back to article Bite my shiny metal Ask: Java for OS X crapware storm brewing

Mac fans now have one more thing in common with their Windows-using bosses: their Oracle Java updates now try to smuggle in Ask's browser toolbar. The upgrade, version 8u40 of Java for OS X, tragically tries to install the plugin, which hijacks the user's default web search engine and homepage to Ask.com. Windows users of the …

  1. Mad Chaz

    I don't understand why people keep installing it. For 99% of users, it's not useful at all anymore. The few who still have to use it are almost all, thankfully, stuck with old antique versions from when JAVA was owned by sun.

    1. Kevin McMurtrie Silver badge

      Applet plugin != Application runtime

      The Java runtime is quite useful and common. Some types of applications are faster to develop in Java or easier to support across diverse platforms.

      99.99999% of users should not install the Java browser plugin. The applet environment is so awful that software engineers gladly waited 15 years for JavaScript to catch up, and even tolerated Flash in the meantime. That bad.

    2. Richy Freeway

      Why do people install it?

      Minecraft.

      1. jason 7 Silver badge

        Don't need it for Minecraft anymore. It now uses a more secure built in version.

        MS bought Minecraft so they could eliminate one of the two biggest attack vectors in Windows? Hmmm.

      2. oceanhippie

        .net

        Microsoft will soon (5years plus wait for next update) rewrite it to use lync and .net instead...

    3. Anonymous Coward
      Anonymous Coward

      I believe Java is still necessary for the hapless Libre/OpenOffice suites

      They're manned by two of the most unresponsive dev teams of all time, so I'd expect to see Java remaining a requirement for at least another few decades.

      1. Doctor Syntax Silver badge

        Re: I believe Java is still necessary for the hapless Libre/OpenOffice suites

        "two of the most unresponsive dev teams of all time"

        Citation needed. Or do you just mean they haven't changed the interface to a ribbon?

      2. Wensleydale Cheese
        Happy

        Re: I believe Java is still necessary for the hapless Libre/OpenOffice suites

        Nope. I'm happily running LibreOffice without Java.

        Yes, a few years ago the installer would bitch if you didn't have Java installed, but you could still go ahead and install it without.

        I've just checked v4.4 and the database element wants Java. I can do without that bit thanksverymuch.

        1. phil dude
          Happy

          Re: I believe Java is still necessary for the hapless Libre/OpenOffice suites

          and it is top of the Libreoffice roadmap - "Die, Die Die Java!!!!"

          P.

      3. Anonymous Coward
        Anonymous Coward

        Re: I believe Java is still necessary for the hapless Libre/OpenOffice suites

        "They're manned by two of the most unresponsive dev teams of all time, so I'd expect to see Java remaining a requirement for at least another few decades."

        Sounds like an admission that LibreOffice has a decent future ahead of it!

    4. Michael Wojcik Silver badge

      I think it's fair to say that anyone who writes "Java" in block capitals doesn't have an informed opinion on the subject.

  2. mafoo

    Flash

    Im pretty sure the last time I installed flash on someone's mac it tried to get me to download McAffe.

    So many people blindly click next it's scary.

  3. DNTP

    I need Java on my Mac and I just did the 8u40 upgrade, but didn't get an option to infect my computer with malware I mean install the Ask toolbar. And I'm sure I didn't blind click through it. Maybe it does not show up for users who upgrade Java through System Preferences rather than downloading the update package through their browsers?

    Anyway I find Ask is an important IT tool when I encounter it, it tells me "How much time am I going to have to waste on this computer seeing how deep the can of worms goes" and also "If I hear this user is looking for me in the future how much effort will I spend dodging them".

  4. Stevie Silver badge

    Bah!

    THAT'S where that fucking thing came from????!!!!

    I assumed I had just forgotten to uncheck a box on an Adobe Acrobat Reader update splash screen.

    1. beast666

      Re: Bah!

      Why do you have that installed pray tell? Just associate .pdf with Chrome...

      1. Gordon 10 Silver badge
        Terminator

        Re: Bah!

        Maybe he prefers pdf bloatware to getting borged?

      2. Doctor Syntax Silver badge

        Re: Bah!

        "Just associate .pdf with Chrome..."

        I prefer Okular. But there are a few times when AR does a better job, such as copying text from an OCRd multicolumn layout.

      3. Stevie Silver badge

        Re: Bah!

