How do Java and Javascript relate to each other?

That’s actually just one example of several questions that I received this week
relating to a recently discovered zero-day exploit of an unpatched vulnerability in
Java. My understanding is that a fix is now available, but the scenario has
brought to light something very important:

Many people confuse Java and Javascript.

Java is not Javascript. In fact, other than the first four characters of
their names, Javascript and Java are not related to each other at
all.

Let’s look at each and why in situations like this it’s so
critical to understand that there is a difference.

Disclaimer: I’ll definitely be over-simplifying here. The pesky details and
the nuances aren’t really that critical and I don’t want them to distract from
the main issue.

Javascript

Javasscript is a programming language that is supported natively by
most modern web browsers. That means that the browsers come with the means to
understand and execute Javascript using what’s called an “interpreter.”

Programs or “scripts” written in Javascript are often contained directly in
the HTML pages in which they are used. View the source of even this article on
the Ask Leo! website and you’ll see a few snippets of Javascript used for
various purposes.

Javascript enables richly interactive web pages, turning them from static
displays of text and pictures into small applications capable of often
impressive functionality. Sites like Gmail, Facebook, and others use Javascript
to display, animate, and change content without requiring you to
visit a new “page” for each change. Scroll down your Facebook wall and it’s
Javascript that keeps downloading and adding more content to the page the
further you scroll.

Javascript has become so popular and so prevalent in web design that it’s
difficult to use many sites without it.

Java

Java is a programming language that’s not natively supported by
browsers, but when used on websites, requires the download and installation of a
“Java Virtual Machine” or JVM, now more commonly referred to as the Java
Runtime Environment (JRE).

Programs written in Java are typically compiled into an intermediate form
that is more efficiently executed by the JRE than the original source would be.
As such, Java programs are typically separate downloads referenced by, but not
actually included within, web pages that happen to make use of Java
applications.

Java programs are not limited to being embedded in web pages or other
containers. There are many standalone applications written directly in Java
that run and execute like any other program and may not be related to the web
or internet at all. Fundamentally, Java is just another programming language
that can be used for almost any purpose, only one of those purposes being
embedded into web pages.

Regardless of where or how it’s used – embedded in a web page or as a
standalone program – it’s the same Java Runtime that’s used in each case.

Visibility

Whereas Javascript tends to be part of and interact with the web
page on which it is hosted, Java applications on web pages tend to be more
self-contained and restricted to a rectangle on the page (which, sometimes, can
be the entire page).

Unless you’re using advanced configurations or extensions such as NoScript,
Javascript is typically either on or off – usually on. This means that its
presence on or use by a web page may not be obvious.

Java must first be downloaded and installed before it’s available for use in
either web pages or standalone applications. Once downloaded, there’s often no
real indication that a standalone application is using Java.

Browsers will often often ask for permission before running Java on a web
page.

Javascript is typically updated with your browser. Keep your browser
up-to-date and you’ll be keeping Javascript up-to-date.

In Windows, Java is a separate application on your computer. It includes its
own update functionality and automatic check.

If Java is installed, you may also find a Java control icon in Control Panel
that will allow you to check for updates immediately.

Enabling and disabling

Javascript

Javascript is enabled and disabled via a setting in your browser’s
options.

In internet Explorer, it’s buried in Tools, Internet
Options, Security, Custom level…,
in the Scripting section:

In Chrome, it’s in Settings, Advanced,
Javascript:

While a similar setting exists in Firefox, the best approach is to use the
NoScript
plugin to control scripting on a site-by-site basis.

Java

The easiest and safest way to disable Java is to simply not have it
installed and uninstalling it if it is:

Simply locate Java in the list of installed programs, right-click on it, and
select Uninstall.

This is safe to do, even if you regularly visit a website that required
Java, as the next time you visit, it will automatically prompt you to
re-download and install Java. If you prefer not to have Java installed, you can
decline and that website’s Java-based functionality will not be available.

Web browsers can also disable Java without needing to uninstall it,
typically using settings in the browser’s advanced options, but in general,
uninstalling is by far the easiest approach.

As you can see, disabling Javascript has nothing directly1 to do with disabling Java and vice
versa. Thus disabling one when you think you are disabling the other (or
because you don’t understand that they are unrelated) can lead to a false sense
of security.

Java & JavaScript: Should you or shouldn’t you?

Given the current application and security landscape, I’ll make the following
recommendations:

• Javascript: In general, leave Javascript enabled and stay
  away from questionable sites. The practical fact is that many, many websites
  simply will not work if Javascript is disabled. If you are concerned, then the
  only true solution is to use Firefox with the NoScript add-on to allow selective
  choice of which websites are allowed to use Javascript. Similar-sounding
  add-ons for Chrome apparently don’t work reliably and give a false sense of
  security. Managing this through IE’s security zones is a confusing
  nightmare.

• Java: Uninstall Java unless you’re certain you need it.
  It’s not at all uncommon to end up with Java installed because of a website you
  visited only once. Uninstall it, and if something you care about breaks,
  re-install it. In this case, some security-minded folks recommend having it
  enabled in only one browser that you don’t use regularly and explicitly
  disabling it in the browser you use day-to-day.

As for me, I just uninstalled Java. I know of only one program that I use that
may eventually require it2.
Until then, I’ll run without.