Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

gotluck

macrumors 603
Dec 8, 2011
5,712
1,204
East Central Florida
Here's a different perspective: using vendors which continue to use something as broken as Java in web browsers holds the risk of crippling your entire organization. Your company sounds ripe for a spear phishing attack.



If you have proper planning in your organization and have decided that allowing zero-day attacks from Java and Flash is your preferred means of operating, you would have already changed that security option on the Macs in your enterprise.

Here's a question for you: how long will it take before your company realizes that Java/Flash in web clients is a terrible idea and you will phase them out?

Do you have any suggestions on an alternative to Jack Henry for banking systems that does not use java?

We have no macs at our community bank but operations would halt without access to java.
 

MagnusVonMagnum

macrumors 603
Jun 18, 2007
5,193
1,442
WTF doesn't Apple just give a warning and make the user DECIDE whether to disable it or not rather than just go around shutting down computers willy nilly without the users' permission? This strikes me as an invasion of privacy and frankly as pointed out with Java, it can do more damage than an actual threat in some cases if there's no update to move to (as was the case with Java at one point).
 

wood_e

macrumors newbie
Sep 14, 2003
19
11
This Xprotect blocking is a PURE NIGHTMARE for enterprise users. I manage over 60 macs and updating each one by hand is such a PITA...
 

tbrinkma

macrumors 68000
Apr 24, 2006
1,651
93
Um.... blocking exploits should be done at the liberty of the administrators, not by the manufacturer. That's the business's decision to make. Not Apple's. If Apple is serious about continuing to claim to serve the Enterprise market (which they have repeatedly shown more and more that they are completely inept at) then they will cease this practice immediately.

In the business world, when you have several thousand workstations on your network, it is unacceptible and impractical to ask an administrator to manually have to disable a block. And for some businesses, 1-2 hours is too long. What if you are in medicine and your medical database uses a Java based client? Someone could die if you lose access to these records for 1-2 hours.

This would NEVER fly on a Microsoft product. If this is what people will have to expect from Apple, then they will not use their products for the Enterprise.

Apple continues to play God and show an arrogance towards the Enterprise about their needs.

Congratulations. You've just told someone in IT, who has to deal with Microsoft's security practices on a regular basis that *cutting off an actively exploited security vulnerability* is a 'bad' thing. Really?

I've had to clean up after a *number* of 0-day exploits over the course of my career, and would have given my eye teeth to not have had to go through that mess. If you've ever had to deal with completely reimaging 2 dozen Windows boxes, you'll know how much *more* effort that is than undoing this security fix *IF* it actually causes any users a problem.

Might I suggest that you go shopping for a clue? :eek:

----------

Actually, I do because I'll have to log into my admin account to install updates and such. The user account I use does not have admin privileges for obvious reasons. Then there's the OCD of rebooting after updates and such from the early days of computing. :p

You still don't need to reboot. Just switch to your admin account, do the install, and restart Safari when you switch back to your normal account.
 

FloatingBones

macrumors 65816
Jul 19, 2006
1,486
745
Do you have any suggestions on an alternative to Jack Henry for banking systems that does not use java?

We have no macs at our community bank but operations would halt without access to java.

Not my industry. Does Jack provide iPad (or other tablet) solutions for what you need to do?

Note: the problem isn't with Java per se; it's with Java apps in the browser.


WTF doesn't Apple just give a warning and make the user DECIDE whether to disable it or not rather than just go around shutting down computers willy nilly without the users' permission?

They don't. You gave them permission to do it in your preferences.

Apple needs to have swift response to a virus threat, and most users appreciate that. If you don't want that level of protection on your machine, then turn it off. Simple.
 

mrkgoo

macrumors 65816
Aug 18, 2005
1,178
3
The adobe get flash website downloads a file called "AdobeFlashPlayerInstaller_11_aih.dmg". This is different than what Adobe normally deliver (what does "aih" stand for?).

Further, it is only 879 KB, whereas the link specifies that the file will be 16 MB.

What gives?
 

BIS2

macrumors regular
Jun 20, 2004
144
0
I have a 2011 macbook pro running 10.8.2. Over the last few months there have been several times where I've been using safari and suddenly I won't be able to play any video (on sites like hulu, nbcnews, and youtube). Sort of weird cause this hasn't ever happened until recently? The only way I've been able to fix this is by manually updating flash.

Anyway this was the case again today - no videos would play, but updating flash fixed it. But I'm reading on this thread that I don't need to even use flash - it can be disabled? So how would I get video to work again? How do I even shut off flash? And how come I don't get the "you need to update flash" message that was shown in the main story on this?

Thanks a lot
 

Lara F

macrumors 6502a
May 5, 2005
853
10
Montreal, Quebec
Which was really unnecessary because Apple didn't block the recent Flash update, they blocked the older version. You're kids can still play their little games just fine. :cool:

But that's not the real point. Every time Flash comes up there are posts saying "who needs it?" and that it should disappear.

