Hacker News Reader

Comment by bpodgursky | Hacker News Reader

JVM security concerns are irrelevant when you are running a desktop application. You aren't running it as root, and you aren't executing arbitrary code as if you were running applets.

If arbitrary code is able to access the JVM on your computer, then you already have arbitrary code running on your computer.

View on HN

Ok, though I still believe "less is more". Also prevents my browser from doing anything clever, like enabling the browser extension behind my back.

If you're truly worried about the second point, to run JetBrains software all you need is to download the jvm somewhere on your system (it's just a directory) and set the JAVA_HOME variable before starting it:

export JAVA_HOME=/my/install/dir; bin/pycharm.sh

There is really no conceivable way that your browser would be scanning your operating system looking for a downloaded JVM (if it does that, it's not a browser, it's a virus.)

If you truly are religiously against jvm it's w/e to me, but the security concerns are not valid.

Sorry, not going to set up a custom runtime for an editor. Note the "giant runtime" concern I put first.

I'd use the system java/browser which has an extension available, no need to scan. FF just enabled javascript for everyone without their permission, and Chrome does plenty of shady things. The fewer software installed, the better. I prefer to stay far away from potential security problems, with multiple hurdles whenever possible. If it makes you feel better I don't install flash or ruby either unless the situation calls for it.

imo you are making huge tradeoffs for very little benefit, as there is no such thing as a 100% secure system anyway. But still its your decision, to each their own.

I learned this paranoia while running Windows XP through the 2000's and I can tell you it served me very well. While others were rebuilding their systems I was working.

I realize Linux in 2013 is not so dangerous, but take a gander at recent java security bulletins when you get a chance anyway. Steve Gibson recommends not even having it installed if you don't need it (I don't) and that's good enough for me.

Also, I think you may be overselling the trade-offs. I've not been inconvenienced in the last decade of avoiding java, as far as I can remember. On occasion I will install random things into a VM for temporary experimentation.

> I realize Linux in 2013 is not so dangerous, but take a gander at recent java security bulletins when you get a chance anyway.

Off the top of my head, all of the recent serious vulnerabilities were applet related. The JRE doesn't require a Java plugin for your browser, no plugin, no applets.

>I'd use the system java/browser which has an extension available, no need to scan. System java? Which OS (barring Oracle Linux) ships with JRE pre-installed? Browser extension for Java? I assume your familiarity about the Java ecosystem has not been updated since HotJava (or whatever it was called).

sudo apt-get install ...

Reply on news.ycombinator.com