So what's the deal with the warnings about JAVA ???

[Virus Guy]

So where can I get my hands on the POC code and test to see if my
hypothesis (that Win-98 running JAVA 6 is not vulnerable to this current
world-wide threat) is correct?

[s|b]

Maybe you shouldn't worry about Java. Support for W98 was dropped in
2006.

--
s|b

[Virus Guy]

s|b wrote:

> Maybe you shouldn't worry about Java. Support for W98 was dropped in
> 2006.

By the time that "support" (if you want to call it that) for win-98 was
dropped in the summer of 2006, Secunia.org listed a whopping 33
advisories and 22 vulnerabilities for win-98.

At the same time, there were over 200 vulnerabilities for Windows XP -
with some "critical" vulnerabilities not patched. Today, there are over
400 advisories and 560 vulnerabilities for Windows XP.

So I can understand this concept that many windoze users have regarding
it's perpetual state of support in terms of vulnerability and security,
and your failure to understand how and why this dire issue of support
never bled over into win-9x/me - because they were better by design.

Because Microsoft's motto is ->

"If it works, it's not complicated enough".

That motto is what drives Micro$haft to instill ever higher levels of
bloat and complexity with each new version of Windoze.

With bloat and complexity comes vulnerability.

Windoze NT (and it's offspring) -> code made from the finest, most
expensive threads, intended to tantilize the masses like the emperor's
new clothes.

[FromTheRafters]

Virus Guy presented the following explanation :

> So where can I get my hands on the POC code and test to see if my
> hypothesis (that Win-98 running JAVA 6 is not vulnerable to this current
> world-wide threat) is correct?

I don't know, I just heard about this on the news. I had to laugh when
they said it only affects PCs and everyone should disable Java.

When you find a POC, you'll have to look for a different output event
from the payload provided. You'll need to see that the "exploit" worked
even though the "payload" didn't.

[Bast]

XP still works fine for all my needs.
And the nice part is none of the hackers seem to bother writing viruses for
it anymore

[Tecknomage]

On Sat, 12 Jan 2013 09:09:10 -0500, Virus Guy <Vi...@Guy.com> wrote:

> s|b wrote:
>

snip...

>
> Because Microsoft's motto is ->
>
> "If it works, it's not complicated enough".
>
> That motto is what drives Micro$haft to instill ever higher levels of
> bloat and complexity with each new version of Windoze.
>
> With bloat and complexity comes vulnerability.
>
> Windoze NT (and it's offspring) -> code made from the finest, most
> expensive threads, intended to tantilize the masses like the emperor's
> new clothes.

Oh so true. Especially the 'bloat and complexity' comment.

I use WinXP SP3 on my desktop system, but I also have a Ubuntu (Linux)
laptop. Linux IS the better operator system; lean, fast, and mean.

Just as one example: If I turn on my WinXP desktop first, then my
Ubuntu laptop, my laptop is ready to use while my desktop is still
loading (Win Desktop NOT fully ready to use), and the hardware for my
systems are comparable. "Lean' = Linux uses much less resources than
Windoze.

Windoze is 'on top' ONLY because of the early marketing scheme that
made users (non-techies) habituated to Windoze.



--
=========== Tecknomage ===========
Computer Systems Specialist
IT Technician
(retired)
San Diego, CA

[Tecknomage]

On Sat, 12 Jan 2013 13:50:17 -0500, FromTheRafters
<err...@nomail.afraid.org> wrote:

> Virus Guy presented the following explanation :
> > So where can I get my hands on the POC code and test to see if my
> > hypothesis (that Win-98 running JAVA 6 is not vulnerable to this current
> > world-wide threat) is correct?
>
> I don't know, I just heard about this on the news. I had to laugh when
> they said it only affects PCs and everyone should disable Java.
>

WRONG

Today we cannot do without JAVA in some form. It is use by almost all
WEB sites, therefore your browser needs it. It is use by many
applications, like Libre Office suite which I use on my WinXP SP3
desktop and Ubuntu (Linux) laptop.

Then there's devices (SmartPhones, etc.) that run JAVA.


But JAVA is like ANY other app or OS, it will have holes that must be
plugged.

