Hacker News new | past | comments | ask | show | jobs | submit login
A close look at how Oracle installs deceptive software with Java updates (zdnet.com)
363 points by Hagelin on Jan 22, 2013 | hide | past | favorite | 194 comments



Just to tell my experiences on this, I was forced to install the crapware last week. There was no way for me to uncheck or opt out of the checkbox.

I have a machines which I connect to that do not have any mouse connected. I have no problem in navigating systems with a keyboard and can run through installers probably quicker than most people with a mouse can, but when this dialog popped up for me, I was stumped for about 10 minutes. I employed every shortcut in my keyboard-shortcut arsenal and fell short.

I genuinely felt like this was not just some programming mistake (because the "Next" control was already highlighted waiting for me to hit Enter). It is a dark pattern that was purposefully introduced to their installer to make it impossible for users like me to opt-out of their installer.

A consequence of their deception was that they did get a dozen installs from me, but my dislike for Oracle increased tenfold, and in a quiet-protest, I'll make damned sure that I suggest any alternative to an Oracle product when I have reasonable alternatives (Without cutting off my nose to spite my face).


I employed every shortcut in my keyboard-shortcut arsenal and fell short.

One good one to remember is ALT+Left Shift+NumLock

Then you can use your keypad as a mouse. / and - toggle which mouse button 5 is.


Thanks for the shortcut!

For those of you struggling to enable it under WinXP, you may need to choose "Settings" first in the popup dialog and tick (with the spacebar) "Use MouseKeys".

If you happened to have multiple keyboards installed (e.g. running English Windows + your local kbd settings), LEFT ALT + SHIFT additionally switches between kbd layouts as a bonus, so be sure to disable this shortcut in Control Panel > Regional and Language Options > Languages tab > click Details > click Key Settings.


How incredibly obscure! Thanks a ton for this.


Also, pressing shift 5 times is an easy way to enable sticky keys in Windows.


I have accidentally enabled this a million times and I've no idea what it does other than messing up my keyboard.


It's an accessibility feature. If you don't have the dexterity to hold keys down yourself, you can enable sticky keys and (if I remember correctly) it will make certain keys act as toggles so you don't have to do finger-yoga to hit certain key combinations.


For anyone interested in the keyboard layout for mouse keys: http://en.wikipedia.org/wiki/Mouse_keys#Layout


many thanks


Monetizing software is a hard problem. Oracle is just trying to do good in a scummy space. Most users choose to install Java, so obviously they want it.

The above post was satire in reference to Y Combinator staff's reaction to this thread: http://news.ycombinator.com/item?id=5092711


> Oracle is just trying to do good

You mean they're trying to do well.


I just formatted & had to reinstall Java today, out of curiousity I used the offline installer instead... No toolbar bundled with it, didn't even give me the option to install it.

http://www.java.com/en/download/manual.jsp


Don't put all the blame on Oracle. Follow the money:

   Oracle distributes Ask Toolbar
   Ask Toolbar drives searches to Ask.com
   Ask.com displays ads from its parent, IAC
   IAC is the largest third-party distributor of Google ads


It absolutely wasn't a mistake. Most legitimate software makes the descriptive text for a checkbox (the label) a trigger for the checkbox. The Ask Toolbar installer option, however, disables this, forcing you to specifically target the checkbox itself.

It is incredibly scummy, and worse it actually encourages Oracle to create insecure software -- at least in the short term -- because each fix is another spin of the wheel.


That's weird, I thought Oracle have been making insecure software for decades and this was just business as usual for them.


clearly, you haven't been paying attention.


How secure are these toolbars? It seems like end users are getting reamed twice. Once by just using java and again by increasing their vulnerability profile with toolbars.


Disabled to make automation (corporate installations) difficult, perhaps?

I find it mind-boggling that people actually put up with (or defend) user-unfriendly behavior like this.


Oracle explicitly supports automated corporate deployment, albeit in a roundabout way.

http://docs.oracle.com/javase/6/docs/technotes/guides/deploy...


The only reason why anyone would defend these practices is that presumably, if the company did not monetize their software in this way, the software couldn't continue to be developed.

In Oracle's case, this seems absurd. The money they make from toolbar installations couldn't possibly be very high, could it?


There are examples of legitimate software failing in this aspect as well. Not to suggest that Oracle does not do this on purpose for nefarious reasons or that other software is being scummy somehow. I don't work at Oracle so I can't say if it's intentional or just part of the problem that's more common then you think.


Ladies and gentlemen, introducing THE fugliest company of all time - ORACLE.

The company that sued Android unsuccessfully, The company that fucked up JAVA, The company that fucked up MySQL, The company that fucked up OpenOffice, The company that doesn't like anything good happening within the tech sector.

I really miss those days when Oracle was highly respected and used to be a great workplace to be a part of.


Oracle fucked up Java? Not my view. Installing Java on Windows installed unwanted stuff for years during Sun's days. (Was it the Yahoo toolbar? I forget).

Oracle, for all its faults, has actually managed to get the new versions of Java back on track. Sun seemed to be unable to get Java 7 out the door. Oracle did so, and is making good progress on Java 8.


I won't speak to Java itself, but I will say that -- crapware side-effects aside -- the Java SE installation process has actually improved since Oracle bought out Sun.

Whether coincidence or causative, I don't know.

It runs more quickly, and it only has a single instance of a single level of nested installers (for the JRE). A couple of years ago, the installation process had gotten simply bleep-awful, especially after they tacked JavaFX onto it, which installation seemed to take even longer than the installation of the rest of the SE package.


I mostly agree with you, except Sun went under because it couldn't monetize (there's that word again) those free products (that and the server market tanked/changed on them). As long as Sun was making 50% margin on servers, they could fund all these projects/acquisitions. When they had to rely on this wonderful open-source market, they couldn't.

Frankly, I think it's time to pay for software or software services again. I'd gladly pay $5 to $2o (depending on size or complexity) per year for quality, bug-free, ad-free software/services and its updates. And yes, I pay $20 to yahoo to get ad-free email that (hopefully) doesn't sell my information down the road. Is that even an option with gmail? When you think about it, the only person getting money for you being on the internet (with all the software required to do so) is your ISP--is that right? I'd prefer to pony up some money to get a better experience, but in most cases, that isn't even possible.

The way I see it, there should be a single service, something like ninite, where I can give my CC once and manage all my subscriptions/updates. Then it would provide me the software by negociating with the author/owner for a painless, ad-free, crap-free binaries/subscription/whatever. Why is that still science fiction?


It's a beautiful concept my friend. I wonder why it hasn't become popular yet, though.


How long it took to realize this? A decade?)

Actually, RDBMS folks knew that for ages. There are basically two major types - ones who know nothing but Oracle, a vast majority, and those who have seen Informix or DB2. (SQL Server always considered as a tasteless joke). So, those small minority always knew what a bloatware Oracle is.


I have seen Informix, DB2 (which one? there are four code bases), and Sybase. Oracle is still the #1 database for many reasons. Is it vastly superior? No. But it's not what I would consider bloatware anymore than another commercial RDBMS.


I have 10+ years of being Informix DBA. Informix was a product of a wonderful team of engineers. It has small code base, and I mean it, proper design and engineering decisions and excellent set of features. The Dynamic Server Product was so good, that Informix was acquired by IBM. It was solid Linux version back in 90s, and works well on Solaris or even SCO.

And you could configure almost everything you need in two simple text files and monitor and fine-tune almost everything on the go with just a telnet connection. Don't even tell me about Oracle.)


Informix was everything you say it was, I concur.

Oracle you could fine tune nearly everything with a single text file through 8i. And even now that's still supported (the pfile vs spfile). Their recovery procedures are also bulletproof unlike the voodoo with say, Sybase ASE to this day.


