A close look at how Oracle installs deceptive software with Java updates(zdnet.com)

363 pointsby Hagelin14 yıl önce194 comments

A close look at how Oracle installs deceptive software with Java updates

http://www.zdnet.com/a-close-look-at-how-oracle-installs-deceptive-software-with-java-updates-7000010038/

201 comments

Just to tell my experiences on this, I was forced to install the crapware last week. There was no way for me to uncheck or opt out of the checkbox.

I have a machines which I connect to that do not have any mouse connected. I have no problem in navigating systems with a keyboard and can run through installers probably quicker than most people with a mouse can, but when this dialog popped up for me, I was stumped for about 10 minutes. I employed every shortcut in my keyboard-shortcut arsenal and fell short.

I genuinely felt like this was not just some programming mistake (because the "Next" control was already highlighted waiting for me to hit Enter). It is a dark pattern that was purposefully introduced to their installer to make it impossible for users like me to opt-out of their installer.

A consequence of their deception was that they did get a dozen installs from me, but my dislike for Oracle increased tenfold, and in a quiet-protest, I'll make damned sure that I suggest any alternative to an Oracle product when I have reasonable alternatives (Without cutting off my nose to spite my face).

halviti14 yıl önce

I employed every shortcut in my keyboard-shortcut arsenal and fell short.

One good one to remember is ALT+Left Shift+NumLock

Then you can use your keypad as a mouse. / and - toggle which mouse button 5 is.

jakub_g14 yıl önce

Thanks for the shortcut!

For those of you struggling to enable it under WinXP, you may need to choose "Settings" first in the popup dialog and tick (with the spacebar) "Use MouseKeys".

If you happened to have multiple keyboards installed (e.g. running English Windows + your local kbd settings), LEFT ALT + SHIFT additionally switches between kbd layouts as a bonus, so be sure to disable this shortcut in Control Panel > Regional and Language Options > Languages tab > click Details > click Key Settings.

kibwen14 yıl önce

How incredibly obscure! Thanks a ton for this.

error5414 yıl önce

Also, pressing shift 5 times is an easy way to enable sticky keys in Windows.

smcl14 yıl önce

I have accidentally enabled this a million times and I've no idea what it does other than messing up my keyboard.

FredFredrickson14 yıl önce

It's an accessibility feature. If you don't have the dexterity to hold keys down yourself, you can enable sticky keys and (if I remember correctly) it will make certain keys act as toggles so you don't have to do finger-yoga to hit certain key combinations.

akandiah14 yıl önce

For anyone interested in the keyboard layout for mouse keys: http://en.wikipedia.org/wiki/Mouse_keys#Layout

[deleted]14 yıl önce

jackbauer14 yıl önce

many thanks

lawnchair_larry14 yıl önce

Monetizing software is a hard problem. Oracle is just trying to do good in a scummy space. Most users choose to install Java, so obviously they want it.

The above post was satire in reference to Y Combinator staff's reaction to this thread: http://news.ycombinator.com/item?id=5092711

Florin_Andrei14 yıl önce

> Oracle is just trying to do good

You mean they're trying to do well.

Breakthrough14 yıl önce

I just formatted & had to reinstall Java today, out of curiousity I used the offline installer instead... No toolbar bundled with it, didn't even give me the option to install it.

http://www.java.com/en/download/manual.jsp

dsl14 yıl önce

Don't put all the blame on Oracle. Follow the money:

   Oracle distributes Ask Toolbar
   Ask Toolbar drives searches to Ask.com
   Ask.com displays ads from its parent, IAC
   IAC is the largest third-party distributor of Google ads

corresation14 yıl önce

It absolutely wasn't a mistake. Most legitimate software makes the descriptive text for a checkbox (the label) a trigger for the checkbox. The Ask Toolbar installer option, however, disables this, forcing you to specifically target the checkbox itself.

It is incredibly scummy, and worse it actually encourages Oracle to create insecure software -- at least in the short term -- because each fix is another spin of the wheel.

_b8r014 yıl önce

That's weird, I thought Oracle have been making insecure software for decades and this was just business as usual for them.

hnriot14 yıl önce

clearly, you haven't been paying attention.

drzaiusapelord14 yıl önce

How secure are these toolbars? It seems like end users are getting reamed twice. Once by just using java and again by increasing their vulnerability profile with toolbars.

logic14 yıl önce

Disabled to make automation (corporate installations) difficult, perhaps?

I find it mind-boggling that people actually put up with (or defend) user-unfriendly behavior like this.

skymt14 yıl önce

Oracle explicitly supports automated corporate deployment, albeit in a roundabout way.

http://docs.oracle.com/javase/6/docs/technotes/guides/deploy...

FredFredrickson14 yıl önce

The only reason why anyone would defend these practices is that presumably, if the company did not monetize their software in this way, the software couldn't continue to be developed.

In Oracle's case, this seems absurd. The money they make from toolbar installations couldn't possibly be very high, could it?

talmand14 yıl önce

There are examples of legitimate software failing in this aspect as well. Not to suggest that Oracle does not do this on purpose for nefarious reasons or that other software is being scummy somehow. I don't work at Oracle so I can't say if it's intentional or just part of the problem that's more common then you think.

neya14 yıl önce

Ladies and gentlemen, introducing THE fugliest company of all time - ORACLE.

The company that sued Android unsuccessfully, The company that fucked up JAVA, The company that fucked up MySQL, The company that fucked up OpenOffice, The company that doesn't like anything good happening within the tech sector.

I really miss those days when Oracle was highly respected and used to be a great workplace to be a part of.

stevoski14 yıl önce

Oracle fucked up Java? Not my view. Installing Java on Windows installed unwanted stuff for years during Sun's days. (Was it the Yahoo toolbar? I forget).

Oracle, for all its faults, has actually managed to get the new versions of Java back on track. Sun seemed to be unable to get Java 7 out the door. Oracle did so, and is making good progress on Java 8.

[deleted]14 yıl önce

pasbesoin14 yıl önce

I won't speak to Java itself, but I will say that -- crapware side-effects aside -- the Java SE installation process has actually improved since Oracle bought out Sun.

Whether coincidence or causative, I don't know.

It runs more quickly, and it only has a single instance of a single level of nested installers (for the JRE). A couple of years ago, the installation process had gotten simply bleep-awful, especially after they tacked JavaFX onto it, which installation seemed to take even longer than the installation of the rest of the SE package.

205guy14 yıl önce

I mostly agree with you, except Sun went under because it couldn't monetize (there's that word again) those free products (that and the server market tanked/changed on them). As long as Sun was making 50% margin on servers, they could fund all these projects/acquisitions. When they had to rely on this wonderful open-source market, they couldn't.

Frankly, I think it's time to pay for software or software services again. I'd gladly pay $5 to $2o (depending on size or complexity) per year for quality, bug-free, ad-free software/services and its updates. And yes, I pay $20 to yahoo to get ad-free email that (hopefully) doesn't sell my information down the road. Is that even an option with gmail? When you think about it, the only person getting money for you being on the internet (with all the software required to do so) is your ISP--is that right? I'd prefer to pony up some money to get a better experience, but in most cases, that isn't even possible.

The way I see it, there should be a single service, something like ninite, where I can give my CC once and manage all my subscriptions/updates. Then it would provide me the software by negociating with the author/owner for a painless, ad-free, crap-free binaries/subscription/whatever. Why is that still science fiction?

neya14 yıl önce

It's a beautiful concept my friend. I wonder why it hasn't become popular yet, though.

dschiptsov14 yıl önce

How long it took to realize this? A decade?)

Actually, RDBMS folks knew that for ages. There are basically two major types - ones who know nothing but Oracle, a vast majority, and those who have seen Informix or DB2. (SQL Server always considered as a tasteless joke). So, those small minority always knew what a bloatware Oracle is.

parasubvert14 yıl önce

I have seen Informix, DB2 (which one? there are four code bases), and Sybase. Oracle is still the #1 database for many reasons. Is it vastly superior? No. But it's not what I would consider bloatware anymore than another commercial RDBMS.

dschiptsov14 yıl önce

I have 10+ years of being Informix DBA. Informix was a product of a wonderful team of engineers. It has small code base, and I mean it, proper design and engineering decisions and excellent set of features. The Dynamic Server Product was so good, that Informix was acquired by IBM. It was solid Linux version back in 90s, and works well on Solaris or even SCO.

