Javascript security

goodValue

I keep getting notifications to update Javascript.
I've read that Javascript is a security problem, and so have ignored the notifications.
Should I actually take some action, like trying to remove Javascript?
Or is it not clear whether or not it is a securtity problem?

Neil_Jones

goodValue said:

I keep getting notifications to update Javascript.
I've read that Javascript is a security problem, and so have ignored the notifications.
Should I actually take some action, like trying to remove Javascript?
Or is it not clear whether or not it is a securtity problem?

Sure you don't mean Java?

Java and Javascript is not the same thing.

CoastingHatbox

Javascript is (usually) executed inside your Internet browser. So legitimate notification might mean your browser is out of date.

For most people, it's more likely they are using a Java application and they are running an out of date version of the Java runtime environment (JRE) - as @Neil_Jones said this is not Javascript.

Or it might be that the the notifications are not legitimate. What is telling you that you need to update Javascript?

goodValue

Neil_Jones said:

Sure you don't mean Java?

Java and Javascript is not the same thing.

I'm not sure which it is now.
I'll have to wait until the next time it happens.

goodValue

Or it might be that the the notifications are not legitimate. What is telling you that you need to update Javascript?

It's a pop-up box from the RHS of the screen.
Can I trace where this comes from?

Neil_Jones

If this is Windows 10 and you haven't cleared the notification (and you have a number bottom right by the clock) you can click on it, it'll bring the notification up in the action centre.

Otherwise if this is Java, the update check is done IIRC weekly so it should reappear again next week

[Deleted User]

goodValue said:

Or it might be that the the notifications are not legitimate. What is telling you that you need to update Javascript?

It's a pop-up box from the RHS of the screen.
Can I trace where this comes from?

Do you have any software that needs it? If not, uninstall it.

If you do need it, then make sure it is the latest version as that will be more secure than an out of date version.

To uninstall, just go to settings > apps > apps and features in Windows and search for Java then uninstall option.

To update, click on the prompt you get or go direct to the website to download the latest version.

If you are not sure, you could just uninstall it at see what stops working.

Ergates

If something is considered a security risk - that should be an incentive to update it more frequently, as the updates are often patching security holes as and when they're discovered.

jamesd

When you read that something is a security risk and are invited to upgrade it, you should upgrade it because that upgrade is likely to fix some known security issues. If you decline, you commit to keeping known vulnerabilities.

Java is now no longer recommended for new development and has a long history of security and privacy breaches.

Javascript is still key to many web site features but has a few security issues from time to time. You won't normally get a choice about upgrading javascript because it is normally built in to your browser as an integral part of it. Because of a range of issues, partly related to advertising scams, it's my normal practice much of the time to browse with javascript turned off and only on for specific sites. If you take this approach you should expect to see many web sites complain or not work properly until you make them an exception; that's OK because those aren't the ones that are likely to be harmfully using it.

goodValue

To uninstall, just go to settings > apps > apps and features in Windows and search for Java then uninstall option.

This proved useful as it also led me to the Startup apps. There were on two - Java Update Scheduler, and 

Windows security notification icon. Should there not have been a Virus Checker there?

I'll wait until I get the message again to decide if I should turn Java off. 

Is it now the case that most reputable web developers would NOT use Java?

goodValue

jamesd said:

When yoou read that something is a security risk and are invited to upgrade it, you hould upgrade it because that upgrade is likely to fix some known security issues. If you decline, you commit to keeping known vulnerabilities.

Java is now no longer recommended for new development and has a long history of security and privacy breaches.

Javascript is still key to many web site features but has a few security issues from time to time. You won't normally get a choice about upgrading javascript because it is normally built in to your browser as an integral part of it. Because of a range of issues, partly related to advertising scams, it's my normal practice much of the time to browse with javascript turned off and only on for specific sites. If you take this approach you should expect to see many web sites complain or not work properly until you make them an exception; that's OK because those aren't the ones that are likely to be harmfully using it.

In the past I've not been a frequent internet browser. It's only recently that I've done a bit more, and consequently found I didn't like the way FireFox was organised (bookmarks and cookies).
So I've started trying out Chrome.
I found it quite easy to turn off Javascript and also make an exception for MSE forums.