I once have resolved some stalled server issues on a machine located in a polar town Severomosk (via 2 sequential ssh connections, via terrible GPRS and one plain long-distance modem call - cu -l /dev/ttyS0 you know) from Katmandu, Nepal.) So, properly designed console tools matters.)


Cool. I've dealt with similar circumstances - one of my favorite incidents was a remote farm inventory database that kept getting corrupted because sheep kept head-butting an electric fence that was shorting the power to the nearby farmhouse.

Sqlplus still is the choice to do most things for old school Oracle DBAs :)


I started working in 1994 and Oracle was already the database provider that did not want to comply with standards (Sql92). They were already greedy.


SQL standards were and are a joke. Real app developers can't wait for the standards boards to ratify a syntax, they have to actually get on and build things. Oracle SQL is what it is, and if you don't like it use something else. The old dream of making the database a commodity and easily switching thanks to the SQL standards was always unrealistic.

I doubt that Oracle "didn't want to comply with standards" but what is much more likely was that they had better things to do than pander the syntax nerds. Like making the database faster, more reliable, more secure etc.

Like TPC benchmarks, SQL standards have never mattered to real developers.


Unless you are a real developer that has to write app supporting 4 databases. And you discover that simplest and most common use cases like implementing paginated query results work radically different in each DB and sometimes it's like "oh, you really want to limit result set from 100K-row query and view it piece-by-piece and not all at once? We didn't think about it..."


In 1996, I was using RDB on VAX. The SQL book I was using to help me was a book about SQL92 (not at all about RDB) bought in a small non technical library. Almost all the examples were working perfectly on RDB (and on Microsoft Access). A few years latter, when I had to use Oracle, I was very disappointed to see all the silly differences in syntax.


Don't forget the OpenOffice.org clusterfuck.


Thanks, edited to include OO (how could I forget this one?).


You forgot Jenkins/Hudson too.


Was pretty painless for us to move from hudson to jenkins. I would recommend it.


You are totally confused and making irrational arguments here! Oracle is the most dominant and top player in the software industries improving the lives of programmers and helping business become more efficient and save unnecessary trouble. Oracle's improvement on Java platform and MySQL are commendable!


It's a nice racket Oracle has. Every time they release a security fix, they make a few hundred thousand bucks on drive-by installs. Security holes as business model.


They don't even need to release a fix. I have been prompted to update several times in the past year, where I go through the install process (including having to uncheck the Ask box), only to get the message at the end that version x.y.x is already installed.

The updater is just plain buggy. Ed Bott mentioned the problems with limited user accounts, but I didn't see him mention the issue with jucheck ignoring the update settings:

http://superuser.com/questions/130961/how-to-stop-jucheck-fr...

I also had an XP system where the %appdata% environment variable somehow got deleted. This completely breaks the installer.


Is the Ask.com toolbar installed before or after Java, and if java fails will ask.com be rolled back?


When you check for the Ask toolbar and click next in the Java installer, the toolbar installer is fired off in the background, and installs itself after 10 minutes, regardless of what you do with the Java installer.


That's incredibly shady.


In the original article he details that the Ask updater waits patiently for 10 minutes after the Java installation completes (probably successfully or unsuccessfully) before launching as a background process.


Talk about maximizing your income. I'm also bewildered that a new install of java is set to only check for updates every month. Wha?

I picture some Oracle bean counters decided that once a month toolbar installs is decent revenue for them without pounding their update servers too much with requests to see if the new version is out.

Also, where is ask.com getting all this cash? I don't know anyone who uses it.


> I don't know anyone who uses it.

Apparently most people who use Java use the ask.com toolbar. </sarcasm off> Edit: With the ask.com toolbar installed, it also changes your default search provider, and it is very hard to put it back in some cases. So I'm sure that's where they get their money to pay for the drive-by install.


Pretty much a Tony Soprano-like racket.


This sums up everything I find wrong about the Windows philosophy. Software whining for updates. Unwanted background programs. Installers that want to install more than you ask for. Usage of the phrase "We recommend" where recommend means "we get money if you".

I've never seen any of those terrible anti-user behaviours in a Linux package manager, or makefile.

I would be fine with an actual security fix being downloaded and installed silently (without any other payload of course).


This has nothing to do with Windows specifically and everything to do with software developers prioritizing profit over all else.

What does the 'Windows Philosophy' have to do with the decisions Oracle makes about Java anyway? Do you really think Java follows the 'Windows Philosophy'?


> This has nothing to do with Windows specifically and everything to do with software developers prioritizing profit over all else.

I don't know about philosophies, but Windows is the only OS I have used which suffers from these problems. I have never experienced this on OS X or Linux.

I don't particularly care why, just that it happens.


I strongly suspect that the fact that this doesn't happen as often on OS X and Linux has very little to do with anything intrinsic to those two operating systems. It's just that they're less fertile ground for this sort of thing.

For one, each having fewer users should not be ignored. 90% fewer users means 90% less potential profit. That's a big number even when you aren't relying on a revenue generation model such as ads.

But not just that - also because the average user on both platforms (particularly Linux) is more computer-literate, and therefore better-capable of defending against this sort of thing.

And on the OS X side, remember that for a long time the Java run-time was distributed by Apple. The agreement to start having it be distributed by Oracle might well have included a "no crapware" provision.

On the Linux side, well, that's where all their enterprise customers live nowadays. They really do not want to piss off their enterprise customers like that.


"90% fewer users means 90% less potential profit."

So, those companies could grow their profits by 10% by becoming cross-platform? I would think it would be much harder to tweak that installer to get 10% more conversions on Windows than to provide a Mac installer.

Also: it is revenue that they are leaving on the table, not profit. That makes this a slightly less favorable option, but still, I think a company would be stupid to keep even 5% extra revenue on the table.

I see two potential reasons why OS X does not have this problem:

- there aren't as many places to hook into the system. For example, Safari doesn't support custom toolbars (it might be possible to code something as a browser extension, but let's not wake anybody)

- the culture on both platforms is different. Windows users may moan about crap, but in general accept it; Mac users less so. See my earlier comment at http://news.ycombinator.com/item?id=5060019


OS X and Linux apps don't have to be bundled in a custom installer. In OS X you simply drag the app into you Application folder and now there's an App Store that makes the whole experience even simpler and curated.

Linux distros have great package manager and you won't get greedy crap-ware from the Open Source community.

It's a shame that Windows installers have become so bloated. The other day I've seen one with a check box labeled "I agree [to install this crap ware]" just bellow the license text. Really deceptive.

Hopefully the Windows Store will help improve that experience.


Sadly, the Windows store is only for Don't-Call-it-Metro apps that can run on the tablet version. So it really doesn't offer anything to help desktop users - for the most part they're still stuck with the same old Windows Installer quagmire.


Again, I do not care "why", just that it happens. Crapware is more of a Windows thing. This is one of (many) reasons I avoid it.


You should care, because it could change. And if you know why it happened in the first place, you'll know when it could change.


And also you'll know the danger signs of the same situation coming to your platform of choice.


A few members of my family have gotten toolbars and search-hijacking malware on their Macs from carelessly installing freeware.


Citation needed. My entire family has Macs, and I have never seen this. As far as I know it is impossible to add toolbars to Safari: there is no API for doing so.

I call shenanigans.


What do you mean by "citation needed"? I highly doubt the parent poster documented the event. It is not impossible to add toolbars to Safari (e.g. http://blog.gregfiumara.com/archives/134)

Just because it hasn't happened to you, doesn't mean it never happens.


I was curious, so I did a quick search - https://discussions.apple.com/thread/3313282?start=0&tst...


It was in firefox.


