JAVA security threat - What about EPC with no JAVA?

[Tomnistuff]

Now that the US Government Dept of Homeland Security has advised everyone to disable JAVA, does anyone know what MB will do to support the Electronic Parts Catalog (EPC)?

Quote from Associated Press:
"The U.S. Department of Homeland Security is advising people to temporarily disable the Java software on their computers to avoid potential hacking attacks.
The recommendation came in an advisory issued late Thursday, following up on concerns raised by computer security experts."

There are several stories that are being issued by the press.  I'm only smart enough or paranoid enough to delete JAVA but not quite smart enough to really know why.

Tom Kizer

[Tomnistuff]

I sent off an email to the people running the EPC - I just logged into EPC and clicked `Contact Us`.  They`ve promised to get back to me within two days.
Tom Kizer

[Peter van Es]

If you need Java, they recommend enabling it only for those sites that you trust. For Macintosh owners, an excellent work-around is published here: http://www.tuaw.com/2013/01/11/a-reasonable-response-to-java-security-problems/

Peter (your resident IT expert)

[Tomnistuff]

...they recommend enabling it only for those sites that you trust...

Peter, referring to my first post, enabling it only for sites I trust is one of those things that I`m not quite smart enough to know how to do.  Is it difficult?  I`m using Mozilla Firefox because it allows me to control cookies easier and has private browsing which, I think keeps me from being watched by advertisers and other thieves.  Of course, I`m probably wrong about that too.  Anyway, I`m not married to Mozilla Firefox, if there is a better browser I can download.

Tom Kizer

[jacovdw]

Tom,

Apparently Oracle has released an update for the Java run-time environment (java 7 update 11) on the 13th to address SOME of the issues.
With the older versions of the JRE (java run-time environment) you would find a plug-in in the Firefox browser, which is now absent with update 11.

I'm using Firefox as well (version 18.0) and with the updated JRE have successfully used the EPC last night as a test.
Whether the security is as better as they claim it to be remains to be seen.

On the other hand, would our computers/browsers/operating systems ever be 100% safe?

[Tomnistuff]

I am still waiting for MB (EPC people) to reply to my inquiry about JAVA, but here`s what I`ve done so far.
1.  Deleted JAVA 6.0
2.  Downloaded and installed JAVA 7,0 version 11
3.  Upgraded to Mozilla Firefox 18
4.  Disabled JAVA in the JAVA Control Panel except when I want to use the EPC (Search JAVA in the Windows Control Panel then click on the JAVA Icon that pops up  to open the JAVA Control Panel, then click on the Security tab to find the little box at the top of the window to enable and disable JAVA).
5.  Wrote myself a sticky note to remind me to enable JAVA in the Control Panel when I want to use EPC then disable it when I`m done.

I also verified that EPC does not work when JAVA is disabled and does work when JAVA is enabled in this fashion.

I don`t know if this is any better than just crossing my fingers, but at least I feel more secure.  I hope to get a MB answer soon.

Peter and Jacovdw, thanks for the advice.

Tom Kizer

[jacovdw]

Tom,

What you have done pretty much sums up the whole process.
Don't think that there is much else to do about the whole thing.

I guess we have to wait and see when Oracle provides the necessary patches/updates to fix ALL the alleged loopholes.

Would be interesting to hear what MB has to say about the whole thing, assuming they are aware of the security problems...

On a side note, here is some information from Oracle for those that are interested:

http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html