-4

As of a few days ago, Bitcoin.org offers MultiBit instead of Bitcoin-Qt on its website: http://bitcoin.org/en/choose-your-wallet

I do not wish to install MultiBit because it requires Sun Java to be preinstalled.

As we all know, Sun Java is full of security holes/exploits and according to The H Security at http://www.h-online.com/security/ Oracle has not patched all of them. How can we trust our money with using a software that has full of security issues? (Note: Sun Java is proprietary software and end users are at the mercy of Oracle when it comes to fixing bugs.)

I hope the developers of MultiBit will drop the Java prerequisite in their next software version.

  • 3
    Security issues in Java aren't really relevant for desktop programs, as desktop programs already have full access to your computer. – Tom van der Woerdt Jul 6 '13 at 11:50
  • 1
    If you want an open source alternative to the Oracle JDK there is also OpenJDK (for Linux). en.wikipedia.org/wiki/OpenJDK – jim618 Jul 6 '13 at 15:31
  • @Tom van der Woerdt: It doesn't matter whether desktop programs already have full access to my PC. If Java has security issues, it has issues. – user5556 Jul 7 '13 at 10:59
  • 1
    @user5556 The Java browser plugin has security issues, not the JRE itself. – Tom van der Woerdt Jul 7 '13 at 11:19
  • 2
    @user5556 With that logic about Java, you should stop using windows then since it has security vulnerabilities. Oracle's insecure browser plugin has absolutely nothing to do with the security of Java – TheLQ Jul 9 '13 at 2:16
3

As per the comments to your main question, it is mainly the Java browser plugin that is the problem. I advise you not to be have that running.

Java for a desktop application is more like a supporting library to the applications you are installing. The usage is different.

It is a good idea to be security conscious with Bitcoin software - the question to ask is: How can rogue code get to run on my machine ?

If you download MultiBit from https://multibit.org (and check its SHA256 hash and/or signature) and download the JDK from a reputable source then you know what you are running.

All that being said, if you still do not want to install Java then I would have a look at Electrum (http://electrum.org) and see that meets your needs.

  • 1
    If you download MultiBit from multibit.org (and check its SHA256 hash and/or signature) and download the JDK from a reputable source then you know what you are running I'm using Microsoft Windows 7 and the only Java that is available for it is Oracle's. Sadly the company has not fully patched all the security holes revealed so far. – user5556 Jul 7 '13 at 11:04
  • 1
    I have just surfed to Electrum's website. It seems that it only offers online wallet. I prefer to store my Bitcoins on my PC, not on some remote server. I can't afford to take any risks. – user5556 Jul 7 '13 at 11:22
  • @user5556 Here's an open source JDK: github.com/alexkasko/… It doesn't have the browser plugin and thus not the security issues. – stommestack Aug 13 '13 at 7:29
  • @user5556: In Electrum the bitcoins are stored on your PC. You just use them with the help of a remote server for convenience, but it cannot take them, and you can use them without the remote server. – Meni Rosenfeld Aug 13 '13 at 8:24
3

If Java is your only concern, just use MultiBit. It is safe to install Java. It's a common myth that Java is insecure. It is not. Only the browser plugin of Java is insecure. So, just install Java and then disable its browser plugin.

EDIT: The makers of Multibit confirm this.


EDIT: Also, you say Java is proprietary software. It is. However, Sun made an open source version of it, OpenJDK. It doesn't include the browser plugin. In case you don't use Linux or BSD: It's only for Linux and BSD however, but the closed one (that is also availible for Windows and Mac OS X) is largely based on the same source code, according to OpenJDK's webpage.

You also say "I hope the developers of MultiBit will drop the Java prerequisite in their next software version.". I hope you realise that would require a total (and unnecessary) rewrite of MultiBit?

  • @Pieter Wuille and Jop: If I were the chief developer of MultiBit, I would definitely rewrite the whole software. Why? Security must be the most important consideration especially when we are talking about money and how to store them safely. – user5556 Jul 10 '13 at 11:59
  • @user5556 You didn't read my answer except for the last line didn't you? Java isn't insecure, it's only the browser plugin. It's completely safe to install it. Just remove the browser plugin afterwards – stommestack Jul 10 '13 at 12:12
  • @user5556 Seriously, there is no point in not writing a piece of software in Java just because of the non-existent security problem – stommestack Jul 10 '13 at 12:30
  • +1 for @Jop for clarifying the java is insecure myth. Java on website is insecure, Java on desktops is not. – spuder Aug 13 '13 at 1:34
0

Most of you got this wrong!

When it comes to BitCoin, security must come first. It has become the target of many black hats lately.

While it is true that most of the security concerns with Java are based around the browser plugin, with MultiBit the issue is even worse - because what bitcoin clients (even multibit) do is they connect to IRC to gather network updates, and they work as both a network client (connect to other nodes and ask for data) and as a server (ready to give data to others). This makes the user even more vulnerable, because they might not even know that they are running in fact a server software on their desktop. Note: it is possible Multibit doesn't have the server part as it doesn't store the whole chain, that would not help much, though.

  • Multibit is a thin SPV client, so it does not act as a server. Nevertheless, it is a complex network application, so it's certainly appropriate to be concerned about the security of both the application code itself and the underlaying technology (Java) as well. Just the fact that the "web plugin Java" is the vulnerable one does not mean the "desktop Java" is bulletproof. The only way to find out is to audit the code, which is obviously not feasible with the original (nonfree) Java VM implementation. – Jozef Oct 19 '14 at 12:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.