Network News

X My Profile
View More Activity

More thoughts on junking Java

Last week, I asked if Oracle's Java software was worth keeping around on home computers, given its numerous security issues, unpleasant updates and general irrelevance.

Your comments pointed out a few ongoing uses of Java--one right on this site. But since then, I've seen other reasons to doubt this software's utility.

One is further evidence of the attention malware authors are paying to Java--a Microsoft security study that shows Java exploits now massively outnumber attacks on Adobe's PDF software.

java_icon.PNG

(Yes, Microsoft tried to sabotage Java in the '90s, back when it showed actual promise as an alternative software-development platform. That doesn't invalidate its work a decade later.)

The other is Apple's decision--"announced" in a document on its developer site that went largely unnoticed until today--to back away from Java. The release notes updated yesterday declare Java "deprecated" and state that Apple's Java software "will not be maintained at the same level, and may be removed from future versions of Mac OS X."

Translation: Apple may take longer than it already does to ship Java security updates previously released on other platforms.

So why keep Java around? Well--this is awkward--the Post's online crossword puzzles require it. So do those at other sites, such as Merl Reagle's Sunday Crosswords.

Post managing editor Raju Narisetti e-mailed that the paper had no plans to revise its crosswords software until after completing a major update to its publishing system, sometime in the second quarter of 2011.

Reagle wrote in an e-mail that "the day that someone comes along with a better online interface, we'll jump to it -- java or not -- but there doesn't seem to be one out there."

The New York Times doesn't employ Java. But its subscription-required crosswords site instead requires members to install a separate, proprietary plug-in, an equally obsolete solution.

I don't know why there's this industry-wide hangup when it comes to online crosswords. It's possible to write a crossword puzzle using just JavaScript, as this simple example on a developer's site shows. (JavaScript, if anybody's confused by that ill-chosen name, has nothing to do with Java.) Adobe's Flash can do the job too, as seen on such sites as the Los Angeles Times.

Like many of you, I like crossword puzzles. But I also like having a secure computer that requires updates to as few Web-facing software components as possible. To me, that makes Java expendable. So I am going to disable it on the machines I use--while continuing to do battle with crosswords on paper--and I think you should too.

In Windows, uninstalling Java through the Control Panel ("Add or Remove Programs" in Windows XP, "Uninstall a program" in Windows Vista and 7) will suffice. In Mac OS X, you can't uninstall Java but you can disable it in your browser--which eliminates your risk of drive-by-download attacks. To do that in Safari, open its Preferences window, click the "Security" header, and click to clear the checkbox next to "Enable Java." In Firefox, go to its Tools menu, select Add-Ons, click the Plug-Ins header and right-click on each Java item listed there and select "Disable."

You can also use that Firefox workaround to turn Java on and off at will in Windows, in case there's one Java site that you can't avoid.

Let me know if those directions work for you--or if there are other reasons to keep Java that I've missed.

(9:18 a.m., 10/22: I e-mailed an Apple publicist for comment yesterday morning but still haven't heard from him. Steve Jobs, however, apparently replied to one developer's query by writing that "Sun (now Oracle) supplies Java for all other platforms. They have their own releaes schedules, which are almost always different than ours, so the Java we ship is always a version behind. This may not be the best way to do it." Mind you, I can't prove that this screenshot represents an actual e-mail from Jobs.)

By Rob Pegoraro  | October 21, 2010; 1:50 PM ET
Categories:  Security, The business we have chosen  
Save & Share:  Send E-mail   Facebook   Twitter   Digg   Yahoo Buzz   Del.icio.us   StumbleUpon   Technorati   Google Buzz   Previous: Apple updates: iLife '11, FaceTime on the Mac, Mac OS X Lion, Mac App Store, new MacBook Air models
Next: Google TV review, part 1: setup and online

Comments

Some preinstalled software may require Java to work properly. As I mentioned in my comment on your earlier post, I hesitate to remove Java from my ThinkPad because I think it might be required for some of the pre-installed Lenovo utilities.

