In Firefox 24 and following, mark all versions of Java as unsafe

https://bugzilla.mozilla.org/show_bug.cgi?id=914690

by y0ghur7_xxx • 13 years ago

124 179 13 years ago

bugzilla.mozilla.org

Gonzih2• 13 years ago

Great news, I'm always paranoid about java plugin. Now I can relax a little bit.

You were able to disable java in your browser with one click also before ...in my opinion, this move from FF is a very bad one.

Now what we should use if we need more then HTML5? A) -> Silverlight ...FF promote a closed technology against the somehow open Java?? B) -> Flash ...which is on a downhill now? C) -> Java ...users need to be IT experts to enable it

One thing I would like to see: MS should ban FF because it is insecure :)

Gonzih2• 13 years ago

Change is to disable java by default. User can enable it for one page but can't enable it globally for every page. I like that because it close to things like flashblock.

GyrosOfWar2• 13 years ago

One thing I would like to see: MS should ban FF because it is insecure :)

Any follow-up on that? FF is, to my belief at least, one of the more secure browsers.

chris_wot• 13 years ago

I'm trying to find a summary of why this was done. This is a pretty high impact change!!!

codeflo• 13 years ago

Maybe Oracle's "only once per quarter" patch day policy has something to do with it.

tga_d• 13 years ago

I hate to state the obvious, but... https://bugzilla.mozilla.org/show_bug.cgi?id=914690#c0 That seems like pretty straight-forward reasoning to me.

InclinedPlane3• 13 years ago

Java vulnerabilities are a huge source of drive-by exploits in the browser. I wouldn't recommend anyone leave java on by default.

RyanZAG4• 13 years ago

This will have a pretty bad effect on Firefox's market-share if it goes live.

That said, it's a solution for the current problem and should really be applied to all plugins - I'm not sure why java is singled out here, many of the other browser plugins are just as bad. Java has likely the most widely publicized security vulnerabilities, yet I can guarantee you that many many 0-days are traded daily for practically every single other browser plugin as well.

y0ghur7_xxx2• 13 years ago

This will have a pretty bad effect on Firefox's market-share if it goes live.

It's already live. ff24 is the current stable.

RyanZAG4• 13 years ago

Oh interesting - hard to keep track of which version Firefox is up to these days. They should really swap to a system like Ubuntu's - using the date for the version number.

It was released over a month ago too. Has it had any effect on Firefox's market-share? Especially in enterprise? It's a pretty decent test bed for understanding how users react to these kinds of changes. If they just accept them and adapt when forced it shows that we can be more proactive in moving users to better yet incompatible software?

josteink8• 13 years ago

Confirmed. It broke my SO's ability to do online banking yesterday and I was (as usual) called in as tech support.

I just assumed Java was out of date (again) and was surprised to see it still blacklisted after updating to latest version.

There's no part of the UI saying "We've permanently blocked all of Java by default". Even if you agree with the developer's ideological stance here (which you very well may not), the UX part of the job is completely botched.

dmpk2k• 13 years ago

Will it? I've been browsing without Java for years, and I can only remember problems with one site (some hilarious throwback from the late 90s). For general browsing, I doubt anyone will notice a difference.

Maybe for corporate use, but isn't that mostly IE anyway?

emil0r2• 13 years ago

Depends on where you are in the world. Java is required for online banking in Norway, while it's mostly unused in Sweden, the neighbouring country. Both use Java for online verification to government sites.

angrymouse• 13 years ago

I believe apps like Google hangouts use Java/Need Java enabled.

I think the commenter shiloh.enriquez on that Mozilla thread had a decent point in that many users just want the thing to work, won't necessarily understand or have the patience to understand and will move from FF to Chrome or IE.

InclinedPlane3• 13 years ago

Why? Java applets are extremely rare these days.

acqq• 13 years ago

If you're 20-something doing "the startup game" you probably don't see it on the next cool site demos.

If you support the company where most of the users just know to click and login, and one day they just can't, you aren't going to like it, to quote one of the post from the bugzilla:

"I haven't been able to get VPN-ed in for days, until I figured I could still use the Juniper SSL VPN from Internet Explorer. I find it amazing the casualness with which a small group of developers just shut off an entire set of functionality with no regard for its size, utility... You just broke millions of peoples software, and then you complain about this being a bug list, and you can simply do this, or simply do that."

