It has come to my attention that Minecraft no longer requires java to be installed in order to run, meetings its needs from its own local copy of the java. This was done it order to not force users to install the horrendous piece of malware-magnet that it sadly is.

This means that java is installed, but just not publicly, for the OS to see. Considering this is a fully-fledged copy of the software, couldn't attackers use it (And its far too plentiful amount of security holes) to gain access to the system? What restraint could possibly block that?

  • I think the reasons why Minecraft now comes with its own JRE are 1. convenience for the user, 2. easier support because people using outdated JREs is no longer a problem and 3. they are now owned by Microsoft who would rather like to see less systems with properly installed JREs in order to gain a market advantage for their competing .NET framework. – Philipp May 8 '17 at 17:25

The bad press Java got in the past years which might lead you to the preconception that the whole technology is a "horrendous piece of malware-magnet" applied mostly to the Java browser plugin. This plugin allows to run Java applications embedded in websites (Java Applets). Applets are supposed to be sandboxed so that they can't do any harm, but that sandboxing concept wasn't always as thorough as it should have been. This allowed java applets embedded in malicious websites to do things they were not supposed to do on the visitor's computer, in some cases even install malware.

When you install Minecraft, its Java Runtime Environment doesn't install the Java browser plugin in any web browser you use, so you won't get exposed to drive-by malware in form of malicious Java applets while web browsing.

A JRE being somewhere on a system doesn't provide much attack surface. When an attacker obtained the means to get their malicious Java application onto your computer and invoke the JRE to run it, then they are very likely also able to run any non-Java application they want.

  • There's still the problem of finding reputable places to get .jar files for mods from. I'm quite apprehensive with Minecraft running code from a .jar my kid downloaded off a random forum, although I have at least trained him that anything he needs to click through 6 pages of ads to download is probably not worth the trouble. – Ben May 8 '17 at 17:40
  • Those 6 pages of ads probably installed at least as much crapware as the .jar file. – user1258361 May 9 '17 at 0:39
  • A very concise answer! Everything's a lot clearer now, thanks! – C._ May 9 '17 at 15:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.