I'm asking this because Libre Office was pre-installed and some of it's features require Java. I don't want Java because of a malicious remote administration tool (RAT) called jRAT and there are also others. But with this even a script kiddie can take control of my computer.
1 Answer
Simple answer, Java is not installed by default in any Ubuntu system (in fact this goes against the Java distribution policy, that's why is being included in the non-free repository).
You can check the packages manifest of any version of Ubuntu, and you will notice that it does not include either JDK nor Java.
Precise Pangolin package manifest:
http://releases.ubuntu.com/releases/precise/ubuntu-12.04.3-desktop-i386.manifest
Raring Ringtail package manifest:
http://releases.ubuntu.com/releases/raring/ubuntu-13.04-desktop-i386.manifest
You can search the list up and down, and you will find no reference to Java (please don't confuse with JavaScript, that is different).
(Links are thanks to our friend Oli)
How does LibreOffice run, then?
libreoffice
suggest the packagejava-runtime
for some specifics functions but isn't necessary the complete Java Virtual Machine. It also includes their very own packages with Java classes, scripts, and config snippets calledlibreoffice-java-common
, but not all the suite require the packages (only writer and base). Hence, you can use most of LO without even installing Oracle's Java or openJDK.Do you just mean Oracle Java is not installed? Is OpenJDK also not present?
This was answered above:
You can check the packages manifest of any version of Ubuntu, and you will notice that it does not include either JDK nor Java.
Are the differences between Oracle Java and OpenJDK from a security perspective are pretty small?
According to Thomas Pornin from Security.SE, yes, the differences are none. Both share lots of code, which made them both vulnerable. There was even a case where Ubuntu was affected by one vulnerability which right now is fixed. (non citatory)
You can read his full answer (along others) here.
Hope this address all inquiries.
-
Thanks for the edit. This is a very good answer! A couple points: right now it looks like the added quotes were the OP's words, so I recommend putting them in italics or making
###
headings out of them instead of using blockquotes. (I do not need credit for them, though--this is only about possible confusion regarding what the OP said.) Also, regardinglibreoffice-java-common
: I believe this is a (totally legitimate and positive!) instance of a program shipping its own JRE. Couldn't someone with access use it for other Java software? Sep 4, 2013 at 23:48 -
@EliahKagan I think I should ask in security.se about that. But my hunch right now is that it isn't a java vm (the package is way too small), hence if you try to run arbitrary java code using that library, it will fail.– BraiamSep 4, 2013 at 23:56
-