Oracle breaks Java Web Start, claim...

[Fernando Cassia]

WTF is this about? I´ve run JWS apps on Java 7 just fine.

Although I didnt test OpenJDK...

http://developers.slashdot.org/story/11/09/22/1217253/Oracle-Removes-Java-Signatures-Breaking-Webstart?utm_source=slashdot&utm_medium=twitter

[ricky.c...@gmail.com]

It's about libraries that Oracle distributes, that used to be signed and no longer are, and the effect this has on webstart.

I'll be here all week to read articles for you.
Sent from my BlackBerry® wireless device

--
You received this message because you are subscribed to the Google Groups "The Java Posse" group.
To post to this group, send email to java...@googlegroups.com.
To unsubscribe from this group, send email to javaposse+...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/javaposse?hl=en.

[opinali]

On Thursday, September 22, 2011 8:58:59 AM UTC-4, Ricky Clarkson wrote:

It's about libraries that Oracle distributes, that used to be signed and no longer are, and the effect this has on webstart.

With the important detail that these libraries are apparently, only Java3D, which has been in the limbo of abandonware since 2004. Sun open sourced it but never  invested on it seriously anymore; and in 2008 Sun announced that it was abandoning Java3D for the second time, pulling the little resources they had on Java3D to focus on JavaFX. I'd say all this is true for other old Java media APIs like JAI.

My take is that Oracle just doesn't want to have any liability for some old junk that definitely has a significant potential of security issues because it contains native code.

A+
Osvaldo

 

[Fabrizio Giudici]

On 09/22/2011 03:45 PM, opinali wrote:
> On Thursday, September 22, 2011 8:58:59 AM UTC-4, Ricky Clarkson wrote:
>
> It's about libraries that Oracle distributes, that used to be
> signed and no longer are, and the effect this has on webstart.
>
>
> With the important detail that these libraries are apparently, only
> Java3D, which has been in the limbo of abandonware since 2004. Sun
> open sourced it but never invested on it seriously anymore; and in
> 2008 Sun announced that it was abandoning Java3D for the second time,
> pulling the little resources they had on Java3D to focus on JavaFX.
> I'd say all this is true for other old Java media APIs like JAI.
>
> My take is that Oracle just doesn't want to have any liability for
> some old junk that definitely has a significant potential of security
> issues because it contains native code.
>

I add that JWS is good, but it's always a bad idea, for production, to
rely upon artifacts not under your control.

--
Fabrizio Giudici - Java Architect, Project Manager
Tidalwave s.a.s. - "We make Java work. Everywhere."
fabrizio...@tidalwave.it
http://tidalwave.it - http://fabriziogiudici.it

[opinali]

On Thursday, September 22, 2011 1:33:08 PM UTC-4, fabrizio.giudici wrote:

I add that JWS is good, but it's always a bad idea, for production, to
rely upon artifacts not under your control.

Very true, at least for intranet apps or pure-Java extensions. The big problem is extensions that require native code, used by apps launched from the internet. The "privileged" distribution from Sun/Oracle, including their digital signature, is the only way (I believe) to allow a seamless user experience, without scary security dialogs. Most Java libraries are pure-Java, but libs for media and graphics have always been a notable exception.

A+

Osvaldo

[mbien]

JAI, Java3D and JOGL 1.1.1 (the old one) where redeployed without
signature. Nothing really important. The problem was the lack of
communication/warning since many third party apps still used the old
stuff.
since all of them used some kind of native lib it ended up in a
security exception for applications using the mentioned libs.

in other words it wasn't nice from oracle to do this but i don't
believe it was intentional.

best regards,
michael