And you could configure almost everything you need in two simple text files and monitor and fine-tune almost everything on the go with just a telnet connection. Don't even tell me about Oracle.)

parasubvert14 yıl önce

Informix was everything you say it was, I concur.

Oracle you could fine tune nearly everything with a single text file through 8i. And even now that's still supported (the pfile vs spfile). Their recovery procedures are also bulletproof unlike the voodoo with say, Sybase ASE to this day.

dschiptsov14 yıl önce

I once have resolved some stalled server issues on a machine located in a polar town Severomosk (via 2 sequential ssh connections, via terrible GPRS and one plain long-distance modem call - cu -l /dev/ttyS0 you know) from Katmandu, Nepal.) So, properly designed console tools matters.)

parasubvert14 yıl önce

Cool. I've dealt with similar circumstances - one of my favorite incidents was a remote farm inventory database that kept getting corrupted because sheep kept head-butting an electric fence that was shorting the power to the nearby farmhouse.

Sqlplus still is the choice to do most things for old school Oracle DBAs :)

webreac14 yıl önce

I started working in 1994 and Oracle was already the database provider that did not want to comply with standards (Sql92). They were already greedy.

hnriot14 yıl önce

SQL standards were and are a joke. Real app developers can't wait for the standards boards to ratify a syntax, they have to actually get on and build things. Oracle SQL is what it is, and if you don't like it use something else. The old dream of making the database a commodity and easily switching thanks to the SQL standards was always unrealistic.

I doubt that Oracle "didn't want to comply with standards" but what is much more likely was that they had better things to do than pander the syntax nerds. Like making the database faster, more reliable, more secure etc.

Like TPC benchmarks, SQL standards have never mattered to real developers.

webreac13 yıl önce

In 1996, I was using RDB on VAX. The SQL book I was using to help me was a book about SQL92 (not at all about RDB) bought in a small non technical library. Almost all the examples were working perfectly on RDB (and on Microsoft Access). A few years latter, when I had to use Oracle, I was very disappointed to see all the silly differences in syntax.

smsm4214 yıl önce

Unless you are a real developer that has to write app supporting 4 databases. And you discover that simplest and most common use cases like implementing paginated query results work radically different in each DB and sometimes it's like "oh, you really want to limit result set from 100K-row query and view it piece-by-piece and not all at once? We didn't think about it..."

colanderman14 yıl önce

Don't forget the OpenOffice.org clusterfuck.

neya14 yıl önce

Thanks, edited to include OO (how could I forget this one?).

alayne14 yıl önce

You forgot Jenkins/Hudson too.

cnlwsu14 yıl önce

Was pretty painless for us to move from hudson to jenkins. I would recommend it.

suyash14 yıl önce

You are totally confused and making irrational arguments here! Oracle is the most dominant and top player in the software industries improving the lives of programmers and helping business become more efficient and save unnecessary trouble. Oracle's improvement on Java platform and MySQL are commendable!

NelsonMinar14 yıl önce

It's a nice racket Oracle has. Every time they release a security fix, they make a few hundred thousand bucks on drive-by installs. Security holes as business model.

nhebb14 yıl önce

They don't even need to release a fix. I have been prompted to update several times in the past year, where I go through the install process (including having to uncheck the Ask box), only to get the message at the end that version x.y.x is already installed.

The updater is just plain buggy. Ed Bott mentioned the problems with limited user accounts, but I didn't see him mention the issue with jucheck ignoring the update settings:

http://superuser.com/questions/130961/how-to-stop-jucheck-fr...

I also had an XP system where the %appdata% environment variable somehow got deleted. This completely breaks the installer.

niggler14 yıl önce

Is the Ask.com toolbar installed before or after Java, and if java fails will ask.com be rolled back?

noselasd14 yıl önce

When you check for the Ask toolbar and click next in the Java installer, the toolbar installer is fired off in the background, and installs itself after 10 minutes, regardless of what you do with the Java installer.

niggler14 yıl önce

That's incredibly shady.

kaffiene14 yıl önce

techtalsky14 yıl önce

In the original article he details that the Ask updater waits patiently for 10 minutes after the Java installation completes (probably successfully or unsuccessfully) before launching as a background process.

drzaiusapelord14 yıl önce

Talk about maximizing your income. I'm also bewildered that a new install of java is set to only check for updates every month. Wha?

I picture some Oracle bean counters decided that once a month toolbar installs is decent revenue for them without pounding their update servers too much with requests to see if the new version is out.

Also, where is ask.com getting all this cash? I don't know anyone who uses it.

derekp714 yıl önce

> I don't know anyone who uses it.

Apparently most people who use Java use the ask.com toolbar. </sarcasm off> Edit: With the ask.com toolbar installed, it also changes your default search provider, and it is very hard to put it back in some cases. So I'm sure that's where they get their money to pay for the drive-by install.

Florin_Andrei14 yıl önce

Pretty much a Tony Soprano-like racket.

Aardwolf14 yıl önce

This sums up everything I find wrong about the Windows philosophy. Software whining for updates. Unwanted background programs. Installers that want to install more than you ask for. Usage of the phrase "We recommend" where recommend means "we get money if you".

I've never seen any of those terrible anti-user behaviours in a Linux package manager, or makefile.

I would be fine with an actual security fix being downloaded and installed silently (without any other payload of course).

kevingadd14 yıl önce

This has nothing to do with Windows specifically and everything to do with software developers prioritizing profit over all else.

What does the 'Windows Philosophy' have to do with the decisions Oracle makes about Java anyway? Do you really think Java follows the 'Windows Philosophy'?

revscat14 yıl önce

> This has nothing to do with Windows specifically and everything to do with software developers prioritizing profit over all else.

I don't know about philosophies, but Windows is the only OS I have used which suffers from these problems. I have never experienced this on OS X or Linux.

I don't particularly care why, just that it happens.

bunderbunder14 yıl önce

I strongly suspect that the fact that this doesn't happen as often on OS X and Linux has very little to do with anything intrinsic to those two operating systems. It's just that they're less fertile ground for this sort of thing.

For one, each having fewer users should not be ignored. 90% fewer users means 90% less potential profit. That's a big number even when you aren't relying on a revenue generation model such as ads.

But not just that - also because the average user on both platforms (particularly Linux) is more computer-literate, and therefore better-capable of defending against this sort of thing.

And on the OS X side, remember that for a long time the Java run-time was distributed by Apple. The agreement to start having it be distributed by Oracle might well have included a "no crapware" provision.

On the Linux side, well, that's where all their enterprise customers live nowadays. They really do not want to piss off their enterprise customers like that.

Someone14 yıl önce

"90% fewer users means 90% less potential profit."

So, those companies could grow their profits by 10% by becoming cross-platform? I would think it would be much harder to tweak that installer to get 10% more conversions on Windows than to provide a Mac installer.

Also: it is revenue that they are leaving on the table, not profit. That makes this a slightly less favorable option, but still, I think a company would be stupid to keep even 5% extra revenue on the table.

I see two potential reasons why OS X does not have this problem:

- there aren't as many places to hook into the system. For example, Safari doesn't support custom toolbars (it might be possible to code something as a browser extension, but let's not wake anybody)

- the culture on both platforms is different. Windows users may moan about crap, but in general accept it; Mac users less so. See my earlier comment at http://news.ycombinator.com/item?id=5060019

ajasmin14 yıl önce

OS X and Linux apps don't have to be bundled in a custom installer. In OS X you simply drag the app into you Application folder and now there's an App Store that makes the whole experience even simpler and curated.

Linux distros have great package manager and you won't get greedy crap-ware from the Open Source community.

It's a shame that Windows installers have become so bloated. The other day I've seen one with a check box labeled "I agree [to install this crap ware]" just bellow the license text. Really deceptive.

Hopefully the Windows Store will help improve that experience.

bunderbunder14 yıl önce

Sadly, the Windows store is only for Don't-Call-it-Metro apps that can run on the tablet version. So it really doesn't offer anything to help desktop users - for the most part they're still stuck with the same old Windows Installer quagmire.

revscat14 yıl önce

Again, I do not care "why", just that it happens. Crapware is more of a Windows thing. This is one of (many) reasons I avoid it.

ars14 yıl önce

You should care, because it could change. And if you know why it happened in the first place, you'll know when it could change.

TeMPOraL14 yıl önce

And also you'll know the danger signs of the same situation coming to your platform of choice.

oftenwrong14 yıl önce

A few members of my family have gotten toolbars and search-hijacking malware on their Macs from carelessly installing freeware.

revscat14 yıl önce

Citation needed. My entire family has Macs, and I have never seen this. As far as I know it is impossible to add toolbars to Safari: there is no API for doing so.