In the real world, try watching a stream of today's storm news from ABC New York without Flash if you don't have an iPad. (Just one example.)
http://abclocal.go.com/wabc/livenow?id=7241659

Adobe may have given up on mobile, but it's not close to dead on the desktop.
 

deannnnn

macrumors 68020
Jun 4, 2007
2,090
625
New York City & South Florida
Does anybody use flash anymore ? I been blocking flash for 4 years

You can't have a full internet experience without Flash.

I'm not sticking up for it, I hate Flash too, but you're kidding yourself if you think it's irrelevant. A very limited number of websites support HTML5 alternatives but they're always awful. The HTML5 YouTube is a buggy disaster... which is ironic because people will block Flash because it's "buggy" yet they're willing to go with an alternative that is 50x worse.

Additionally the video players on most non-indie websites require Flash (specifically TV networks), and then there are the small websites for local restaurants and stores that are built in Flash.
 

cerote

macrumors 6502a
Mar 2, 2009
843
269
This Xprotect blocking is a PURE NIGHTMARE for enterprise users. I manage over 60 macs and updating each one by hand is such a PITA...

Can't it just be turned off then? There are other solutions if it is causing this much of an issue.
 

Hes Nikke

macrumors member
Apr 16, 2001
94
13
You need to restart your browser after the install. It doesn't tell you to do this, but it looks as though the update has failed if you don't when it has in fact worked.

In my experience, all flash installs force you to quit all browsers before they let you install. That said, it has also been my experience that you can skirt around this by finding the .pkg installer package inside of the flash installer app bundle and letting apple's installer install flash. But if you're going to bypass the adobe installer front end, you're advanced enough to understand the consequences.
 

HenryDJP

Suspended
Nov 25, 2012
5,084
843
United States
But that's not the real point. Every time Flash comes up there are posts saying "who needs it?" and that it should disappear.

In the real world, try watching a stream of today's storm news from ABC New York without Flash if you don't have an iPad. (Just one example.)
http://abclocal.go.com/wabc/livenow?id=7241659

Adobe may have given up on mobile, but it's not close to dead on the desktop.

Which is why I said this earlier in the thread on post #95 but you missed my post somehow. ;).......


Before Flash took off all that was used for media streaming was Windows Media Player and it ran terribly on the Mac, of course MS made sure of that. . When Flash came around and started becoming the norm I highly welcomed it and I still do. It is quite a resource hog but I am far from trashing it as others seem to.
 

Lara F

macrumors 6502a
May 5, 2005
853
10
Montreal, Quebec
I did miss that, sorry. :eek: Actually I too remember those days where much streaming video on Windows Media Player didn't work on the Mac (got my first in 2005, it was about two years I think before Flash really became standard). I won't mind when something properly replaces it, I just don't see it happening soon enough on the desktop. Content providers may be fine with HTML5 on iOS where it's hard to pirate/download, but they're not allowing it outside.
 

gotluck

macrumors 603
Dec 8, 2011
5,712
1,204
East Central Florida
Not my industry. Does Jack provide iPad (or other tablet) solutions for what you need to do?

Note: the problem isn't with Java per se; it's with Java apps in the browser.

The main client uses java in the browser. No available iOS solution. iPhones and iPads are prevalent (no android afaik), but only used for mail and non-jack henry (processing/underwriting/operations) tasks - mostly convenience devices.

I see no escape from java... just curious :p
 

FloatingBones

macrumors 65816
Jul 19, 2006
1,486
745
But that's not the real point. Every time Flash comes up there are posts saying "who needs it?" and that it should disappear.

In the real world, try watching a stream of today's storm news from ABC New York without Flash if you don't have an iPad. (Just one example.)
http://abclocal.go.com/wabc/livenow?id=7241659

Adobe may have given up on mobile, but it's not close to dead on the desktop.

Lara: here's the disconnect: there's a clear and present danger from continuing to use web-based Flash. It has ceased to be a reliable way for people to use their laptop computers.

Your WABC website was able to find a way to stream to iOS devices years ago. WTF haven't they learned how to stream to laptops without Flash? The only reason I see is that they have complacency about going Flash-free.

Note: I'm not disagreeing that Flash is needed on some websites. I am wondering what it will take to light a fire under their ... feet. Got any ideas?

The main client uses java in the browser. No available iOS solution. iPhones and iPads are prevalent (no android afaik), but only used for mail and non-jack henry (processing/underwriting/operations) tasks - mostly convenience devices.

I see no escape from java... just curious :p

What about Jack Henry's iBizmanager: http://www.prnewswire.com/news-releases/jack-henry-banking-introduces-ibizmanager-158549095.html

Yes. Still widely used.

Flash is not run in the browser on over 100 million iPads. It's not run in the browser on a total of 410 million iOS devices. It doesn't run on Windows RT or a whole bunch of new machines. Adobe has abandoned development of Flash on mobile platforms.

