Tell me more ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.
up vote 0 down vote favorite

I have a couple of websites I have to use that require Java so I am leaving it on in Java Preferences.app, disabling it on all browsers bar one that will only be used for those sites. Am I safe to leave JavaScript on in Safari's preference's checkbox?

share|improve this question
3  
Java != Javascript. So which one do you mean? – james.garriss Sep 17 '12 at 2:49
1  
As already mentioned by @CanuckSkier below, neither Java nor JavaScript (nor anything else you run on your computer) is guaranteed to be secure. Whether you individually are able or willing to carry the remaining risk is something this site can't answer for you. – patrix♦ Sep 17 '12 at 5:58

closed as not constructive by daviesgeek, patrix♦, Stu Wilson, jmlumpkin, Mark Sep 24 '12 at 12:34

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.

2 Answers

up vote 1 down vote accepted

As a security person, here is what I recommend:

  • Yes, leave Javascript enabled. It is a core part of the web and is about as safe as anything on the web. (Also, if you turn off Javascript, you might as well uninstall your web browser, because almost nothing will work right any more.) While there are no absolutes in life, leaving Javascript enabled is generally safe. Javascript comes enabled by default, and I recommend you leave it that way.

    To give you some relative risk factor: installing Flash or Java is significantly riskier than leaving Javascript enabled. (If you are a security paranoid and really concerned about Javascript, you could install Firefox and use the NoScript extension. However, that doesn't make sense for most people, and isn't necessary for most people.)

  • Get rid of Java. Java is a significant security risk. There have been a spate of security problems in Java. Oracle has not been doing a good job of responding to those problems in a timely fashion. In addition, few sites really need Java. Therefore, for most people, Java is just an unnecessary risk.

    (If you are one of the few who really needs Java for some website to work -- e.g., you turn off Java and you discover some internal corporate site doesn't work any more -- you may need to bite the bullet and leave Java enabled. In that case, you're taking a calculated risk.)

This kind of question is not Safari-specific. For those kinds of non-Apple-specific questions, Security.SE is another good resource.

share|improve this answer
up vote 9 down vote

It's important to make the distinction between Java and JavaScript.

Java is a general purpose programming language and associated runtime originally developed by Sun. Java programs can run inside a browser plug-in. There have been some recent vulnerabilities uncovered, and Apple has taken the step of disabling Java by default.

Javascript is a scripting language used widely on the web to provide all sorts of dynamic behaviour for websites. Like anything, it's never going to be 100% secure, but because it's limited in what it can do (it can modify the behaviour of a webpage, but it can't run arbitrary code on your Mac or modify your files), it's safer than Java.

Javascript is fairly safe to leave on (and it will cripple a lot of sites if you turn it off). If you definitely need Java, then leave it on, but be vigilant about running Software Update so that you get the latest security patches, and consider disabling it if you don't need to access those sites for a while. Disabling it in browsers you don't use for those sites is also a good idea.

share|improve this answer
Thanks CanuckSkier ! – Visitor82 Sep 17 '12 at 7:51

Not the answer you're looking for? Browse other questions tagged or ask your own question.