On Wed, Oct 19, 2011 at 03:28:02PM +0200, Thijs Kinkhorst wrote: > What I'm wondering is if we tried to ask upstream whether they would be > willing to extend the DLJ offer so we can keep security fixes for the > sun-java6 version in stable coming in for the lifetime of this release, > notwithstanding the fact that we're removing it from the next release. They won't. | I'm not familiar with the Debian Project's practices around security issues | in non-free packages to be able to make a specific recommendation other than to | recommend using the open source OpenJDK code base for Debian's packaging needs. | | Like I said on my blog, there won't be further Oracle JDK 6 releases published | under the DLJ license. Oracle's schedule for Critical Patch Updates (CPUs) is | public, and available at | http://www.oracle.com/technetwork/topics/security/alerts-086861.html > > (in the past the security team > > didn't care about this at all for the current oldstable). > I don't know what this refers to, but it doesn't seem relevant because > we're talking about the present. Well, non-free used to be unsupported security-wise AFAIK. doko is right that the security team still didn't care in the present, though, as the updates were through p-u and not the security archive. That said I'm glad that somebody stepped up and did the updates that were possible. There might be one other option, but one I probably wouldn't be happy with due to it probably being impossible to review: improve openjdk in stable enough to replace sun-java6. Apart from this it's either a DSA telling people that it contains known flaws (if they're critical enough) and that there will be no further security updates. OTOH the updates didn't pass security anyway because there's no non-free there. Or it's the removal of the package. Or we simply don't care because it's freaking non-free and people are supposed to use it in secure environments with a grain of salt. Kind regards, Philipp Kern -- .''`. Philipp Kern Debian Developer : :' : http://philkern.de Stable Release Manager `. `' xmpp:phil@0x539.de Wanna-Build Admin `- finger pkern/key@db.debian.org
Attachment:
signature.asc
Description: Digital signature