Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I know very little about how Java works and its interactions with OS X, so I'm partly looking for an expert and simple description on how Java works on the Mac, and why so much press includes "fear, uncertainty, doubt" but no concrete details about how and why Java is not safe..

I want to use the Bitcoin client Multibit, but to do so I will need to install Java which over the past six months I've only heard bad things about.

So my question is: How safe is it for me to install Java on Mac OS X 10.8.3?

(The hidden question inside this question is what version / source of Java I should select if I can depend on Apple to keep Java secure.)

I understand "safeness" is a fairly difficult thing to define, but just some general advice would be greatly appreciated. Even if someone could point me in the direction of some learning materials so I can work this out for myself, that would be great.

share|improve this question
2  
Other than being a bad human by encouraging the continued use of Java, you should be fine. –  jnovack Apr 4 '13 at 21:25
    
This question is about Multibit client and how safe is to use it. –  Buscar 웃 Apr 6 '13 at 9:30
2  
@Buscar The question is very broadly about how safe it is to use Java for standalone applications. –  patrix Apr 6 '13 at 10:46
    
No it is not, The user does not understand that the Multibit will use java to perform its online activity. Not as standalone. So it is a wrong question. –  Buscar 웃 Apr 6 '13 at 11:03
2  
@buscar Using Java as an application environment is as safe or unsafe as using Cocoa, .Net etc. The security issues arise from running Java in the browser where it should be sandboxed but sometimes isn't. If you want to discuss further, please come to the chat room. –  patrix Apr 6 '13 at 12:14
add comment

3 Answers

up vote -8 down vote accepted

Yes, it is safe to install Java on you computer.

To answer your second question, is it safe to use http://multibit.org/ with Java for online transactions, the answer is use Caution as with any money transaction on the web.

The real question is about the Mulibit client as you pointed out. Multibit is not the safest out there so consider using others. Multibit connects directly to the network, and there could be your problem. Means you would have to keep the Multibit up to date, but that is no quarantine either.

http://bitcoinmagazine.com/bitcoin-wallet-options/

...There is also more specific website for this type of question here:

http://bitcoin.stackexchange.com/

Just to add my personal advice, I would caution you with such products, unless you are expert in keeping your computer safe.

It is your money!

share|improve this answer
1  
This is the direction I was leaning in, I think I will just avoid it for now! Thanks for the quick answer! –  Panrubius Apr 4 '13 at 14:34
7  
Note that neither of these would affect your use in BitCoin as they are both related to the Java plugin in a browser which is a separate use to command line java –  Mark Apr 4 '13 at 15:27
2  
@Mark The question was How Safe is Java! And the JS plug in is not safer. –  Buscar 웃 Apr 4 '13 at 18:10
5  
This answer is completely misleading. –  Martín Marconcini Apr 4 '13 at 19:16
9  
The user is asking about Java, not the Java Plug in. The plug in has nothing to do with how the Java language works or is designed (for the most part) and it's a crap piece of software. I'd blame the Browser's first, but it's easier to just tell the browser don't use that, it's something you can't control and bad things can happen. Anyway, let's stay on topic. Java is not necessarily unsafe. The Java Plug-in may be. –  Martín Marconcini Apr 4 '13 at 19:27
show 10 more comments

The Java Runtime Environment (JRE) and the Java SDK are not inherently unsafe. The problem relies for the most part in certain ways the JVM (Java Virtual Machine) accesses (and can be fooled to) certain pieces of the operating system.

Like every other complex piece of software, Java is no different than, say, .NET on a Windows machine or Mono.NET on any flavor.

Java on a browser, however, is a different world (and hence why you can go ahead and disable it in most modern browsers), similar to (but not as bad as) what ActiveX was back in the days of Internet Explorer.

You can safely have the JRE in your Macintosh, Linux or Windows machine with little danger, since no element of the Java RE or SDK will expose remote vulnerabilities by default. It's just a lot of code sitting in your Hard Drive.

Now if you want to know if executing Java software is unsafe, then there's no way to answer that without diving into huge arguments. If you want to run Java Software, just go to Oracle, download the Runtime environment and run your Java program. It will not be activated by default on Safari (but double check to be sure) or any other browser.

With all that said, Java is annoying (especially their updater, which you can tone down or disable but never ceases to be as annoying or sometimes more than the Flash Updater if you have Flash). On the other hand, Oracle finally started rolling more periodic updates to Java so vulnerabilities are taken care more often (which is annoying but good). When Apple was in control of the SDK, this wasn't the case.

Of course, some "security experts" will cry out loud that having Java in your hard drive can lead to more insecurity since someone gains access to your computer, they could exploit local Java vulnerabilities. Trust me, if anyone gains access to your computer (even remote) to the point where they can execute anything (including Java), you have a bigger problem.

So if you need it, go ahead and get it.

share|improve this answer
add comment

The Java exploits have been accessing through java on websites. You do not need to enable this e.g. in Safari you can set a preference to use Java or not.

If you have a command line java application (e.g. Bitcoin) this is then is as risky as an other application. You need to make sure you have the latest version of third party libraries and executables to keep up to date with security fixes.

share|improve this answer
1  
(just pointing out he's referring not to the default Bitcoin client, which isn't written in Java, but to a specific third-party client, Multibit) –  Lohoris Apr 5 '13 at 13:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.