Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.java.programmer > #35812 > unrolled thread
| Started by | Roedy Green <inquiry@mindprod.com> |
|---|---|
| First post | 2016-10-18 15:24 -0700 |
| Last post | 2016-10-19 21:26 -0400 |
| Articles | 7 — 4 participants |
Back to article view | Back to comp.lang.java.programmer
new JDK 1.8.0_112 Roedy Green <inquiry@mindprod.com> - 2016-10-18 15:24 -0700
Re: new JDK 1.8.0_112 Eric Douglas <e.d.programmer@gmail.com> - 2016-10-19 05:03 -0700
Re: new JDK 1.8.0_112 Eric Sosman <esosman@comcast-dot-net.invalid> - 2016-10-19 08:20 -0400
Re: new JDK 1.8.0_112 Eric Douglas <e.d.programmer@gmail.com> - 2016-10-19 05:33 -0700
Re: new JDK 1.8.0_112 Eric Sosman <esosman@comcast-dot-net.invalid> - 2016-10-19 09:28 -0400
Re: new JDK 1.8.0_112 Eric Douglas <e.d.programmer@gmail.com> - 2016-10-19 07:14 -0700
Re: new JDK 1.8.0_112 Arne Vajhøj <arne@vajhoej.dk> - 2016-10-19 21:26 -0400
| From | Roedy Green <inquiry@mindprod.com> |
|---|---|
| Date | 2016-10-18 15:24 -0700 |
| Subject | new JDK 1.8.0_112 |
| Message-ID | <d68d0c9ub7i9gc66m8p3sduv44nbvpmhn1@4ax.com> |
JDK 1.8.0_111 and 1.8.0_112 are out.
[toc] | [next] | [standalone]
| From | Eric Douglas <e.d.programmer@gmail.com> |
|---|---|
| Date | 2016-10-19 05:03 -0700 |
| Message-ID | <801e31b0-8a86-4276-952c-45c44a0d5d81@googlegroups.com> |
| In reply to | #35812 |
On Tuesday, October 18, 2016 at 6:24:23 PM UTC-4, Roedy Green wrote: > JDK 1.8.0_111 and 1.8.0_112 are out. 111 and 112? Which one works? Last update there was a 101 and 102 and we had problems with 102. So I guess we stick with 111, even though when we fixed the rest of the machines on our network by removing 102 and installing 101 I just put 122 on my machine which seems to be working fine. So, 111, or early release is at least up to 122...
[toc] | [prev] | [next] | [standalone]
| From | Eric Sosman <esosman@comcast-dot-net.invalid> |
|---|---|
| Date | 2016-10-19 08:20 -0400 |
| Message-ID | <nu7oeb$229$1@dont-email.me> |
| In reply to | #35814 |
On 10/19/2016 8:03 AM, Eric Douglas wrote:
> On Tuesday, October 18, 2016 at 6:24:23 PM UTC-4, Roedy Green wrote:
>> JDK 1.8.0_111 and 1.8.0_112 are out.
>
> 111 and 112? Which one works? Last update there was a 101 and 102 and we had problems with 102. So I guess we stick with 111, even though when we fixed the rest of the machines on our network by removing 102 and installing 101 I just put 122 on my machine which seems to be working fine.
> So, 111, or early release is at least up to 122...
From Oracle's download page:
"Java SE 8u111 includes important security fixes. Oracle
strongly recommends that all Java SE 8 users upgrade to this
release. Java SE 8u112 is a patch-set update, including all of
8u111 plus additional features (described in the release
notes). "
Also, a few links from that same page:
http://www.oracle.com/technetwork/java/javase/8u111-relnotes-3124969.html
http://www.oracle.com/technetwork/java/javase/8u112-relnotes-3124973.html
Will there be anything else, Sir?