[Virus Guy]

Tecknomage wrote:

> > I had to laugh when they said it only affects PCs and everyone
> > should disable Java.
>

> Today we cannot do without JAVA in some form. It is use by almost
> all WEB sites, therefore your browser needs it. It is use by many
> applications, like Libre Office suite which I use on my WinXP SP3
> desktop and Ubuntu (Linux) laptop.

I run Interactive Broker's "Trader Workstation" platform and it uses
JAVA.

A lot of websites that give real-time graphs of the financial markets
also use JAVA.

Many IP web-cams use Java to stream video to mozilla-based browsers (or
they use activex to stream to Internet Exploiter).

[Sam Hill]

In alt.privacy.spyware, Tecknomage wrote:

> Today we cannot do without JAVA in some form. It is use by almost all
> WEB sites, therefore your browser needs it.

<cough!>

--
sam

[s|b]

On Mon, 14 Jan 2013 08:46:40 -0800, Tecknomage wrote:

> Today we cannot do without JAVA in some form. It is use by almost all
> WEB sites, therefore your browser needs it.

In that case I'm missing a lot since I don't have Java installed.

> It is use by many
> applications, like Libre Office suite

I have LO and I have Java disabled in its settings. I know I'm missing
certain features because of this, but I still need to discover which
ones because I don't feel like I'm missing something...

--
s|b

[FromTheRafters]

Virus Guy brought next idea :

Many of my workplace's computers use Java applications and applets.
They're all PCs, but that's not the point. Java is a very widespread
cross-platform virtual-machine based system. I just updated my Java,
perhaps the zero-day is no more.

[FromTheRafters]

Virus Guy formulated the question :

> So where can I get my hands on the POC code and test to see if my
> hypothesis (that Win-98 running JAVA 6 is not vulnerable to this current
> world-wide threat) is correct?

You probably already have this by now, but anyway...

https://community.rapid7.com/community/metasploit/blog/2013/01/11/omg-java-everybody-panic

[Juan Wei]

Tecknomage has written on 1/14/2013 11:46 AM:

> Today we cannot do without JAVA in some form. It is use by almost all
> WEB sites, therefore your browser needs it. It is use by many
> applications, like Libre Office suite

Where does LO use Java?

[FromTheRafters]

After serious thinking Juan Wei wrote :

I think he's confused.

[David W. Hodgins]

In oowriter, take a look a look at Tools/Options/Java, or
https://help.libreoffice.org/Common/Java

My understanding is that it's used by libreoffice-base.

Regards, Dave Hodgins

--
Change nomail.afraid.org to ody.ca to reply by email.
(nomail.afraid.org has been set up specifically for
use in usenet. Feel free to use it yourself.)

[FromTheRafters]

David W. Hodgins has brought this to us :

> On Thu, 04 Apr 2013 21:24:07 -0400, FromTheRafters
> <err...@nomail.afraid.org> wrote:
>
>> After serious thinking Juan Wei wrote :
>>> Tecknomage has written on 1/14/2013 11:46 AM:
>>>> Today we cannot do without JAVA in some form. It is use by almost all
>>>> WEB sites, therefore your browser needs it. It is use by many
>>>> applications, like Libre Office suite
>>>
>>> Where does LO use Java?
>>
>> I think he's confused.
>
> In oowriter, take a look a look at Tools/Options/Java, or
> https://help.libreoffice.org/Common/Java
>
> My understanding is that it's used by libreoffice-base.
>
> Regards, Dave Hodgins

I was referring to his contention that Java "... is use by almost all
WEB sites, therefore your browser needs it" - indeed I see it is used
quite a lot, but one can easily browse without it.

[David W. Hodgins]

On Fri, 05 Apr 2013 00:10:35 -0400, FromTheRafters <err...@nomail.afraid.org> wrote:

> I was referring to his contention that Java "... is use by almost all
> WEB sites, therefore your browser needs it" - indeed I see it is used
> quite a lot, but one can easily browse without it.

I'll agree with you on that. I only enable java on
a very select few web sites, as with other plugins.

Most websites that require java, javascript, or other
plugins, can be avoided by looking for other sites that
don't require them.