Posted by: bokamba | October 21, 2010 3:04 PM | Report abuse

Putting aside consumer uses of Java, a lot of web sites and other server software are written using it. So developers use Java a lot. Mac's have gained a lot of popularity among developers, which helps them gain interest in building apps for all the Apple platforms. I think Apple is risking losing a lot of influencers with this move. It depends if Oracle is going to step up and provide Java for Mac instead.

Posted by: ronbodkin | October 21, 2010 3:12 PM | Report abuse

@bokamba: I don't have a Lenovo machine handy to try out. But if you use Firefox, you should be able to unplug Java in the browser as outlined above, then continue running local Java-based programs. Let me know if that works.

- RP

Posted by: robpegoraro | October 21, 2010 3:45 PM | Report abuse

Back in the late 90's I quipped that Java wouldn't be good for anything but stock tickets and sports scores. Yeah, and crosswords...

Obviously I missed the whole server-side concept and now we have Android which is Java based, but it is interesting to me that my prediction was actually right when it came to desktop client software, the one area that Java was supposed to fix.

Posted by: slar | October 21, 2010 5:19 PM | Report abuse

When this topic surfaced about two weeks ago (was it?) I removed Java from the machine I use most heavily. I've missed it so little -- not at all, in fact -- that I'd more or less forgotten I'd removed it until today's discussion reminded me of that. (Of course, I forget *a lot* of things, lately...). I've kept it on a little netbook I've got, so that Open Office will have access to it, but even there that is just an occasional application. In fact the uses I make of Open Office might go on just as well without Java...

I only hope this means I don't have to give up real coffee too...

Posted by: mjohnston1 | October 21, 2010 5:42 PM | Report abuse

Rob - interesting piece; interesting coincidence that my iMac had me download "Java for Mac OS X 10.6 Update 3" when I turned it on today. Interesting that Apple's offering an update through its software update mechanism the day after they say they're looking to ditch it...

Posted by: wombatua | October 21, 2010 5:50 PM | Report abuse

"It's possible to write a crossword puzzle using just JavaScript, as this simple example on a developer's site shows. (JavaScript, if anybody's confused by that ill-chosen name, has nothing to do with Java.)"
======================
LOL...from Wikipedia:"'JavaScript' is a trademark of Oracle Corporation."
ROFL

Posted by: Sadler | October 22, 2010 1:58 AM | Report abuse

As someone who has been involved with software development for (holy cow) 30+ years I'd have to say that Java is a crowning achievement of our industry.
Java is a language, an OS and a community without allegiance to any particular platform, be it hardware or software.

It was a dark day for me when Oracle acquired Sun (and hence Java) but it would be downright depressing to return to the days of software balkanization that was the only option available to developers before Java came along.

Apple wants to run it's OS on all of it's proprietary hardware. Microsoft wants to run Windows everywhere. Java already does run everywhere, so obviously it's a threat and has to be destroyed to make the world safe again for corporate control over your hardware.

Posted by: jameadows1 | October 22, 2010 3:26 AM | Report abuse

I have a similar background to jameadows1 and I agree with all he said.

I'm suspicious of Apple's move. It couldn't have anything to do with Android taking off with Java, could it?

I'd rather write phone apps in Java than Objective C. The former is fairly elegant. The latter is just plain cryptic.

And Microsoft would still rather have ActiveX be the solution to everything, including the "Apple problem".

Posted by: filfeit | October 22, 2010 6:56 AM | Report abuse

So, Java is only needed for crossword puzzles. It must be nice. Unlike the author, I use my computer for actual "work" and java is essential. As a network administrator, java is needed as interface by a lot of network vendors, and rightfully so, for cross platform support. Don't get me wrong, there are issues with java, but until someone finds something better, java it is.

Posted by: madstan | October 22, 2010 7:24 AM | Report abuse

I Use Eclipse, which runs on Java, to do web development in PHP. I don't know if we need it in our browsers, but I would sure miss it if it weren't on my dev machine (which is still running XP SP3).

