# Homeland Security warns to disable Java amid zero-day flaw **URL:** \ **Category:** In My Humble Opinion\ **Created:** [January 11, 2013, 7:32pm UTC](https://boards.straightdope.com/t/homeland-security-warns-to-disable-java-amid-zero-day-flaw/646893 "2013-01-11T19:32:19Z")\ **Posts on this page:** 12\ **Page:** 2
**Author:** ![njtt](https://avatars.discourse-cdn.com/v4/letter/n/ecd19e/32.png) [@njtt](https://boards.straightdope.com/u/njtt)\ **Post date:** [January 13, 2013, 12:17am UTC](https://boards.straightdope.com/t/homeland-security-warns-to-disable-java-amid-zero-day-flaw/646893/21 "2013-01-13T00:17:48Z")
> [@DJ\_Motorbike](#): > > According to [Oracle](http://www.oracle.com/technetwork/java/javase/documentation/autoupdate-1667051.html) if I’m reading this correctly, they haven’t updated Java for 32bit Windows to v7 yet. It is not due for release until February. > > If you’re using a 32bit version of Windows you’re safe because only v7 of Java is vulnerable according to DHS. I do happen to use Windows 7 32bit. I checked the version of Java installed. Yep, version 6 update 37 which is current for 32bit Windows. > > [Smug]If you’re using 32bit Windows you should be safe, but if you’re using OS X you may not be.[/Smug] 😉 This is not correct. First of all, Java 7 for Windows _is_ out. I uninstalled it from my computer yesterday after first reading about this alert. Secondly, if you are still running Java 6, that is an obsolete version that has vulnerabilities that were patched in Java 7. You are not safe with it; you are probably even more unsafe than with Java 7. For most people, the best thing to do is simply to uninstall Java from your computer altogether (if it is there in the first place). Most people simply are making no use of it anyway. Although Java aplets used to be fairly common on web pages, that is no longer the case. Windows users can do this simply by going to Programs under Control Panel and uninstalling Java. > [@SmartAleq](#): > > If you’re running Firefox and recently updated to v.18 I think you’ll discover that Java and Silverlight are both blocked for vulnerability issues. I am on v18 and I just looked. Silverlight is not disabled. Is there any good reason it should be? (Java is not there because I uninstalled it.) ---
**Author:** ![Skypist](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/skypist/32/169_2.png) [@Skypist](https://boards.straightdope.com/u/Skypist)\ **Post date:** [January 13, 2013, 12:53am UTC](https://boards.straightdope.com/t/homeland-security-warns-to-disable-java-amid-zero-day-flaw/646893/22 "2013-01-13T00:53:53Z")
I use Firefox, and when I checked my plug-ins, I saw that Java is already disabled but Silverlight is not. Big computer know-nothing here (it’s embarrassing), so I have no idea if Silverlight is bad or not. ---
**Author:** ![SmartAleq](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/smartaleq/32/163_2.png) [@SmartAleq](https://boards.straightdope.com/u/SmartAleq)\ **Post date:** [January 13, 2013, 4:57am UTC](https://boards.straightdope.com/t/homeland-security-warns-to-disable-java-amid-zero-day-flaw/646893/23 "2013-01-13T04:57:00Z")
Silverlight might be disabled on mine because of NoScript–and it’s marked as “use with caution” but since I pretty much never need it I don’t bother enabling it. ---
**Author:** ![Evil\_Captor](https://avatars.discourse-cdn.com/v4/letter/e/f17d59/32.png) [@Evil\_Captor](https://boards.straightdope.com/u/Evil_Captor)\ **Post date:** [January 13, 2013, 6:42am UTC](https://boards.straightdope.com/t/homeland-security-warns-to-disable-java-amid-zero-day-flaw/646893/24 "2013-01-13T06:42:09Z")
I had v7 installed, but not any more. ---
**Author:** ![Dallas\_Jones](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dallas_jones/32/3277_2.png) [@Dallas\_Jones](https://boards.straightdope.com/u/Dallas_Jones)\ **Post date:** [January 13, 2013, 8:01am UTC](https://boards.straightdope.com/t/homeland-security-warns-to-disable-java-amid-zero-day-flaw/646893/25 "2013-01-13T08:01:50Z")
> [@njtt](#): > > For most people, the best thing to do is simply to uninstall Java from your computer altogether (if it is there in the first place). Most people simply are making no use of it anyway. Although Java aplets used to be fairly common on web pages, that is no longer the case. > > Windows users can do this simply by going to Programs under Control Panel and uninstalling Java. To check Internet Explorer, all versions including IE 10: Go to Tools on the taskbar. Manage Add Ons. On the left it will probably say under Show, ‘show current add ons’, change that to ‘show all add ons.’ Go through the list of add ons and disable anything from Oracle. ---
**Author:** ![foolsguinea](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/foolsguinea/32/14751_2.png) [@foolsguinea](https://boards.straightdope.com/u/foolsguinea)\ **Post date:** [January 13, 2013, 9:25am UTC](https://boards.straightdope.com/t/homeland-security-warns-to-disable-java-amid-zero-day-flaw/646893/26 "2013-01-13T09:25:04Z")
What about JavaFX? Is that exploitable as well? ---
**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\ **Post date:** [January 14, 2013, 2:24pm UTC](https://boards.straightdope.com/t/homeland-security-warns-to-disable-java-amid-zero-day-flaw/646893/27 "2013-01-14T14:24:21Z")
Oracle has released a [fix](http://java.com/en/download/java_update.jsp). But note that they knew about this problem for some time and the patch in October didn’t completely fix it. So who knows if they’ve really fixed it this time. ---
**Author:** ![Clothilde](https://avatars.discourse-cdn.com/v4/letter/c/439d5e/32.png) [@Clothilde](https://boards.straightdope.com/u/Clothilde)\ **Post date:** [January 14, 2013, 8:08pm UTC](https://boards.straightdope.com/t/homeland-security-warns-to-disable-java-amid-zero-day-flaw/646893/28 "2013-01-14T20:08:38Z")
I am such a computer weenie. I use Firefox and Windows. Just so’s I understand this correctly, are y’all saying that in order to protect my computer, I need to disable anything with the word Java in it that’s shown as a plug-in in Firefox but can allow “enable JavaScript” under the Options tab? Is this correct or have I totally misunderstood this… And if I’ve got it wrong, can someone please tell me what I need to do? Thanks so much! ---
**Author:** ![foolsguinea](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/foolsguinea/32/14751_2.png) [@foolsguinea](https://boards.straightdope.com/u/foolsguinea)\ **Post date:** [January 15, 2013, 1:21am UTC](https://boards.straightdope.com/t/homeland-security-warns-to-disable-java-amid-zero-day-flaw/646893/29 "2013-01-15T01:21:07Z")
At this point, if you have Java 7, update to Java 7.11. JavaScript is completely different, not a problem. ---
**Author:** ![njtt](https://avatars.discourse-cdn.com/v4/letter/n/ecd19e/32.png) [@njtt](https://boards.straightdope.com/u/njtt)\ **Post date:** [January 15, 2013, 2:05am UTC](https://boards.straightdope.com/t/homeland-security-warns-to-disable-java-amid-zero-day-flaw/646893/30 "2013-01-15T02:05:43Z")
> [@Dallas\_Jones](#): > > To check Internet Explorer, all versions including IE 10: > > Go to Tools on the taskbar. > Manage Add Ons. > On the left it will probably say under Show, ‘show current add ons’, change that to ‘show all add ons.’ > > Go through the list of add ons and disable anything from Oracle. There is no need for this, or any other fucking about with browser settings, if you do what I said: simply uninstall Java via the control panel Programs icon. Unless you _know_ you need Java for some specific purpose, you almost certainly do not need it at all. Its ubiquity on most computers is a hangover from former times. ---
**Author:** ![control-z](https://avatars.discourse-cdn.com/v4/letter/c/eada6e/32.png) [@control-z](https://boards.straightdope.com/u/control-z)\ **Post date:** [January 15, 2013, 6:44pm UTC](https://boards.straightdope.com/t/homeland-security-warns-to-disable-java-amid-zero-day-flaw/646893/31 "2013-01-15T18:44:14Z")
Agreed, most people can just uninstall Java. The only things I know that might use Java are browser-based games and certain applets like Internet speed tests. I run the Chrome browser, inside a Sandboxie sandbox. Apparently I already had Java disabled for a year or more but only noticed it recently when I tried to run a speed test. ---
**Author:** ![Clothilde](https://avatars.discourse-cdn.com/v4/letter/c/439d5e/32.png) [@Clothilde](https://boards.straightdope.com/u/Clothilde)\ **Post date:** [January 15, 2013, 8:14pm UTC](https://boards.straightdope.com/t/homeland-security-warns-to-disable-java-amid-zero-day-flaw/646893/32 "2013-01-15T20:14:54Z")
> [@foolsguinea](#): > > At this point, if you have Java 7, update to Java 7.11. > > JavaScript is completely different, not a problem. Thank you! [Previous page](https://boards.straightdope.com/t/homeland-security-warns-to-disable-java-amid-zero-day-flaw/646893.md?page=1)