Dear LW People

A serious vulnerability has been found in the Java applet, see for further details.

My question is this: Will this security flaw allow someone to hack into my PC when I am using LW Pro (International) or should I move over to LW Pro (English/USA), which can use different versions of Java, and avoid the security problem?


UK Bob

This security flaw only affects java applets used on websites. It has nothing to do with LimeWire. - Still, you should considering updating java if you are using java 1.4.2_05 or earlier.

Cheers trap_jaw4

I use LW Pro (International), which uses Java V1.3, and at this time there is no way to get it to use later versions of Java.

I suppose you could ask why don't I use the English/USA installation of LW Pro, which is able to use any installed version of Java. The simple answer is that LW Pro (International) is stable, i.e. I have had no real problems with it, and, apart from security, I value stability above everything else.




UK Bob

All versions should be able to use the latest Java. If you have problems ask the developers for support you paid for it.

I never used the US version, but as far as I know the code is the same. The differences are that the international version offers other languages. In theory they should work in the same way...

Again write a mail to the developers that they can fix it if there is a bug.

Morgwen

__________________
patience is a virtue

There's been many many posts on the international vs english installers, and why the international one requires Java 1.3 right now. You can also install Java 1.4 side-by-side, and applets will use the more recent version.

Dear Morgwen

I have sent many posts and had discussions with sberlin about LW Pro (International)'s inability to use anything but Java V1.3. However, when I get home tonight, I will download LW Pro V4.2.3 and re-download Java 1.4.

I'll let you know how I get on.



UK Bob

Hm, simply deleting the v1.3 JRE from the LimeWire program directory to force it to use the newer version used to work fairly well, - back in the days....

I'm just a bit curious. I installed english installer of LW 4.2.3 for windows today on somebody's comp. It asked for Java 1.3.x I stopped installation & installed 1.5 & then reinstalled LW. It didn't ask for java again. But why did it ask for Java 1.3 instead of asking for a later version or just 'Java'? Does that have something to do with minimum requirements & that's all it asks for? It also strangely happily connected despite xp firewall being on (without configuration for LW.)

Dear People

I have installed LW Pro V4.2.3 (International) and I have Java V1.5 installed on my PC, trying to reinstall Java V1.4 did not entirely work because V1.5 was already there.

However, LW Pro V4.2.3 did not recognise that Java V1.5 was installed and it is only using the Java applet it downloaded with, namely V1.3.

As I said before, my main goal is to maintain stability over features because I use my PC for other important tasks, like home/internet banking, rather than just entertainment.

Saying all that, I would still like LW Pro V4.2.3 to use my latest Java installation without having the bother of deleting V1.3. But I guess this is not to be.



UK Bob

Dear LOTR

I use WinXP SP1 along with Norton Personal Firewall 2003, I also use other protection software which is not relevant to this discussion.

I have turned on my XP firewall, which is not really a firewall because although it will block some things from getting into your PC it will not stop anything from getting out. I understand that the SP2 firewall works in exactly the same manner. Therefore, there is no surprise that LW can access the Internet without any configuration of XP’s (so called) firewall.

However, NPF2003 can auto or manually configure your PCs protection for both incoming and out going communications with the Internet and, in my opinion, is well worth having.



UK Bob

I realise I was side-tracking a little with the firewall issue. Sorry about that. But thanks for the info & advice, much appreciated UK Bob!

Cheers

Lotr

ukbobby -- as I've said in every single post about the installers, the international installer will use Java 1.3 unless you delete the 'jre' subdirectory from LimeWire. If you want to use a newer version of Java and not delete the 'jre' directory, use the English installer. Mentions of stability, etc... are a moot point, because they're the exact same program.

LOTR -- The LimeWire installer installs Java 1.3 right now if it doesn't detect any version of Java on the machine. This is because the 1.3 JRE is about 1/3 the size of the 1.4 or 1.5 JRE, and when someone installs LimeWire, we want them to be able to use it ASAP. As I mentioned in an elsewhere (a while ago), we're exploring ways to unify the installers and use a newer version of Java by default.

Dear sberlin

Thanks for your summary of the Java problem, but I do feel that as a user I should not have to delete V1.3 to get LW Pro to use my installed V1.5, LW should detect the latest version of Java automatically. As the LW team are working towards this goal then I can wait until the finished product is ready.

In addition, you say stability is a moot point, which is probably correct from a technical point of view and looking at LW in isolation. However, I have to consider my PC as a whole, the myriad of things I call upon it do and whether I should risk its destabilisation in the hope of getting a few extra features.

As I have said before, the stability and security of my PC mean more to me than anything else.




UK Bob

Like 99% of all other users, but Sam explained you that the international and English versions are the same. Same program same stability.

Morgwen

__________________
patience is a virtue

You know Morgwen

want stability, I wish that was true because based on my own experience I know of home users that do not think about security or stability, until something goes wrong.

I have a colleague that has been working in IT for about 30 years yet his attitude towards his home computer has been cavalier, until his browser and Internet connection got hi-jacked.

My sister told me that she would not use a firewall on her home PC because it slowed down her Internet surfing. A month or two later I got a plaintive e-mail cry for help detailing the problems she was having. She had so many problems that all I could advise was that she did a complete reinstall of her system.

If my experience is typical then most home users do not really think about security or/and stability just about getting on the web as soon as possible.




UK Bob