Maybe that's because Macs already have installed all of Apples bloatware.

I found it very irritating that if you try to install iTunes on windows, it would pop up a window telling you to 'upgrade' your browser to safari.


My Ubuntu installations whine about updates constantly...so it's not just Microsoft. Annoying, none the less.


That is the whole distro, and not a hundred individual programs talking out of turn. If you don't want Ubuntu's update notifications, you can turn that off in one place.


I have a machine running Ubuntu 11.04 or 11.10, I forget which. It keeps on telling me a new update is available. I'll upgrade eventually, but I don't want to be nagged about it, so when I see the box pop up telling me I should upgrade, I hit "Don't Upgrade." Next time it boots, the box is back.


I have a feeling he means bundling crap with installers. This has been done for a long time on Windows and not so much on Linux or OSX.


Likely because Windows has enjoyed a rather massive installation base, particularly among folks who are not terribly knowledgeable. I'm sure as other platforms become more dominant, we'll see similar shenanigans.


Having a user base of folks that aren't very knowledgeable is no excuse for abuse.

Also, I do not think other platforms can be as plagued as Windows is, because it's a matter of culture and user expectations being driven by that culture. The size of the user base has nothing to do with it.

On Windows users wishing to get anything done resort to installing some crap, even for basic things like uncompressing an archive, watching a movie, listen to some MP3 or viewing a PDF or an Office document.

Things got better with open-source software that was ported to Windows, but considering that Windows is the dominant operating system, the ecosystem is actually kind of lame. If you want quality software, the few exceptions are some open-source apps and some products being sold by some big publishers and that's it.

I have a theory that this is because Microsoft itself encouraged piracy and bundling of crapware, while discouraging indie developers, communities and open-source.


I have never seen any other package bundled with the one you want to install in Linux.


That's because it's probably made by volunteers and they're not trying to make a profit off you.


Also, I think it is frowned upon in open source world.


> This has nothing to do with Windows specifically and everything to do with software developers prioritizing profit over all else.

Sounds like Windows to me.


I fail to understand how that's the Windows philosophy. I've used Windows almost exclusively since I've started using computers and I don't recall that being the norm for quite some time. Even today I would say it's not really the norm simply because most people will not run into this on a regular basis. I would say that's the philosophy of business in general, especially considering the article is about Oracle's bad behavior. They target Windows simply because of sheer numbers which would possibly give them a good return on investment. The main reason you don't see that behavior on Linux, yet, is that it's not worth the time for these businesses. If they ever change their mind I guarantee that will be the day you'll start to see this type of thing.


I've stopped using a Windows PC in 2004, and as far as I remember this was already pretty common at the time.

I'm taking a shot in the dark here, but I remember Nero or similar software coming with such a crap too. We, geeks and nerds, quickly get into our habits to uncheck the checkboxes and all. But workaround have developed, such as needing to check a box to not install the bundled crapware.


Going even further back: RealPlayer was synonymous this this kind of behaviour. Yet the Linux client never installed such crap.

In my opinion, package managers are the single greatest innovation to happen to computer usability since the WIMP paradigm.


So, a few examples have come forward but I don't see a trend that suggests that using Windows on a daily basis is just an ever annoying adventure in avoiding crapware. So far the examples provided I'm familiar with but for the most part avoided. Likely maybe because of the crapware but also just as likely I didn't want/need/like the software being mentioned.


You want more examples then?

* iTunes installing several start up processes and Quicktime players

* printer drivers CDs installing all manner of crapware

* OEM bloatware

* Winamp installer recommends all sorts of sponsored crap

* Adobe's terrible update system (ok, not really what we're discussing here, but i resent having to reboot my entire OS just for an update to a PDF viewer)

* and the amount of programs that install start up processes just to check for updates is depressing

* Even Microsoft themselves are guilty of pushing crapware (eg Bing seach bars) in Windows update

....and that's just off the top of my head.

I know this sounds terribly negative but it's fair to say that Windows' current method for allowing developer to run rampant with 3rd party installers is sub par by today's standards. And I think even Microsoft realise this because they're now switching to a package manager with online repositories with Win8. I just hope that their main focus isn't to fleece the developers like Apple do.


Granted, good examples. Other than programs that install memory resident apps for their own use (which isn't even part of this discussion), most of them do not affect day-to-day usage of Windows.

On a side note, about that memory resident stuff. A quick look at the Activity Monitor on my Mac suggests similar stories. I have an iTunes Helper process running, don't use iTunes. A bunch of MS Office stuff, irony there. There's one for Spotify, which isn't running. Another for VMWare Fusion which is also not running. A large amount of processes that I have to assume that a number of them are typical system processes but not familiar with such things on a Mac I have no way to tell. Following your thought then I totally blame Apple for their lack of control over their third parties.

But again, why exactly is this the fault of Windows and/or Microsoft? Are you saying that Microsoft should have had a heavier hand in terms of third-parties? Seems to me, considering history, they would have answered to the Justice Department for doing such a thing. Keep in mind that almost every single one of your examples come from third-party sources outside of Microsoft's control.

Are you suggesting that it is impossible for nefarious entities to get crapware, bloatware, or other unwanted things into Linux or OS X through social engineering or shady practices? My Mac comes with all kinds of iSoftware that I don't want/need/use so can I call those bloatware?

I'm still waiting for enough examples of crapware bothering people on a day-to-day basis that can support the statement that such behavior is the "Windows philosophy".

Although, I grant to you that if you somehow managed to get all that stuff on your system at the same time then that would affect your day-to-day because of eventual performance issues. But then again, in most cases if people would bother to read what they click on then they'll avoid most of this stuff. It's the ones that install themselves without your knowledge are the truly offensive crap.


> The main reason you don't see that behavior on Linux, > yet, is that it's not worth the time for these businesses

I think it's rather that almost all Linux software is either open source or installed through a package manager (usually both). Open source developers would fork and remove any such behavior if the program is at all worth dealing with. While package managers would not be likely to include such annoying software to begin with.


If ever Linux gets a similar userbase as Windows, I guarantee you there will be tons of crapware for it as well. Open source developers can do exactly nothing if users will want to download something from the Web and crapware makers make it extra easy and convenient to them.

And if you say that this won't happen, because software will still be installed through a package manager than well... maybe that's (one of the reasons) why Linux doesn't have a similar non-tech-savvy userbase as Windows.


Yep, and already we have Steam, for example. While an excellent gaming platform, is also Adware by default, and displays popups with special offers and new games on sale.


As much as I hate Steam, Steam coming to Linux is actually a Good Thing.

One of the main reasons it took me many years to switch to Linux was the lack of games. Many others felt the same way.

If I was Steam, I'd use the sales to customers whose primary platform is Linux to fund the porting of additional games, either through grants/incentives to developers, patching of Wine, or both. The more acceptable Linux becomes as a viable alternative for gamers, the stronger the uptake of desktop Linux will be.


Well, Windows has open source software as well so those positives apply for it as well.

As for package managers, money talks. I would have said the same thing about someone sliding in crapware with a Java update some years ago.


You don't remember Gator? or that smiley thing?


Nope. Like I said I don't recall much of these shenanigans. Although I'm fully willing to admit that may just be my experience.


I've never seen any of those terrible anti-user behaviours in a Linux package manager, or makefile.

No, on Linux the Java plug-ins simply don't work at all most of the time.

(I work on a project using a Java applet, and frequently get negative feedback from colleagues running Linux about this issue.)


Oracle/Sun's JRE Works perfectly fine in Linux. Pretty much always has done.

I bet the vast majority of those users having problems are running OpenJRE/JDK, which is known to have issues with some Java applications (though the issues are slowly being resolved; bit by bit).

