Re: Java plugin phase out timeline

On Fri, Jun 24, 2016 at 6:28 PM, Java Dev <[email protected]> wrote:

>
>
> Also, I have been puzzled about something else recently. Even if the NPAPI
> plug-ins are allowed in Firefox ESR, how is the "plug-in black list" in
> Firefox ESR handled? Would Java be blocked somehow in it? In other words,
> is there a possibility that Java as a plug-in would be blocked in the
> Firefox ESR "plug-in black list", even though NPAPI plug-in's as a whole
> would still be allowed? And how likely is this to actually happen?
> Appreciate your help with these questions.


The purpose of the plugin blocklist is to keep users secure from
known-vulnerable versions of various plugins.  We regularly add old
versions of Flash and Java to the blocklist when security updates are
released. We also periodically may add the *current* version of plugins to
the blocklist if there are unpatched vulnerabilities which are being
actively exploited in the wild.

This is no different for ESR than normal release channels, and we will
continue to maintain this blocklist for Java versions through the end of
the supported ESR cycle.

--BDS