Java JRE

[sg31]

Sometime ago there was a lot of discussion about Java being vulnerable and an easy way for computers to become infected. I removed Java from my desktop and haven't missed it.

I've just downloaded a programme I need from an equipment manufacturer and it refuses to run because I don't have Java Runtime Environment.

Is it safe to download JRE or is it still considered a risk? Is there a safe substitute?

[syrio]

It is safe to download JRE.

It is not safe to allow any sort of Java to run in the browser. So make sure that the installation does not install any browser plugins, and double check after the installation takes place / make sure that everything Java related is disabled in all the browsers on your computer.

[sg31]

It is safe to download JRE.

It is not safe to allow any sort of Java to run in the browser. So make sure that the installation does not install any browser plugins, and double check after the installation takes place / make sure that everything Java related is disabled in all the browsers on your computer.

Thanks for the reply. I have no idea how to do that. I've just had a quick Google and what I found was using the Java control panel but that seems to allow it to run if certificates are up to date. I'd rather not give Java control if it isn't to be trusted.

Is there a safe alternative to Java?

[johnhemming]

Is there a safe alternative to Java?

The Java Runtime Environment is basically a virtual machine that interprets java object code (which comes in the form of classes - which may be in java archives (jar) ). Hence if something is written in java it need to run in a java runtime environment. It is nice because it runs on a number of different operating systems although there are slight variations (not in java, but in native classes that you may need to use).

There are a number of different JREs, but you need a jre to run java. (although someone somewhere may have written something that compiles java source code into an object code that runs on a system, but that is unlikely to solve your problem).

[sg31]

Is there a safe alternative to Java?

The Java Runtime Environment is basically a virtual machine that interprets java object code (which comes in the form of classes - which may be in java archives (jar) ). Hence if something is written in java it need to run in a java runtime environment. It is nice because it runs on a number of different operating systems although there are slight variations (not in java, but in native classes that you may need to use).

There are a number of different JREs, but you need a jre to run java. (although someone somewhere may have written something that compiles java source code into an object code that runs on a system, but that is unlikely to solve your problem).

Thanks for the explanation. I will avoid Java if I'm not up to restricting it. I will just have to do without the programme I want to run, a shame but I'd rather not take a risk of compromising my security.

[johnhemming]

Thanks for the explanation. I will avoid Java if I'm not up to restricting it. I will just have to do without the programme I want to run, a shame but I'd rather not take a risk of compromising my security.

I am not sure why Java itself creates the insecurity.

Windows (and I am guessing that you are using windows) tends not to have that much security built into the operating system. Android as an alternative has a lot of limiting built into the OS (permissions are needed to access things etc). Hence any lack of security is much the same for a compiled (*.exe/*.com) file or java program on windows. Where there is a risk is running java (as opposed to javascript or ECMAscript) in the browser. There is effort put in by design to prevent javascript doing things that are insecure.

Chrome, for example, does not allow java to run in the browser.

[uspaul666]

Just adding a few points to add to above in case it helps...
It is tricky but worthwhile.
Your could try downloading the “server JRE” from here
http://www.oracle.com/technetwork/java/ ... 38363.html
This doesn’t include the browser plug-in but you’ll have to use a tool that understands tar.gz files...
You’re probably best of installing the standard windows JRE and either saying no to the option of installing the web plug-in or deinstalling the plug in later or taking the option to inactivate the plug-in using the browser settings.
It’s easy to check that java in the browser is turned off by going to https://java.com/en/ and clicking on the “do I have java” button. There’s any number of web tutorials on how to disable java in your browser.

The reason why java is relatively safe on your PC whereas it is not safe in your browser is because the java in your browser can be asked to run any program the web site you’re visiting asks it to. There are bugs in just about all programs and the java JRE and the browser are two of those programs. Allowing websites to run java programs in your browser is making it easier for bad people to attempt to exploit those bugs for bad purposes. In industry, java is still the predominant programming language and is just about everywhere. But not in the browser, not anymore.
Btw. Do not get confused between “Java (plug-in)” and “JavaScript”. JavaScript is something quite different despite the name has no connection with java at all!
(Really hoping this post won’t increase confusion)

[sg31]

Hi, I tend to use Firefox and IE as my main browsers. I've used Chrome on my laptop without problems.

From your comments I could download the programme and Java to my laptop if I only use Chrome on it. In fact I'm not too bothered if the laptop is insecure, I only use it occasionally and never for anything needing security because it's usually connected via public WIFI. It is never connected to my home network.

My desktop is my main computer and I do a lot of banking, investments etc online which is why I'm twitchy about security. At a push I could download Java to it, run the programme to do the calculations I need then delete Java with Revo uninstaller.

I only need to do the calculations on an irregular basis so that would be fine.

Thanks for you help, with your input I've found a workaround.

[sg31]

Thanks for your input uspaul666, You must have posted while I was typing. I'll give your suggestion a try, if I can make it work that will solve the problem, otherwise I can use the workaround.

[johnhemming]

You should be able to disable Java in Firefox and IE.

Here are some links (I have not read them)
https://support.mozilla.org/en-US/kb/ho ... va-applets

https://nakedsecurity.sophos.com/how-to ... -explorer/

Edge it appears does not support Java.

[sg31]

Thanks johnhemming, I'll have a look at those tomorrow.

[hiriskpaul]

Thanks johnhemming, I'll have a look at those tomorrow.

Oracle are phasing out support or Java in browsers (applets and Java Web Start).

By coincidence I downloaded the latest JDK today and on installing the JRE, I noticed there was a tick box asking whether browser support should be added. So no real need to disable it, just don't install it.

[UncleEbenezer]

It is safe to download JRE.

So long as you verify its provenance (as with any download). Note there are several choices of JRE.

It is not safe to allow any sort of Java to run in the browser. So make sure that the installation does not install any browser plugins, and double check after the installation takes place / make sure that everything Java related is disabled in all the browsers on your computer.

Indeed, the potential risk is that your browser might run untrusted code. And your browser probably does run untrusted third-party code: for example, it happens on a small scale if you use any editor features in posting to lemonfool, and on a much larger scale if you use more elaborate content.

[Infrasonic]

My desktop is my main computer and I do a lot of banking, investments etc online which is why I'm twitchy about security. At a push I could download Java to it, run the programme to do the calculations I need then delete Java with Revo uninstaller.

If you aren't technically confident then the best bet is to have a specific security focused browser (in addition to your regular browsers) which you keep solely for the sensitive stuff like banking.
There are several around that will delete cookies, passwords, history, cache et al on exit by default. They may whitelist other active content if needed.
https://www.techworld.com/security/best ... s-3246550/

If you are technically aware then you can just set up one of your regular browsers to be security focused in the same way by altering the advanced settings and using the various encryption and blocking add ons/extensions.

Bear in mind that if you block everything then the website functionality takes a nosedive. Many sites won't work properly if you block first party cookies or Javascript for example. Chrome browser is very flexible here in that you can block most stuff 'globally' in settings and then whitelist individually on a per site basis as needed, (the same with the add on extensions.)
I'd imagine you could do similar in Firefox. I use it (in a Linux Mint VM) but am not as up to date on the capability as I am with Chrome and Edge on W10.