Sadly, because of licencing issues, most distros only support the open run times in their main repos, but adding Oracle JRE isn't much trouble.


You're comparing a walled garden software source (OK not exactly, but Linux package managers are practically curated App Stores by default), with installing software from all over the Internet. Now, sure, that used to be the only way to get software on Windows, but there is now a valid alternative for both Modern-style UI and Desktop apps: Windows Store


Android too is catching up with the apps spamming the notification bar.


So are the Feds going to go after Oracle and Larry for "unauthorized access to a computer" and "wire fraud"? With, like, real jail time?


Considering I clicked Java Installer.exe and got Ask.com toolbar installing, it sounds like a clear cut case of identity fraud as well.

Taking up real estate in my toolbar is basically criminal trespassing, so throw that in. I mean, it's not like in real life you can just say to an inattentive person, "I'm about to break into your house unless you tell me no" and have it be okay.


Looks like YC should make an investment!


It does seem to meet PG's critera

1. The user has an opportunity to opt out.

2. Calling Ask Toolbar "crapware" is only an opinion. Someone may actually want it. sniggers

I think bundling software is fine so long as it is relevant and genuinely useful. Ask Toolbar fails on both accounts. Bundled software shouldn't be offered during minor updates or security fixes... or at the very least, during these minor updates, it should be opt-in instead of opt-out.


Well when after the last security issue there were articles calling end users for uninstalling java completely, I was pretty mad at the missing distinction between the plugin and the runtime.

But now I really think this is a good thing to recommend under windows.

I will still continue using OpenJDK for server projects under Linux, but will press for different solutions whenever installation of Jav on a Windows machine might be required.


Can someone comment on how .NET platform + tools compare?

As someone who is not invested in either camp, between the two, .NET seems like a much better place to be invested in right now.

Edit: Thanks a lot for the replies, I'm much better informed.


I had about a decade in both, and really they're two very different worlds. From a code standpoint I'd much rather be in C#. It's one thing that MS has done really, really well over the last 10 years. They've taken a pretty aggressive stance towards adopting new features and although it's become fairly complex as of 4.0 and on, it really has some great features, some functional-inspired things like closures and collections api stuff that reminds me of Ruby in a lot of ways, and a great web framework in MVC that is honestly almost as fun to code for as any of the open source web frameworks out there. If you had to choose between one of the big J2EE stacks and MVC, no question, MVC is far, far better. The infrastructure is still a big 'ol MS GUI world, and I'd rather do <badPainfulThing> than spend a lot of time configuring and deploying IIS apps, but then TomCat and WAR files et. al. ain't exactly fun either.

Java's JVM/bytecode infrastructure on the other hand has undergone a renaissance as a VM platform for a lot of very cool languages: Scala and Clojure being the two big examples there. But that's Really not the same thing as Java, obviously. And there's Android -- a completely different ecosystem, and somewhat truncated as a Java dialect, but still basically the Java language and able to employ most of the libs you're used to having: Guava, Guice and so on. No dynamic code gen, which stinks, but I know why they did it. So if you have Java under your belt and want to get into mobile stuff, that's a huge plus.

So, as a general-purpose language skill, Java is still really, really important to know and will have legs for a long time to come. ASP MVC is a great framework, and if you can't work in something like Django or Rails or the like, it comes in nice 3rd or 4th place in terms of making for general coder happiness. C# is a far more progressive and interesting language than Java, but that's a philosophical difference between the gatekeepers of the two languages: Java intentionally moves slow for the sake of stability and continuity, C#'s minders have apparently embraced a little of the 'move fast break things' attitude of some parts of the open source world. I prefer the latter, but understand the rationale of the former.

Me, I'm a Rails coder these days but also get to hop back into Java for Android dev and the rare foray into ASP work and they all have strengths and tradeoffs and they'll all be around a long time. The only thing I think I would avoid on principle, for my own sanity, is any enterprisey J2EE framework. That truly does feel like a massive leap backwards.


Agreed with this. I used to code C# for a living but have moved on- however, I'm now playing around with MonoTouch in my spare time and I'm loving using C# again.

MonoDevelop is a poor man's Visual Studio, but it's a lot less demanding and runs on OSX. Backend frameworks like Nancy.fx are really great for being even simpler versions of MVC, too.


I was shocked how well MonoDevelop worked out when I used it briefly a couple of years ago. But my expectations were pretty low -- I was expecting a compatibility quotient something close to Wine circa 2001, and got instead a basically functioning C# environment on my Mac, which was pretty dang cool.


So how do you propose we do enterprise stuff?

What's wrong with the latest version of Spring or JEE (please remember this is NOT J2EE).


I never used Spring as a framework, although I did use it as a general purpose IOC tool, so I can't really speak to that. I much prefer Guice these days if I need IOC for Java. XML config is clunky and heavy and although was a good choice at the time for Spring, has not aged well.

I'm sure Spring would make dealing with beans a lot less painful. I know there's more to J2EE these days than Beans and WebSphere and the whole early-2000s debacle that frankly gave Java a bad name and enabled the rise of php and Rails and the like.

Struts is Struts and never really appealed to me. Wicket looks more lightweight but still seems config-heavy. I think that's the one thing, from a coding standpoint, that makes even contemporary Java still feel 15 years behind: configuration hell. It's just part of the whole Java mindset, that it's never really shaken (even in Android!), that a major part of my coding life should be spent configuring the framework. C# and .NET has moved away from that more and more and to me it's a much better environment for it. This is all subjective tho. YMMV.

So what do you use? What makes you happy in the Java world these days (I'd really like to hear).


It appears you haven't really done enterprise Java for a long time.

For a start, J2EE is history, anything using J2EE is a legacy project. JEE6 is the latest Java Enterprise Spec and it's fairly lightweight, you have to use almost zero xml configuration (everything is annotations) and you and you can turn a plain old java object into a bean with just one annotation (@Stateless) and you can even inject beans anywhere with just one annotation.

The same is true for the newer versions of Spring, pretty much no XML config required anymore.

I use JEE6 and Spring, these are as powerful as ever but with less and less actual implementation nightmares with every release. They have looked at the other frameworks and stolen all the best ideas in their latest form.

Play! for java is also a great framework although it doesn't have much adoption by anyone I care about.


Awesome, thanks for that -- and no, I haven't done enterprise Java in a while. If one could swap out Spring with Guice (annotation-driven as well), sounds like a framework I could live with. I do appreciate the move away from configuration files to annotations that a lot of Java frameworks seem to be embracing.


+1 for Spring not aging well

The only thing that makes me happy in the Java world lately is Scala. It has it's flaws but is much more pleasant that old school Java.


> XML config is clunky and heavy and although was a good choice at the time for Spring, has not aged well.

You don't need to use XML its just an option now. Annotations work well.


Stop using the word J2EE please :)

J2EE is horrible.

JEE is awesome.

Comparing J2EE with ASP.NET MVC is not fair just as I would compare ASP.NET with JEE or Spring MVC :)


Fair enough. I was pleasantly surprised how much ASP MVC had cribbed from Rails, and it sounds like I'd likely be similarly enthused about new JEE developments. I have noticed the trend towards annotation-driven development and moving away from configuration in Java frameworks and heartily approve.


Sinatra -> JAX-RS (of JEE 6)

Rails -> Spring MVC (albeit we still don't have a mature ActiveRecord but I concur that the Java world prefers the Repository pattern a'la DataMapper/Merb)

The whole Rails ecosystems is pretty much:

1) Spring MVC

2) ORM (Hibernate/JPA2 or one of the newest tool is Spring-Data)

3) Maven == bundler + rake + gem

4) JUnit

5) Some sane folder structure


I've been a professional Java developer for just over 2 years now. Let me give you a simple example.