I call shenanigans.

keyboardP14 yıl önce

What do you mean by "citation needed"? I highly doubt the parent poster documented the event. It is not impossible to add toolbars to Safari (e.g. http://blog.gregfiumara.com/archives/134)

Just because it hasn't happened to you, doesn't mean it never happens.

[deleted]14 yıl önce

rndmize14 yıl önce

I was curious, so I did a quick search - https://discussions.apple.com/thread/3313282?start=0&tst...

oftenwrong14 yıl önce

It was in firefox.

kybernetikos14 yıl önce

Maybe that's because Macs already have installed all of Apples bloatware.

I found it very irritating that if you try to install iTunes on windows, it would pop up a window telling you to 'upgrade' your browser to safari.

[deleted]14 yıl önce

moheeb14 yıl önce

My Ubuntu installations whine about updates constantly...so it's not just Microsoft. Annoying, none the less.

pekk14 yıl önce

That is the whole distro, and not a hundred individual programs talking out of turn. If you don't want Ubuntu's update notifications, you can turn that off in one place.

csense14 yıl önce

I have a machine running Ubuntu 11.04 or 11.10, I forget which. It keeps on telling me a new update is available. I'll upgrade eventually, but I don't want to be nagged about it, so when I see the box pop up telling me I should upgrade, I hit "Don't Upgrade." Next time it boots, the box is back.

sc0rb14 yıl önce

I have a feeling he means bundling crap with installers. This has been done for a long time on Windows and not so much on Linux or OSX.

bmj14 yıl önce

Likely because Windows has enjoyed a rather massive installation base, particularly among folks who are not terribly knowledgeable. I'm sure as other platforms become more dominant, we'll see similar shenanigans.

bad_user14 yıl önce

Having a user base of folks that aren't very knowledgeable is no excuse for abuse.

Also, I do not think other platforms can be as plagued as Windows is, because it's a matter of culture and user expectations being driven by that culture. The size of the user base has nothing to do with it.

On Windows users wishing to get anything done resort to installing some crap, even for basic things like uncompressing an archive, watching a movie, listen to some MP3 or viewing a PDF or an Office document.

Things got better with open-source software that was ported to Windows, but considering that Windows is the dominant operating system, the ecosystem is actually kind of lame. If you want quality software, the few exceptions are some open-source apps and some products being sold by some big publishers and that's it.

I have a theory that this is because Microsoft itself encouraged piracy and bundling of crapware, while discouraging indie developers, communities and open-source.

donniezazen14 yıl önce

I have never seen any other package bundled with the one you want to install in Linux.

TazeTSchnitzel14 yıl önce

That's because it's probably made by volunteers and they're not trying to make a profit off you.

donniezazen14 yıl önce

Also, I think it is frowned upon in open source world.

steveklabnik14 yıl önce

> This has nothing to do with Windows specifically and everything to do with software developers prioritizing profit over all else.

Sounds like Windows to me.

talmand14 yıl önce

I fail to understand how that's the Windows philosophy. I've used Windows almost exclusively since I've started using computers and I don't recall that being the norm for quite some time. Even today I would say it's not really the norm simply because most people will not run into this on a regular basis. I would say that's the philosophy of business in general, especially considering the article is about Oracle's bad behavior. They target Windows simply because of sheer numbers which would possibly give them a good return on investment. The main reason you don't see that behavior on Linux, yet, is that it's not worth the time for these businesses. If they ever change their mind I guarantee that will be the day you'll start to see this type of thing.

jvzr14 yıl önce

I've stopped using a Windows PC in 2004, and as far as I remember this was already pretty common at the time.

I'm taking a shot in the dark here, but I remember Nero or similar software coming with such a crap too. We, geeks and nerds, quickly get into our habits to uncheck the checkboxes and all. But workaround have developed, such as needing to check a box to not install the bundled crapware.

laumars14 yıl önce

Going even further back: RealPlayer was synonymous this this kind of behaviour. Yet the Linux client never installed such crap.

In my opinion, package managers are the single greatest innovation to happen to computer usability since the WIMP paradigm.

talmand14 yıl önce

So, a few examples have come forward but I don't see a trend that suggests that using Windows on a daily basis is just an ever annoying adventure in avoiding crapware. So far the examples provided I'm familiar with but for the most part avoided. Likely maybe because of the crapware but also just as likely I didn't want/need/like the software being mentioned.

laumars14 yıl önce

You want more examples then?

* iTunes installing several start up processes and Quicktime players

* printer drivers CDs installing all manner of crapware

* OEM bloatware

* Winamp installer recommends all sorts of sponsored crap

* Adobe's terrible update system (ok, not really what we're discussing here, but i resent having to reboot my entire OS just for an update to a PDF viewer)

* and the amount of programs that install start up processes just to check for updates is depressing

* Even Microsoft themselves are guilty of pushing crapware (eg Bing seach bars) in Windows update

....and that's just off the top of my head.

I know this sounds terribly negative but it's fair to say that Windows' current method for allowing developer to run rampant with 3rd party installers is sub par by today's standards. And I think even Microsoft realise this because they're now switching to a package manager with online repositories with Win8. I just hope that their main focus isn't to fleece the developers like Apple do.

talmand14 yıl önce

Granted, good examples. Other than programs that install memory resident apps for their own use (which isn't even part of this discussion), most of them do not affect day-to-day usage of Windows.

On a side note, about that memory resident stuff. A quick look at the Activity Monitor on my Mac suggests similar stories. I have an iTunes Helper process running, don't use iTunes. A bunch of MS Office stuff, irony there. There's one for Spotify, which isn't running. Another for VMWare Fusion which is also not running. A large amount of processes that I have to assume that a number of them are typical system processes but not familiar with such things on a Mac I have no way to tell. Following your thought then I totally blame Apple for their lack of control over their third parties.

But again, why exactly is this the fault of Windows and/or Microsoft? Are you saying that Microsoft should have had a heavier hand in terms of third-parties? Seems to me, considering history, they would have answered to the Justice Department for doing such a thing. Keep in mind that almost every single one of your examples come from third-party sources outside of Microsoft's control.

Are you suggesting that it is impossible for nefarious entities to get crapware, bloatware, or other unwanted things into Linux or OS X through social engineering or shady practices? My Mac comes with all kinds of iSoftware that I don't want/need/use so can I call those bloatware?

I'm still waiting for enough examples of crapware bothering people on a day-to-day basis that can support the statement that such behavior is the "Windows philosophy".

Although, I grant to you that if you somehow managed to get all that stuff on your system at the same time then that would affect your day-to-day because of eventual performance issues. But then again, in most cases if people would bother to read what they click on then they'll avoid most of this stuff. It's the ones that install themselves without your knowledge are the truly offensive crap.

sixbrx14 yıl önce

> The main reason you don't see that behavior on Linux, > yet, is that it's not worth the time for these businesses

I think it's rather that almost all Linux software is either open source or installed through a package manager (usually both). Open source developers would fork and remove any such behavior if the program is at all worth dealing with. While package managers would not be likely to include such annoying software to begin with.

TeMPOraL14 yıl önce

If ever Linux gets a similar userbase as Windows, I guarantee you there will be tons of crapware for it as well. Open source developers can do exactly nothing if users will want to download something from the Web and crapware makers make it extra easy and convenient to them.

And if you say that this won't happen, because software will still be installed through a package manager than well... maybe that's (one of the reasons) why Linux doesn't have a similar non-tech-savvy userbase as Windows.

TazeTSchnitzel14 yıl önce

Yep, and already we have Steam, for example. While an excellent gaming platform, is also Adware by default, and displays popups with special offers and new games on sale.

csense14 yıl önce

As much as I hate Steam, Steam coming to Linux is actually a Good Thing.

One of the main reasons it took me many years to switch to Linux was the lack of games. Many others felt the same way.

If I was Steam, I'd use the sales to customers whose primary platform is Linux to fund the porting of additional games, either through grants/incentives to developers, patching of Wine, or both. The more acceptable Linux becomes as a viable alternative for gamers, the stronger the uptake of desktop Linux will be.

talmand14 yıl önce

Well, Windows has open source software as well so those positives apply for it as well.

As for package managers, money talks. I would have said the same thing about someone sliding in crapware with a Java update some years ago.

nodata14 yıl önce

You don't remember Gator? or that smiley thing?

talmand14 yıl önce

Nope. Like I said I don't recall much of these shenanigans. Although I'm fully willing to admit that may just be my experience.

