Is Java Safe or is it going to be back door into Linux virus?

Question

There has been a lot of talk that Java is not safe (can be attacked, virus, etc.) recently, and due to the nature of some of the security problems, will never be fixed. I was told to remove Java from Firefox (not Java Script). Libre Office uses Java as part of the Base section.

Is Java going to be the 'back door' into Linux virus', attacks, etc.

Answer 1

There's been a lot of hype and disinformation.

(Part of this is because Oracle owns Java now; indeed it's widely thought that Oracle bought Sun just for Java, really. And whereas lots of people liked Sun, which was a pretty good citizen of the FOSS community, everyone hates Oracle, which isn't.)

On Linux, you're still fairly safe.

You need Java for LibreOffice, as you note.

If you're still on IcedTea 6, I'd suggest that you update to IcedTea 7 - it's in the repositories. Keep your computer(s) scrupulously up-to-date, and if you're feeling really paranoid, just remove the icedtea-?-plugin package; this will leave Java installed on your computer (for local Java apps) but disable it in your web browser.

Answer 2

As a web language, it has issues that Oracle seems unlikely ever to fix. As a programming language, it's no more or less secure than anything else. So you don't need to uninstall Java - but it's not a bad idea (unless you know you need it for some favorite site) to disable it or remove it from browsers. And install NoScript regardless, because JavaScript is pretty bad too.

Answer 3

There are known vulnerabilities in the Java sandbox security that Oracle is having lots of difficulties addressing. Since you need the JVM to run applets in the browser, the recommendation has been to turn off Java in the browser, so that you are not at risk from unsigned applets and other mischief that may result from a web site trying to take advantage of your browser running Java.

As far as Java on the server side, Java will be as secure as any other development language dependent on the skill of the developer(s) writing the server side code. There is no such thing as a bullet proof web
application, the attack vectors are numerous (i.e. sql injection, buffer overflows, etc...) But developers following good practices have learned to mitigate these types of attacks. This will be true whether you are in the Java or .NET camp.