If you wanted to use a utility on your Linux (or other Unix) server box, and it required Java, and no other application on your server required Java, would you be turned off that you had to install it?
That is, do you look at that dependency and think "Bloat, security hazard, another system I have to maintain," or at this point is Java so safe and ubiquitous that it's no trouble at all?
Depends on a lot of things.
It's basically a tradeoff between the cost and the benefit. Java, like all apps, has security flaws. Sun updates their JVM every now and then and the Linux vendors that ship Java also do the same. How do you plan to push updates to this machine? How important is it? If the machine has proper firewalls and limited network daemons running, Java as an interpreter on the disk is probably not much of a hazard. Java typically doesn't run as root.
Almost any arguments that can be made about Java can be made about Perl, Mono, GCC, or any software that can run arbitrary code. Furthermore most Linux software is typically shipped by a distro, so you can often rely on the distro's updates to keep things secure. Sun Java, in this case, would be the same as any third party software. Does it matter if this third-party utility requires a library that happens to be Java? Maybe not.
The scenario is slightly different if you are talking about Java running a service application, such as Tomcat or JBoss, where Java is then listening to the network. In that case the security risk is higher. But you have the same security risks with any network-facing application such as apache or ssh.
I find it very very rare that no app on my linux server required java, and I don't have much of an issue with something requiring java. It is so widely used that I expect I'll need it at some point. This may be because most linux servers I have are for ERP systems.
I do have an issue with different apps wanting different version of the JVM or very very specific versions of the JVM though.
It's a minimal risk. ANY software contains some risk, so it'd be incorrect to say it's no concern at all, but I have no special concerns about Java anymore compared to anything else. In the early days of Java, things were different though.
I look at that dependency and think "bloat, another system to maintain, and likely a PITA install". I don't think security hazard.
I put Java in the same category as Python, Perl, Ruby, PHP, Mono or anything that needs a runtime. I have no problems with installing it as long as it doesn't require me to go find some custom classes, plugins or modules that conflict with the packaged version.
That said, being a sysadmin with Java apps tends to be a little time consuming as sysadmins would rather have error straight up, instead of reading through 3 pages of 'in stack...' errors to find an error like "empty string".
Yes. I would think twice about it. In the case that I had no other Java app already running, I'd look for an alternative.
I'd rather not go to the pain of installing and configuring another system on my server if I couldn't help it. The same reason applies to everything else though - if I didn't need an email MTA on my server, I wouldn't install one. If I didn't run any Ruby apps, I wouldn't install Ruby.
However, if I did already have java installed and running, I'd install the new app and not worry about it. (but that's not what you asked!)
It should be noted that Java 4 / 1.4 has reached end-of-service-life and is no longer supported.
Java 5 / 1.5 will reach end-of-service-life in October this year
