[NewsPoster]

Oracle's Java Update 8 Update 40 for OS X has an unexpected surprise for installers. The update instructions note that the company has "partnered with companies that offer various products" and will install the borderline-malware Ask.com toolbar into unsuspecting OS X users' systems.

The latest revision is the first on OS X to include the toolbar. The adware, available for five years on Windows, takes search engine control away from the user, and replaces it with Ask.com results. The toolbar is enabled by default during installation.

Ask.com's toolbar can be uninstalled by the moderately technically-savvy from the browser extensions manager in Safari and Chrome. Additionally, the installation overwrites the user's default home page selection.

[OldMacGeek]

Is anyone else pissed right now? . . .

[Flying Meat]

poopie.
Under Windows, you can uninstall the Ask junk "fairly simply". Is that the case with the OS X install?

[slboett]

Use it and avoid the crap:
Control-click the installer app.
Find:
/Java\ 8\ Update\ 40.app/Contents/Resources/JavaAppletPlugin.pkg
Launch that and install java sans BS.

[infowarrior]

Didn't this always happen? I seem to remember seeing Ask.Com stuff showing up during the install, but simply unchecking the box didn't put that crap on my system. Did they change something?

[Mike Wuerthele]

This is the first version on OS X with a checkbox pre-checked, and an additional download not required.

Flying Meat: its uninstallable in the browser extensions selection screen in Chrome and Safari.

[JimWall]

What worries me is that is is a subtle security flaw. It means you really can't just install and upgrade you have to manually check it - which slows down the process and leave vulnerabilities open for longer.

[joshua305]

Its like they screwed up. To prevent java updates from installing "sponsor" software you have to go to the advanced tab of the java control panel and choose to suppress installation. you can't do it in the installer anymore. See: https://www.java.com/en/download/faq/disable_offers.xml
Unfortunately the option to suppress does not exist until after you install this update.

So the solution is to go to Option 2. Unfortunately Option 2 is written for windows. I tried what seemed to be the equivalent process from the mac, and after hitting a couple minor bumps came up with this:

1. Download java (it will be a dmg file) and open the dmg.
2. Copy the Java 8 Update 40 app to your HD. [step 2 and 3 may not be necessary. You can skip them and see if it works without them. I was experimenting and had already moved the app to the HD and renamed it before I thought to show package contents. The worst that will happen is that it will not run.]
3. Select the app (single click) and remove the spaces from the name. (I did this because the spaces cause problems if, like me, you are not good at terminal).
4. Right click on the renamed app [or the not renamed app if you skipped 2 and 3] and choose "Show Package Contents." Open the Folder Contents. Open the folder MacOS. You should see a Unix Executable File named "MacJREInstaller"
5. Open a window in Terminal.
6. Drag MacJREInstaller into the window and then type SPONSORS=0 (there should be a space between the filename and sponsors. On my computer it looked like this: MacBook-Pro:~ joshua$ /Users/joshua/Downloads/Java8Update40.app/Contents/MacOS/MacJREInstaller SPONSORS=0

it will ask for permission to run or install a helper app. great it.

When you are done, go to the java control panel advanced tab and choose "suppress sponsor offers when installing or updating" so you don't have to do this again.

[tntracy]

I just downloaded the Java 8 Update 40 DMG installer from Oracle and ran it. It appears that, IF you deselect the option to replace your current homepage with ask.com, the toolbar is NOT installed. I checked Safari, Chrome & Firefox (all current versions), and, not only was the toolbar not visible, it was not even listed in the extension list in each browser. This was all true after rebooting, as well.

Now, don't get me wrong, it still angers me off that Oracle included this ad-ware in the latest Java update, but at least it appears that not installing it is very easy as long as you pay attention....

[Mike Wuerthele]

Originally Posted by tntracy 

I just downloaded the Java 8 Update 40 DMG installer from Oracle and ran it. It appears that, IF you deselect the option to replace your current homepage with ask.com, the toolbar is NOT installed. I checked Safari, Chrome & Firefox (all current versions), and, not only was the toolbar not visible, it was not even listed in the extension list in each browser. This was all true after rebooting, as well.

Now, don't get me wrong, it still angers me off that Oracle included this ad-ware in the latest Java update, but at least it appears that not installing it is very easy as long as you pay attention....

This is in fact the case - and we mentioned that in the article. My issue with "optional" installs is that they're enabled by default. How many of these just get blown through by a user in a hurry, or used to the previous workflow?

"Extras" NEED to be disabled by default. Enabling crapware installs by default is shady.