[Silhouette]

Pleased to see they've backed off on the draconian Java restrictions. I now see (with an up-to-date plug-in) three options: always or never active, or ask to activate, with the latter then prompting as a one-time or remembered choice. This seems a much more reasonable balance between trying to protect security and making sure people can get work done than some of the other proposals in recent discussions.

[josteink]

They honestly had to though. their aggressive stance on plugins risked losing them significant market share in the Java-heavier parts of the world.

They couldn't let a few rogue cowboy-developers with an agenda and complete user disconnect overnight just ruin what Mozilla have spent decades building up.

[mixmastamyk]

The plugin is quite dangerous, an "aggressive" stance sounds reasonable to me. In the interest of fairness I keep a similar stance with IE/ActiveX.

[Silhouette]

The plugin is quite dangerous, an "aggressive" stance sounds reasonable to me.

But what would persisting with claims that Java plug-ins are always dangerous have achieved? By a similar argument, the Firefox team fixes several security vulnerabilities they themselves describe as "critical" in each new six-weekly release, so they ought to have advised users not to run Firefox either. Software has bugs, and security flaws need to be fixed, but something about glass houses and stones kept coming to mind with the previous stance. The new one seems a reasonable balance and a constructive policy, and I welcome it as such.

[mixmastamyk]

And some software has almost an order of magnitude more vulnerabilities while simultaneously being unnecessary for most folks.

Oracle has been issuing ~50 per quarter recently, an incredibly long time to wait for critical fixes. In security, less is more. Now that Windows has become safer, the big targets are Java and Flash. It continues to be good practice to avoid standing behind big targets.

[Silhouette]

Firefox has had in the region of 30-40 advisories per quarter recently, hardly an order of magnitude more vulnerabilities than the ~50 you mentioned as the Java plug-in's recent record.

Also, as has been pointed out in numerous recent debates about Java, it might be unnecessary for most folks, but there are still many millions who use it routinely. Indeed, this is precisely why I think Mozilla's U-turn on this issue was a sensible move.

[iSnow]

Anyone is still using Java in the Browser?

[josteink]

Yes. and thanks for demonstrating the user disconnect I was just referring to. the internet is big, so it's an easy thing to fall into.

for better or worse some places java is the one sanctioned way to sign into online banks and sign official documents online.

Having your browser constantly telling you that you can't do that anymore, completely out of the blue, tends to cause dramatic reduction in browser usage in those areas.

[Svip]

Look at it this way; I love a good debate. Even where more extreme measures are proposed. In fact, when starting a discussion about a problem, not having proposals (i.e. solutions) of your own, tends to leave your debate dead in the water.

Merely stating that Java is a security problem hasn't really sped up a solution to the problem. It's like the talk about how terrible PHP and JavaScript are, but it isn't really helping, is it?

So while my personal experience would not have been ruined by the initial proposal from Mozilla (as I do not use any plugins in my Firefox, I leave that for my Chromium browser), I do agree that they made the right call in the end. But it did at least spark a debate on the matter, and an interesting one at that. And it'll probably come up again, when another Java security issue appears.