They as in browsers developers.

ActiveX crashes a bunch.  Yes it is only IE, but they should remove it since it poses the same issues.

Applets still run in Chrome.  I am betting that Firefox won't remove the plugin and will just do the same thing.

Firefox is not the only browser so Web Sockets is still the same issue.

It doesn't matter which way you cut it, the Java plugin has become a very large attack vector in browsers. Until this changes, then it should rightly be blocked by browsers.

An entirely unscientific google for "flash security vulnerability" yields ~7,700,00 hits. It's been the attack vector of choice for years from what I remember, and only recently seems to have got reasonably secure. And now that all of it's low-hanging security holes are closed, hackers have moved on to the low-hanging java holes.

Personally I'd blame this on Oracle bolting new stuff onto java too fast, not doing robust security testing, and then dragging it's feet to actually fix critical vulnerabilities. Sun had a better track record of not letting as many holes into the wild in the first place, and then at least patching them up at a reasonable speed.

If I was a browser developer, I'd be looking at ways to sandbox *all* browser plugins (java, flash, activeX, silverlight, etc.) in some generic way. Chrome half does this by running everything in different processes, but I'm not sure how you'd lock things down tighter and stop the plugins calling any native api calls they want. Maybe if you proxied *all* the native calls so they actually go via your browser sandbox via some kind of dll redirection shenanigans? I suspect this would be a huge amount of work though. A more practical way on a *nix box would be to run the plugins in separate processes under a restricted user account, but I suspect this doesn't work on windows so it'd be a bit pointless since 90% of hacks target windows.

Or maybe as a browser developer I'd be thinking "I already have a language that's sandboxed in a vm I control - it's called javascript, why don't I disable all native plugins and get everyone to migrate to that". And while theoretically a good move it's not really very pragmatic given the state of the web.

Ultimately browser developers are in a tough bind IMHO. They're stuck between several opposed goals (security, functionality, backwards compatibility), and choosing any option is going to leave a large amount of people unhappy.

That is what I tried to explain to Mozilla guys. They seem to be pleased to plan to remove the Java plugin, maybe there is something to do to drive such a removal legally harder if we do not succeed in convincing them technically.

There isn't.  They could decide to stop supporting Javascript tomorrow if they felt like it.

It would have been better if they'd simply allowed Java to just do anything Javascript can do. As in, that, and only that.

Cas

They could force sandboxing all applets.  That would also remove the need for the security dialog.

Flash has more leaks than Applets do when you don't use a security dialog (keeping it in sandboxed mode).

Although, many business applets would still need to turn on or install a plugin that allowed for unsecured applets.

I actually think they should have had 2 plugins 12 years ago. Then you would have the sandboxed way not only by default but would also require installation of a non-sandboxed capable java plugin.

I think I said this over ten year ago to a Sun employee.  Oh well.

This is a really good point. Firefox blocked Silverlight a year or two ago, but only for a couple of days, because MS stepped up and fixed the security hole.

By saying "were only supporting this if it's safe", and actually sticking to that, it's sending out a message to Adobe, MS, Oracle and other vendors, that they need to take security issues seriously. In the long run, that's a good thing.

I don't think about Javascript and I don't think Flash vulnerabilities are only something of the past. If they block Java, they have to block Flash too. I think what the Mozilla Foundation is doing does not respect some European laws even though I think Oracle should fix these vulnerabilities as soon as possible.

Yes, in Chrome, it uses it's own PDF viewer for extra security and reduced startup time.

There has also been a lot of movement to make Adobe Reader much safer on the web. PDF files are also far more popular then Applets, so people actually care.