5

I have an old version of Photoshop that requires an outdated Java runtime.

"More info" takes me to this Apple support page where you can download the older JRE.

Seems reasonable enough, but I am slightly concerned.

My question:

Could installing this deprecated, unsupported JRE make my system more vulnerable to malware?

Additional details:

  • I'm running macOS 10.13.6 (17G65) High Sierra.

  • As far as I'm aware, I'm only using Java to (prospectively) run Photoshop.

  • I never install Java extensions for browsers, so this question only has to do with desktop applications.

  • Under "Security & Privacy" I've selected "Only allow apps from the App Store and identified developers".

|improve this question
2

I don’t consider java a safe tool to install period. Unless you have a very compelling reason, or some specific threat model, don’t install java if you want security in your Mac. It’s worse to install older versions that don’t get current security patches in general.

I’d look at something like Pixelmator or Acorn or even a newer Photoshop since your photoshop won’t get security patches anymore either.

https://www.engadget.com/2013/05/14/pixelmator-and-acorn-economic-practical-image-editors/

Your mitigation steps in additional details are all solid and well reasoned and each reduces your risk to security. so I can’t say the risk wouldn’t be worth it to you once you evaluate the alternatives I’ve mentioned.

I can say, I’d choose to not use photoshop CS 5.1 and java in my case.

|improve this answer
  • nonsense. Java is generally secure, far more secure than some random thing you download from the internet. I do agree that you shouldn't install old versions of anything without very good reason, but that's another story entirely. – jwenting Apr 17 '19 at 7:25
  • @jwenting I can agree to disagree if that's where it lands. Are you saying running Photoshop CS 5.1 and Java SE 6 runtime on machines that aren't necessarily managed by professional staff is secure? We expend considerable resources at work to secure / mitigate / sandbox java runtime since it allows random things that are downloaded from the internet to run locally. I'm not against Java being managed. However in this context I don't consider this setup safe or recommended and suggest most individuals avoid it unless/until they're supported and secured. – bmike♦ Apr 17 '19 at 11:38
  • No, I'm saying using Java isn't necessarily insecure. One should of course always use the most current version of anything if possible, and barring that the latest supported version that meets the requirements if possible, which for Java would effectively mean 11.02 or 1.8.201 (202 is 201 with tweaks for some specific users but effectively identical). I'd certainly advise OP to figure out whether an up to date version of Java will do the trick for him (probably 1.8, as 11 is often tricky for backwards compatibility) or whether he can use an alternative to that old Photoshop. – jwenting Apr 18 '19 at 3:40
  • And no, Java doesn't allow random things downloaded from the internet to be run any more than anything else does. If I download a random exe from the internet I can run it as well, and with Java it'd at least have some restrictions on what it can do with my machine. I'm a Java developer, been using it since 1.06, or maybe 1.07. Of course if you're in an environment you're not allowing anything to run that's not installed by sysops, you'd not want people to install Java either, but you may just install Java as sysops and restrict access to the JVM to authorised applications for example. – jwenting Apr 18 '19 at 3:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .