Proposed new schedule for JDK 8

http://mail.openjdk.java.net/pipermail/jdk8-dev/2013-April/002336.html

by austinbv • 13 years ago

76 29 13 years ago

mail.openjdk.java.net

pswenson• 13 years ago

My proposed security fix: kill the Java Browser Plugin.

moondowner3• 13 years ago

I agree. All the bad rep Java gets is from the Applet 0-day hacks.

Java 8 to deprecate the Browser Plugin, Applets and all related stuff to it, and for those who need this technology can use Java 7 and other previous releases.

mdmarra2• 13 years ago

Then you're going to have all kind of apps stuck on older Java versions forever. While I'd love to see it happen, it would be Oracle shooting themselves in the foot with their enterprise customers, which - let's face it - is who they actually care about.

brokenparser• 13 years ago

That's a bit harsh. Just offer it as a separate download or don't include it in a default install.

hatchoo• 13 years ago

Why not just come up with a separate installer for the browser plugin. The runtime isn't as bad security-wise. Or is it?

mynameishere• 13 years ago

It's still used in commercial and industrial applications. (Obviously, it never caught on in userland.) You could make it disabled by default, but getting rid of it would be an outrageous mistake.

csense• 13 years ago

Does anyone have any ideas about why the browser plugin for applets has so many security zero-days?

If competing products like Flash, JavaScript, or HTML 5 have fewer security issues, what are the engineering reasons they're better, and how can those lessons be ported to Java?

Alternatively, maybe Java applets are actually comparable to other technologies in this space in terms of security zero-days. Its bad reputation might be merely due to the fact that relatively few people actually use it, so a recommendation to get rid of it won't break nearly as much of the Web as removing Flash or disabling JS. Is this explanation plausible?

TazeTSchnitzel• 13 years ago

Because Java allows signed applets to ask to run native binaries, it will always be hopelessly dangerous.

hugi• 13 years ago

Kill the Java browser plugin. Also, delay by another year and use the opportunity to bring in Jigsaw. Lambdas are nice, but in the big picture, Jigsaw is huge.

rlmw• 13 years ago

Seems pretty likely that Jigsaw will take > 1 year to complete.

batgaijin• 13 years ago

what does jigsaw bring to the table? what does its existence imply?

suyash2• 13 years ago

Read about it and ask more specific questions: http://openjdk.java.net/projects/jigsaw/

suyash2• 13 years ago

We can wait till 03/2014 for JDK 8. I don't want to jump on buggy code. Good idea by Oracle not to scope creep by delaying but fixing security bugs and making the code base more stable.

iso8859-13• 13 years ago

I am happy about the renewed focus on security. As far as I remember, people were pretty skeptical and didn't think Oracle would fix the JRE once the exploits started getting discovered so frequently.

JulianMorrison2• 13 years ago

Versioned jarballs with versioned dependencies PLEASE. Seriously, Ruby is laughing at you.

moondowner3• 13 years ago

Jarballs? I don't know why Ruby would be laughing. Maven and Gradle are doing their job fine of handling project dependencies.

JulianMorrison2• 13 years ago

Build dependencies, yes.

Runtime dependencies for upgrade in situ, not so much.

Proposed new schedule for JDK 8

Related Stories