        "Just associate .pdf with Chrome"

        My first and last experience of chrome was when trying to get a BeagleBoneBlack to talk to me through its USB webby interface. Though listed as politically acceptable in the dox my browser of choice would not render the workbench correctly.

        Chrome installed, and the very first thing it did was attempt to scrape all my e-mail contacts. When thwarted is started a nag campaign. This, coupled with Google deciding my real name, by which I was known to three people, was a better choice for my blogger account profile than my web name, used for over a decade for same and known by up to three dozen people from all over the world, made me decide on the spot that were Chrome the last browser on the face of the internet I'd renounce the game of Mornington Crescent rather than use it.

        Mention it not again. It is, in my mind, the stuff of opium dreams; not real, spoken of by maniacs chemically unhinged from real life, the sign of a life mis-spent in darkened rooms wreathed in thick smoke. 8o)

  5. beast666

    Only the JRE not the JDK

    I need this abomination on my hackintosh to run Eclipse, which is itself the spawn of Satan.

    Anyways-up, the latest Java 8 JRE does try to sneak the wonderful Ask toolbar on you. If you install the JDK, which also installs the JRE, it doesn't.

    Take-home point: I hate you Java and all who sail in you.

    1. Destroy All Monsters Silver badge

      Re: Only the JRE not the JDK

      Take-home point: I hate you Java and all who sail in you.

      You seem to not develop in Java, so do you mean "I hate the JVM" or "I hate the Oracle JVM" or "I hate the JRE package that Oracle provides" or "I hate Oracle"?

      Enquiring minds etc.

      I feel the urge for .Net runtimes. Now that Clojure has been ported...

  6. RachelG

    am a Java Dev, albeit mainly server-side. But this pisses me off so much. I mean, client-side Java has *enough* problems with end-user acceptance already, much of it ill-informed (say as valid as refusing to use Windows now because of my experience with Windows ME) but nevertheless there, without *this* too. It's really, really unhelpful. I can't believe (especially after the Lenovo debacle) that they really get enough from it to be worth the reputational damage. No-one, but no-one wants the bloody ask toolbar!

    I think if I was to be trying to develop something for the desktop now I'd be looking at the Packager stuff, to just create it as a standalone app, that bundles a minimal JRE for its own use, work hard at seamless OS integration, and really just quietly not bother the user with even the knowledge that it's Java. But if you're going to do that you're probably better off going native anyway.

    BTW if you install the JDK rather than the JRE from Java.com, no ask toolbar. And there's a setting in the Java control panel to turn off future prompts to install ask, but it's really not good enough. They reserve the worst experience for the poor bloody end user.

  7. Tom Betz

    At least on a Windows PC...

    ... there's a registry entry that blocks this behavior.

    http://www.howtogeek.com/198240/avoid-javas-ask-toolbar-installations-with-this-one-weird-registry-hack/

    Maybe Apple can come up with something similar.

    1. Anonymous Coward
      Anonymous Coward

      Re: At least on a Windows PC...

      No need to edit the registry - there's a checkbox in the Java control panel, Advanced page/miscellaneous: "Suppress sponsor offers when installing or updating Java"

      1. arctic_haze Silver badge

        Re: At least on a Windows PC...

        I just checked the "Suppress sponsor offers when installing or updating Java" checkbox, then "Apply" and started to upgrade Java. The malware was offered to me anyway.

        1. Sandtitz Silver badge
          WTF?

          Re: At least on a Windows PC... @arctic_haze

          I did the same and upgraded from Java 8.31 to 8.40. No crapware was offered nor installed.

          Perhaps you're just having technical difficulties.

      2. SImon Hobson Silver badge

        Re: At least on a Windows PC...

        > there's a checkbox in the Java control panel, Advanced page/miscellaneous: "Suppress sponsor offers when installing or updating Java"

        There wasn't in mine - it only appeared after upgrading from .39 to .40

        And it appears unchecked.

        But at least the updater didn't prompt me for anything. I'm currently running a scan for it just to be safe.

        I'm guessing that perhaps they slipped the checkbox in sometime without actually changing the revision level. So those with the checkbox already get prompted for the malware, while those still without it just get the option installed silently (ready for next time).

        I'm sure there's scope for an enterprising person with the wherewithall to go to the Police and report a crime under the misuse of computers act. I think it would be a hard case to make that the user has "given permission" by the action of not noticing this new option appearing down at the end of a long list of settings that the average user couldn't be expected to understand (let alone be fiddling with). Thus installing such malware would be interfering with the computer without the user's consent.

