Java browser plugin to be sent to death row in September

Come September 2016, the perennial threat vector otherwise known as the Java plugin will be deprecated and well on its way to being dead, decreased, and thankfully, an ex-plugin.
Written by Chris Duckett, Contributor

Oracle has announced that the days of the Java browser plugin are numbered, with its deprecation set for the upcoming Java Development Kit 9 release and its removal slated for a future release.

The reasoning behind the move has been laid at the feet of browser makers choosing to move away from plugins.

"With modern browser vendors working to restrict and reduce plugin support in their products, developers of applications that rely on the Java browser plugin need to consider alternative options such as migrating from Java Applets (which rely on a browser plugin) to the plugin-free Java Web Start technology," the company said in a blog post on Wednesday.

Browser makers have been looking to retire the use of the Netscape Plugin API over recent years, with users needing to click to use NPAPI plugins in Firefox, and Chrome having removed support for NPAPI altogether.

"The rise of web usage on mobile device browsers, typically without support for plugins, increasingly led browser makers to want to restrict and remove standards-based plugin support from their products, as they tried to unify the set of features available across desktop and mobile versions," Oracle said in a whitepaper [PDF] on the change. "The Oracle JRE can only support applets on browsers for as long as browser vendors provide the requisite cross-browser standards-based plugin API (eg NPAPI) support.

"Without a cross-browser API, Oracle would only be able to offer a subset of the required functionality, different from one browser to the next, impacting both application developers and users."

During its life, the Java plugin has been a common vector to install malware or otherwise attack users.

JDK 9 is scheduled to ship on September 22 this year.

Editorial standards