The three leading Ecommerce platforms (Oracle ATG, Hybris and IBM WebSphere) are all done in Java.

There is huge demands for Java developers working on Web and Enterprise systems the world over. The average Salary for Java developers is pretty high in most places (london and Sydney) and the day rates you can charge as a contractor are very good.

There also seems to be more open source and technical community in Java.

I am glad that I went down the Java route.

also, Most Java development jobs nowadays focus on the web and server side stuff, this is followed by mobile (such as android) and embedded (such as TIVO boxes).


I went from writing client-server code in Java to writing similar things in .NET.

After two months of C#, I remember thinking to myself, quite clearly, "Oh, thank God, the nightmare is over."

Debuggers that worked. Native calling systems that actually interoperated well. A set of classes that weren't horribly overdesigned and under-implemented.

Best of all, no culture that insisted on factories that made factories that made factories.

Writing Java on phone platforms is fine. But the enterprisey stuff is death on roller skates.

Hey, if you can stand it (my cousin does), then you might make a bunch of money. My cousin spends six months hacking Java for a bank, then six months vacationing. I prefer to do stuff that doesn't make me contemplate washing dishes for a living again.

.NET has its warts, but it's not cancerous the way Java turned out to be in the hands of the architecture astronauts.


Interesting experience you have.

I have spend most of my career doing Java6 JEE6 and modern Spring and it all feels quite modern. I did a lot of C# at University and it is a good language and platform but I don't think it's better than Java. New / modern Java is fine, it's old java that you want to avoid.


If you ever try any of the modern stuff (django, rails, play, grails, any node.js framework) in depth, j2ee / Spring and java just feels old and ancient. Spring has gotten better over the years, but there's still just too much work and too much unnecessary complexity and cruft with Spring. It's really telling when even Spring's creator jumped ship to work with TypeSafe and jvm7 has huge improvements designed for other languages.

imo C# is an improved java, but C# open source ecosystem is just anemic compared to java.


I actually like old and ancient. That means all bugs have been fixed already. Systems become complex quickly enough and you need to use the most boring bricks imaginable if you want to build something sturdy.


> I actually like old and ancient. That means all bugs have been fixed already.

By that logic everyone would still be using Cobol or Fortran for new development. Moreover neither Rails, Django, or Grails are brand spanking new anymore. Those projects are mature. If you don't want to stray too far away from the jvm comfort zone, Grails is actually built on top of Spring and Hibernate and it's still maintained by the Spring team.


I'm not sure which debugger you use to debug Java code but I can do local _and_ remote java debugging via Eclipse.

IntelliJ supports JavaScript and JSP debugging as well.

Client-server development using EJB 3.x is way much better, cleaner, and simpler than .NET, sorry, this is something that I don't think you can argue elegantly.

.NET culture when it comes to open source is sub-par while Java is very rich. Spring, Tomcat, Jetty, Hadoop, HBase, Eclipse, NetBeans, Maven, Ant, the list goes on. These are mature and high profiled open source projects wherein .NET I have never seen an open source project reached that level of acceptance.

While Java has this sub-culture of factories that made of factories. .NET has this culture of fighting with the latest and grandest libraries that Microsoft launched once every 6 - 12 months.

Enterprise .NET is not at the level of Java yet (compare Message Queue, remoting, security, and other capabilities .NET are still lagging).

.NET has its cancer in its own way.

I honestly believe that you have not used Java that deep professionally.


"Oh, thank God, the nightmare is over."

The nightmare for me has been over in the mid-nineties, when I discovered Unix through Linux.

There's no way I'll ever be going back to working on Windows. I'd rather go work as a plumber or a truck driver (not that there's anything wrong with that) then have to work on Windows ever again.

C# / F# might be interesting, but using any Windows as my OS is a big no-no. Never this nightmare again.

And, nearly 20 years later, the great thing is that a lot of devs previously working on Windows are now working on OS X (anybody disputing that trend is a fool).

Major win for Unix with both Linux and OS X. Not to mention all the devices running either iOS or Linux / Android.

The nightmare is over: Windows shall never be the OS powering all these servers and devices out there and hence .Net shall never be the dominant platform.

It's not that .NET has its warts (it does), it's that Windows has its ugly warts and I'll never ever be using that inferior OS ever again and I'll never ever again will be forced to deploy on an Microsoft stack.

In the mid-nineties I considered quitting IT. And Linux saved me. And now OS X. Thanks.


I wouldn't go this far myself, but I deeply sympathize. I developed an inordinate level of familiarity with the Windows ecosystem for 10 years. I could tell you which registry keys did what for which COM components <shudder/>. Then I rebooted my technical self into Mac/Linux/Ruby and would have to scream into a pillow for 20 minutes before I'd be able to open up a windows command line again. Although I did do a bit of PowerShell when it came out and -- wait for it -- it was actually pretty nice. But still, the overall OS is such an odd beast in retrospect.


In other news, the mid-nineties were a long time ago.


Well, you can write C# without having to develop on windows through the Mono framework, and Xamarin's products - http://xamarin.com/

These days, you can be a C# developer without having to do an ounce of "Microsoft Stack" programming if you didn't want to.


Java isn't what it used to be. The products written in Java are slow, bad looking and less secure. The days of Java are anyways numbered.


That's an incredibly ignorant response and you have no idea what you're talking about.

Java looks bad? You're probably talking about certain swing applications which are now very rare on the desktop.

Java is slow? You clearly have no idea how fast the JVM can interpret and JIT java nowadays.

Java is insecure? You're mainly talking about applets which are an ancient technology on their way out (slowly). In terms of actual JVM security. Every product has its security issues.

You seem very ignorant, your java experience is probably from the past e.g. J2EE1.4 and old swing apps.

Modern Java is an good language on a great platform. There's a reason why it runs some of the worlds biggest ecommerce sites and worlds fastest trading desks.


While I think the parent was overplaying it, I do find most of the Java applications on my mac are slow and irritating to run.

Pycharm is an example of one of the apps I am talking about. It just feels like it struggles at times, eventhough I have a fairly new machine.

Java was the first language I learned while going through college but I find the verbosity to be irritating.


Desktop java is dead. Actually desktop anything that's not web is going to end up dying. The server is where the languages will duke it out next and Java is fine there. C# is also fine on the server. The nice thing about Java is it easily runs on linux and has many OSS libraries to help quickly standup server applications.


The best way I can think to phrase it is "in-browser VMs are dead". This covers Java, Flash, that one Microsoft had for a while, and anything else that uses the browser plug-in mechanism to load heavy frameworks.


Your experience is not necessarily because Java is slow. It could just be the applications you are running that are slow for reason that have nothing to do with the language.

Swing is probably going to be slower (maybe?) than some native windowing framework.

But Java as a language running on the JVM is certainly not slow.

I've just been looking up pycharm and it seems that the slowness issues are to do with things like opening files and doing parsing. These things are likely to be slow for anything but the language they are written in.


Most people are exposed to Java via enterprise monstrosities.

It depends on your POV. I've had to deal with an enterprise Java crapware app that was essentially a terminal emulator for an old mainframe... except that it required more than 4GB of memory on the desktop to work appropriately.

The mainframe itself has 2GB of RAM.


Although you are taking heat for saying they are less secure, this is mostly true. Specifically, it is the JVM that has major security problems, not the apps themselves. This is not so much a fault in Java but in Oracle's implementation and their longstanding failure with security.

Fun fact, several Windows versions have included a security mitigation technology called ASLR (Address Space Layout Randomization) that breaks a large majority of exploits and raises the bar significantly. Exploit developers and penetration testers love Java, because any machine that has it installed (most of them) breaks ASLR, re-enabling all of those exploits that Microsoft had otherwise mitigated.