Silhouette14 yıl önce

I've never seen any of those terrible anti-user behaviours in a Linux package manager, or makefile.

No, on Linux the Java plug-ins simply don't work at all most of the time.

(I work on a project using a Java applet, and frequently get negative feedback from colleagues running Linux about this issue.)

laumars14 yıl önce

Oracle/Sun's JRE Works perfectly fine in Linux. Pretty much always has done.

I bet the vast majority of those users having problems are running OpenJRE/JDK, which is known to have issues with some Java applications (though the issues are slowly being resolved; bit by bit).

Sadly, because of licencing issues, most distros only support the open run times in their main repos, but adding Oracle JRE isn't much trouble.

TazeTSchnitzel14 yıl önce

You're comparing a walled garden software source (OK not exactly, but Linux package managers are practically curated App Stores by default), with installing software from all over the Internet. Now, sure, that used to be the only way to get software on Windows, but there is now a valid alternative for both Modern-style UI and Desktop apps: Windows Store

spyder14 yıl önce

Android too is catching up with the apps spamming the notification bar.

mpweiher14 yıl önce

So are the Feds going to go after Oracle and Larry for "unauthorized access to a computer" and "wire fraud"? With, like, real jail time?

lawnchair_larry14 yıl önce

Considering I clicked Java Installer.exe and got Ask.com toolbar installing, it sounds like a clear cut case of identity fraud as well.

Taking up real estate in my toolbar is basically criminal trespassing, so throw that in. I mean, it's not like in real life you can just say to an inattentive person, "I'm about to break into your house unless you tell me no" and have it be okay.

edandersen14 yıl önce

Looks like YC should make an investment!

bobsy14 yıl önce

It does seem to meet PG's critera

1. The user has an opportunity to opt out.

2. Calling Ask Toolbar "crapware" is only an opinion. Someone may actually want it. sniggers

I think bundling software is fine so long as it is relevant and genuinely useful. Ask Toolbar fails on both accounts. Bundled software shouldn't be offered during minor updates or security fixes... or at the very least, during these minor updates, it should be opt-in instead of opt-out.

DoubleMalt14 yıl önce

Well when after the last security issue there were articles calling end users for uninstalling java completely, I was pretty mad at the missing distinction between the plugin and the runtime.

But now I really think this is a good thing to recommend under windows.

I will still continue using OpenJDK for server projects under Linux, but will press for different solutions whenever installation of Jav on a Windows machine might be required.

manaskarekar14 yıl önce

Can someone comment on how .NET platform + tools compare?

As someone who is not invested in either camp, between the two, .NET seems like a much better place to be invested in right now.

Edit: Thanks a lot for the replies, I'm much better informed.

davesims14 yıl önce

I had about a decade in both, and really they're two very different worlds. From a code standpoint I'd much rather be in C#. It's one thing that MS has done really, really well over the last 10 years. They've taken a pretty aggressive stance towards adopting new features and although it's become fairly complex as of 4.0 and on, it really has some great features, some functional-inspired things like closures and collections api stuff that reminds me of Ruby in a lot of ways, and a great web framework in MVC that is honestly almost as fun to code for as any of the open source web frameworks out there. If you had to choose between one of the big J2EE stacks and MVC, no question, MVC is far, far better. The infrastructure is still a big 'ol MS GUI world, and I'd rather do <badPainfulThing> than spend a lot of time configuring and deploying IIS apps, but then TomCat and WAR files et. al. ain't exactly fun either.

Java's JVM/bytecode infrastructure on the other hand has undergone a renaissance as a VM platform for a lot of very cool languages: Scala and Clojure being the two big examples there. But that's Really not the same thing as Java, obviously. And there's Android -- a completely different ecosystem, and somewhat truncated as a Java dialect, but still basically the Java language and able to employ most of the libs you're used to having: Guava, Guice and so on. No dynamic code gen, which stinks, but I know why they did it. So if you have Java under your belt and want to get into mobile stuff, that's a huge plus.

So, as a general-purpose language skill, Java is still really, really important to know and will have legs for a long time to come. ASP MVC is a great framework, and if you can't work in something like Django or Rails or the like, it comes in nice 3rd or 4th place in terms of making for general coder happiness. C# is a far more progressive and interesting language than Java, but that's a philosophical difference between the gatekeepers of the two languages: Java intentionally moves slow for the sake of stability and continuity, C#'s minders have apparently embraced a little of the 'move fast break things' attitude of some parts of the open source world. I prefer the latter, but understand the rationale of the former.

Me, I'm a Rails coder these days but also get to hop back into Java for Android dev and the rare foray into ASP work and they all have strengths and tradeoffs and they'll all be around a long time. The only thing I think I would avoid on principle, for my own sanity, is any enterprisey J2EE framework. That truly does feel like a massive leap backwards.

untog14 yıl önce

Agreed with this. I used to code C# for a living but have moved on- however, I'm now playing around with MonoTouch in my spare time and I'm loving using C# again.

MonoDevelop is a poor man's Visual Studio, but it's a lot less demanding and runs on OSX. Backend frameworks like Nancy.fx are really great for being even simpler versions of MVC, too.

davesims14 yıl önce

I was shocked how well MonoDevelop worked out when I used it briefly a couple of years ago. But my expectations were pretty low -- I was expecting a compatibility quotient something close to Wine circa 2001, and got instead a basically functioning C# environment on my Mac, which was pretty dang cool.

sc0rb14 yıl önce

So how do you propose we do enterprise stuff?

What's wrong with the latest version of Spring or JEE (please remember this is NOT J2EE).

davesims14 yıl önce

I never used Spring as a framework, although I did use it as a general purpose IOC tool, so I can't really speak to that. I much prefer Guice these days if I need IOC for Java. XML config is clunky and heavy and although was a good choice at the time for Spring, has not aged well.

I'm sure Spring would make dealing with beans a lot less painful. I know there's more to J2EE these days than Beans and WebSphere and the whole early-2000s debacle that frankly gave Java a bad name and enabled the rise of php and Rails and the like.

Struts is Struts and never really appealed to me. Wicket looks more lightweight but still seems config-heavy. I think that's the one thing, from a coding standpoint, that makes even contemporary Java still feel 15 years behind: configuration hell. It's just part of the whole Java mindset, that it's never really shaken (even in Android!), that a major part of my coding life should be spent configuring the framework. C# and .NET has moved away from that more and more and to me it's a much better environment for it. This is all subjective tho. YMMV.

So what do you use? What makes you happy in the Java world these days (I'd really like to hear).

sc0rb14 yıl önce

It appears you haven't really done enterprise Java for a long time.

For a start, J2EE is history, anything using J2EE is a legacy project. JEE6 is the latest Java Enterprise Spec and it's fairly lightweight, you have to use almost zero xml configuration (everything is annotations) and you and you can turn a plain old java object into a bean with just one annotation (@Stateless) and you can even inject beans anywhere with just one annotation.

The same is true for the newer versions of Spring, pretty much no XML config required anymore.

I use JEE6 and Spring, these are as powerful as ever but with less and less actual implementation nightmares with every release. They have looked at the other frameworks and stolen all the best ideas in their latest form.

Play! for java is also a great framework although it doesn't have much adoption by anyone I care about.

davesims14 yıl önce

Awesome, thanks for that -- and no, I haven't done enterprise Java in a while. If one could swap out Spring with Guice (annotation-driven as well), sounds like a framework I could live with. I do appreciate the move away from configuration files to annotations that a lot of Java frameworks seem to be embracing.

thebluesky14 yıl önce

+1 for Spring not aging well

The only thing that makes me happy in the Java world lately is Scala. It has it's flaws but is much more pleasant that old school Java.

cnlwsu14 yıl önce

> XML config is clunky and heavy and although was a good choice at the time for Spring, has not aged well.

You don't need to use XML its just an option now. Annotations work well.

edwinnathaniel14 yıl önce

Stop using the word J2EE please :)

J2EE is horrible.

JEE is awesome.

Comparing J2EE with ASP.NET MVC is not fair just as I would compare ASP.NET with JEE or Spring MVC :)

davesims14 yıl önce

Fair enough. I was pleasantly surprised how much ASP MVC had cribbed from Rails, and it sounds like I'd likely be similarly enthused about new JEE developments. I have noticed the trend towards annotation-driven development and moving away from configuration in Java frameworks and heartily approve.

edwinnathaniel14 yıl önce

Sinatra -> JAX-RS (of JEE 6)

Rails -> Spring MVC (albeit we still don't have a mature ActiveRecord but I concur that the Java world prefers the Repository pattern a'la DataMapper/Merb)

The whole Rails ecosystems is pretty much:

1) Spring MVC

2) ORM (Hibernate/JPA2 or one of the newest tool is Spring-Data)

3) Maven == bundler + rake + gem

4) JUnit

5) Some sane folder structure

edwinnathaniel14 yıl önce

I used to intern at MS and have used .NET platform for a while (on and off, including not too long ago doing a bit of ASP.NET, ASP.NET MVC, and Sharepoint for one-week project). I've used VS.NET 2005, 2008, and 2010.

I've also used Java for a while, the whole Spring MVC, JEE6, Eclipse, IntelliJ.

If you're willing to live in Windows OS platform, you should go with .NET, no question asked. Forget about tooling and everything else.

If you want more flexibility, more choices, etc, Java is your choice. (There's also Python, Ruby, and the rest but let's scope it to Java).

.NET culture is heavily influenced by the culture of Microsoft which means:

1) Less Open Source, More mISV (more "pay" products)

2) Windows/GUI, less command-line (has changed a bit but still not there)

3) Fire and Motion http://www.joelonsoftware.com/articles/fog0000000339.html

#3 is important because MS makes money from tooling as well. When I was there, the internal chatter was "tool will be out of date every 2-3 years". Please make your own conclusion.

Some people said Java had this period of "sleeping" which was true. But during that time frame, we've seen TONS of open source projects that are very mature, battle-tested, and probably everlasting.

We've also learned a better way to write Java code (HN made such a big deal of Factories yet HN never acknowledge the best breed of Java code out there, it's a typical of a community like this anyway).

Thus that "sleeping" period is being used efficiently to stabilize things.

When it comes to tooling, Java beats .NET by miles. Java deployment packaging (JAR for library and WAR for web-app) is one of the best out there and it's been stable for many many years. (http://dirtsimple.org/2004/12/java-is-not-python-either.html)

Java build and dependency management tool is also far ahead of what the .NET has. Maven is far beyond NuGET and MSBuild (shrudder).

Integrating Java build with popular Continuous Integration server like Jenkins, TeamCity is waaaay easier than .NET.

Eclipse foster a good community of open source and free tools/plugins which put VS.NET to shame BUT BUT BUT experience may vary when using Eclipse. Eclipse is like black magic and moody: if somehow you're in the position that your Eclipse is stable, it's one of the best IDE out there.

Eclipse has its own built-in "app-store" that makes installing plugins sooo much easier, seamlessly, and faster.

m2clipse, a Maven plugin for Eclipse can perform the following steps:

1) Download dependencies

2) Download the dependencies javadoc (auto-complete will show the code documentation)

3) Download the dependencies source code (#1 only download the compiled code) if you ever wanted to "navigate to the implementation of a method"

It does this seamlessly without you breaking a sweat.

Tools like FindBugs and CheckStyle helped to improve your code hygine/style and EclEmma can tell your Code Coverage. All of these are free.

Java has rich and mature tools and libraries:

1) Sonar => http://www.sonarsource.org/

2) Jenkins => http://jenkins-ci.org/

To put it simply, the Java community has a very strong Software Engineering discipline and continue to find better ways to develop whereas the .NET/C# community is either following Java lead or serving its own master: Microsoft.

I'm glad I'm out the .NET world because it was soo much limiting and "capping" your day-to-day productivity.

darklajid14 yıl önce

You got a lot of replies already, but let me join the crowd.

Disclaimer: Was a Java guy, working with C# exclusively now by day (F# and Clojure - not Clojure-Clr - are my pet languages at night).

In my opinion the languages (specifically Java vs. C# now, ignoring other languages for now) started out really, really close when C# was new. C# gained a lot of nice features, while Java was - euphemistically - 'stable'.

Thinks that made my day and made every sporadic try to get back to Java (or work on Android) a chore: .Net events, properties (later automatic properties), usable generics, delegates, yield based generators/enumerators and the reason they were added: LINQ. Type inference aka 'var'. Basically every release brought half a dozen interesting features (and new technology, WCF/WPF/Silverlight/Workflow), while Java was sleeping as far as I could tell.

I understand the latest release of Java now came closer again, but C# is still quite ahead in my opinion.

Tooling: Visual Studio. Now, I'm not a total fan and some releases are better (2008, 2012) than others (2003, 2005, 2010), but it's a decent tool for most all your developing needs and ranges from free to 'includes the kitchen sink and costs $$$'. It supports three languages out of the box (F# is very interesting and a fully supported language!).

I like IntelliJ and sympathize with the Eclipse project, but for me the VS experience is more streamlined, simple and nicer in general.

Libraries: If it's _really_ popular in the Java world, you'll find a port (think nhibernate, log4net) or something equivalent.

I wouldn't want to go back (C# -> Java), but I DO have the jdk around for Clojure (and I'm still watching Scala from a distance).

edwinnathaniel14 yıl önce

Eclipse has rich plugins that even Visual Studio can't touch.

(Maven) m2clipse alone is a very good reason to learn Eclipse.

You can't download 3rd-party library with Documentation _and_ Source Code _and_ Navigate to the code without having to setup anything _and_ included in your build like you would have in.NET.

It's a big plus for incorporating and debugging code when you need to do so.

I've done C# and now fully Java (and JavaScript) and I wouldn't go back to a more locked and dumbed-down ecosystem.

C# the language may well be better than Java but that alone is not enough of productivity boost.

Eclipse, Maven, FindBugs, CheckStyle, Jenkins, Tomcat, Jetty, rich 3rd-party ecosystems are the key of my productivity boost.

VS.NET, NuGET and having to write either MSBuild or NAnt plus IIS (express or not) aren't cut it. Not enough to be agile.

darklajid14 yıl önce

Okay, I love Eclipse (technically). It's just a dog, most of the time and tries to be everything at once. Still, it _is_ a great project.

Maven: I .. never got that one. I guess the parts that make sense to me are covered by nuget. But I might be totally ignorant here.

CheckStyle -> StyleCop ? Jenkins supports .Net Tomcat makes no sense in this list for me. IIS? Jetty: See above? Maybe the ASP.Net dev server, depending on why you'd list jetty?

I rarely feel the need to do a lot in msbuild files. I might add build tasks (StyleCop?), but that's about it. Deploying is not in scope here (and for that I'd probably go for WiX. Not a huge fan of MSI, but that's what the platform uses and what other tools can manage).

I appreciate your opinion and read your sibling post, but I guess we're both a bit ingorant of the other guy's platform?

Jenkins: https://wiki.jenkins-ci.org/display/JENKINS/MSBuild+Plugin Sonar (mentioned in your sibling post): http://www.sonarsource.com/products/plugins/languages/c-shar...

Incidentally the Sonar page for C# lists a couple decent code quality tools for the .Net side of things.

But in the end if will remain a matter of taste & experience and I'm very certainly biased.

edwinnathaniel14 yıl önce

Won't argue about Eclipse performance. Sometime it depends on the characteristic of the project.

Some of the projects that I worked on, albeit huge, Eclipse still performs pretty nice. While in other instances I do notice issues with the performance.

Tomcat and Jetty make a lot of sense if you use it with Maven. The ability to compile, deploy and bring up your App Server is something that you don't get for free in .NET

http://mojo.codehaus.org/tomcat-maven-plugin/deployment.html

mvn clean install && mvn tomcat:deploy <-- win

NuGET only deals with dependencies but doesn't deal with packaging, running unit-tests, running integration-tests, running PMD/CheckStyle/FindBugs as part of your build.

All of these things are important for CI/Continuous Delivery.

Oh almost forgot this one: JavaFX 2 may be way behind of .NET WPF but JavaFX 2 comes with a tool that can generate installer for OSX App Store (will bundle JRE automagically), Windows, and other platforms. WiX can't do that.

I may be ignorant of some of the .NET stuff but as of 2010 - 2012, the last time I used .NET, .NET is still lagging behind Java when it comes to tooling.

chaostheory14 yıl önce

> Tooling: Visual Studio.

It's a decent tool but I think the alternatives for other platforms are either equal or better. imo MS is typically playing catchup in this area now.

> Libraries: If it's _really_ popular in the Java world, you'll find a port (think nhibernate, log4net) or something equivalent.