Posted by: msh41 | October 22, 2010 7:26 AM | Report abuse

The underlying motivation for apple and microsoft isn't just security holes. Microsoft's .net platform uses ActiveX, which on the desktop is a direct competitor to JAVA. Now that Oracle owns SUN, the competition is more direct between MSFT and therefore one can expect the marketplace to reflect this. JAVA is an important platform for server side development. Interestesting times...

Posted by: DontGetIt | October 22, 2010 7:32 AM | Report abuse

=======
=======
Hey, I'm surprised it took this long. For decades, I've gotten all excited about this week's Miracle Software which will "improve programmer productivity, be self-documenting, and program-out the bugs". Structured programming, Yourdon, Ada, structured reviews, TQM, Java... and OOP is next, with it's "simpler" object classes and convoluted initialization routines.

I program in BASICA
Just like yesterday
And get on my knees and pray
We don't get fooled again.

--faye kane, homeless idiot savant
Get more of my smartmouth at http://tinyurl.com/fayescave

Posted by: Knee_Cheese_Zarathustra | October 22, 2010 7:45 AM | Report abuse

As far as business use, Java is pretty well integrated into a lot of applications. At the company I work for, we have not only Java applications that run stand-alone, but applications that require Java be available through the browser. So the option of turning off Java on the workplace computer isn't a viable one.

Posted by: TalGreywolf | October 22, 2010 8:07 AM | Report abuse

Other than the content.... can we NOT have every other word linked? It is so distracting and annoying. Please!!!!

Posted by: Mama1 | October 22, 2010 11:20 AM | Report abuse

I also prefer writing applications in Java than C and other languages. Write once, run anywhere they used to say.

Posted by: timekeepr | October 22, 2010 11:25 AM | Report abuse

We just released a desktop application that runs everywhere including Windows and Linux. We already have native desktop Mac apps (NoteTaker/NoteShare) but when it came to deciding what our customers wanted for cross-platform device use; the only choice was Java because we could deliver both webtop and desktop options at the same time.

We'd be happy to hear what alternatives are available for meeting these requirements but for now, Java works great. Take a look and judge for yourself.

Scott Love
President
AquaMinds Software
www.aquaminds.com
Palo Alto, CA

Posted by: rscolove | October 22, 2010 12:02 PM | Report abuse

We just released a desktop application that runs everywhere including Windows and Linux. We already have native desktop Mac apps (NoteTaker/NoteShare) but when it came to deciding what our customers wanted for cross-platform device use; the only choice was Java because we could deliver both webtop and desktop options at the same time.

We'd be happy to hear what alternatives are available for meeting these requirements but for now, Java works great. Take a look and judge for yourself.

Scott Love
President
AquaMinds Software
www.aquaminds.com
Palo Alto, CA

Posted by: rscolove | October 22, 2010 12:02 PM | Report abuse

It's important to differentiate between Java as a development tool and Java for end users. As a development tool, there are lots of advantages (programmer familiarity, server-side support, multi-platform, strong suites of developer tools and libraries, build and version control). One of the more exciting of these tools in my view is 'Google Web Toolkit', which allows software developers to write Java code but deliver native web/javascript applications (so, no client Java). It's great for business applications, where you want to offer a depth of functionality but deliver as a web service. I'm not sure how this would deal with crossword puzzles, but it seems to support Google maps and Gmail just fine, and it's free :)
http://code.google.com/webtoolkit/.

Posted by: pdfisher | October 22, 2010 12:11 PM | Report abuse

The Web conferencing software our enterprise uses requires Java, but then we are still on Internet Explorer 6....

Posted by: 54Stratocaster | October 22, 2010 1:11 PM | Report abuse

Rob, you've been drinking the monopolists' Kool-Aid. Java is the most capable language for cross-platform development. It is *not* replaceable by Javascript. If you don't need it, fine, but you aren't looking out for end-users if you encourage Microsoft and Apple to drop Java support.