It doesn't help that "advanced users" would know, ordinary users after the automatic update can't do what they were able to do.

dingaling• 13 years ago

Java applets are extremely rare these days.

Yes, but unfortunately when they do occur they tend to be rather important; Eurocontrol's air-traffic flow management site, for example. If you need to file or change a flight-plan...

puzzlingcaptcha• 13 years ago

Still, many users [http://geeksbynature.dk/2013/03/28/plugins-usage-distributio...] have only Flash, Java and Windows Media plugins installed, maybe also Reader and Office. With Mozilla's efforts to replace Reader with pdf.js and Flash with Shumway (or HTML5), Java is a reasonable next target.

josteink8• 13 years ago

Except it's not getting replaced, it's getting blocked and disabled. While lots of code deployed still depends on it.

I hate Java applets as much as the next guy, but lets not ignore that there's a real world out there.

ivan_gammel2• 13 years ago

Their PDF replacement is far from good - buggy and unusable. We have to show PDF documents to our customers directly in browser, so we need good UX, and it was disappointing to see how it works in FF compared to other browsers with Reader and how much effort do we need to fix it. I'm not surprised they screwed up with Java too.

iand3• 13 years ago

I doubt it. Apart from the odd algorithm demonstration I haven't found a need to enable Java in my browser for the past 10 years.

RyanZAG4• 13 years ago

Sure, and I haven't used Internet Explorer in years. That doesn't mean that suddenly disabling Internet Explorer is going to have no effect even if I (and probably most of us here on HN) would not even notice.

A lot of corporates and financial applications require Java.

im3w1l• 13 years ago

Java is singled out because it is "too big to fail".

NKCSS• 13 years ago

Very nice :) Maybe this will nudge Oracle a bit (we can always hope, but know it won't do anything...)

edwintorok• 13 years ago

Did they also disable Flash? (well I don't have the plugin installed anyway, so I wouldn't know)

SEMW• 13 years ago

No. Mozilla's plan for flash is to replace it with a javascript flash runtime, shumway.js, in the same way they discouraged adobe's acrobat plugin by bundling pdf.js. But shumway's not finished yet.

See: https://lwn.net/Articles/569496/

Yoric8• 13 years ago

A few years ago, Flash used to be a security nightmare and Java was shiny and solid. These days, it's pretty much the opposite. Flash security holes are fixed very quickly, Java security holes, slowly-to-never.

So, for the moment, we have not taken the decision to disable Flash.

nikbackm• 13 years ago

Great, maybe then I can stop checking if the Java updates at work also sneakily re-enables the Firefox plug-in behind my back each time they're installed.

Tharkun• 13 years ago

The sooner Java moves away from Oracle, the better for everyone. That being said, there is rarely a need to run Java from a browser, aside from the odd game.

But, given Flash's similar reputation (not to mention it being prone to crash), why not mark Flash as unsafe as well?

LaGrange• 13 years ago

Juniper VPN is evil, broken, uses Java, and extremely common. And that's just one example of a common Java plugin.

DZittersteyn2• 13 years ago

Wow, this is really irresponsible behavior, I would've expected something better from Mozilla.. Until now they've first offered an alternative (e.g. pdf.js) before trying to move away from a tech.

Marking a current version as unsafe, even when there are no known exploits is simply ridiculous. I'd love to see the reaction of Mozilla if Microsoft decided to mark all Firefox releases as unsafe, and give a big security warning whenever you installed FF.

Especially if the UI for unblocking it in FF is as obtuse as the discussion implies..

calibwam3• 13 years ago

Well, when you download the .exe file in IE, you do get a warning that it might be unsafe from Windows. And you need to verify that you want to install it.

The way to verify that the installer is legit, verifying the checksum, is not done by Windows, and must be done manually. Users don't do that, and flagging everything as unsafe is a good way of notifying the user that they must be careful.

josteink8• 13 years ago

flagging everything as unsafe is a good way of notifying the user that they must be careful

Crying wolf all the time is a 100% guaranteed way of making sure nobody will ever care.

eterm• 13 years ago

No, it's a good way to ensure that users click OK without reading message boxes ever.

Yoric8• 13 years ago

Have you read the linked page?

At the moment, as Oracle refuses to fix security bugs timely, Java is permanently unsafe. Please be pissed off at Oracle for not protecting their users, not at Mozilla for doing it for them.

byuu• 13 years ago

I'm all for this being blocked by default, and the same goes for all plugins. But it certainly bothers me when they make it impossible to override their security constraints. Put in an about:config setting to allow Java, and it's fine.

All the heavy-handedness is going to do is force Firefox out of corporate IT environments where many internal websites rely on Java.

lead99• 13 years ago

This. Firefox is all about customization for me. Can you use about:config to turn this off? (I don't even use Java or Flash)

kristofferR5• 13 years ago

They didn't block Java at all, they just stopped it from running the applets automatically. You can still run Java applets without any issues, you just have to allow it by clicking the red lego block.

gfritzsche4• 13 years ago

There are options which have been discussed on the enterprise mailing list, e.g. one most recently here: https://mail.mozilla.org/pipermail/enterprise/2013-October/0...

calibwam3• 13 years ago

This sounds like a major move from Mozilla, but really it is not. In Chrome, you have to enable Java per site basis, and as long as the UI for enabling Java is good, it shouldn't be an issue. Java on client side is dying, anyway. And good riddance.

motif• 13 years ago

haha, reading through the bug comments is golden. All the Mozilla folks are super professional coordinating between teams then it's released to the testing channel and shit hits the fan :D

Stratoscope2• 13 years ago

I'm using Firefox in Ubuntu with Java to connect to a Juniper Networks VPN. When I upgraded to Ubuntu 13.10 a couple of days ago, the VPN launcher stopped working. I think Firefox 24 came along with the upgrade (that's the version running now).

I upgraded to the latest Java r45 and it still didn't work. Then I noticed a blinking red thing in the address bar where the security lock icon goes. I clicked that and it gave me an option to enable Java for the VPN connection site permanently.

Seemed easy enough to fix. I only had to click that icon once, and it's been working smoothly since.

datr• 13 years ago

You might also want to take a look at https://github.com/madscientist/msjnc. I found it a lot better than Juniper's manager for linux.

Stratoscope2• 13 years ago

I agree, msjnc looks much better than the Juniper launcher. But it doesn't seem to support two-factor authentication, which I need:

A number of people have written me to ask about multi-key logins. I don't have any knowledge of or experience with these and my (very limited) investigation of the Network Connect service doesn't show how to do this from the command line. If someone can describe what the expected interface to the ncsvc program is for these situations I'll try to add support for it.

http://mad-scientist.us/juniper.html

At least that sounds like two-factor authentication he's talking about ("multi-key logins"). If it supported that I would definitely use it.

lucian1900• 13 years ago

Which is great, since the whole point was to disable drive-by attacks.

ce42• 13 years ago

the user can still enable java permanently for particular sites, but will not be able to enable java for all sites.

https://support.mozilla.org/en-US/kb/how-to-enable-java-if-i...

kristofferR5• 13 years ago

A lot of the commenters here seem to misunderstand this change.

You can still easily run Java applets in Firefox 24 and beyond, you just need to click the red lego block in the upper left corner and allow it. [1]

It's much less strict than in Chrome (on OS X), where Java doesn't run at all anymore.

[1] https://support.mozilla.org/en-US/kb/how-to-enable-java-if-i...

Silhouette16• 13 years ago

You can still easily run Java applets in Firefox 24 and beyond, you just need to click the red lego block in the upper left corner and allow it.

I've had multiple calls in the past week from Java users who didn't know that and just thought the page in question had stopped working. Your idea of "easily" and theirs are very different.

It's much less strict than in Chrome, where Java doesn't run at all anymore.

I've spent much of this morning testing applets in Chrome. In fact, I've got one running right now, and I just confirmed that Chrome is up-to-date. Perhaps you've misunderstood something?

kristofferR5• 13 years ago

Yeah, it's true that lot of the sites still using Java hasn't been updated with the correct instructions about how to enable it in FF 24 yet - and they should fix that as soon as possible of course.

Still, it's a much easier thing for normal users to figure out than how to update Java (which they must do quite regularly to get Java to run at all).

I did a little Googling and it turns out that Java still runs in Chrome on Windows, it's just banned on OS X.

belorn2• 13 years ago

Are those actually users, or developers/testers who run test suits on their products and noticed a change?

johnchristopher9• 13 years ago

You can still easily run Java applets in Firefox 24 and beyond, you just need to click the red lego block in the upper left corner and allow it. [1]

Allow me to disagree and to tell you what happened last weekend:

Last Sunday I had a call from my stepfather who "couldn't run the website to order agro food" anymore. This website runs a Java applet to manage agro food orders on-line and the code isn't signed (it's a small structure).

He tried to understand what was going on with the warning before clicking "ok/yes/run". He googled the warning and unfortunately ended up installing malwares from ads running on some PC help website/forums that promised to fix "2 just found vulnerabilities": he thought that was related since the warning actually preventing him from accessing his "working-fine-yesterday" website seemed to be about security and vulnerabilities in the plug-in.

He then tried to update Java but canceled it at the end of the process because the window with the Java propaganda ("it powers 3 billions of applications, your car, your website, etc.") looked too much like the one with malwares from before and those didn't fix the problem (not being able to access his website).

When I finally could go to his house to fix it I realized what had happened.

It is definitely not user-friendly. It was working before and in his eyes Mozilla made it not working anymore.

edit: typo and grammar

kristofferR5• 13 years ago

Java actually installs malware (the Ask toolbar) unless you are careful enough to deselect it during the installation/update process.

z92• 13 years ago

This one needs a separate post. Please make a blog entry and post it here and on reddit.

nknighthb13• 13 years ago

This is clearly a person who would have wound up with malware regardless. It's as if you blamed telephones for allowing a scammer to call a gullible mark from the Official Credit Card Office.

Yoric8• 13 years ago

Interesting point. How would you rephrase the warning?

jasonlotito• 13 years ago

You should update your comment to reflect the reality learned here:

https://news.ycombinator.com/item?id=6591531

johnchristopher9• 13 years ago

I can't edit my message anymore so I reply here.

After reviewing the facts by discussing them with nknighthb it appears the warning message that prompted me to blame Mozilla for a confusing warning message was due to Oracle and their Java warning pop-up. https://dl.dropboxusercontent.com/u/202857/java.png

My apologies :], I am a little bit ashamed for not spotting it sooner.

_random_• 13 years ago

Why stop on the Java? Mark all Java* languages as unsafe.

GyrosOfWar2• 13 years ago

What do you even mean with that? Marking all JVM languages as unsafe? Marking JavaScript as unsafe (because it has so much to do with Java, right?) The issues Mozilla has with Java are limited to browser applets and the lack of security updates from Oracle (which, coincidentally, mainly affect the browser applets)

eonil3• 13 years ago

What about Flash?

camus24• 13 years ago

we are talking about Java , why do you want to talk about Flash? because you want your daily flash bashing fix?

eonil3• 13 years ago

We are talking about FireFox's decision. Not only for Java.

eonil3• 13 years ago

If Java is whole source of vulnerabilities, how it's working well in servers?

jrochkind1• 13 years ago

Most of the vulnerabilities in Java that effect browsers are not relevant when Java is used in other contexts, rather than embedded in a browser.

kevingadd• 13 years ago

A lot of the angry comments about this seem to be coming from uninformed people who haven't actually tried it - that or something about this change isn't actually rolled out. I just tried it in an up-to-date version of Firefox 24, along with Firefox Nightly.

In both, with my existing old build of Java, I got a placeholder image like this:

https://dl.dropboxusercontent.com/u/1643240/outdated_java.pn...

Clicking it took me to the update page. Exactly what you want. There was an option in the top-left corner to forcibly load it, which is fine - updating is the right move.

Once I updated and uninstalled the old JRE, in Firefox 24 the applet I was trying loaded silently without any confirmation. It was not blacklisted.

In Firefox Nightly, once Java is updated, I see this placeholder where the applet would have been:

https://dl.dropboxusercontent.com/u/1643240/activate_java.pn...

Clicking the placeholder opens a prompt asking if I want to allow the plugin once or allow it always on this site. Very straightforward.

Other than the fact that modern Java 7 is not blocked by default in Firefox 24 for me (maybe they didn't roll that out yet?), everything works fine here, and I don't see any catastrophic UI mistakes, developer/enterprise-hostile design, or attempts at destroying the web.

gfritzsche4• 13 years ago

The applet loading without user action after the Java update sounds like you had already allowed it for that site before (or maybe you haven't got the blocklist update yet for some reason?).