This is what truly makes .NET a no go for me. There's just too few non-paid and open library equivalents compared to almost any other platform. Not mention the libraries in other platforms tend to have more features. The .NET open source community is still pretty small and weak, and I just don't see that changing (even with CodePlex it hasn't really had any drastic changes).

sc0rb14 yıl önce

I've been a professional Java developer for just over 2 years now. Let me give you a simple example.

The three leading Ecommerce platforms (Oracle ATG, Hybris and IBM WebSphere) are all done in Java.

There is huge demands for Java developers working on Web and Enterprise systems the world over. The average Salary for Java developers is pretty high in most places (london and Sydney) and the day rates you can charge as a contractor are very good.

There also seems to be more open source and technical community in Java.

I am glad that I went down the Java route.

also, Most Java development jobs nowadays focus on the web and server side stuff, this is followed by mobile (such as android) and embedded (such as TIVO boxes).

kabdib14 yıl önce

I went from writing client-server code in Java to writing similar things in .NET.

After two months of C#, I remember thinking to myself, quite clearly, "Oh, thank God, the nightmare is over."

Debuggers that worked. Native calling systems that actually interoperated well. A set of classes that weren't horribly overdesigned and under-implemented.

Best of all, no culture that insisted on factories that made factories that made factories.

Writing Java on phone platforms is fine. But the enterprisey stuff is death on roller skates.

Hey, if you can stand it (my cousin does), then you might make a bunch of money. My cousin spends six months hacking Java for a bank, then six months vacationing. I prefer to do stuff that doesn't make me contemplate washing dishes for a living again.

.NET has its warts, but it's not cancerous the way Java turned out to be in the hands of the architecture astronauts.

sc0rb14 yıl önce

Interesting experience you have.

I have spend most of my career doing Java6 JEE6 and modern Spring and it all feels quite modern. I did a lot of C# at University and it is a good language and platform but I don't think it's better than Java. New / modern Java is fine, it's old java that you want to avoid.

chaostheory14 yıl önce

If you ever try any of the modern stuff (django, rails, play, grails, any node.js framework) in depth, j2ee / Spring and java just feels old and ancient. Spring has gotten better over the years, but there's still just too much work and too much unnecessary complexity and cruft with Spring. It's really telling when even Spring's creator jumped ship to work with TypeSafe and jvm7 has huge improvements designed for other languages.

imo C# is an improved java, but C# open source ecosystem is just anemic compared to java.

DoubleCluster14 yıl önce

I actually like old and ancient. That means all bugs have been fixed already. Systems become complex quickly enough and you need to use the most boring bricks imaginable if you want to build something sturdy.

chaostheory14 yıl önce

> I actually like old and ancient. That means all bugs have been fixed already.

By that logic everyone would still be using Cobol or Fortran for new development. Moreover neither Rails, Django, or Grails are brand spanking new anymore. Those projects are mature. If you don't want to stray too far away from the jvm comfort zone, Grails is actually built on top of Spring and Hibernate and it's still maintained by the Spring team.

edwinnathaniel14 yıl önce

I'm not sure which debugger you use to debug Java code but I can do local _and_ remote java debugging via Eclipse.

IntelliJ supports JavaScript and JSP debugging as well.

Client-server development using EJB 3.x is way much better, cleaner, and simpler than .NET, sorry, this is something that I don't think you can argue elegantly.

.NET culture when it comes to open source is sub-par while Java is very rich. Spring, Tomcat, Jetty, Hadoop, HBase, Eclipse, NetBeans, Maven, Ant, the list goes on. These are mature and high profiled open source projects wherein .NET I have never seen an open source project reached that level of acceptance.

While Java has this sub-culture of factories that made of factories. .NET has this culture of fighting with the latest and grandest libraries that Microsoft launched once every 6 - 12 months.

Enterprise .NET is not at the level of Java yet (compare Message Queue, remoting, security, and other capabilities .NET are still lagging).

.NET has its cancer in its own way.

I honestly believe that you have not used Java that deep professionally.

martinced14 yıl önce

"Oh, thank God, the nightmare is over."

The nightmare for me has been over in the mid-nineties, when I discovered Unix through Linux.

There's no way I'll ever be going back to working on Windows. I'd rather go work as a plumber or a truck driver (not that there's anything wrong with that) then have to work on Windows ever again.

C# / F# might be interesting, but using any Windows as my OS is a big no-no. Never this nightmare again.

And, nearly 20 years later, the great thing is that a lot of devs previously working on Windows are now working on OS X (anybody disputing that trend is a fool).

Major win for Unix with both Linux and OS X. Not to mention all the devices running either iOS or Linux / Android.

The nightmare is over: Windows shall never be the OS powering all these servers and devices out there and hence .Net shall never be the dominant platform.

It's not that .NET has its warts (it does), it's that Windows has its ugly warts and I'll never ever be using that inferior OS ever again and I'll never ever again will be forced to deploy on an Microsoft stack.

In the mid-nineties I considered quitting IT. And Linux saved me. And now OS X. Thanks.

davesims14 yıl önce

I wouldn't go this far myself, but I deeply sympathize. I developed an inordinate level of familiarity with the Windows ecosystem for 10 years. I could tell you which registry keys did what for which COM components <shudder/>. Then I rebooted my technical self into Mac/Linux/Ruby and would have to scream into a pillow for 20 minutes before I'd be able to open up a windows command line again. Although I did do a bit of PowerShell when it came out and -- wait for it -- it was actually pretty nice. But still, the overall OS is such an odd beast in retrospect.

CamperBob214 yıl önce

In other news, the mid-nineties were a long time ago.

CodeCube14 yıl önce

Well, you can write C# without having to develop on windows through the Mono framework, and Xamarin's products - http://xamarin.com/

These days, you can be a C# developer without having to do an ounce of "Microsoft Stack" programming if you didn't want to.

KumarAseem14 yıl önce

Java isn't what it used to be. The products written in Java are slow, bad looking and less secure. The days of Java are anyways numbered.

sc0rb14 yıl önce

That's an incredibly ignorant response and you have no idea what you're talking about.

Java looks bad? You're probably talking about certain swing applications which are now very rare on the desktop.

Java is slow? You clearly have no idea how fast the JVM can interpret and JIT java nowadays.

Java is insecure? You're mainly talking about applets which are an ancient technology on their way out (slowly). In terms of actual JVM security. Every product has its security issues.

You seem very ignorant, your java experience is probably from the past e.g. J2EE1.4 and old swing apps.

Modern Java is an good language on a great platform. There's a reason why it runs some of the worlds biggest ecommerce sites and worlds fastest trading desks.

jbm14 yıl önce

While I think the parent was overplaying it, I do find most of the Java applications on my mac are slow and irritating to run.

Pycharm is an example of one of the apps I am talking about. It just feels like it struggles at times, eventhough I have a fairly new machine.

Java was the first language I learned while going through college but I find the verbosity to be irritating.

sc0rb14 yıl önce

Your experience is not necessarily because Java is slow. It could just be the applications you are running that are slow for reason that have nothing to do with the language.

Swing is probably going to be slower (maybe?) than some native windowing framework.

But Java as a language running on the JVM is certainly not slow.

I've just been looking up pycharm and it seems that the slowness issues are to do with things like opening files and doing parsing. These things are likely to be slow for anything but the language they are written in.

matwood14 yıl önce

Desktop java is dead. Actually desktop anything that's not web is going to end up dying. The server is where the languages will duke it out next and Java is fine there. C# is also fine on the server. The nice thing about Java is it easily runs on linux and has many OSS libraries to help quickly standup server applications.

revscat14 yıl önce

The best way I can think to phrase it is "in-browser VMs are dead". This covers Java, Flash, that one Microsoft had for a while, and anything else that uses the browser plug-in mechanism to load heavy frameworks.

Spooky2314 yıl önce

Most people are exposed to Java via enterprise monstrosities.

It depends on your POV. I've had to deal with an enterprise Java crapware app that was essentially a terminal emulator for an old mainframe... except that it required more than 4GB of memory on the desktop to work appropriately.

The mainframe itself has 2GB of RAM.

lawnchair_larry14 yıl önce

Although you are taking heat for saying they are less secure, this is mostly true. Specifically, it is the JVM that has major security problems, not the apps themselves. This is not so much a fault in Java but in Oracle's implementation and their longstanding failure with security.

