From owner-freebsd-java@FreeBSD.ORG  Thu Mar 10 16:17:21 2011
Return-Path: <owner-freebsd-java@FreeBSD.ORG>
Delivered-To: freebsd-java@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 59652106566B
	for <freebsd-java@freebsd.org>; Thu, 10 Mar 2011 16:17:21 +0000 (UTC)
	(envelope-from marquis@roble.com)
Received: from mx5.roble.com (mx5.roble.com [206.40.34.5])
	by mx1.freebsd.org (Postfix) with ESMTP id 49C2C8FC16
	for <freebsd-java@freebsd.org>; Thu, 10 Mar 2011 16:17:21 +0000 (UTC)
Received: from mx5.roble.com (mx5.roble.com [206.40.34.5])
	by mx5.roble.com (Postfix) with ESMTP id C16A067883
	for <freebsd-java@freebsd.org>; Thu, 10 Mar 2011 08:17:20 -0800 (PST)
Date: Thu, 10 Mar 2011 08:17:20 -0800 (PST)
From: Roger Marquis <marquis@roble.com>
To: freebsd-java@freebsd.org
In-Reply-To: <20110310120028.6013310656B0@hub.freebsd.org>
References: <20110310120028.6013310656B0@hub.freebsd.org>
User-Agent: Alpine 2.00 (BSF 1167 2008-08-23)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Message-Id: <20110310161721.59652106566B@hub.freebsd.org>
Subject: Re: AW: Question Update Java Security Updates
X-BeenThere: freebsd-java@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Porting Java to FreeBSD <freebsd-java.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-java>,
	<mailto:freebsd-java-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-java>
List-Post: <mailto:freebsd-java@freebsd.org>
List-Help: <mailto:freebsd-java-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-java>,
	<mailto:freebsd-java-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Mar 2011 16:17:21 -0000

Andriy Gapon wrote:
>>> Agreed, we should probably switch the default JDK to openjdk6.
>>
>> Really, even considering the large number of security issues openjdk has
>> had and is expected to continue to having for the foreseeable future?
>>
>> Sounds like a recipe for pain among FreeBSD default JDK users or at least
>> those whose primary criteria for a JDK are compatibility and security.
>
> Is having very old "official" JDK any better?

Old or new is not a criteria many sysadmins value relative to the pain of
upgrading.  The time and effort to upgrade applications and servers every
few years vs several times a year can make or break the choice of an OS,
and used to be FreeBSD's strong suite vis-a-vis Linux.

> I don't think we get many (any?) security updates for them lately.

The reason for that is that they haven't been necessary.  This cannot be
said for openjdk, not yet at least.

Roger Marquis