Oracle Agrees to Settle FTC Charges

Oracle has agreed to settle Federal Trade Commission charges that it deceived consumers about the security provided by updates to its Java Platform, Standard Edition software (Java SE), which is installed on more than 850 million personal computers. Under the terms of a proposed consent order, Oracle will be required to give consumers the ability to easily uninstall insecure, older versions of Java SE.

Source: FTC press release

Truth is, the vast majority of people don't need Java on their machines. Most mistakenly install it because they think Java is the same as Javascript, which of course it isn't.

I've been running without Java for years, and I can't remember the last time I was prompted that I could not view web content because I didn't have it.

It has a long and distinguished record for being a security liability, and I almost always advise people to remove it, unless they have a specific and well proven need for it.

The only sites I can think of that use Java are Speedtest.net and Netalyzer. I think the market penetration is vastly disproportionate to the actual use of Java. Part of the problem is that there are some applications that require the JRE and the browser extensions are enabled automatically when Java is installed.

Hopefully this settlement will at least help with the problem of old versions. Even just recently I saw a user with the most recent as well as the prior version so clearly the problem isn't solved. Something about their update process is fundamentally broken because I can't think of a single other program that has such a bad outdated versions problem.

Yes, quite why they have this appalling record of not being to remove old versions of their software with their updater is beyond me. As you say, other software producers seem to be able to do it, so there's no reasonable reason why Java should not be able to do so.

If you run a search on this forum using Java as the search term, you'll find the problem goes back at least 8 years (and probably more), so neither Sun Microsystems (the originators of Java), nor Oracle (its current producers) have ever really put themselves out to resolve the issue, and if it's taken the FTC this long to work out that it is an issue, then they haven't exactly rushed about resolving things either.