What you are seeing on Firefox 26+ is all plugins except Flash becoming click-to-play by default: https://blog.mozilla.org/futurereleases/2013/09/24/plugin-ac...

josteink8• 13 years ago

In both, with my existing old build of Java, I got a placeholder image like this:
https://dl.dropboxusercontent.com/u/1643240/outdated_java.pn...

The problem is that this dialog box is outright lying. It will show that placeholder even with the latest version of Java installed.

Firefox is open source software. Open source software should be trustworthy. Software which lies to you is by definition not.

As things stand here, right now, it's Firefox which has a problem.

gfritzsche4• 13 years ago

It will show a different placeholder with the latest Java (no update link & text): http://imgur.com/k94vEvB

Given Javas security history, this seems correct.

adamtulinius2• 13 years ago

I just want to confirm 'gfritzsche' in you being wrong, and ranting about a lot of stuff that is just wrong. You should delete your comment.

Fuxy• 13 years ago

Allowing java to run is not very intuitive. I predict a lot of people believing It can't be run getting frustrated and using a different browser.

I know it's to protect the users from themselves but if you're going to warn on all versions make it easier to allow the applet to run.

jtheory6• 13 years ago

Does anyone want to write a user-friendly walk-through to help normal users get Java running? I may have the time to assist, though I'm doubtful I could do the whole thing.

ScreenLeap has a good start: http://www.screenleap.com/troubleshooting-java

The advice they give varies based on the detected browser and OS (as it must) but it's somewhat out of date, and isn't intended for a general audience.

The applets on my educational site are signed JARs (a wasted expense, it seems), and they are explicitly run within the sandbox, but every few months it gets harder and harder for students and their parents to get Java to run.

And now in Firefox my interactive components have just become scary-looking blocks of DO-NOT-ENTER signs and warnings that are totally unwarranted for my site. If you work up the courage to click through the browser's warnings, then of course you get round 2, the warnings that the plugin itself pops up.

I dearly wish to see some of the details on the evil that's being done with Java applets, and if all of these aggressive measures are actually doing anything to stop real risks, or if the main effect is to kill sites like mine.

These do not seem to be actions based on data anymore.

Yoric8• 13 years ago

Could you consider contributing this to http://support.mozilla.org ?

jtheory6• 13 years ago

I don't have much hope - the pile-on against applets has been unrelenting for months now - but I will give this a shot. It's not obvious to me which part of the site you mean yet, though.

jtheory6• 13 years ago

Last night I submitted comments on the Bugzilla bug, and joined the (small) conversation on the dev list. My message is still in moderation, though (it wasn't rude or anything, so I suspect it's just because of time differences).

https://mail.mozilla.org/pipermail/firefox-dev/2013-October/...

pjmlp• 13 years ago

Now can we mark JavaScript as unsafe as well?

marvin3• 13 years ago

This will be more great publicity for Norwegian government-owned consultancy Evry, which has built the BankID Java Applet which is used for authentication of each and every online consumer money transaction performed in the country.

However, it is about time - I've heard online banking developers talk crap both about BankID and the underlying online banking infrastructure in the country, and security holes due to Java exploits are rampant. The banks have paid the bill for this until now, but it causes massive inconvenience for...every Norwegian who uses an online banking service. (Every adult Norwegian, more or less).

gizzlon• 13 years ago

"government-owned" is misleading, it's not used for "every online consumer money transaction performed", and, if I understand it correctly, it's just one extra click ..

marvin3• 13 years ago

Evry, the consultancy which developed and runs BankID, is largely owned by the public (The Postal Service: 40%, Telenor: 30%, of which the latter is 53% state-owned: http://www.purehelp.no/company/owner_network/evryasa/9343824...). BankID is in fact used to sign all(#) internet banking transactions by regular, private end users of online banking services.

The problem isn't the extra click - two factor authentication with a one-time pad is an excellent extra security measure. The problem is that the implementation sucks and is riddled with security holes, prompting you to update Java every other time you log into your online bank account. This in addition to incredibly slow loading and also outright crashes if you are using a non-standard (i.e. not latest version of IE) browser. It is a giant, steaming pile of crappy software. We can't switch to a Javascript version fast enough.

