Java security issues

[revelations]

Has anyone removed Java from their PC?

Apparently even the US Govt is recommending removing it.


Reuters) - The U.S. Department of Homeland Security urged computer users to disable Oracle Corp's Java software, amplifying security experts' prior warnings to hundreds of millions of consumers and businesses that use it to surf the Web.

[schocker]

I think a few browsers are blocking it already, on FF, it is disabled and I can't remember if it was chrome or ie i was using, it is disabled but gave me the option to override. The item I was looking at was the bmw configurator which is java which is an easy way to test.

[revelations]

I've uninstalled it from all my PC's - no issues this past week ... :dunno: (ie websites that wont load)

[sexualbanana]

How and why would I do such a thing?

[Zhariak]

Originally posted by revelations
Has anyone removed Java from their PC?

Apparently even the US Govt is recommending removing it.



I own a IT Consulting / Managed Services firm...

One of the biggest problems I used to have with non Managed Services clients are Adobe products, and Java...

Even with a firewall scanning http/https traffic, and corporate anti-virus, there would still always be issues with computers getting infected because the client didn't want to keep these products regularly up to date.

All the time they would just be mindlessly web-surfing away and exploits on websites would either exploit Java itself, or the update feature, shoot a payload on to the computer and execute it...

This was one of the main reasons why I stopped offering hourly based services and only offer Managed Services so I could keep these products up to date (using GPO to deploy)...

Huge pain in the ass.


As long as you keep it up to date, and don't browse free porn sites, you should be fine...

[revelations]

^ I dont understand why Oracle cant simply remove older versios oj Java automatically.

Most of my clients with older PCs are running Java 5/6.0 - even with Java auto updater service running.

[Zhariak]

Originally posted by revelations
^ I dont understand why Oracle cant simply remove older versios oj Java automatically.

Most of my clients with older PCs are running Java 5/6.0 - even with Java auto updater service running.

Can java applets and code still take advantage of the older engines?

I know that with my clients just like you it doesn't uninstall the older versions, but with that being said, I haven't noticed any issues by keeping the older version installed... I noticed that as long as I have the latest version installed, infections/exploits don't occur (even with the older versions installed).

[thetransporter]

Originally posted by revelations
Has anyone removed Java from their PC?

Apparently even the US Govt is recommending removing it.




I dont run anti virus on my PC but when I did have Javaclient in the task bar running I would get malware visiting websites.

solution - removed it.

[revelations]

Removing JAVA seems like a good idea. I wonder if FLASH is the next thing to be targeted (no more YT).

[rage2]

YT runs on html5 if you don't have flash.

[Seth1968]

Old versions of Java are simply overwritten, thus can't be exploited.

Adobe Flash now gives you an auto update function when you update it. I have no idea why Java doesn't give an auto update option, as most infections I see are a result of exploits via old Java versions.

EDIT: Overwritten wasn't the right term. The Java update will utilize the latest Java files on your computer, and only update what's needed. That's why a new install of Java takes much longer than an update.