[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Bug#742864: ITP: openjdk-8 -- OpenJDK 8 - Open source implementation of the Java Platform Standard Edition 8


Disclaimer: I haven't done any work on Debian Java, so my opinion isn't here isn't worth anything. :-)

If I understand correctly, the difference between the profiles is simply the number of Java packages available at runtime [0].

Whether the compact1 profile is worth packaging despite only a 6-7% improvement in startup times depends on whether performance improvement is the only benefit we think is worthwhile with these profiles.

Here's my take:

1. If you only need features from the compact1 profile, then you only need to install this profile

2. If there is an exploitable vulnerability in some other code (e.g. JavaEE), but you do not have any software installed that needs it, then the existence of this compact1 profile means that your system is not vulnerable to the problem. If on the other hand, you are forced to install the full profile, then you could be vulnerable (e.g. forcing some class to be loaded via Reflection and exploiting it).


* I suppose this is just theoretical; and
* I'm by no means a security expert; and
* There are also costs to packaging/maintaining the profile

So ultimately, a decision will have to be made with these considerations in mind.


[0] https://blogs.oracle.com/jtc/entry/a_first_look_at_compact

On Mon, Jun 2, 2014 at 5:51 PM, Emmanuel Bourg <ebourg@apache.org> wrote:
After further investigation the error I encountered was caused by GNU
Make 4.0. Erik Joelsson from Oracle kindly provided a patch [1] and I've
been able to build the compact JREs.

I did a quick test with headless applications to see the difference in
startup time between the full JRE and the compact1 profile. I measured
the time to run 'mvn -version' and 'ant -version' 100 times. The compact
JRE was faster by 6-7% only. With clirr the compact JRE was ~13% faster.

With an average startup time of ~100ms the difference was hardly
noticeable. Now I wonder if packaging the compact JREs is really worth
the trouble.

Emmanuel Bourg

[1] http://mail.openjdk.java.net/pipermail/build-dev/2014-June/012715.html

To UNSUBSCRIBE, email to debian-java-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: [🔎] 538CF1FD.9060103@apache.org" target="_blank">https://lists.debian.org/[🔎] 538CF1FD.9060103@apache.org

Reply to: