Federal Warning About Java

[Icedawg]

Has anyone else heard about this? The feds are warning Americans to disable Java as it supposedly has lots of security issues related to identity theft. Is this a matter of the feds having some axe to grind with Oracle, or something to do with keeping the population in fear, or is there a serious threat of being hacked?

As far as I know, I only need Java for Tracker. However, since AE is my life (okay, I'm exaggerating a bit), I don't want to disable it if not absolutely necessary.

Can anyone enlighten me here?

[GreyJoy]

ORIGINAL: Icedawg
However, since AE is my life (

---

), I don't want to disable it if not absolutely necessary.

+1

Sometimes i feel like Sheldon Cooper....but much much less intelligent [:D]

[sanderz]

theres some comments on this in the tracker thread

basically you can have java 7 installed as default (which has a bug fix) and java 6 called to specifically run tracker.

this is 'safer' rather than totally safe as even the patched java 7 is, i think, still not totally fixed

also i have no idea if the virus can call java6 rather than use the default (java7)

[Lokasenna]

Playing this game, I at first thought this was about a travel warning TO Java, not about USING Java.

If you've got Firefox, you should install NoScript and then only allow scripts (usually this means the Java and Flash that's on the page) from websites you trust. Warnings about Java are nothing new, really. But it's no more dangerous than anything else you do over the 'net on your computer, aside from being a bit more ubiquitous. As long as you follow best practices, you should be fine.

[dcpollay]

I'm playing as Allies vs. AI. It's March 20, 1942 and I can assure you, Java IS being disabled. [:(]

[GreyJoy]

ORIGINAL: Colonel Mustard

I'm playing as Allies vs. AI. It's March 20, 1942 and I can assure you, Java IS being disabled. [:(]

ahahahaha[&o]

[witpqs]

Also in the Tracker thread, see my comments about how Chrome operates. Other browsers might have slightly different strategies but by now the major ones latest versions all should have something to you manage Java so that random web sites can not run it on their own.

[jeffk3510]

I received a similar message...something to do with Homeland Security..

[wdolson]

I thought this was about a travel advisory too. I've used NoScript for a while now. It's sometimes a bit irritating to enable scripts on new sites I go to, but it does offer protection if I accidentally end up at a dodgy site which can happen if I misspell a common URL or from searching for something.

Running a Java app on your system should be safe if you know what you're running.

Bill

[Lecivius]

Running a Java App is ok. The problem is in the Java Update program, which is used to open a path into your machine. It's a VERY insidious little loop. As long as you don't auto update, but rather go to the Oracle website & update, you should be fine. The problem is that Oracle sets up a back door in Java to advise on updates, and then sets a change in your Registry to allow it. This allows the hacker with the know-how to back end any machine running it.

[Dixie]

ORIGINAL: wdolson

I thought this was about a travel advisory too. I've used NoScript for a while now. It's sometimes a bit irritating to enable scripts on new sites I go to, but it does offer protection if I accidentally end up at a dodgy site which can happen if I misspell a common URL or from searching for something.

Running a Java app on your system should be safe if you know what you're running.

Bill

I use the same excuse around Mrs Dixie [:D]

[Cap Mandrake]

Hory Crap! Thata sigrine is rearry funny.

[wdolson]

[:D]

[Cap Mandrake]

ORIGINAL: Lecivius

Running a Java App is ok. The problem is in the Java Update program, which is used to open a path into your machine. It's a VERY insidious little loop. As long as you don't auto update, but rather go to the Oracle website & update, you should be fine. The problem is that Oracle sets up a back door in Java to advise on updates, and then sets a change in your Registry to allow it. This allows the hacker with the know-how to back end any machine running it.

There are two things about this that concern me.

1) This auto-update exploit, isn't that analagous to the old IE vulnerability? If so, how could they (the Java folks) possibly NOT foresee this?

2) Why are we learning about this from Homeland Security? [X(][X(]

[Lecivius]

ORIGINAL: Cap Mandrake

ORIGINAL: Lecivius

Running a Java App is ok. The problem is in the Java Update program, which is used to open a path into your machine. It's a VERY insidious little loop. As long as you don't auto update, but rather go to the Oracle website & update, you should be fine. The problem is that Oracle sets up a back door in Java to advise on updates, and then sets a change in your Registry to allow it. This allows the hacker with the know-how to back end any machine running it.

There are two things about this that concern me.

1) This auto-update exploit, isn't that analagous to the old IE vulnerability? If so, how could they (the Java folks) possibly NOT foresee this?

2) Why are we learning about this from Homeland Security? [X(][X(]

Not sure on Homeland Security. Perhaps there is something else I don't know about. It wouldn't be the 1st time. As to the IE vulnerability, that was (and still has not been completely) patched by MS. The Java hole is just that. A hole. Your machine will get an echo that it "thinks" is a Java update request, and then update. Depending on your settings, you might not even know it happened. Even if you do, it's the Java Update screen, a real one that pops up. I only learned of it during a recent Ethical Hacker seminar

[msieving1]

ORIGINAL: Icedawg

Has anyone else heard about this? The feds are warning Americans to disable Java as it supposedly has lots of security issues related to identity theft. Is this a matter of the feds having some axe to grind with Oracle, or something to do with keeping the population in fear, or is there a serious threat of being hacked?

As far as I know, I only need Java for Tracker. However, since AE is my life (okay, I'm exaggerating a bit), I don't want to disable it if not absolutely necessary.

Can anyone enlighten me here?

Apparently, the DHS warning applies to Java in web browsers, not stand-alone Java applications.

[geofflambert]

ORIGINAL: Lokasenna

Playing this game, I at first thought this was about a travel warning TO Java, not about USING Java.

The travel advisory still holds. There are still Japanese soldiers hiding out in the jungle who think the war is still on.

[The Gnome]

Also, for the tech novice javascript is to java as eggplant is to eggs. They just share a name, but don't have anything else in common.

The warnings are for java and the run time engines that need to be installed on your computer.

[wdolson]

ORIGINAL: geofflambert
The travel advisory still holds. There are still Japanese soldiers hiding out in the jungle who think the war is still on.

Somehow 90 year old soldiers who have been living off the land for nearly 70 years with 70 year old weapons don't really scare me too much.

Bill

[PaxMondo]

ORIGINAL: wdolson

ORIGINAL: geofflambert
The travel advisory still holds. There are still Japanese soldiers hiding out in the jungle who think the war is still on.

Somehow 90 year old soldiers who have been living off the land for nearly 70 years with 70 year old weapons don't really scare me too much.

Bill

Bill,

They are now in their 4th generation ... these are now 18 yo's armed with Ipod's. [;)]