I hate to say it, but you have absolutely no idea what you are talking about.


Most applications written in Java these days don't have UIs.


> Java isn't what it used to be. The products written in Java are slow, bad looking and less secure. The days of Java are anyways numbered.

Shorter: "I only know anything about client-side programming."


You got a lot of replies already, but let me join the crowd.

Disclaimer: Was a Java guy, working with C# exclusively now by day (F# and Clojure - not Clojure-Clr - are my pet languages at night).

In my opinion the languages (specifically Java vs. C# now, ignoring other languages for now) started out really, really close when C# was new. C# gained a lot of nice features, while Java was - euphemistically - 'stable'.

Thinks that made my day and made every sporadic try to get back to Java (or work on Android) a chore: .Net events, properties (later automatic properties), usable generics, delegates, yield based generators/enumerators and the reason they were added: LINQ. Type inference aka 'var'. Basically every release brought half a dozen interesting features (and new technology, WCF/WPF/Silverlight/Workflow), while Java was sleeping as far as I could tell.

I understand the latest release of Java now came closer again, but C# is still quite ahead in my opinion.

Tooling: Visual Studio. Now, I'm not a total fan and some releases are better (2008, 2012) than others (2003, 2005, 2010), but it's a decent tool for most all your developing needs and ranges from free to 'includes the kitchen sink and costs $$$'. It supports three languages out of the box (F# is very interesting and a fully supported language!).

I like IntelliJ and sympathize with the Eclipse project, but for me the VS experience is more streamlined, simple and nicer in general.

Libraries: If it's _really_ popular in the Java world, you'll find a port (think nhibernate, log4net) or something equivalent.

I wouldn't want to go back (C# -> Java), but I DO have the jdk around for Clojure (and I'm still watching Scala from a distance).


Eclipse has rich plugins that even Visual Studio can't touch.

(Maven) m2clipse alone is a very good reason to learn Eclipse.

You can't download 3rd-party library with Documentation _and_ Source Code _and_ Navigate to the code without having to setup anything _and_ included in your build like you would have in.NET.

It's a big plus for incorporating and debugging code when you need to do so.

I've done C# and now fully Java (and JavaScript) and I wouldn't go back to a more locked and dumbed-down ecosystem.

C# the language may well be better than Java but that alone is not enough of productivity boost.

Eclipse, Maven, FindBugs, CheckStyle, Jenkins, Tomcat, Jetty, rich 3rd-party ecosystems are the key of my productivity boost.

VS.NET, NuGET and having to write either MSBuild or NAnt plus IIS (express or not) aren't cut it. Not enough to be agile.


Okay, I love Eclipse (technically). It's just a dog, most of the time and tries to be everything at once. Still, it _is_ a great project.

Maven: I .. never got that one. I guess the parts that make sense to me are covered by nuget. But I might be totally ignorant here.

CheckStyle -> StyleCop ? Jenkins supports .Net Tomcat makes no sense in this list for me. IIS? Jetty: See above? Maybe the ASP.Net dev server, depending on why you'd list jetty?

I rarely feel the need to do a lot in msbuild files. I might add build tasks (StyleCop?), but that's about it. Deploying is not in scope here (and for that I'd probably go for WiX. Not a huge fan of MSI, but that's what the platform uses and what other tools can manage).

I appreciate your opinion and read your sibling post, but I guess we're both a bit ingorant of the other guy's platform?

Jenkins: https://wiki.jenkins-ci.org/display/JENKINS/MSBuild+Plugin Sonar (mentioned in your sibling post): http://www.sonarsource.com/products/plugins/languages/c-shar...

Incidentally the Sonar page for C# lists a couple decent code quality tools for the .Net side of things.

But in the end if will remain a matter of taste & experience and I'm very certainly biased.


Won't argue about Eclipse performance. Sometime it depends on the characteristic of the project.

Some of the projects that I worked on, albeit huge, Eclipse still performs pretty nice. While in other instances I do notice issues with the performance.

Tomcat and Jetty make a lot of sense if you use it with Maven. The ability to compile, deploy and bring up your App Server is something that you don't get for free in .NET

http://mojo.codehaus.org/tomcat-maven-plugin/deployment.html

mvn clean install && mvn tomcat:deploy <-- win

NuGET only deals with dependencies but doesn't deal with packaging, running unit-tests, running integration-tests, running PMD/CheckStyle/FindBugs as part of your build.

All of these things are important for CI/Continuous Delivery.

Oh almost forgot this one: JavaFX 2 may be way behind of .NET WPF but JavaFX 2 comes with a tool that can generate installer for OSX App Store (will bundle JRE automagically), Windows, and other platforms. WiX can't do that.

I may be ignorant of some of the .NET stuff but as of 2010 - 2012, the last time I used .NET, .NET is still lagging behind Java when it comes to tooling.


> Tooling: Visual Studio.

It's a decent tool but I think the alternatives for other platforms are either equal or better. imo MS is typically playing catchup in this area now.

> Libraries: If it's _really_ popular in the Java world, you'll find a port (think nhibernate, log4net) or something equivalent.

This is what truly makes .NET a no go for me. There's just too few non-paid and open library equivalents compared to almost any other platform. Not mention the libraries in other platforms tend to have more features. The .NET open source community is still pretty small and weak, and I just don't see that changing (even with CodePlex it hasn't really had any drastic changes).


For the newest versions of Windows (Server 2012, Windows 8) .NET comes installed -- I forget if it's installed by default or installs as a Windows component. If it's the latter you install it from the same screens you install IIS or the SMTP server from.

After you install it updates to the .NET framework show up in the "optional" windows updates.

There are certainly standalone installers as well: http://www.microsoft.com/net/download

But if you're producing client-side software that's dependent on the .NET framework then you most certainly will make your installer "bootstrap" the installation of the correct framework for your OS language and hardware.


You never have to worry about drive-by installers with .NET updates - security updates just come down with Windows Updates.

.NET is seeing a small renaissance with ASP.NET MVC and what the Server teams are putting out, but Java is also gaining popularity again as a way of running Rails apps quickly and with Scala.

Both platforms have enough legacy apps out there for a lifetime of maintenance work, if that's your sort of thing. Cleaning up after outsourcing companies is lucrative.


In terms of just the languages themselves, .NET is very solid. C# is definitely a better version of Java, and the rest of the # languages in general are decent or good.

However, the .NET open source ecosystem (while greatly improved from years back) still really really sucks. Historically, this is directly MS's fault (codeplex helped but it still will never be able to undo the damage MS did early on). I just think it's a waste of time having to reinvent wheels that pretty much every other major platform (Java, PHP, Ruby, Python, etc...) has plenty of. I always hate having to do extra work that I feel is entirely unnecessary, which happens a lot on .NET.


I used to intern at MS and have used .NET platform for a while (on and off, including not too long ago doing a bit of ASP.NET, ASP.NET MVC, and Sharepoint for one-week project). I've used VS.NET 2005, 2008, and 2010.

I've also used Java for a while, the whole Spring MVC, JEE6, Eclipse, IntelliJ.

If you're willing to live in Windows OS platform, you should go with .NET, no question asked. Forget about tooling and everything else.

If you want more flexibility, more choices, etc, Java is your choice. (There's also Python, Ruby, and the rest but let's scope it to Java).

.NET culture is heavily influenced by the culture of Microsoft which means:

1) Less Open Source, More mISV (more "pay" products)

2) Windows/GUI, less command-line (has changed a bit but still not there)

3) Fire and Motion http://www.joelonsoftware.com/articles/fog0000000339.html

#3 is important because MS makes money from tooling as well. When I was there, the internal chatter was "tool will be out of date every 2-3 years". Please make your own conclusion.

