Apple tries to kill its own Java on most Macs

Apple tries to kill its own Java on most Macs

Apple this week started scrubbing most Macs of older Java browser plug-ins, a move that will force users to download the software from Oracle. The company also patched Java for OS X, the second time Apple synchronized its Java security update with Oracle’s, releasing its patches for OS X the same day as the Java software maker.

Along with the Java patches, Apple beefed by OS X security by uninstalling old browser plug-ins for the software.

The update aimed at Lion and Mountain Lion—which collectively accounted for 60 percent of all Macs last month—zaps plug-ins provided by Apple via Java 6 and earlier.

“This update uninstalls the Apple-provided Java applet plug-in from all Web browsers,” Apple said in a support document.

Apple’s Java update for Snow Leopard did something different: “On systems that have not already installed Java for Mac OS X 10.6 update 9 or later, this update will configure Web browsers to not automatically run Java applets,” Apple stated.

After the Lion and Mountain Lion update is applied, users who browse to websites that require Java will see the message “Missing plug-in,” and can then proceed to the Oracle site to download the newest version of Java 7 and its browser plug-in.

Apple has been ratcheting up efforts to eliminate some plug-ins, notably Adobe’s Flash Player and Oracle’s Java, after hundreds of thousands of Macs were infected by the Flashback Trojan horse last March and April.

The company reacted with several measures, including blocking older versions of Flash. Earlier, Apple had made similar moves on Java, first blocking automatic execution of the Oracle plug-in, then following that with a patch that automatically disabled the plug-in if it had not been run in the past 35 days.

Wolfgang Kandek, CTO of Qualys, saw Wednesday’s plug-in elimination as both a security enhancement and an attempt by Apple to push customers towards Oracle as the distributor of Java.

this bug] in the next Java SE Critical Patch Update which ships in February 2013,” Gowdiak wrote on his firm’s bug status website.

In the hope that he could prod Oracle to act quickly last month, Gowdiak had gone public—albeit minus technical details—rather than privately reporting it to Oracle and waiting for the company to quietly patch Java. But the strategy came up bust. �