Java 8 Update 40 out - now using an application to install

[rtrouton]

There's a new Java 8 update out as of today. Oracle has decided to change its application deployment strategy from providing a standard installer package to an installer application.

external image link

This application will prompt for admin privileges before fully launching.

external image link

Once you provide admin authentication, the application launches.

external image link

You will be prompted to install an Ask.com toolbar. The installation of the toolbar is selected by default.

external image link

It will then tell you how many devices run Java while it installs.

external image link

Once complete, it'll tell you what it's installed.

external image link

It'll then ask you to install the Ask.com toolbar as a Safari extension.

external image link

If you then choose to install the Ask.com toolbar, Safari will look like this.

external image link

[m_entholzner]

Using the package inside the app, does it just overwrite the plug-in? IE does it maintain previously pushed settings (for instance updates set to off stay that way after using the package inside the app)?

I'm deploying this package since yesterday, seems to work pretty fine. I've also checked the package content of the 7U40 package against the 7U31 package, they seem to be the same. Even the postinstall scripts are the same. So, for my point of view, the only wrapped that creepy app around the usual package.

[dpertschi]

Scathing comments and suggestions just sent, and boy that felt good! After I calm down a little, I might just shoot the same off to the CEO's.

Let's be heard!

[maser]

This is just awesome:

http://www.brunerd.com/blog/2015/03/06/java-8-update-40-installer-app-fun/

[mm2270]

Wow, that is just freakin' stupid. All the more reason to drop the nonsense that is Java and not look back. Talk about swiss cheese security.

[dstranathan]

Has this checkbox always been in the Java 8 System Preference Pane on OS X? I just noticed it today.

Advanced > Miscellaneous > "Suppress sponsor offers when installing or updating Java"

Does this apply to the Ask.com browser extension?

[tangerinehuge]

Definitely not. It was added as of update 40. Not sure what it refers to but I assume the Ask.com extension is a good bet.

[adam_s]

To get the standard .pkg. Right click on the .app installer. "Show Package Contents". Contents > Resources > JavaAppletPlugin.pkg This is the underlying installer for Java8u40.

This is similar to running the Java exe installer on Windows and finding the .msi and .cab in the AppData folder

[Chris_Hafner]

Sounds like they've taken some creative inspiration form Adobe... and yes, the package works just fine.

[dstranathan]

On a somewhat related note...

Not sure if this has been mentioned, but there are some good ideas for managing Java 7 and Java 8 here on Patrick Fergus' blog:

https://foigus.wordpress.com/2015/02/20/managing-java-7-and-8-updates/

[Anonymous]

Just downloaded it this morning and it's gone back to how it was before! Not sure if that's happening to anyone else?

[nessts]

looks like just a pkg to me in the DMG. glad I had not gotten around to pulling apart the other one.

[cwaldrip]

Certainly looks like they got the message. I see a pkg installer now too.

[mm2270]

Rich already posted about this, but on a new thread:
https://jamfnation.jamfsoftware.com/discussion.html?id=13703

Definitely seems like they got the message loud and clear. I'm not sure if the .app installer or the promotion of Ask.com bothered me more, but no matter - I'm glad someone at Oracle came to their senses and reversed course. And I hope whoever came up with the .app/Ask bundle idea got an earful on never doing that again.

[Kennedy]

Thanks to @Ball for the links - I certainly posted some feedback, and clearly many others did as well. Perplexing decision, but at least they took the feedback on-board and sorted it.

That's more than I can say for our basketball umpires tonight.

[mm2270]

I also would not be surprised if the link above posted by @maser had something to do with the reversal as well-
http://www.brunerd.com/blog/2015/03/06/java-8-update-40-installer-app-fun/
That's some pungent swiss cheese security there! To note, the new installer is a signed package. I never checked to see if the other embedded one was also signed, but since the .app wrapper wasn't checking the signature, that was bad news. The reversal should put that to rest though.

[cashxx]

Well it didn't last long....seems to be back to an .app installer off Java.com today! Must be having some inside rumblings! See https://derflounder.wordpress.com and also just checked Java.com myself and it is indeed back to a .app! Frustrating! I wonder whats going on inside of Oracle about this the past few days...lol
Keep emailing them!!

[gskibum]

Has anyone tested the Java 8 Update 45 that was released yesterday?

My experience was that I couldn't get the "Show Package Contents" to appear. However the installer didn't install any of the garbage detailed above. It was just a clean install captured by Composer.

[timsutton]

The latest release doesn't use the .app installer. Again referring to an earlier post in this thread:

https://jamfnation.jamfsoftware.com/discussion.html?id=13567#responseChild80832

[jhbush]

@gskibum so far it looks fine to me. Oracle returned to a .pkg installer which worked as expected. @rtrouton update script works great and detected the new version based on the smart group.

[#21]

Same experience here, neither the pre or postinstall scrips in the package have any reference to any of the Sponsor garbage. That said, I cannot wait to ditch Java entirely.