    2. Anonymous Coward
      Anonymous Coward

      Re: At least on a Windows PC...

      You sir are a gent, I shall have that registry setting pushed to every computer my company's monitoring system can reach before, err, well I'm in the pub, so tomorrow!

  8. Anonymous Coward
    Anonymous Coward

    Complain and spam them back

    Here all start complaining!!!

    http://bugreport.java.com/bugreport/main.jsp At the bottom under “Report an Issue” from the drop down select “Comments and/or Suggestions” and write away!

    If thats not enough for you send the CEO’s an email as well!! mark.hurd@oracle.com and safra.catz@oracle.com they seem to hold a joint CEO positions.

    1. smartypants

      Re: Complain and spam them back

      It's not like they aren't aware of the hatred. When you go to that bug report link, you see the following message: "Here is a list of commonly reported issues. Please select the issue that you are facing from the list below:" Then there are 10 or so options. Top of them is:

      "How do I install Java without third party sponsor offers?"

      So they know it pisses people off. But they still do it. It's as though they're actively trying to drive people away from the platform.

  9. JLV Silver badge

    well, my Brother laserprinter's wifi setup is through... drumroll, a Java applet (good printer otherwise).

    once installed, it seems as if Java 7 on OSX has no system-wide uninstaller (though there is a Java applet-disabling setting).

    next time, I'll VM a Java for the duration instead but I didn't know you couldn't uninstall Java.

    and, for the record, before that printer, I had pretty much happily avoided any Java, applet, JRE or JDK on my Mac. the lack of an uninstall mechanism is hardly going to make me revise my opinion that Java is best avoided entirely if one can get away with it.

    as far as ask.com goes, I really wonder what a gazillion $ company like Oracle is doing with this on a Java install. not, quite, as dumb as Lenovo, but how much $ are they getting for how much bad press? they should not renew whatever arrangement they have and come clean on when their ask.com shenanigans will go away.

  10. Mad Hacker

    Java still needed here...

    When I was younger I sure bought into the write once run everywhere mantra. Since the realities of Java's security issues have become obvious I've whittled down my Java dependencies down to one app. For the rare occasion (once a year?) I purchase something on eBay I use JBidwatcher. Runs brilliantly in Java on my Mac.

    1. Tufty Squirrel

      Re: Java still needed here...

      *ahem* http://eniper.sourceforge.net *ahem*

  11. Scroticus Canis
    Meh

    Haven't had Java or Adobe Reader for 2+ years and no problems.

    Killed Java and un-installed Adobe Reader over two years ago and haven't noticed anything missing at all. Everything works fine and no problems with PDFs as preview reads them just fine. Still need the accursed Flash Player though and scrub the tracking crap once a week or so.

    1. Christian Berger Silver badge

      Re: Haven't had Java or Adobe Reader for 2+ years and no problems.

      To be honest, so far Acrobat Reader seems to be one of the worst PDF readers out there as it has all the features you don't want to have.

      Java... well... It just seems like most software coded in Java is rather messy and complex stuff. Kinda like all those uncounted Windows applications which do 20 things really badly. There are a few exceptions, mostly academical software which could have been implemented in portable C more easily, but the professor somehow believed that Java had a future.

  12. sorry, what?

    Most Java != applet (a short trip off-topic)

    i see no reason to install the JRE on a machine unless it's a server. In that case it is part of a good programming and runtime environment. Some of the open source stuff you can use is really impressive and the must-have IDE (no, not Eclipse, of course) is fantastic.

    I miss Java and IntelliJ IDEA, now I work on C# and VisualStudio. Well, actually C# ain't bad (if you ignore the general lack of great open source libraries) but VS is Virtually Senile.

    1. Anonymous Coward
      Anonymous Coward

      Re: Most Java != applet (a short trip off-topic)

      There used to be an IDEA that was for C++ that didn't require Java, however I have no idea if that still exists. But you're right, IntelliJ was good, really good. Even though it's been over a decade since I used IntelliJ, when I go tinkering with new IDEs I still compare the IDE features and Ui's to my memory of IntelliJ.

      Today though I've abandoned IDEs all together and just run scripts with a decent text editor. It was the general "What goes where" memory lessons that turned me off from all the different IDEs. Of course I'm a micro-manager when it comes to development environments, so I have a bias for controlling all little things the way I want and to have them fail as I want. But in the end, it really was "Where the fuck is that again? Wait, do I need it?". I can't remember V.S. all that well, but I remember the debugger was O.K. I also remember it had little terminologies that weren't exactly truthful to their functionality, which made the help manual almost as important as having a monitor to see.