Some people said Java had this period of "sleeping" which was true. But during that time frame, we've seen TONS of open source projects that are very mature, battle-tested, and probably everlasting.

We've also learned a better way to write Java code (HN made such a big deal of Factories yet HN never acknowledge the best breed of Java code out there, it's a typical of a community like this anyway).

Thus that "sleeping" period is being used efficiently to stabilize things.

When it comes to tooling, Java beats .NET by miles. Java deployment packaging (JAR for library and WAR for web-app) is one of the best out there and it's been stable for many many years. (http://dirtsimple.org/2004/12/java-is-not-python-either.html)

Java build and dependency management tool is also far ahead of what the .NET has. Maven is far beyond NuGET and MSBuild (shrudder).

Integrating Java build with popular Continuous Integration server like Jenkins, TeamCity is waaaay easier than .NET.

Eclipse foster a good community of open source and free tools/plugins which put VS.NET to shame BUT BUT BUT experience may vary when using Eclipse. Eclipse is like black magic and moody: if somehow you're in the position that your Eclipse is stable, it's one of the best IDE out there.

Eclipse has its own built-in "app-store" that makes installing plugins sooo much easier, seamlessly, and faster.

m2clipse, a Maven plugin for Eclipse can perform the following steps:

1) Download dependencies

2) Download the dependencies javadoc (auto-complete will show the code documentation)

3) Download the dependencies source code (#1 only download the compiled code) if you ever wanted to "navigate to the implementation of a method"

It does this seamlessly without you breaking a sweat.

Tools like FindBugs and CheckStyle helped to improve your code hygine/style and EclEmma can tell your Code Coverage. All of these are free.

Java has rich and mature tools and libraries:

1) Sonar => http://www.sonarsource.org/

2) Jenkins => http://jenkins-ci.org/

To put it simply, the Java community has a very strong Software Engineering discipline and continue to find better ways to develop whereas the .NET/C# community is either following Java lead or serving its own master: Microsoft.

I'm glad I'm out the .NET world because it was soo much limiting and "capping" your day-to-day productivity.


You would think that a company Oracle's size wouldn't need to resort to install commissions from something like this.

You would think that after several years of conning people into using their search engine, the employees at Ask would feel dirty to have to engage in such tactics.


Even Google is supporting these shady practices by powering some of the search toolbars and probably paying the toolbar owners for ad clicks. See MyWebSearch (http://home.mywebsearch.com/) mentioned in the article.


Humans have an amazing capacity to rationalize and self-justify, as long as they are getting some personal benefit.


One additional note regarding the installer: to opt out of the toolbar installation, you have to click the checkbox itself. You can't click the text label associated to it. I call it a bug, but certainly it's a feature in this context.


Actually, that's very common. It's one of my pet peeves for web design but I see it often in installers and the applications themselves.


This problem has been known and complained about for ages. What's the community response? We have OpenJDK, why does anyone put up with an abusive installer from Oracle?


Because Windows is not a supported platform? You have to find an unofficial build or build it yourself.


Is anyone distributing 64bit OpenJDK builds for windows?

EDIT: I found: https://github.com/alexkasko/openjdk-unofficial-builds


Just the word 'unofficial' is enough to stop most large companies using them. It is (was?) the same with Firefox- they never offered an MSI installer for use on corporate networks. There were unofficial versions, but you could never be sure that someone hadn't bundled something extra in there.


"but you could never be sure that someone hadn't bundled something extra in there".

Irony,

With Oracle, your are SURE.


Well, this thing about Java shows that you can trust not even official versions...


Is there an OpenJRE(or even a need)? or do we just run OpenJDK?


Java could have been such a good thing, even in the browser (ok, as platform, ignoring the language's shortcomings, but still...). Whys did both Sun and Oracle strive so hard to fuck it up? It's as if these guys have a "how to fuck things up for the end user" brainstorming meeting every week!


I think the last few years have shown conclusively that the it is not a good thing in the Browser because the sandbox security model is too complex to be implemented correctly.


> the sandbox security model is too complex to be implemented correctly

...is there any other simpler security model than this? Java even seems a simpler and more "well behaved" language than JavaScript, and JVM bytecode is said to be even simpler (though I'm not an expert on this...), and browsers had they own share of Javascript related exploits but people rolled updates quickly, acted responsibly and didn't do anything particularly stupid (as opposed to the described crapware incident perpetuated by Oracle).

EDIT+: one can buy browser exploits cheaper on "the x market" and they are more useful than JVM exploits so "security" is not Java's Achilles' heel, and it's Swiss cheese all the way down if you at most web-facing software unfortunately...


I really hate the crapware, and I hate more the "opt-out" crapware. But the "summary" of the article is a little unfair:

Oracle's Java plugin for browsers is a notoriously insecure product. Over the past 18 months, the company has released 11 updates, six of them containing critical security fixes. [...]

The updates and security fixes include not only the plugin, but all the Java runtime that is much bigger and complex. (For example, one of the updates was: http://www.oracle.com/technetwork/topics/security/javacpuoct... ). This is like accusing Chome or Dropbox of being insecure, because they do a lot of updates (that are automatic, invisible and don't offer crapware).


Crapware-free downloads ARE available.

If you go to Oracle's Technology Network area to download (or Google for the specific version e.g. "java 6u38" or "java 7u11 oracle" because of all the press) you can agree to their binary license and download crap-free offline installers.

The link for 6u38 is http://www.oracle.com/technetwork/java/javase/downloads/jre6... and the link for 7u11 is http://www.oracle.com/technetwork/java/javase/downloads/jre7...


Interesting how many comments about desktop Java being dead, when the highest selling video game still available and being developed is Minecraft, written in Java, which runs on the desktop... (over 9 million registered users, and still increasing... enough to make it the #9 all-time selling video game)

I will admit tho, for traditional desktop apps, it is very dead.


I'm glad this was said in a much larger avenue than my paltry Twitter account. To bundle a toolbar installation in with a major security fix is not only dishonest, it's unethical and who's to say that toolbar isn't the next piece to contain a security hole?


A sleeping add-on installer that waits ten minutes? Sounds kind of rootkit-y, opt-in or not.


I can't sympathize with this article and most users in this thread because I don't understand why anyone uses Java within web browsers. Today, Java is for server-side code. Full stop. Okay, I know some people still have to use Applets, but none of us here, right?

Kidding aside, I've installed the Oracle JDK on dozens of Windows machines and not once have I been prompted to install a toolbar or bloatware.

1. Navigate to java.oracle.com

2. Select Java SE.

3. Select to download JDK SE 7u11

4. Accept license agreement

5. Download Windows x64

6. Open installer

7. Select to install "Development Tools" and "Source Code" (disable "Public JRE")

8. Wait and then close installer

9. Run c:\java\bin\java.exe

10. Review Windows' "Programs" and note only JDK has been installed; no toolbars

11. Celebrate

I suspect many people are installing the JRE, which is something I've never done. Since the JDK can run Java code, why install the JRE at all?


Because many people are still stuck using applets in the browser. The JDK won't run those.


Last update I received I clicked the next button a little to fast. I realized after I went through the dialogs too quick and I figured no big deal I'd just cancel it when the McAfee dialog came up. It never did... all of the installation was in the background.

Shady!


I think the Java plugin should start to be flagged as malware given the persistent presence of holes that allow remote execution of arbitrary code, the clever bundling of questionable software and the update wizard behavior.


Sun was installing toolbars before Oracle bought them. I remember them bundling the Yahoo toolbar with Java.


What really upsets me about this is that it's Java that they are stuffing this adware into... Java a previously legitimate requirement that many applications have chosen to build on top of as a language/platform. For the average user it looks like all of these other programs are promoting this... I'm surprised that they can get away with it.


