zammbi
|
 |
«
Posted
2011-04-09 17:16:02 » |
|
Not sure if anyone else noticed but in Chrome 11, applets are now blocked by default. 
|
|
|
|
DzzD
|
 |
«
Reply #1 - Posted
2011-04-09 17:22:26 » |
|
unsigned applet too ?
|
|
|
|
kappa
|
 |
«
Reply #2 - Posted
2011-04-09 17:24:01 » |
|
hmm, might be a bug in Chrome otherwise it'd be really stupid if they did that. Are you on linux?
|
|
|
|
Games published by our own members! Check 'em out!
|
|
zammbi
|
 |
«
Reply #3 - Posted
2011-04-09 17:29:34 » |
|
"Are you on linux?" No, windows 7.
"unsigned applet too ?" Seems so.
"might be a bug in Chrome" Could be(though I don't think so), I am using a beta. I'll research some more.
|
|
|
|
|
DzzD
|
 |
«
Reply #5 - Posted
2011-04-09 17:50:24 » |
|
Google is becoming fun...
|
|
|
|
zammbi
|
 |
«
Reply #6 - Posted
2011-04-09 17:54:07 » |
|
Great... Well maybe we should complain on that thread, someone might listen.
|
|
|
|
Riven
|
 |
«
Reply #7 - Posted
2011-04-09 17:56:39 » |
|
Seriously, last year we saw such an incredible rise in exploits of bugs in the JRE, that were possible from within unsigned applets, that this is almost a natural response. Chrome already replaced buggy Adobe Reader with their own PDF reader, probably for the same reasons. You really can't blame them for trying to protect their users.
|
Hi, appreciate more people! Σ ♥ = ¾ Learn how to award medals... and work your way up the social rankings!
|
|
|
DzzD
|
 |
«
Reply #8 - Posted
2011-04-09 18:08:22 » |
|
problem is that it bring new rules in Web world, every plugins can bring security holes this should not be a chrome concern, like if window start to block steam because they think it is not enought secure, or any other software... this is not fair
|
|
|
|
kappa
|
 |
«
Reply #9 - Posted
2011-04-09 18:14:07 » |
|
yup, looks like some anti competition play here from Google. The flash plugin continues to work as before with no block even though it was massively targeted too. Don't forget that Oracle released a massive patch ball with the last Java 1.6.0_24 release which fixed most of the known security holes, so not sure that argument holds much weight.
|
|
|
|
Games published by our own members! Check 'em out!
|
|
zammbi
|
 |
«
Reply #10 - Posted
2011-04-09 18:17:46 » |
|
yup, looks like some anti competition play here from Google. The flash plugin continues to work as before with no block even though it was massively targeted too. Yeah though they work directly with adobe to make it more sandboxed in Chrome. Why couldn't they work directly with Oracle? I guess it's because of the suing
|
|
|
|
Riven
|
 |
«
Reply #11 - Posted
2011-04-09 18:17:46 » |
|
It's always a compromise.
Given the very poor state the applet plugin was in for more than a decade and the still very marginal use and the massive security problem, I personally think it's a fair attempt at raising the bar to get infected.
|
Hi, appreciate more people! Σ ♥ = ¾ Learn how to award medals... and work your way up the social rankings!
|
|
|
benc1213
Senior Newbie 
|
 |
«
Reply #12 - Posted
2011-04-09 18:21:49 » |
|
Yeah I have noticed that but I switched to firefox 4 a few weeks ago and I am so glad I did.
|
|
|
|
DzzD
|
 |
«
Reply #13 - Posted
2011-04-09 18:27:05 » |
|
In a perfect world maybe, but I cant imagine there is not something behind
this is not a good solution, security hole are everywhere and the global security gain here is negligeable, it just increase the bad reputation of java
once again just imagine tha Microsoft decide Chrome is not enought secure... should they block it this way ? I mean they could just decide to sell a security certification to any software running on window, but is it real solution ? thundirbird, Outlook, IE, Chrome, FF, Steam, Skype, Emul etc... are all potential nice infection vector
nowaday not only browser are using internet, security must be thinked more globally, the gain in security is so poor that this cannot be something else than a "pike" to Oracle
|
|
|
|
oNyx
|
 |
«
Reply #14 - Posted
2011-04-09 19:09:55 » |
|
yup, looks like some anti competition play here from Google. The flash plugin continues to work as before with no block even though it was massively targeted too. Don't forget that Oracle released a massive patch ball with the last Java 1.6.0_24 release which fixed most of the known security holes, so not sure that argument holds much weight.
Flash is integrated into Chrome. Like Chrome itself, it's kept up to date automatically. Java's update rate is pretty sluggish. By the way, Firefox blocks old versions of Java completely. E.g. 1.6.0_07 (can't figure out the exact version number, but I know that they blocked that one) and everything before gets blocked. Everything prior to _10 doesn't work anyways (incompatible).
|
|
|
|
kappa
|
 |
«
Reply #15 - Posted
2011-04-09 19:16:43 » |
|
yeh true, blocking out dated plugins is fine and Chrome already does this for all plugins.