Fun fact, several Windows versions have included a security mitigation technology called ASLR (Address Space Layout Randomization) that breaks a large majority of exploits and raises the bar significantly. Exploit developers and penetration testers love Java, because any machine that has it installed (most of them) breaks ASLR, re-enabling all of those exploits that Microsoft had otherwise mitigated.

revscat14 yıl önce

I hate to say it, but you have absolutely no idea what you are talking about.

brown9-214 yıl önce

Most applications written in Java these days don't have UIs.

slurry14 yıl önce

> Java isn't what it used to be. The products written in Java are slow, bad looking and less secure. The days of Java are anyways numbered.

Shorter: "I only know anything about client-side programming."

TimGebhardt14 yıl önce

For the newest versions of Windows (Server 2012, Windows 8) .NET comes installed -- I forget if it's installed by default or installs as a Windows component. If it's the latter you install it from the same screens you install IIS or the SMTP server from.

After you install it updates to the .NET framework show up in the "optional" windows updates.

There are certainly standalone installers as well: http://www.microsoft.com/net/download

But if you're producing client-side software that's dependent on the .NET framework then you most certainly will make your installer "bootstrap" the installation of the correct framework for your OS language and hardware.

edandersen14 yıl önce

You never have to worry about drive-by installers with .NET updates - security updates just come down with Windows Updates.

.NET is seeing a small renaissance with ASP.NET MVC and what the Server teams are putting out, but Java is also gaining popularity again as a way of running Rails apps quickly and with Scala.

Both platforms have enough legacy apps out there for a lifetime of maintenance work, if that's your sort of thing. Cleaning up after outsourcing companies is lucrative.

chaostheory14 yıl önce

In terms of just the languages themselves, .NET is very solid. C# is definitely a better version of Java, and the rest of the # languages in general are decent or good.

However, the .NET open source ecosystem (while greatly improved from years back) still really really sucks. Historically, this is directly MS's fault (codeplex helped but it still will never be able to undo the damage MS did early on). I just think it's a waste of time having to reinvent wheels that pretty much every other major platform (Java, PHP, Ruby, Python, etc...) has plenty of. I always hate having to do extra work that I feel is entirely unnecessary, which happens a lot on .NET.

brown9-214 yıl önce

You would think that a company Oracle's size wouldn't need to resort to install commissions from something like this.

You would think that after several years of conning people into using their search engine, the employees at Ask would feel dirty to have to engage in such tactics.

spyder14 yıl önce

Even Google is supporting these shady practices by powering some of the search toolbars and probably paying the toolbar owners for ad clicks. See MyWebSearch (http://home.mywebsearch.com/) mentioned in the article.

lilsunnybee14 yıl önce

Humans have an amazing capacity to rationalize and self-justify, as long as they are getting some personal benefit.

jakub_g14 yıl önce

One additional note regarding the installer: to opt out of the toolbar installation, you have to click the checkbox itself. You can't click the text label associated to it. I call it a bug, but certainly it's a feature in this context.

talmand14 yıl önce

Actually, that's very common. It's one of my pet peeves for web design but I see it often in installers and the applications themselves.

regularfry14 yıl önce

This problem has been known and complained about for ages. What's the community response? We have OpenJDK, why does anyone put up with an abusive installer from Oracle?

jarito14 yıl önce

Because Windows is not a supported platform? You have to find an unofficial build or build it yourself.

mathnode14 yıl önce

Is anyone distributing 64bit OpenJDK builds for windows?

EDIT: I found: https://github.com/alexkasko/openjdk-unofficial-builds

untog14 yıl önce

Just the word 'unofficial' is enough to stop most large companies using them. It is (was?) the same with Firefox- they never offered an MSI installer for use on corporate networks. There were unofficial versions, but you could never be sure that someone hadn't bundled something extra in there.

mamcx14 yıl önce

"but you could never be sure that someone hadn't bundled something extra in there".

Irony,

With Oracle, your are SURE.

klez14 yıl önce

Well, this thing about Java shows that you can trust not even official versions...

eumenides114 yıl önce

Is there an OpenJRE(or even a need)? or do we just run OpenJDK?

nnq14 yıl önce

Java could have been such a good thing, even in the browser (ok, as platform, ignoring the language's shortcomings, but still...). Whys did both Sun and Oracle strive so hard to fuck it up? It's as if these guys have a "how to fuck things up for the end user" brainstorming meeting every week!

brazzy14 yıl önce

I think the last few years have shown conclusively that the it is not a good thing in the Browser because the sandbox security model is too complex to be implemented correctly.

nnq14 yıl önce

> the sandbox security model is too complex to be implemented correctly

...is there any other simpler security model than this? Java even seems a simpler and more "well behaved" language than JavaScript, and JVM bytecode is said to be even simpler (though I'm not an expert on this...), and browsers had they own share of Javascript related exploits but people rolled updates quickly, acted responsibly and didn't do anything particularly stupid (as opposed to the described crapware incident perpetuated by Oracle).

EDIT+: one can buy browser exploits cheaper on "the x market" and they are more useful than JVM exploits so "security" is not Java's Achilles' heel, and it's Swiss cheese all the way down if you at most web-facing software unfortunately...

gus_massa14 yıl önce

I really hate the crapware, and I hate more the "opt-out" crapware. But the "summary" of the article is a little unfair:

Oracle's Java plugin for browsers is a notoriously insecure product. Over the past 18 months, the company has released 11 updates, six of them containing critical security fixes. [...]

The updates and security fixes include not only the plugin, but all the Java runtime that is much bigger and complex. (For example, one of the updates was: http://www.oracle.com/technetwork/topics/security/javacpuoct... ). This is like accusing Chome or Dropbox of being insecure, because they do a lot of updates (that are automatic, invisible and don't offer crapware).

fencepost14 yıl önce

Crapware-free downloads ARE available.

If you go to Oracle's Technology Network area to download (or Google for the specific version e.g. "java 6u38" or "java 7u11 oracle" because of all the press) you can agree to their binary license and download crap-free offline installers.

The link for 6u38 is http://www.oracle.com/technetwork/java/javase/downloads/jre6... and the link for 7u11 is http://www.oracle.com/technetwork/java/javase/downloads/jre7...

peapicker14 yıl önce

Interesting how many comments about desktop Java being dead, when the highest selling video game still available and being developed is Minecraft, written in Java, which runs on the desktop... (over 9 million registered users, and still increasing... enough to make it the #9 all-time selling video game)

I will admit tho, for traditional desktop apps, it is very dead.

edgesrazor14 yıl önce

I'm glad this was said in a much larger avenue than my paltry Twitter account. To bundle a toolbar installation in with a major security fix is not only dishonest, it's unethical and who's to say that toolbar isn't the next piece to contain a security hole?

nodata14 yıl önce

A sleeping add-on installer that waits ten minutes? Sounds kind of rootkit-y, opt-in or not.

bhauer14 yıl önce

I can't sympathize with this article and most users in this thread because I don't understand why anyone uses Java within web browsers. Today, Java is for server-side code. Full stop. Okay, I know some people still have to use Applets, but none of us here, right?

Kidding aside, I've installed the Oracle JDK on dozens of Windows machines and not once have I been prompted to install a toolbar or bloatware.

1. Navigate to java.oracle.com

2. Select Java SE.

3. Select to download JDK SE 7u11

4. Accept license agreement

5. Download Windows x64

6. Open installer

7. Select to install "Development Tools" and "Source Code" (disable "Public JRE")

8. Wait and then close installer

9. Run c:\java\bin\java.exe

10. Review Windows' "Programs" and note only JDK has been installed; no toolbars

11. Celebrate

I suspect many people are installing the JRE, which is something I've never done. Since the JDK can run Java code, why install the JRE at all?

bskap14 yıl önce

Because many people are still stuck using applets in the browser. The JDK won't run those.

thesis14 yıl önce

Last update I received I clicked the next button a little to fast. I realized after I went through the dialogs too quick and I figured no big deal I'd just cancel it when the McAfee dialog came up. It never did... all of the installation was in the background.

Shady!

facorreia14 yıl önce

I think the Java plugin should start to be flagged as malware given the persistent presence of holes that allow remote execution of arbitrary code, the clever bundling of questionable software and the update wizard behavior.

alayne14 yıl önce

Sun was installing toolbars before Oracle bought them. I remember them bundling the Yahoo toolbar with Java.

chadscira14 yıl önce

What really upsets me about this is that it's Java that they are stuffing this adware into... Java a previously legitimate requirement that many applications have chosen to build on top of as a language/platform. For the average user it looks like all of these other programs are promoting this... I'm surprised that they can get away with it.

kjackson201214 yıl önce

Fuck Oracle. And unfortunately, I guess that means Fuck Java too. This is the exact kind of stupid behavior that kills great technologies like Java, by stupid, greedy people that care more about money than technology. If this is how they expect to treat their users, I'll switch permanently to Python, PHP, and anything else besides Java.

king_magic14 yıl önce

I happily uninstalled Java from all of my machines/OSes last week. Glad to be rid of it.

neumann_alfred14 yıl önce

I decided to try the same. It's been ages since I last played Minecraft, and I have frankly no idea what other apps I'm using might be using Java; the only way to find out is to uninstall it. It's not like I can't install it again if I need it.. but the days of just having it installed "just in case" are over for me. I might even uninstall Flash just for kicks.

jiggy201114 yıl önce

I think this is in a large part due to the way programs install on Windows perhaps.

These programs seem to rely on getting the user to make a choice during installation time. Windows is the only major OS that seems to rely on "installers" being programs in their own right.

For example on debian, .deb packages provide a standard installation process. Whilst it would still certainly be possible to inject all types of crapware into a .deb the actual install process is not really conductive to this, because there is no way (AFAIK) to pop a custom screen during the install.

pasbesoin14 yıl önce

One reason I always download the full installer (even to upgrade), rather than using the Java update notification service (it runs, but when it prompts with an update -- if it does so before I manually upgrade -- I use that notification as a cue to go download the full installation; I don't let the service upgrade me).

emmelaich14 yıl önce

My experience is that the one from java.sun.com does not have the crapware. Especially if you install jdk?

The one from java.com does.

I'm not 100% certain though.

BTW, there is a process to install java without the installer and without admin rights on Windows. The process is described on say StackOverflow but I have it scripted.

I should put it up on github sometime!

[deleted]14 yıl önce

d4vlx14 yıl önce

Too bad Google missed out on buying Sun.

DHowett14 yıl önce

I was just about to decry ZDNet for calling the kettle black here, but it seems they removed the scummy invisible pop-up ad click target they used to put in the negative space next to the column.

andmarios14 yıl önce

I do not have any such issue. Are you sure this sidebar comes with the official java installer from www.java.com?

From what I've heard, I guess it comes with Java installers from 3rd party sites.

suyash14 yıl önce

Do not take this article Seriously. This is garbage post and problem is with ASK and not Oracle here.

aydoubleyou14 yıl önce

And this is why Apple creates their own install packages for Java.

otterley14 yıl önce

Not anymore, they don't. (Source: http://bit.ly/947yQJ)

adamkochanowicz14 yıl önce

This seriously changes my opinion of Oracle.

doctorpangloss14 yıl önce

Isn't it a little ironic that we're reading an article about foistware where the author searches for his own book on multiple search engines?

kahawe14 yıl önce

I used to work with Sun for quite some time; I can say without failure every single Sun tech I came across was pretty damn cool, knew what they were doing and was hooked up in the Sun-universe enough so they could provide excellent pointers and ultimately that translated into happy customers. On top of that a lot of their enterprise-y software wasn't half bad to begin with, it was just always terrible getting good documentation and information as an "outsider" oh and there were a couple of years when you could just forget the sorry excuse they passed off as "support". But there was always the possibility of going "black-ops", just de-compiling and providing your own fix and although this is far from great, things just worked and everyone was happy. Sun's suits didn't really matter from our point of view anway, they did no harm, stood in nobody's way, shook hands and invited folks to dinner when appropriate. Fair enough, you cannot really ask for more, anymore and it would literally be paradise, so I was happy with that. Even-though I never got that project manager I was basically paying for...

Enter big red. Talking to brain-washed zombies cannot feel very different from talking to Oracle's sales drones and customer relation dummies. You were talking about "A", they would start trying to sell you pricey-addon for the database when you weren't even talking databases in the first place. Whoever was a useful tech contact inside Sun before now turned into a walled-off zombie as well and I guess I was lucky they didn't just slap a price tag on picking-up the phone or simply answering an email. And to top it off I had to suffer one of their pre-sales dummies loudly telling an oh-so-ridiculous story how, can you imagine, bigcorpA was running tomcat(!) in their production environment! And not the abomination from hell that Oracle gets away with charging huge amounts of money for!! Well can you imagine that!!!

Another case of too-big-to-fail and nobody ever got fired for buying Oracle, hm?

emmelaich14 yıl önce

I'm a long time user and sufferer of Sun's products; going back twenty years at least. My experience is that except for their core product (SunOS/Solaris) their products have been awful - over-engineered, buggy, difficult to administer and install.

Exhibit 1 the trainwreck that was the Solaris firewall. I don't think anyone in the world understood or installed the first version. Then they introduced a 'lite' version which perhaps a few sorry souls used. Then I think some sane person in Sun said 'fuck it' and they then offered BSD's pf firewall. Which was what everyone used anyway as it had been available for quite a while from outside sun.com.

This experience mirrors mine with Oracle as well. The database is good and support excellent. The rest of it (I'm looking at you Oracl Fusion Middleware) has an extremely high WTF rate and the consulting and support staff often have no idea.

VonGuard14 yıl önce

Bit Torrent makes all its money through Ask's tool bar. Ask props up a whole economy, it seems. But hey, at least Oracle figured out how to make money on Java! Sun never did that.

bunderbunder14 yıl önce

Which raises an interesting question - how do you make money on a platform like this?

I've been wondering because I think that my preferred managed environment (.NET) is doomed if Microsoft continues keeping it tied to Windows. On the Microsoft side, I suspect that Microsoft's market share in the server and enterprise space is going to continue dwindling for the foreseeable future, which means that their current plan for making profit is far from certain. But neither Sun nor Oracle seem to have figured out a way to distribute Java for free to the world at large and make a profit off of it, and it's hard to imagine that Microsoft is any more capable of pulling that rabbit out of its hat.

Perhaps the trick is that you don't try to make money on it, at least not directly. And there's a great project out there that's trying to do it that way. But, well. . . . ugh. I love Mono; it seems like it has everything going for it. From a technical standpoint it's been rapidly closing the gap with Microsoft's implementation, which I suspect means it's probably already ahead of the Java platform in many respects. The flagship language is certainly way ahead. And it has the singular distinction of being the only Free platform in this sector, which would make you think that folks would be extremely interested in seeing it win. Why that doesn't seem to be the case continues to mystify me. I know it's still got a few Big Business cooties on it, but it's got way, way, way less of them than Java does.

dredmorbius14 yıl önce

> Which raises an interesting question - how do you make money on a platform like this?

Professional services. Hardware sales. Turnkey solutions (you want to support industry X using Java? ...). Development tools (to the extent not provided by third-parties). Certification/compliance. Associated products (nice Java app you've got there, need a database to go with it?).

Here's a thing: making money off of software by itself is hard. One of the lost messages in the recent trash-talking of Microsoft is that the fall of the House of Redmond also means the fall of software as a standalone, unit-sold, high-value product. Nobody but nobody else operates this way, certainly none of the current tech leaders: Google, Apple, Facebook, Amazon. Two sell ads, two sell things. None sells software.

piokoch14 yıl önce

> Which raises an interesting question - how do you make money on a platform like this?

Sell trainigns, certification, support (QA tested fixes for bugs that affected you before they are released to the public). SUN was doing all of that and was pretty successful. The hardware part of the bussiness failed them because of flood of cheap comodity servers.

ars14 yıl önce

> Which raises an interesting question - how do you make money on a platform like this?

Traditionally you sell a development environment. You release a command line compiler for free, and a full development GUI for money.

Then you make some useful (but non core) libraries and sell those as addons.

lgieron14 yıl önce

I always thought the Microsoft makes money with server-side .NET by making people buy expensive Windows server licences. The whole .NET platform can be viewed as a "feature" of their server products, differentiating them from Unix-family alternatives.

pjmlp14 yıl önce

This is why if possible, one should stay away from company driven languages.

205guy14 yıl önce

I could be mistaken, but I seem to recall an add-on in the Java installer during Sun's ownership. I don't think it was the Ask toolbar, but something else. I was out of Sun before that, but that's when I knew the "near-paradise" was over and Sun was circling the drain. Where's fuckedcompany.com when you need it.

piokoch14 yıl önce

Sun software division was profitable and was getting more and more profitable. The hardware part was responsible for the deficit.

fauigerzigerk14 yıl önce

Crapware add-ons as part of the Java update already existed long before Oracle bought Sun.

visualcsharp14 yıl önce