Is Java safe to use?

[Remontti]

I would like to have career mode for Flying Circus and PWCG is apparently the solution. But PWCG needs Java. I recall that Java atleast used to be some kind of security threat. How is it nowadays? Safe to use?

[dburne]

1 hour ago, Remontti said:

I would like to have career mode for Flying Circus and PWCG is apparently the solution. But PWCG needs Java. I recall that Java atleast used to be some kind of security threat. How is it nowadays? Safe to use?

 

As far as I know it should be, at least I have never had a problem with it and been using PWCG since the original Rise of Flight days.

Of course safe computing practices should always be observed.

Note for the current version of PWCG you need the 64 bit version of Java. Link should be in one of the PWCG threads.

Edited April 25, 2020 by dburne

[Izel]

Yes, Java gained the "security-threat" reputation due to some exploitable security holes discovered early; however that was from a time when it was pushed as a way to create a richer, app-like experience in the early days of the web. Browsers allowed you to run supposedly safe, sandboxed apps known as applets, and that's where the threat came from; you could browse a page and inadvertently run a hostile applet that could escape the sandbox and compromise your system. However that is not the case here. PWCG is an application running locally in your computer under the Java runtime, and unless it explicitly opens some kind of backdoor, which I STRONGLY doubt, running it should be perfectly safe. 

Edited April 25, 2020 by Izel

[PatrickAWlson]

It's not Java but what you are running.  "Java" is just a virtual environment that runs a Java program.  By itself it does not pose security issues.

 

Which brings us to PWCG, which is what you will be running.  PWCG has absolutely ZERO network code.  It does not talk to anything - EVER.  Even its data handling is done through  JSON files on the file system.  It does not use a database at all, therefore no need for a database connection.

 

Java's security rep comes from a number of things.  Bad browser code is #1.  Even the installer was compromised at one point.  Issues like these have largely been resolved.  Make sure that you pull Java from Oracle's site.  Don't take it from anywhere else.  Like any internet download, know where you are getting it from.  

 

Java is the preeminent business environment.  There are billions of lines of Java out there handling critical business data.  The deficiencies come when people do stupid crap like transmitting unencrypted data, allowing SQL and other forms of injection by executing data, and various other very bad practices.    PWCG handles this by not transmitting anything, ever and not taking any data from the outside, ever, and not executing data, ever.  The best kind of security is don't do external communications, and that is what PWCG does.

 

P.S. if you think running Java on your system presents a security risk - every time you log into your bank account, that server on the other side is probably running Java  

 

 

Edited April 25, 2020 by PatrickAWlson