-4

As of a few days ago, Bitcoin.org offers MultiBit instead of Bitcoin-Qt on its website: http://bitcoin.org/en/choose-your-wallet

I do not wish to install MultiBit because it requires Sun Java to be preinstalled.

As we all know, Sun Java is full of security holes/exploits and according to The H Security at http://www.h-online.com/security/ Oracle has not patched all of them. How can we trust our money with using a software that has full of security issues? (Note: Sun Java is proprietary software and end users are at the mercy of Oracle when it comes to fixing bugs.)

I hope the developers of MultiBit will drop the Java prerequisite in their next software version.

11
  • 3
    Security issues in Java aren't really relevant for desktop programs, as desktop programs already have full access to your computer. Jul 6, 2013 at 11:50
  • 1
    If you want an open source alternative to the Oracle JDK there is also OpenJDK (for Linux). en.wikipedia.org/wiki/OpenJDK
    – jim618
    Jul 6, 2013 at 15:31
  • @Tom van der Woerdt: It doesn't matter whether desktop programs already have full access to my PC. If Java has security issues, it has issues.
    – user5556
    Jul 7, 2013 at 10:59
  • 1
    @user5556 The Java browser plugin has security issues, not the JRE itself. Jul 7, 2013 at 11:19
  • 2
    @user5556 With that logic about Java, you should stop using windows then since it has security vulnerabilities. Oracle's insecure browser plugin has absolutely nothing to do with the security of Java
    – TheLQ
    Jul 9, 2013 at 2:16

3 Answers 3

3

As per the comments to your main question, it is mainly the Java browser plugin that is the problem. I advise you not to be have that running.

Java for a desktop application is more like a supporting library to the applications you are installing. The usage is different.

It is a good idea to be security conscious with Bitcoin software - the question to ask is: How can rogue code get to run on my machine ?

If you download MultiBit from https://multibit.org (and check its SHA256 hash and/or signature) and download the JDK from a reputable source then you know what you are running.

All that being said, if you still do not want to install Java then I would have a look at Electrum (http://electrum.org) and see that meets your needs.

4
  • 1
    If you download MultiBit from multibit.org (and check its SHA256 hash and/or signature) and download the JDK from a reputable source then you know what you are running I'm using Microsoft Windows 7 and the only Java that is available for it is Oracle's. Sadly the company has not fully patched all the security holes revealed so far.
    – user5556
    Jul 7, 2013 at 11:04
  • 1
    I have just surfed to Electrum's website. It seems that it only offers online wallet. I prefer to store my Bitcoins on my PC, not on some remote server. I can't afford to take any risks.
    – user5556
    Jul 7, 2013 at 11:22
  • @user5556 Here's an open source JDK: github.com/alexkasko/… It doesn't have the browser plugin and thus not the security issues.
    – jobukkit
    Aug 13, 2013 at 7:29
  • @user5556: In Electrum the bitcoins are stored on your PC. You just use them with the help of a remote server for convenience, but it cannot take them, and you can use them without the remote server. Aug 13, 2013 at 8:24
3

If Java is your only concern, just use MultiBit. It is safe to install Java. It's a common myth that Java is insecure. It is not. Only the browser plugin of Java is insecure. So, just install Java and then disable its browser plugin.

EDIT: The makers of Multibit confirm this.


EDIT: Also, you say Java is proprietary software. It is. However, Sun made an open source version of it, OpenJDK. It doesn't include the browser plugin. In case you don't use Linux or BSD: It's only for Linux and BSD however, but the closed one (that is also availible for Windows and Mac OS X) is largely based on the same source code, according to OpenJDK's webpage.

You also say "I hope the developers of MultiBit will drop the Java prerequisite in their next software version.". I hope you realise that would require a total (and unnecessary) rewrite of MultiBit?

4
  • @Pieter Wuille and Jop: If I were the chief developer of MultiBit, I would definitely rewrite the whole software. Why? Security must be the most important consideration especially when we are talking about money and how to store them safely.
    – user5556
    Jul 10, 2013 at 11:59
  • @user5556 You didn't read my answer except for the last line didn't you? Java isn't insecure, it's only the browser plugin. It's completely safe to install it. Just remove the browser plugin afterwards
    – jobukkit
    Jul 10, 2013 at 12:12
  • @user5556 Seriously, there is no point in not writing a piece of software in Java just because of the non-existent security problem
    – jobukkit
    Jul 10, 2013 at 12:30
  • +1 for @Jop for clarifying the java is insecure myth. Java on website is insecure, Java on desktops is not.
    – spuder
    Aug 13, 2013 at 1:34
0

Most of you got this wrong!

When it comes to BitCoin, security must come first. It has become the target of many black hats lately.

While it is true that most of the security concerns with Java are based around the browser plugin, with MultiBit the issue is even worse - because what bitcoin clients (even multibit) do is they connect to IRC to gather network updates, and they work as both a network client (connect to other nodes and ask for data) and as a server (ready to give data to others). This makes the user even more vulnerable, because they might not even know that they are running in fact a server software on their desktop. Note: it is possible Multibit doesn't have the server part as it doesn't store the whole chain, that would not help much, though.

1
  • Multibit is a thin SPV client, so it does not act as a server. Nevertheless, it is a complex network application, so it's certainly appropriate to be concerned about the security of both the application code itself and the underlaying technology (Java) as well. Just the fact that the "web plugin Java" is the vulnerable one does not mean the "desktop Java" is bulletproof. The only way to find out is to audit the code, which is obviously not feasible with the original (nonfree) Java VM implementation.
    – knaperek
    Oct 19, 2014 at 12:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.