in, this morning. However, when I click the 'click to play' button to activate it, it loads the Admin login for Software Update. Of course, once checked, SU reports that there are no updates available.


     


    On checking Firefox Add ons, the Java Applet plug-in is showing as "enabled".

     


    The same thing happens with Safari.

  • Reply 27 of 49
    macxpressmacxpress Posts: 5,849member

    Quote:

    Originally Posted by jragosta View Post





    Understood, but I think he's referring to the developers. The developers shouldn't be making programs like that in Java and school districts should be very cautious about buying it. Obviously, it's not the poor student's fault that they have to use Java.



    It's much like the Flash issues from a few years ago. Lots of people used Flash because it was easy, but it was a resource hog and a security problem. Apple pointed out how terrible it was and the industry slowly moved away from it - to the point that you don't get many "Flash is an essential part of the Internet and we can't live without it" claims any more.



    Same thing will probably happen with Java.


     


    Yes, there are still a lot of Java Mac educational apps, but what do you do? We can just sit around and hope they make a real OS X version of the app. Some developers are just lazy and take what they this is the easiest way out.

  • Reply 28 of 49

    Quote:

    Originally Posted by maffk View Post


    Initially, I thought it was Firefox that was blocking the plug-in, this morning. However, when I click the 'click to play' button to activate it, it loads the Admin login for Software Update. Of course, once checked, SU reports that there are no updates available.


     


    On checking Firefox Add ons, the Java Applet plug-in is showing as "enabled".

     


    The same thing happens with Safari.



    This is very good to know -- I had seen this in Firefox, but did not know it was happening in Safari too. Thanks.

  • Reply 29 of 49


    I'm not reading anywhere here that it's a Safari-only limit. It sounds to me like OS level. I think this is File Quarantine, aka XProtect, which blocks things from running no matter what method is used to launch something. And it's just Java, not all plug-ins. When there's a known vulnerability, is it reasonable to just stand by when you have the tools to immediately take some action?

  • Reply 30 of 49
    hughug Posts: 2member


    Yes, is just isn't Safari.  We've tried firefox and it didn't work.  We tried going into our library system which runs Java and it wouldn't work.   We need a work around.  


     


    Oh, ya, maybe I'll just unplug all computers from the network to tighten security because of all the problems and give no work arounds.

  • Reply 31 of 49

    Quote:

    Originally Posted by John.B View Post


    Folks, this only affects the Java browser plug-in and only in Safari.


     


    Stand-alone Java still works fine for those of that persuasion.


     


    The "workaround" is to simply use a different browser than Safari.  Easy peasy.



    Sometimes that doesn't work. In Germany, for example, every (small) company has to file its VAT declaration online on the 10th day of every subsequent month. This is done via web forms that require Java and, for reasons unknown to me, don't work with Chrome. Annoyingly enough, I have to keep and use Safari for the sole reason of VAT declarations. Now if Java remains disabled until Feb 10th, I'm really stuck. OK there are other workarounds (Internet Explorer with Wine, virtualisation or Bootcamp), but I still find Apple's stand unnecessary paternalistic.

  • Reply 32 of 49

    Quote:

    Originally Posted by John.B View Post


    Folks, this only affects the Java browser plug-in and only in Safari.


     


    Stand-alone Java still works fine for those of that persuasion.


     


    The "workaround" is to simply use a different browser than Safari.  Easy peasy.



     


    Just chiming in to say that you are kinda wrong with your statement. It affects Safari, Firefox, Chrome, etc.


     


    The block to the web plugin is taking place at the OS level via XProtect. When you click on the Inactive Plugin arrow you get taken to an administrator password required Software Update, which doesn't do anything.


     


    This is a temporary fix posted by one of our techs:


     


    sudo /usr/libexec/PlistBuddy -c "Delete:JavaWebComponentVersionMinimum" /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist


     


    However this may get overwritten after every restart.

