Re: Java plugin phase out timeline

On Monday, June 27, 2016 at 11:39:41 AM UTC-4, Benjamin Smedberg wrote:
> On Fri, Jun 24, 2016 at 6:28 PM, Java Dev wrote:
> 
> >
> >
> > Also, I have been puzzled about something else recently. Even if the NPAPI
> > plug-ins are allowed in Firefox ESR, how is the "plug-in black list" in
> > Firefox ESR handled? Would Java be blocked somehow in it? In other words,
> > is there a possibility that Java as a plug-in would be blocked in the
> > Firefox ESR "plug-in black list", even though NPAPI plug-in's as a whole
> > would still be allowed? And how likely is this to actually happen?
> > Appreciate your help with these questions.
> 
> 
> The purpose of the plugin blocklist is to keep users secure from
> known-vulnerable versions of various plugins.  We regularly add old
> versions of Flash and Java to the blocklist when security updates are
> released. We also periodically may add the *current* version of plugins to
> the blocklist if there are unpatched vulnerabilities which are being
> actively exploited in the wild.
> 
> This is no different for ESR than normal release channels, and we will
> continue to maintain this blocklist for Java versions through the end of
> the supported ESR cycle.
> 
> --BDS

Thank you for addressing this topic as well. When the non-ESR version that blocks all NPAPI plugins is released, it would not need a blocklist anymore. Therefore, the blocklist would be used only by the ESR version while NPAPI plugins are still allowed for it. Is this correct? As such, is it possible to keep, at a minimum, the latest updates of Java available (not blocked) so that users can continue using Java with the ESR version while it still supports NPAPI plugins?

Best Regards,
Alexandra