At the same time, we continue to get 0-day security risks for Flash. Flash and Java are the two primary sources of malware on Apple laptop and desktop computers. They are the Typhoid and the Mary for Mac users. :(

What is it going to take to get those complacent service providers to stop using Flash?
 
Last edited:

nagromme

macrumors G5
May 2, 2002
12,546
1,196
WTF doesn't Apple just give a warning and make the user DECIDE whether to disable it or not rather than just go around shutting down computers willy nilly without the users' permission? This strikes me as an invasion of privacy and frankly as pointed out with Java, it can do more damage than an actual threat in some cases if there's no update to move to (as was the case with Java at one point).

You'll be relieved to know that what just happened is not at all what you think just happened.

Apple never shuts down your Mac remotely, and when they issue an urgent security update like this, it doesn't secretly collect any private information from you.

If a user doesn't know how to use a different browser, and doesn't know how to uncheck a box in Security preferences, then they aren't going to know how answer that question you think should be asked. They are not the expert able to judge the magnitude of the threat, and getting malware is almost NEVER going to be better than losing access to some app temporarily until you get tech support to install a workaround (or until an automatic patch comes along--in this case, instantly).

Leaving that kind of highly technical research and decision to a user who doesn't even understand the basic factors is asking for trouble on a scale Windows knows all about.... The choice you want from Apple IS there, but it's for knowledgeable users, not thrown in the face of people who won't know what to do with it.

The problem is not Apple, it's Flash and Java being insecure--people ought to write to THEM saying how vital Flash and Java are, and demanding better security. Security is a feature just as vital--and to a LOT more people--than browser-based Java or Flash.
 

phoenixsan

macrumors 65816
Oct 19, 2012
1,342
2
Too many people....

criticizes the late Steve Jobs by not allowing flash in some Apple devices. Time appears to show that was a sound decission: Resource hog, malware, bogging down hardware, privacy concerns and so on.....That is a pity, because Flash is a very useful tech...

:):apple:
 

H2SO4

macrumors 603
Nov 4, 2008
5,651
6,937
Not only that but it's ridiculous that a website would still require Flash or Java to function properly. A proper website should still be readable and navigable with javascript disabled.

This is it!
I browse sans plug ins and I find it annoying to have to enable them because something I'd like to/need to see requires Flash or Java.
Mind you the website developer surley has a reason for it.
 

Nall

macrumors regular
Aug 15, 2003
111
0
Any exploits in the wild for this, or is this just a security "hole" that is being closed? Basically, does anyone need to worried that they have been compromised?
I'm curious about this, too.
 

FloatingBones

macrumors 65816
Jul 19, 2006
1,486
745
Any exploits in the wild for this, or is this just a security "hole" that is being closed? Basically, does anyone need to worried that they have been compromised?

I'm curious about this, too.

I believe every single one of the Java/Flash updates in 2012 and 2013 have happened when 0-day exploits were identified in the wild. If you wish to stay current on the malware exploits, you can watch the Security Now! podcast weekly. You can also peruse the archive of transcripts from this week's show back to August 19, 2005. Steve has all the shows professionally transcribed a day or two after recording; this is a tremendous service that he provides to the community.

Apple has had the mechanism to instantly disable malware for several versions of the OS (I see references back to at least Snow Leopard). Updates to that plist file allow "sleeper" malware that has been widely deployed to be instantly disabled. The thing that's changed recently is Apple's use of this mechanism to turn off Flash and Java when 0-day threats are identified. Exploits through Flash and Java are, AFAICT, the two greatest risks to Mac users today; I'm grateful for Apple's closing the loop here.

The complaints that Apple is "taking over" machines is nonsense. Anyone with admin privileges on a Mac can turn off this mechanism in their security settings. Apple has provided a great mechanism to secure their computers, they are actively using it, and they even provide a simple means for those not wanting to use it to turn it off. None of the complainers here show understanding of how that mechanism works.

criticizes the late Steve Jobs by not allowing flash in some Apple devices. Time appears to show that was a sound decission: Resource hog, malware, bogging down hardware, privacy concerns and so on.....

If Apple hadn't drawn that line in the sand with the iPhone back in 2007, imagine how much worse the malware problem would be today.

That is a pity, because Flash is a very useful tech

The idea of Flash was wonderful, but Flash never ever executed on its promise. Those tactical and strategic failures of Flash were spelled out in Jobs's 2010 Thoughts on Flash memo. The note provides a rare historical insight into why Apple abandoned a particular technology. IMHO, I think Apple did a tremendous service to the Internet community as a whole by drawing this line in the sand.

I think we're getting pretty close to getting directives from the DHS for websites to drop Flash/Java. I do not like that kind of government intervention, but it is time to remove these sources of infection from mainstream websites. I am rather astonished that Google has failed to take the lead and make their services Flash-free.
 
Last edited:
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.