Why can't Java update automatically?

Question

We've all seen the numerous reports about serious security problems related to Java. It's not really a new thing but it seems to have been more highlighted lately.

Update after update have been released to address these issues, and it's really great that they're trying to fix these issues. But what use do updates have if the users aren't installing them? I have seen so many users that just click away that little Java update notification window, or even worse, they turn off Java update check because it's so annoying to get those messages all the time.

Sometimes I feel it's best to just remove Java all together and get rid of this security issue once and for all. But it's not that easy, we all have some programs, plugins etc that needs it.

I've seen some questions here on Superuser related to how to push Java updates to clients on your network using GP or How to write scripts that run Java update for you. But that's not really what I'm wondering.

My question is: What is the reason why Java can't be set to update automatically, especially since there are so many security issues with it?

• Is it because it has to be "run as administrator" and "there is no other way"? I still think the installation could be more "run in the background" with the user just approving it in the beginning.
• Is it so that Java can sell in that Ask.com toolbar for browsers they're always asking about during the installation process. Are they locked up in some kind of slick legal agreement forcing them to show that question to the users for the coming 50 years?
• Has the Java team/Oracle lost their grip of what the users need, or are they just ignorant?

Not all people would like an automatic installation, I completely get that. But most people (like me) are lazy/ignorant by nature and they would surely benefit from such a feature. There should at least be an option to "always update to the latest version", or is that too much to ask from Oracle?

Solution

There are a number of contributing factors like size and packaging type and the admin requirement, but the most important is that over the year hundreds of thousands of java programs have been written targeting specific java versions, and the maintenance scheme they've chosen introduces incompatibilities with every major release (via object/method deprecation and blacklisting). Many apps work fine on multiple major versions, but many do not. the change between 1.4 and 1.5 was particularly troublesome, and many development folks are hesitant about 8+.

As a result, in order to run your favorite programs, you need the ability to keep older run times installed, and control how/when they update.

Comments

[kinokijuf]

Do you seriously think we have an answer to your question? Go and ask Oracle (pun intended).

[Ohlin]

No, not completely...but I was thinking that someone knows an answer more reasonable that I do. There might be good reasons and the answer given by Frank Thomas is definitely one of them.

[Ohlin]

Yes, that is definitely a reason why automatic updates would be more problematic. I do think normal home users have no idea of what version their Java programs/plugins (if they have any) support, but such is life I guess.