Chrome now blocks applets by default

[zammbi]

Not sure if anyone else noticed but in Chrome 11, applets are now blocked by default.

[DzzD]

unsigned applet too ?

[kappa]

hmm, might be a bug in Chrome otherwise it'd be really stupid if they did that. Are you on linux?

Games published by our own members! Check 'em out!

[zammbi]

"Are you on linux?"
No, windows 7.

"unsigned applet too ?"
Seems so.

"might be a bug in Chrome"
Could be(though I don't think so), I am using a beta. I'll research some more.

[kappa]

http://code.google.com/p/chromium/issues/detail?id=76737

above link looks relevant, from the comments it looks like it might be intentional and the java plugin is infobar'd by default .

[DzzD]

Google is becoming fun...

[zammbi]

Great... Well maybe we should complain on that thread, someone might listen.

[Riven]

Seriously, last year we saw such an incredible rise in exploits of bugs in the JRE, that were possible from within unsigned applets, that this is almost a natural response.

Chrome already replaced buggy Adobe Reader with their own PDF reader, probably for the same reasons.


You really can't blame them for trying to protect their users.

http://www.net-security.org/secworld.php?id=10014

[DzzD]

problem is that it bring new rules in Web world, every plugins can bring security holes this should not be a chrome concern, like if window start to block steam because they think it is not enought secure, or any other software... this is not fair

[kappa]

yup, looks like some anti competition play here from Google. The flash plugin continues to work as before with no block even though it was massively targeted too. Don't forget that Oracle released a massive patch ball with the last Java 1.6.0_24 release which fixed most of the known security holes, so not sure that argument holds much weight.

Games published by our own members! Check 'em out!

[zammbi]

yup, looks like some anti competition play here from Google. The flash plugin continues to work as before with no block even though it was massively targeted too.

Yeah though they work directly with adobe to make it more sandboxed in Chrome. Why couldn't they work directly with Oracle? I guess it's because of the suing

[Riven]

It's always a compromise.

Given the very poor state the applet plugin was in for more than a decade and the still very marginal use and the massive security problem, I personally think it's a fair attempt at raising the bar to get infected.

[benc1213]

Yeah I have noticed that but I switched to firefox 4 a few weeks ago and I am so glad I did.

[DzzD]

In a perfect world maybe, but I cant imagine there is not something behind

this is not a good solution, security hole are everywhere and the global security gain here is negligeable, it just increase the bad reputation of java

once again just imagine tha Microsoft decide Chrome is not enought secure... should they block it this way ? I mean they could just decide to sell a security certification to any software running on window, but is it  real solution ? thundirbird, Outlook, IE, Chrome, FF, Steam, Skype, Emul etc... are all potential nice infection vector

nowaday not only browser are using internet, security must be thinked more globally, the gain in security is so poor that this cannot be something else than a "pike" to Oracle

[oNyx]

yup, looks like some anti competition play here from Google. The flash plugin continues to work as before with no block even though it was massively targeted too. Don't forget that Oracle released a massive patch ball with the last Java 1.6.0_24 release which fixed most of the known security holes, so not sure that argument holds much weight.

Flash is integrated into Chrome. Like Chrome itself, it's kept up to date automatically.

Java's update rate is pretty sluggish.

By the way, Firefox blocks old versions of Java completely. E.g. 1.6.0_07 (can't figure out the exact version number, but I know that they blocked that one) and everything before gets blocked. Everything prior to _10 doesn't work anyways (incompatible).

[kappa]

yeh true, blocking out dated plugins is fine and Chrome already does this for all plugins.

However this time they've gone further and blocked every version of java (intentionally), even if its up to date.

[oNyx]

Infobar'd, not blocked.

[ra4king]

I posted about how outrageous this is and all I got was that I have my facts wrong and then they disabled commenting on the issue alltogether
And I thought I liked Google

[Riven]

I posted about how outrageous this is and all I got was that I have my facts wrong and then they disabled commenting on the issue alltogether
And I thought I liked Google

I read your replies there.

Keep in mind that you are not dealing with 'Google' here but with people. You're certainly acting immature and have just pissed off somebody at the position to make significant changes, ruining it for others that would have more informed arguments as apposed to "But clearly this exchange was a waste of both our times." Like that ever helped in a discussion.

[Addictman]

To ra4kings defence; It wasn't his comment that stated "But clearly this exchange was a waste of both our times."

That aside, I see where google is coming from. The one thing that Chrome has really taken heat for, is it's lack of security. So it's understandable that they're trying to address security issues.  Do I personally like it? No. Would my mother like it, if she knew what it was in the first place? Definitely.

[Riven]

To ra4kings defence; It wasn't his comment that stated "But clearly this exchange was a waste of both our times."

Oops. I thought "dua...@gmail.com" was ra4king. My apologies.

[ra4king]

@Riven
It's all good
Btw, I'm ra4king everywhere on the internet

@Addictman
But Java is not Google's to control. Google can't take heat for security issues on behalf of Java so I really see no point to block autorun for all version of Java. They should only block older versions because it is getting quite annoying allowing every single site I go to.

[Addictman]

I understand what you mean, and as I said, I personally don't like it. But Java's installed on so many computers around the world, and so few of those computers actually *use* java actively. Let's face it, the members of this forum aren't exactly the average user when it comes to Java. So, if/when a new huge gaping security hole emerges in the current java version, what's the safest thing to do? Ignore it, and wait for Oracle to fix it, and risk the vast majority of users around the world that have java installed but don't know what it is, to go into a tantrum over Google because they erroneously think Chrome's the culprit? Or, force those that actually use java services to "click once".

In a perfect world; screw google. In the real world: screw applets.

[ra4king]

Agh screw the real world

But yes, that unfortunately makes sense

[BoBear2681]

At the risk of having an unpopular opinion in this forum, I really don't mind this.  They're essentially embedding functionality similar to (parts of) NoScript into the browser.  Of course, I do see the concern as a Java developer about user perception.

Folks often say that users will usually click "Yes" to any dialog asking them anything, without even reading or understanding it, to try to get software working on their computers.  Might that happen in this scenario as well - "Oh, I have to click OK here to use my banking site, whatever"?

[Nate]

Built in FlashBlock (the Firefox plugin) for Java. Cool.

[Scarzzurs]

It seems a bit overprotective, but on the other hand companies like Apple have been practising stuff like this for years...

I must also admit that after surfing sites that are filled with applets, I have at some point actually wanted a feature like this.
I have a plugin like that for delaying Flash loading called FlashBlock. However as with FlashBlock I as the user made the decision, not the author of the browser...

In regards to security, I'm not sure how much difference it will do.
People will still click the "Allow virus to install" button.
Only the 10% that doesn't will be a tiny bit more protected (future Java patches should fix it anyways).

Hmm, I wonder how big the chances of a removal of this feature is, if Java security goes up...

- Scarzzurs

[delt0r]

I do and always have had java blocked by default. Same with java script and flash. I want to surf and read the web, not have the web  intrude on me. I enable these "run client side" features  only for specific pages or cases.

Quite frankly not only do i understand where google is coming from. I think its a good idea.

[DzzD]

a problem is also that if the user is asked once (by Chrome), logicaly user have been prevent and than the Applet should then be given full access without the need to be signed (stupid to ask twice), this completly make the sandbox of java Applet useless/obsolete.

If Applet is considered as unsafe it should not need to be signed anymore, continu to ask for a secure certificat to gain full access will mean unsigned Applet are considered secure

[kappa]

oh well, another nail in the JavaFX 2.0 coffin.