Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.java.programmer > #35821
| Newsgroups | comp.lang.java.programmer |
|---|---|
| Date | 2016-10-19 07:14 -0700 |
| References | <d68d0c9ub7i9gc66m8p3sduv44nbvpmhn1@4ax.com> <801e31b0-8a86-4276-952c-45c44a0d5d81@googlegroups.com> <nu7oeb$229$1@dont-email.me> <ce1f7a97-eab7-4314-b635-917c5eedaefa@googlegroups.com> <nu7sds$g4a$1@dont-email.me> |
| Message-ID | <499bdf4f-672e-4087-8d51-1d8fc0f2160b@googlegroups.com> (permalink) |
| Subject | Re: new JDK 1.8.0_112 |
| From | Eric Douglas <e.d.programmer@gmail.com> |
On Wednesday, October 19, 2016 at 9:28:57 AM UTC-4, Eric Sosman wrote: > 112's list of bug fixes is considerably longer than 111's, but I'm > not in a position to say how important that might be in your situation. > If you're using SecureRandom.PKCS11 you'll have an easier time with 111 > than with 112, but there may be other countervailing considerations. > > If you don't need the bug fixes *and* you run only apps and applets > that are trusted, you might be able to stick with what you're using > now. But if anyone in your organization runs apps or applets downloaded > from untrusted sources, the fixes for seven CVE's may be of interest ... I haven't heard of SecureRandom.PKCS11 so if my application has any reference to such a thing it would have to be from a third party jar. We develop an application in house which runs on webstart, our own custom API we made from scratch. We use self signed jars from a free keystore I generated years ago from the keytool that came with the Java. Our own app should be trusted. All I noticed in the change list for the latest Java was something about dropping support for MD5 but I'm not sure what that is. Our oldest signed jars (2011) contain "SHA1-Digest" hashes and our current jars contain "SHA-256-Digest". I'm not sure how to tell Java we trust an applet but I know we run at least a couple. In particular we print shipping labels from FedEx which requires applet, and the ever fun GSA Login button (http://fedpay.gsa.gov/) runs an applet with ActiveX controls that look like 1995.
Back to comp.lang.java.programmer | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
new JDK 1.8.0_112 Roedy Green <inquiry@mindprod.com> - 2016-10-18 15:24 -0700
Re: new JDK 1.8.0_112 Eric Douglas <e.d.programmer@gmail.com> - 2016-10-19 05:03 -0700
Re: new JDK 1.8.0_112 Eric Sosman <esosman@comcast-dot-net.invalid> - 2016-10-19 08:20 -0400
Re: new JDK 1.8.0_112 Eric Douglas <e.d.programmer@gmail.com> - 2016-10-19 05:33 -0700
Re: new JDK 1.8.0_112 Eric Sosman <esosman@comcast-dot-net.invalid> - 2016-10-19 09:28 -0400
Re: new JDK 1.8.0_112 Eric Douglas <e.d.programmer@gmail.com> - 2016-10-19 07:14 -0700
Re: new JDK 1.8.0_112 Arne Vajhøj <arne@vajhoej.dk> - 2016-10-19 21:26 -0400
csiph-web