1

(other than "none")

My organization uses a necessary Java-based web app that will not be replaced in the near future, which runs on Java 1.4 and up. Should our (mostly Windows) users have Java 1.6, 1.7, or a different version on their PCs? Does the answer vary across OS versions, browsers, or other variables? Should they allow auto-updating?

Foo Bar
  • 448
  • 1
  • 6
  • 20
  • If the workstations are connected to the interent you should push any and all updates and use the current version of Java otherwise you will be vulernable to malware. – Ramhound Dec 06 '12 at 16:15
  • 1
    Answers to this question might be rather localized in time. The answer may be different next week. – RedGrittyBrick Dec 06 '12 at 16:16
  • @RedGrittyBrick - Which is the reason only the "current version" is the only correct answer. – Ramhound Dec 06 '12 at 16:41
  • This is a great question because there's indeed two or three "up-to-date" versions of Java. I would look at the update release notes ("security advisories") to see which versions they fix bugs in. Often, it's all three at once, but sometimes only the latest ones. Generally, Java adds features, it doesn't remove them, so the older versions may have a smaller attack surface. Regardless, though, the correct answer is, "find a way to block Java except on the webpage that needs it" through a browser plugin or other means. – Aleksandr Dubinsky Oct 27 '15 at 23:20

2 Answers2

3

the only reasonable answer to this question is "the most up-to-date one". always being up to date reduces the number of known exploits to its theoretical minimum.

Frank Thomas
  • 35,097
  • 3
  • 77
  • 98
  • 1
    +1, but this doesn't tell quite the whole story. Java 6, for example, is still maintained alongside Java 7 (at least for the moment), and therefore there are two different versions that can both be called "up-to-date". – Joel Coehoorn Dec 06 '12 at 16:44
  • be ready to update your JVM several times per month, to stay up-to-date with the very frequent security patches. – BorisHajduk Dec 06 '12 at 17:56
1

Safe solution would be, using separate browser with java plugin, restricted only to your webapp. And other one for accessing internet.

week
  • 3,298
  • 1
  • 13
  • 15