Posted by: pundito | October 22, 2010 1:25 PM | Report abuse

Get rid of Java but keep Flash?

Put down your crackpipe.

Posted by: mason08 | October 22, 2010 2:11 PM | Report abuse

secunia scan needs java

Posted by: lindot1 | October 22, 2010 2:27 PM | Report abuse

Thanks for linking Microsoft's post on Java exploits. It notes that the bulk of Java exploits were against security holes that had already been patched, but the patches had not been installed by users.

You drew the wrong conclusion, that Java is insecure technology. The correct conclusion is that users who don't patch their software are inherently insecure.

Posted by: pundito | October 22, 2010 4:01 PM | Report abuse

A lot of the work I do relies on machine learning environments written in Java (e.g. Weka). I have no idea of how I'd replace this capability if Java goes away, especially when I run experiments to compare the performance of multiple learners on a set of data.

Posted by: apn3206 | October 22, 2010 4:05 PM | Report abuse

SO we should get rid of Java because it's a popular attack target? By that reasoning, we should get rid of Windows as a much higher priority.

I use Windows, Linux, and OSX. And though I prefer the latter two, I wouldn't make an argument against Windows primarily on its popularity as an attack vector.

In fact, isn't it rather incoherent to argue that Java is a threat because it's a hugely popular attack target, and we should all get rid of it because it's not actually used for anything?

Posted by: mark923 | October 22, 2010 6:12 PM | Report abuse

To everyone getting on my case for neglecting Java's server-side and enterprise applications: You did see that sentence right at the top in which I specified home-computer use, right? You do know that this is a consumer-tech blog, right? Thank you.

@mason08: I won't miss Flash when HTML5 takes its place, but it's exponentially more difficult to get by on the Web without Flash than without Java.

@pundito: You can't look at patch-install rates without considering the ease of keeping software current. Java's is not good when you factor in its sheer annoyingness, and Sun/Oracle show few signs of realizing that.

- RP

Posted by: robpegoraro | October 22, 2010 7:22 PM | Report abuse

Replying to apn3206 who wrote:

"A lot of the work I do relies on machine learning environments written in Java (e.g. Weka). I have no idea of how I'd replace this capability if Java goes away, especially when I run experiments to compare the performance of multiple learners on a set of data."

Although I prefer C and C++, I have used JAVA (and a lot of other languages including LISP). For cross platform applications you might want to consider PYTHON. It has a lot of modern SW concepts built into the design. A lot of the AI people where I work are switching to it.

Posted by: HappilyRetired2 | October 23, 2010 12:34 AM | Report abuse

Sure, one can still use paper for crossword puzzles; but using a computer makes solving them so much more enticing--no more erasing wrong guesses; no more holes in the paper from such erasures etc.

I never liked doing crossword puzzles UNTIL they were available on-line, usually via Java! The interactivity is a big plus for crossword puzzles via computer, AND via Java.

Posted by: alindeO | October 23, 2010 5:38 PM | Report abuse

It's been mentioned here that OpenOffice.org makes use of Java for some functions. It is possible to install OO.o without Java, but those functions will not be available. The following page, from the OO.o Web site, lists the functions for which Java is needed.

http://wiki.services.openoffice.org/wiki/Documentation/FAQ/Installation/Why_is_Java_needed_in_OpenOffice.org%3F

Posted by: richg74 | October 24, 2010 5:20 PM | Report abuse

Post a Comment

We encourage users to analyze, comment on and even challenge washingtonpost.com's articles, blogs, reviews and multimedia features.

User reviews and comments that include profanity or personal attacks or other inappropriate comments or material will be removed from the site. Additionally, entries that are unsigned or contain "signatures" by someone other than the actual author will be removed. Finally, we will take steps to block users who violate any of our posting standards, terms of use or privacy policies or any other policies governing this site. Please review the full rules governing commentaries and discussions.




characters remaining

 
 
RSS Feed
Subscribe to The Post

© 2010 The Washington Post Company