Have you disabled your Java?

[John Connor]

http://threatpost.com/en_us/blogs/l...ken-two-new-sandbox-bypass-flaws-found-011813

 

[lxskllr]

http://threatpost.com/en_us/blogs/l...ken-two-new-sandbox-bypass-flaws-found-011813

:shakes head:...

 

[FelixDeCat]

:shakes head:...

:uninstalls Java again:

No more steaming quotes. :'(

 

[olds]

Is Java an ATOT group effort?

 

[John Connor]

Java is just useless to me anyway. I only used it for pintest.net. I think I'll just uninstall the crap.

 

[KillerBee]

I like this one
Malware Poses as an Update for Java 0-Day Fix

 

[hclarkjr]

try try again, another update today http://www.oracle.com/technetwork/java/javase/downloads/1880261

 

[Cerb]

Java is just useless to me anyway. I only used it for pintest.net. I think I'll just uninstall the crap.

The problem with Java goes like this:
1: Financial folk, used to using COBOL or stuck in a rut with a niche proprietary system, See The Light(tm) in Java(tm).
2: They write their new applications in Java, and make new versions of existing ones in Java.
3: They then write browser plugins in Java.
4: ...
5: Oracle profits.
6: Now, years later, their developers know Java, so they can keep up with the Java applications and clients, but it would be awfully expensive to rewrite the client-side bits in another language.
7: Java represents a big security hole, it won't always automatically update, and the semi-manual updates have opt-out crapware.
8: Since you need their program or service for your business, or even home banking, you're stuck with Java. DAMMIT!

If I were at a small business today, with any say, I would definitely institute a policy of no new Java, seek alternatives for existing Java programs, and let those companies that make and support current Java client-side code know it.

Server-side Java is fine. Embedded Java is mostly OK. Client-side Java should be migrated away from (if just for the crapware and non-update problems). The JRE browser plug-in should be banned outright--IMO, it aught to be an optional opt-in feature with the JRE installer.

 

[Miramonti]

Scottrade requires JAVA for steaming quotes so its enabled for IE. All other sites are browsed with FF.

To be safe, its uninstalled for now until the update is available on Tuesday. I oversee several dollars and need access to Java so I can manipulate governments and people to serve my Machiavellian interests.

()

Same with interactivebrokers, who's entire platform is built on java.

 

[IronWing]

Is it safe to go back in the water yet?

 

[lxskllr]

Is it safe to go back in the water yet?

If you don't need it, don't install it. I don't follow it closely since I don't need it in my browser. I do need it on my system though.

 

[Paratus]

I tried but Jawas disabled my machine.

Wait what are we talking about?

 

[Red Squirrel]

I keep it disabled and only enable as needed. Thankfully less and less sites use it now. Wish the same could be said for flash.