      NOTE: I just went to http://www.jetbrains.com/products.html and none of the names pop out at me, so maybe I'm crazy or they changed the name...but I swear I thought they had a C++ Intelli IDE.

  13. chivo243 Silver badge
    Facepalm

    If you must

    Install the product, but go slowly, make sure you untick the damn box. Is it a race to see who can click next faster?

  14. Anonymous Coward
    WTF?

    Java - as verbose as cobol, as popular as cobol, as cool as cobol

    Mind you, the JVM's still a pretty great piece of tech and Microsoft are still trying to catch up; I'm just very, very pleased I don't have to write Java to use it.

  15. Anonymous Coward
    Anonymous Coward

    Oh, so people still use client side Java apps?

    Paint me surprised. It's been years since I last needed to download Java runtime (and I work for an outfit that does a lot of Java coding).

  16. RobHib
    Mushroom

    Bloody hell, when will this nonsense ever stop?

    "...Oracle Java updates now try to smuggle in Ask's browser toolbar."

    For fuck's sake, when are these disreputable practices going to stop? How the hell can we expect the multitudes of nefarious exploits to cease when supposedly reputable companies resort to such treachery by only being one step removed? The excuse being by example.

    This disreputable nonsense is truly getting out of hand, it's time we users revolted, big-time.

    1. regadpellagru

      Re: Bloody hell, when will this nonsense ever stop?

      "For fuck's sake, when are these disreputable practices going to stop? How the hell can we expect the multitudes of nefarious exploits to cease when supposedly reputable companies resort to such treachery by only being one step removed? The excuse being by example.

      This disreputable nonsense is truly getting out of hand, it's time we users revolted, big-time."

      There's only one way, mate: uninstall the whole shite, and tell every single person you meet in the street how it's an awfull pile of dangerous shit. People are becoming *very* suspicious each time they're bitten by crapware, so they are eventually listening.

      1. Not Terry Wogan

        Re: Bloody hell, when will this nonsense ever stop?

        "There's only one way, mate: uninstall the whole shite, and tell every single person you meet in the street how it's an awfull pile of dangerous shit."

        ... and when you've done that, ring everyone in the phone book!

        1. Anonymous Coward
          Anonymous Coward

          Re: Bloody hell, when will this nonsense ever stop?

          telling then your from MS, and can you log onto there pc using RDP to check there settings ...lol

    2. Destroy All Monsters Silver badge

      Re: Bloody hell, when will this nonsense ever stop?

      This disreputable nonsense is truly getting out of hand, it's time we users revolted, big-time.

      I blame 14 years of homeland security which has made anal probing by random smug people memetically respectable.

  17. 45RPM

    In common with their bosses? In my experience, the bosses (the ones who sign off on the budget) all have Macs - and they force their minions to use cheap ass Windows Dell machines. Not saying whether that's right or wrong (actually, I am saying - I reckon that users should be able to choose the platform that they're comfortable with, provided that they can demonstrate the technical know how required to support themselves). The point is that the bosses are running the shiny shiny. The minions have Windows. FTFY.

  18. Slx

    It'd be amusing if OS X simply trashed it as malware.

  19. RAMChYLD

    So...

    Will we see GCJ come back to active development after this? I'd sure like to.

  20. TheDoc

    Must be some genuine reason

    The bundling of the Ask toolbar is very un-Oracle, which shies away from partnership deals with 3th parties in general - especially when it's not worth less than many millions of dollars. So why on earth are they still doing this? I have a few theories; 1) It's some inherited contract that they haven't managed to get out of, 2) Larry Elison has some stake in the company which owns Ask, so doesn't see the need to rock the boat, or 3) It's never made it far enough up the to-do list.

    Any other ideas?

    1. Dan 55 Silver badge

      Re: Must be some genuine reason

      It came in after the Oracle buyout, I suppose every product line needs to show a profit to pay for Larry's yachts. Ask pay handsomely ($5 per installation if I remember right).

      The screenshot also shows a trap, it's got a tickbox for 'Set ask.com as my homepage' but it's not got a tickbox for not installing the toolbar. I guess if you were to untick and click continue you get the toolbar anyway, you'd need to hit cancel.

      I tried to install Java 7 ages ago and they did something which borked my Eclipse installation so I installed it by hand, went back to Apple's Java 6, and disabled it in the browser. Not missed it.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2019