(#) Except for those customers who have not yet been pushed into BankID, which is the selected standard for online banking. And obviously not for intra-bank and similar transactions.

unhammer2• 13 years ago

There are still a couple banks in Norway where you can get by without BankID.

flurdy• 13 years ago

Ive been ducking and diving to avoid my account being converted to BankId for years. My online bank prompts me to "upgrade" to it every month and wont let me say no. However if I abort the sign up wizard half way through it always defaults to the old 2 factor fob.

tmilard2• 13 years ago

I reported this big issue forme in the developper forum. al java version, even recent ones, ALL are considered, (not like flash...) as a "permanent unsecure virus" by Firefox.

- How can the Mozilla team can think they can get away with this ? This behavior is all but neutral from firefox ?

- So I have to drop my software that I programmed in 7 years ? Benjamin Smedberg (the guy at mozilla who made this shit) is an extremist. I went 4 days ago in the developper forum to discuss about this :

--------------------------------- Me: "A red no entry sign" is too radical for recent java player I think. My users give me a phone call to tell me "No way I will accept to install your software with this red warning"... Even the people who know me, tell me they got so scared they have really hesitated to accept java. Now I do understand at a time when java had urgent security issue this scary red-message was necessary. But I really wish that Firefox checks the java version installed ... and give a less-scary-warning-sign or a "go !" if the user has a recent java version (like the latest on java 1.7 update 30).

Benjamin Smedberg: "We fundamentally disagree about the risks of the Java plugin. We believe the Java plugin is unsafe, and we want to present that to our users".

-- Is there a boss at Mozilla ? someone who cares about developpers. And yea Benjamin, you know, java is open source by the way. Fuck you idiot ! Thierry

tmilard2• 13 years ago

I have reported this big issue forme in the developper forum last week. All java version, even recent ones, ALL are considered, (not like flash...) as a "permanent unsecure virus" by Firefox.

- How can the Mozilla team can think they can get away with this ? This behavior is all but neutral from firefox!

- So I have to drop my software that I programmed in 7 years ? I went 4 days ago in the developper forum to discuss about this :

Benjamin Smedberg (chef of this idiot change): "We fundamentally disagree about the risks of the Java plugin. We believe the Java plugin is unsafe, and we want to present that to our users".

-- Is there a boss at Mozilla ? someone who cares about developpers. And yea Benjamin, you know, java is open source by the way. Fuck you idiot ! Thierry

ce42• 13 years ago

This is HN, mind your language please.

etimberg• 13 years ago

It's a copy of one of the comments on the link. It should have been in quotes at a minimum.

Karunamon• 13 years ago

sigh

I hope there will be an about:config override for this. It seems like any time one of these browser authors does something "for security", it ends up being a perpetual pain in my ass and the ass of the users I support.

camus24• 13 years ago

That's a great decision. IT departements already acknowledge the fact that java applets are totally insecure and dangerous , and Java or Flash shouldnt run in the browser.

You want to program stuffs in the browser ? use javascript and html5 apis.

You want to do socket stuffs in the browser? use a proxy server.

But dont expose your users to exploits by making them install Java.

You want to build future proof solutions ? stop using applets because you cant learn javascript.

pkolaczk• 13 years ago

What if I need top performance? The only real alternatives are JavaFX or moving off the browser completely (native app). Despite many man-years put into optimisation, JavaScript is still nowhere near in performance. Yeah, I know in some lucky microbenchmarks from Google or Mozilla it can be only 2-4x slower than Java and it is pretty impressive but why do many real JavaScript games/programs struggle on modern hardware as if it was an old Pentium II (see: bombermine [1], quake JS demo [2], circuitlab [3]) or Java applet in year 1998? The only thing that make them look acceptable is that hardware is extremely fast these days.

[1] about 25 FPS with random hiccups on my Core i7 Quad @ 2.4-3.5 GHz and proprietary NVidia drivers and Google Chrome

[2] https://semitwist.com/articles/article/view/quake-shows-java...

[3] about 100x slower than old Berkeley Spice (early 90s technology), despite much less accurate models and using similar algorithms (sparse LU decomposition + Newton Raphson)

kibwen• 13 years ago

Does there exist a version of the Java plugin with PPAPI support? Because if not, all the commenters chiming in with "well we're switching our entire company to Chrome!" will be in for a rude awakening next year when Google removes NPAPI support from Chrome entirely.

http://blog.chromium.org/2013/09/saying-goodbye-to-our-old-f...

drill_sarge2• 13 years ago

Well, Icedtea w/ OpenJDK7 still running. So this is Oracle-Java only?

In Firefox 24 and following, mark all versions of Java as unsafe

Related Stories