  • Reply 33 of 49
    john.bjohn.b Posts: 2,742member

    Quote:

    Originally Posted by Philotech View Post


    Sometimes that doesn't work. In Germany, for example, every (small) company has to file its VAT declaration online on the 10th day of every subsequent month. This is done via web forms that require Java and, for reasons unknown to me, don't work with Chrome. Annoyingly enough, I have to keep and use Safari for the sole reason of VAT declarations. Now if Java remains disabled until Feb 10th, I'm really stuck. OK there are other workarounds (Internet Explorer with Wine, virtualisation or Bootcamp), but I still find Apple's stand unnecessary paternalistic.



     


    If Apple takes a lackadaisical approach and winds up with another "Flashback" trojan epidemic, they aren't being diligent enough.  If they disable browser plug-ins for Java to prevent another outbreak, they are are being "unnecessary paternalistic".  Given the two options, and despite the inconvenience, they err on the side of security.


     


    FWIW, someone over on Ars has posted the steps to disable XProtect in the comments of their Apple Blacklists Java Web Plugin story.


     


    That said, if I were in your shoes I'd be giving someone in the VAT declaration office an earful about the need to replace that Java-based VAT declaration process, stat.

  • Reply 34 of 49
    Just to confirm java is blocked in Firefox under snow leopard work around is to copy xprotect.plist from a working machine into core bundle in core services folder. Then untick auto update safe list in sys prefs - security
  • Reply 35 of 49

    Quote:

    Originally Posted by John.B View Post


     


    That said, if I were in your shoes I'd be giving someone in the VAT declaration office an earful about the need to replace that Java-based VAT declaration process, stat.



    Here we go again.......


     


    He was right when he said "paternalism." He could have added 'condescending' in your case.

  • Reply 36 of 49

    Quote:

    Originally Posted by ascii View Post



    I think the disallow list only works for certain browsers, the workaround is to use a third party browser.


    I typically use Firefox for web based java interfaces & locally run standalone java apps run just fine.  Apple only blocks java in Safari, which is fine by me since half the time it doesn't even work properly with most java based GUIs.  So if you wanna expose yourself to hackers just use a browser other than Safari to browse the web.

  • Reply 37 of 49

    Quote:

    Originally Posted by SmileyDude View Post


     


    It's only the plugin, you can put your tinfoil hat and pitchforks away.  


     


    If Apple completely disabled Java you would hear the cries many many kids as they found out that Minecraft no longer works on their Macs.  As I can tell by looking around my own house, that is most certainly not the case.





    Damned. I never get to use those pitchforks...

  • Reply 38 of 49
    ijoynerijoyner Posts: 135member


    Seems Java has got beyond a joke. Maybe we need decent virtual machine technology like Unisys (Burroughs) ClearPath MCP (B5000) systems, the ultimate programming environment. Or ideas from the B1700. JVM seems to be based on these machines anyway, but the original was better. Niklaus Wirth also based his Oberon systems on similar ideas. JVM is good for running Java and related languages like Scala. B5000 virtual machines are heavily oriented towards ALGOL (that's real HLL programming and the first OS written in HLL, long before Unix and C - which is more like structured assembler than a real HLL, but ran lots of others as well as COBOL, FORTRAN (which was recursive), APL (Iverson said it was the best version of APL even though he was an IBM guy), Simula, C, Eiffel (I wrote that compiler myself). A good VM should be relatively language independent - I don't think Java is and had problems with genericity (which is horrible in Java, like multiple inheritance is in C++).


     


    So here's to a truly language and vendor independent VM. The B5000 high-level stack- and descriptor-based architecture (with no registers) with buffer overflow and array out-of-bounds checks is a good place to start to develop a real computer-independent computational model.

  • Reply 39 of 49


    I can no longer work from home due to Apple!!!!!


    Time to get a PC


    At least I can get infected in peace if I want too!

  • Reply 40 of 49


    only in safari and firefox and chrome, and prevents downloading of apps from trusted sources.....

Sign In or Register to comment.