News for hackers. Stuff that matters.

A comment on Canonical to remove all Sun JDK packages from the Partner archive. Parent comment

Re:Canonical to remove all Sun JDK packages from the Partner... by saurik on Thursday December 15, 2011 @06:43PM (#3358624)
... and just deleting the version of Java they have installed is somehow more reasonable? Honestly, the fact that this is even being seriously considered by Ubuntu is pretty much a death blow to me ever trusting a package update from the project again... what's next: a security update that uninstalls Apache from my web server, or one that uninstalls Exim from my email server?
[ Parent | on HN ]
Re:Canonical to remove all Sun JDK packages from the Partner... by azernik on Thursday December 15, 2011 @08:45PM (#3359001)
Actually, I do think the Ubuntu solution is more reasonable. I installed sun-java6 for precisely the use case mdeslaur described, and I'm pretty sure that the errors from a missing JDK will be much more clear and noticeable than the subtler (but still work-killing) ones from OpenJDK.
[ Parent | on HN ]
Re:Canonical to remove all Sun JDK packages from the Partner... by mdeslaur on Thursday December 15, 2011 @07:32PM (#3358785)
So we would be more trustworthy if we left millions of users vulnerable to being silently compromised by malware?

No, Apache and Exim wouldn't get removed, the source is available so a fix can be issued.

[ Parent | on HN ]
Re:Canonical to remove all Sun JDK packages from the Partner... by saurik on Thursday December 15, 2011 @08:23PM (#3358936)
Strawman. Every other suggestion on this page is more reasonable than the one Ubuntu is choosing, whether it be replacing the package with one that is 90% functionally equivalent (openjdk) to printing giant warnings during the package upgrade process. The decision made by Ubuntu is so uncaring for its user community that this reads like comedy.
[ Parent | on HN ]
Re:Canonical to remove all Sun JDK packages from the Partner... by buntoo on Thursday December 15, 2011 @08:47PM (#3359003)
Removing packages seems to be the way Linux distros handle this type of issue

https://rhn.redhat.com/errata/RHSA-2011-0368.html https://rhn.redhat.com/errata/RHSA-2008-1045.html

[ Parent | on HN ]
Re:Canonical to remove all Sun JDK packages from the Partner... by gldalmaso on Friday December 16, 2011 @05:20AM (#3360248)
I disagree. Many people leave windows in favor of Ubuntu for increased security against virus and malware.

I agree that there could be more transparent feedback to the user who probably will never check to see what's being update and why, but I don't think this reads like comedy at all.

[ Parent | on HN ]
Re:Canonical to remove all Sun JDK packages from the Partner... by nirvdrum on Friday December 16, 2011 @12:31AM (#3359569)
Maybe a balance and not remove it on servers? I have a pretty locked down environment and trust my ability to read advisories and take necessary precautions. It's weird to presume your users can't deal with that.
[ Parent | on HN ]