Fuck Oracle. And unfortunately, I guess that means Fuck Java too. This is the exact kind of stupid behavior that kills great technologies like Java, by stupid, greedy people that care more about money than technology. If this is how they expect to treat their users, I'll switch permanently to Python, PHP, and anything else besides Java.


I happily uninstalled Java from all of my machines/OSes last week. Glad to be rid of it.


I decided to try the same. It's been ages since I last played Minecraft, and I have frankly no idea what other apps I'm using might be using Java; the only way to find out is to uninstall it. It's not like I can't install it again if I need it.. but the days of just having it installed "just in case" are over for me. I might even uninstall Flash just for kicks.


I think this is in a large part due to the way programs install on Windows perhaps.

These programs seem to rely on getting the user to make a choice during installation time. Windows is the only major OS that seems to rely on "installers" being programs in their own right.

For example on debian, .deb packages provide a standard installation process. Whilst it would still certainly be possible to inject all types of crapware into a .deb the actual install process is not really conductive to this, because there is no way (AFAIK) to pop a custom screen during the install.


One reason I always download the full installer (even to upgrade), rather than using the Java update notification service (it runs, but when it prompts with an update -- if it does so before I manually upgrade -- I use that notification as a cue to go download the full installation; I don't let the service upgrade me).


My experience is that the one from java.sun.com does not have the crapware. Especially if you install jdk?

The one from java.com does.

I'm not 100% certain though.

BTW, there is a process to install java without the installer and without admin rights on Windows. The process is described on say StackOverflow but I have it scripted.

I should put it up on github sometime!


Too bad Google missed out on buying Sun.


I was just about to decry ZDNet for calling the kettle black here, but it seems they removed the scummy invisible pop-up ad click target they used to put in the negative space next to the column.


I do not have any such issue. Are you sure this sidebar comes with the official java installer from www.java.com?

From what I've heard, I guess it comes with Java installers from 3rd party sites.


Do not take this article Seriously. This is garbage post and problem is with ASK and not Oracle here.


And this is why Apple creates their own install packages for Java.


Not anymore, they don't. (Source: http://bit.ly/947yQJ)


This seriously changes my opinion of Oracle.


Isn't it a little ironic that we're reading an article about foistware where the author searches for his own book on multiple search engines?


I used to work with Sun for quite some time; I can say without failure every single Sun tech I came across was pretty damn cool, knew what they were doing and was hooked up in the Sun-universe enough so they could provide excellent pointers and ultimately that translated into happy customers. On top of that a lot of their enterprise-y software wasn't half bad to begin with, it was just always terrible getting good documentation and information as an "outsider" oh and there were a couple of years when you could just forget the sorry excuse they passed off as "support". But there was always the possibility of going "black-ops", just de-compiling and providing your own fix and although this is far from great, things just worked and everyone was happy. Sun's suits didn't really matter from our point of view anway, they did no harm, stood in nobody's way, shook hands and invited folks to dinner when appropriate. Fair enough, you cannot really ask for more, anymore and it would literally be paradise, so I was happy with that. Even-though I never got that project manager I was basically paying for...

Enter big red. Talking to brain-washed zombies cannot feel very different from talking to Oracle's sales drones and customer relation dummies. You were talking about "A", they would start trying to sell you pricey-addon for the database when you weren't even talking databases in the first place. Whoever was a useful tech contact inside Sun before now turned into a walled-off zombie as well and I guess I was lucky they didn't just slap a price tag on picking-up the phone or simply answering an email. And to top it off I had to suffer one of their pre-sales dummies loudly telling an oh-so-ridiculous story how, can you imagine, bigcorpA was running tomcat(!) in their production environment! And not the abomination from hell that Oracle gets away with charging huge amounts of money for!! Well can you imagine that!!!

Another case of too-big-to-fail and nobody ever got fired for buying Oracle, hm?


I'm a long time user and sufferer of Sun's products; going back twenty years at least. My experience is that except for their core product (SunOS/Solaris) their products have been awful - over-engineered, buggy, difficult to administer and install.

Exhibit 1 the trainwreck that was the Solaris firewall. I don't think anyone in the world understood or installed the first version. Then they introduced a 'lite' version which perhaps a few sorry souls used. Then I think some sane person in Sun said 'fuck it' and they then offered BSD's pf firewall. Which was what everyone used anyway as it had been available for quite a while from outside sun.com.

This experience mirrors mine with Oracle as well. The database is good and support excellent. The rest of it (I'm looking at you Oracl Fusion Middleware) has an extremely high WTF rate and the consulting and support staff often have no idea.


Bit Torrent makes all its money through Ask's tool bar. Ask props up a whole economy, it seems. But hey, at least Oracle figured out how to make money on Java! Sun never did that.


Which raises an interesting question - how do you make money on a platform like this?

I've been wondering because I think that my preferred managed environment (.NET) is doomed if Microsoft continues keeping it tied to Windows. On the Microsoft side, I suspect that Microsoft's market share in the server and enterprise space is going to continue dwindling for the foreseeable future, which means that their current plan for making profit is far from certain. But neither Sun nor Oracle seem to have figured out a way to distribute Java for free to the world at large and make a profit off of it, and it's hard to imagine that Microsoft is any more capable of pulling that rabbit out of its hat.

Perhaps the trick is that you don't try to make money on it, at least not directly. And there's a great project out there that's trying to do it that way. But, well. . . . ugh. I love Mono; it seems like it has everything going for it. From a technical standpoint it's been rapidly closing the gap with Microsoft's implementation, which I suspect means it's probably already ahead of the Java platform in many respects. The flagship language is certainly way ahead. And it has the singular distinction of being the only Free platform in this sector, which would make you think that folks would be extremely interested in seeing it win. Why that doesn't seem to be the case continues to mystify me. I know it's still got a few Big Business cooties on it, but it's got way, way, way less of them than Java does.


> Which raises an interesting question - how do you make money on a platform like this?

Professional services. Hardware sales. Turnkey solutions (you want to support industry X using Java? ...). Development tools (to the extent not provided by third-parties). Certification/compliance. Associated products (nice Java app you've got there, need a database to go with it?).

Here's a thing: making money off of software by itself is hard. One of the lost messages in the recent trash-talking of Microsoft is that the fall of the House of Redmond also means the fall of software as a standalone, unit-sold, high-value product. Nobody but nobody else operates this way, certainly none of the current tech leaders: Google, Apple, Facebook, Amazon. Two sell ads, two sell things. None sells software.


> Which raises an interesting question - how do you make money on a platform like this?

Sell trainigns, certification, support (QA tested fixes for bugs that affected you before they are released to the public). SUN was doing all of that and was pretty successful. The hardware part of the bussiness failed them because of flood of cheap comodity servers.


> Which raises an interesting question - how do you make money on a platform like this?

Traditionally you sell a development environment. You release a command line compiler for free, and a full development GUI for money.

Then you make some useful (but non core) libraries and sell those as addons.


I always thought the Microsoft makes money with server-side .NET by making people buy expensive Windows server licences. The whole .NET platform can be viewed as a "feature" of their server products, differentiating them from Unix-family alternatives.


This is why if possible, one should stay away from company driven languages.


I could be mistaken, but I seem to recall an add-on in the Java installer during Sun's ownership. I don't think it was the Ask toolbar, but something else. I was out of Sun before that, but that's when I knew the "near-paradise" was over and Sun was circling the drain. Where's fuckedcompany.com when you need it.


Sun software division was profitable and was getting more and more profitable. The hardware part was responsible for the deficit.


Crapware add-ons as part of the Java update already existed long before Oracle bought Sun.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: