Do you need Java in your web browser? Seriously, do you? If not, get rid of it.

Turns out, most users don’t need Java any more, yet people keep running it.

The risks of Java are nicely illustrated by the recent Java Rhino vulnerability (aka CVE-2011-3544). If you’re running Java, but not the latest version, you’re vulnerable. So either you have to check at all times that you have the latest version of Java — or get rid of it altogether.

And the Java Rhino vulnerability is not theoretical: the most common exploit kits have incorporated this vulnerability in their default exploits, and it seems to be working very well for the online criminals.

So, ditch Java if you can. It might not be as painful as you think

Also note that Chrome has been doing a good job in sandboxing or otherwise securing risky add-ons and extensions. Many Java exploits do not work against Chrome. Also, Chrome does not use an Adobe Reader plugin to render PDF files.

“Apparently, Oracle’s ‘Operating System Distributor License for Java’ is expired, causing Ubuntu to not only remove sun-java from the partner repository, but from user’s machines.”

http://www.omgubuntu.co.uk/2011/12/java-to-be-removed-from-ubuntu-uninstalled-from-user-machines/

From the article: “Oracle, in retiring the ‘Operating System Distributor License for Java’, means Canonical no longer have permission to distribute the package.” So it’s not that Oracle has lost their right to distribute Java (JDK) or something, but they are retiring the license Canonical is using that granted them the right to distribute it with Ubuntu. The summary also states (correctly) that Ubuntu will remove the sun-java package from the repository and user’s machines, but does not state why: “Due to the severity of the security risk, Canonical is immediately releasing a security update for the Sun JDK browser plugin which will disable the plugin on all machines.” Ubuntu’s Marc Deslauriers wrote in a mail to the Ubuntu Security Mailing list.

Comment:

It’s being replace by OpenJDK. It was planned to happen like this for years. This was planned obsolescence with a gradual move to OpenJDK. Their is no surprise here except for those who didn’t know it was coming. The summary is inflammatory but if you read the article you see that this is nothing really.

OpenJDK is still the default, and still distributed. And like TFA pointed out, the Sun/Oracle version is old and has security issues anyway.