However this time they've gone further and blocked every version of java (intentionally), even if its up to date.
|
|
|
|
oNyx
|
 |
«
Reply #16 - Posted
2011-04-09 21:37:53 » |
|
Infobar'd, not blocked. 
|
|
|
|
ra4king
|
 |
«
Reply #17 - Posted
2011-04-09 21:54:24 » |
|
I posted about how outrageous this is and all I got was that I have my facts wrong and then they disabled commenting on the issue alltogether  And I thought I liked Google 
|
|
|
|
Riven
|
 |
«
Reply #18 - Posted
2011-04-09 22:07:17 » |
|
I posted about how outrageous this is and all I got was that I have my facts wrong and then they disabled commenting on the issue alltogether  And I thought I liked Google  I read your replies there. Keep in mind that you are not dealing with 'Google' here but with people. You're certainly acting immature and have just pissed off somebody at the position to make significant changes, ruining it for others that would have more informed arguments as apposed to "But clearly this exchange was a waste of both our times." Like that ever helped in a discussion.
|
Hi, appreciate more people! Σ ♥ = ¾ Learn how to award medals... and work your way up the social rankings!
|
|
|
Addictman
|
 |
«
Reply #19 - Posted
2011-04-09 22:17:56 » |
|
To ra4kings defence; It wasn't his comment that stated "But clearly this exchange was a waste of both our times."
That aside, I see where google is coming from. The one thing that Chrome has really taken heat for, is it's lack of security. So it's understandable that they're trying to address security issues. Do I personally like it? No. Would my mother like it, if she knew what it was in the first place? Definitely.
|
|
|
|
Riven
|
 |
«
Reply #20 - Posted
2011-04-09 22:23:17 » |
|
To ra4kings defence; It wasn't his comment that stated "But clearly this exchange was a waste of both our times."
Oops. I thought " dua...@gmail.com" was ra4king. My apologies.
|
Hi, appreciate more people! Σ ♥ = ¾ Learn how to award medals... and work your way up the social rankings!
|
|
|
ra4king
|
 |
«
Reply #21 - Posted
2011-04-09 23:02:04 » |
|
@Riven It's all good  Btw, I'm ra4king everywhere on the internet  @Addictman But Java is not Google's to control. Google can't take heat for security issues on behalf of Java so I really see no point to block autorun for all version of Java. They should only block older versions because it is getting quite annoying allowing every single site I go to.
|
|
|
|
Addictman
|
 |
«
Reply #22 - Posted
2011-04-09 23:23:25 » |
|
I understand what you mean, and as I said, I personally don't like it. But Java's installed on so many computers around the world, and so few of those computers actually *use* java actively. Let's face it, the members of this forum aren't exactly the average user when it comes to Java. So, if/when a new huge gaping security hole emerges in the current java version, what's the safest thing to do? Ignore it, and wait for Oracle to fix it, and risk the vast majority of users around the world that have java installed but don't know what it is, to go into a tantrum over Google because they erroneously think Chrome's the culprit? Or, force those that actually use java services to "click once".
In a perfect world; screw google. In the real world: screw applets.
|
|
|
|
ra4king
|
 |
«
Reply #23 - Posted
2011-04-09 23:27:06 » |
|
Agh screw the real world  But yes, that unfortunately makes sense 
|
|
|
|
BoBear2681
|
 |
«
Reply #24 - Posted
2011-04-10 05:37:51 » |
|
At the risk of having an unpopular opinion in this forum, I really don't mind this. They're essentially embedding functionality similar to (parts of) NoScript into the browser. Of course, I do see the concern as a Java developer about user perception.
Folks often say that users will usually click "Yes" to any dialog asking them anything, without even reading or understanding it, to try to get software working on their computers. Might that happen in this scenario as well - "Oh, I have to click OK here to use my banking site, whatever"?
|
|
|
|
Nate
|
 |
«
Reply #25 - Posted
2011-04-10 06:40:02 » |
|
Built in FlashBlock (the Firefox plugin) for Java. Cool.
|
|
|
|
Scarzzurs
|
 |
«
Reply #26 - Posted
2011-04-10 07:43:03 » |
|
It seems a bit overprotective, but on the other hand companies like Apple have been practising stuff like this for years...
I must also admit that after surfing sites that are filled with applets, I have at some point actually wanted a feature like this. I have a plugin like that for delaying Flash loading called FlashBlock. However as with FlashBlock I as the user made the decision, not the author of the browser...
In regards to security, I'm not sure how much difference it will do. People will still click the "Allow virus to install" button. Only the 10% that doesn't will be a tiny bit more protected (future Java patches should fix it anyways).
Hmm, I wonder how big the chances of a removal of this feature is, if Java security goes up...
- Scarzzurs
|
|
|
|
delt0r
|
 |
«
Reply #27 - Posted
2011-04-10 10:36:43 » |
|
I do and always have had java blocked by default. Same with java script and flash. I want to surf and read the web, not have the web intrude on me. I enable these "run client side" features only for specific pages or cases.
Quite frankly not only do i understand where google is coming from. I think its a good idea.
|
I have no special talents. I am only passionately curious.--Albert Einstein
|
|
|
DzzD
|
 |
«
Reply #28 - Posted
2011-04-10 10:52:18 » |
|
a problem is also that if the user is asked once (by Chrome), logicaly user have been prevent and than the Applet should then be given full access without the need to be signed (stupid to ask twice), this completly make the sandbox of java Applet useless/obsolete.
If Applet is considered as unsafe it should not need to be signed anymore, continu to ask for a secure certificat to gain full access will mean unsigned Applet are considered secure
|
|
|
|
kappa
|
 |
«
Reply #29 - Posted
2011-04-10 11:09:06 » |
|
oh well, another nail in the JavaFX 2.0 coffin.
|
|
|
|
|