Oracle's plan to dump its Java browser plug-in came as no surprise to two ISVs in the Java ecosystem, but they differ in their views on the viability of Java Web Start, Oracle's designated replacement for the plug-in.
Oracle's JDK team has "wanted to [drop the plug-in] for some time," said Simon Ritter, deputy CTO at JVM technology vendor Azul Systems, in an email. "If you look at the security vulnerabilities reported for Java in the last few years, the vast majority have been in the plug-in, affecting browser-based applications. Since the Java plug-in is not part of the Java SE standard, Oracle -- or any other Java platform provider -- [is] under no obligation to support this."
Fred Simon, chief architect at devops tools vendor JFrog, said in an email that Oracle's move would not mean much. "I don't think anyone was still using Java applets today. There are still some legacy ones, but they will have problems running on Java 9 anyway."
With HTML5 and powerful JavaScript engines in browsers, the need for applets and even Flash Player disappeared, Simon said. Java applets have been converted to HTML5 and JavaScript or Java desktop applications, he said.
Furthermore, the plug-in will still be around for a while. Recognizing the growing distaste for browser plug-ins among browser vendors, Oracle last week decided to deprecate its Java plug-in in JDK 9 and remove it some time afterward. But JDK 9 is not due until March 2017.
"Developers have plenty of time to work out their migration strategy since it is over a year until JDK 9 is released and at least two more years before it may be removed in JDK 10," Ritter said. "That means that Oracle has committed to support the Java plug-in until at least 2019."
The two ISVs differed, however, over the viability of Java Web Start. "It is already dead," Simon said. "There are no more applications using it, they all migrated to Web and mobile." Web Start, he said, was not easy to configure or distribute. "Every Web Start [application] that we used to see out there, they got fully converted," to desktop applications, he said.
Ritter was more receptive -- albeit with a reservation about security. "Anyone who has applications still using the plug-in should be working on a plan for migration to alternatives like Java Web Start," he said.
Java Web Start, Ritter said, "provides the ability to deliver applications in a way that is somewhat similar to the Java plug-in, but without requiring the use of a browser."
While Java Web Start has also had its share of security vulnerabilities in the past, eliminating the plug-in will probably still improve the security stance for Java on the desktop compared to what it has been. And since Java Web Start applications can be launched from a Web browser without the need for the Java plug-in, it provides a useful migration path away from applications using the Java plug-in.
One analyst said developers simply need to stop building applets. "Seriously, software that relies on applets and Java Web Start -- and any other plug-in technologies [such as] Silverlight, Air -- has to be rewritten to incorporate modern UI approaches," said John Rymer, an analyst at Forrester. "Apps used within enterprises in which IT can control the browsers used will be sustainable for years, but the majority of apps need to be rewritten to strip out plug-ins. The only thing 'surprising' here is Oracle pulling the trigger on Java plug-ins; the trend away from browser plug-ins is not news."
Developers started to use Java on the server side after its initial viral success was based on applets in a browser, Simon said. "The original drive to use Java for cool animations faded, and Java got used mainly on all the servers delivering big Web applications." Android applications are basically the only place where Java is still used to develop user interfaces, Simon said.