--
esosman@comcast-dot-net.invalid
"Don't be afraid of work. Make work afraid of you." -- TLM
[toc] | [prev] | [next] | [standalone]
| From | Eric Douglas <e.d.programmer@gmail.com> |
|---|---|
| Date | 2016-10-19 05:33 -0700 |
| Message-ID | <ce1f7a97-eab7-4314-b635-917c5eedaefa@googlegroups.com> |
| In reply to | #35815 |
On Wednesday, October 19, 2016 at 8:20:56 AM UTC-4, Eric Sosman wrote: > From Oracle's download page: > > "Java SE 8u111 includes important security fixes. Oracle > strongly recommends that all Java SE 8 users upgrade to this > release. Java SE 8u112 is a patch-set update, including all of > 8u111 plus additional features (described in the release > notes). " > > Also, a few links from that same page: > > http://www.oracle.com/technetwork/java/javase/8u111-relnotes-3124969.html > > http://www.oracle.com/technetwork/java/javase/8u112-relnotes-3124973.html > > Will there be anything else, Sir? It just seems odd...why they call them both public release, and they list the lower number first for downloads, and the higher numbered one crashed our system last time... Now I guess we want to test both versions, since higher should be better (if it doesn't crash the system?) and the first bug fix listed says they made it faster? Version 122 seems to work, maybe we should run the 'early release' versions in production!?
[toc] | [prev] | [next] | [standalone]
| From | Eric Sosman <esosman@comcast-dot-net.invalid> |
|---|---|
| Date | 2016-10-19 09:28 -0400 |
| Message-ID | <nu7sds$g4a$1@dont-email.me> |
| In reply to | #35816 |
On 10/19/2016 8:33 AM, Eric Douglas wrote:
> On Wednesday, October 19, 2016 at 8:20:56 AM UTC-4, Eric Sosman wrote:
>> From Oracle's download page:
>>
>> "Java SE 8u111 includes important security fixes. Oracle
>> strongly recommends that all Java SE 8 users upgrade to this
>> release. Java SE 8u112 is a patch-set update, including all of
>> 8u111 plus additional features (described in the release
>> notes). "
>>
>> Also, a few links from that same page:
>>
>> http://www.oracle.com/technetwork/java/javase/8u111-relnotes-3124969.html
>>
>> http://www.oracle.com/technetwork/java/javase/8u112-relnotes-3124973.html
>>
>> Will there be anything else, Sir?
>
> It just seems odd...why they call them both public release, and they list the lower number first for downloads, and the higher numbered one crashed our system last time...
> Now I guess we want to test both versions, since higher should be better (if it doesn't crash the system?) and the first bug fix listed says they made it faster?
> Version 122 seems to work, maybe we should run the 'early release' versions in production!?
Which to adopt for production is, of course, your call and not mine.
If the choice were mine, though, I doubt I'd opt for 122 -- 112, maybe,
but 122 would seem just a wee bit rash. :)
112's list of bug fixes is considerably longer than 111's, but I'm
not in a position to say how important that might be in your situation.
If you're using SecureRandom.PKCS11 you'll have an easier time with 111
than with 112, but there may be other countervailing considerations.
If you don't need the bug fixes *and* you run only apps and applets
that are trusted, you might be able to stick with what you're using
now. But if anyone in your organization runs apps or applets downloaded
from untrusted sources, the fixes for seven CVE's may be of interest ...
--
esosman@comcast-dot-net.invalid
"Don't be afraid of work. Make work afraid of you." -- TLM
[toc] | [prev] | [next] | [standalone]
| From | Eric Douglas <e.d.programmer@gmail.com> |
|---|---|
| Date | 2016-10-19 07:14 -0700 |
| Message-ID | <499bdf4f-672e-4087-8d51-1d8fc0f2160b@googlegroups.com> |
| In reply to | #35819 |
On Wednesday, October 19, 2016 at 9:28:57 AM UTC-4, Eric Sosman wrote: > 112's list of bug fixes is considerably longer than 111's, but I'm > not in a position to say how important that might be in your situation. > If you're using SecureRandom.PKCS11 you'll have an easier time with 111 > than with 112, but there may be other countervailing considerations. > > If you don't need the bug fixes *and* you run only apps and applets > that are trusted, you might be able to stick with what you're using > now. But if anyone in your organization runs apps or applets downloaded > from untrusted sources, the fixes for seven CVE's may be of interest ... I haven't heard of SecureRandom.PKCS11 so if my application has any reference to such a thing it would have to be from a third party jar. We develop an application in house which runs on webstart, our own custom API we made from scratch. We use self signed jars from a free keystore I generated years ago from the keytool that came with the Java. Our own app should be trusted. All I noticed in the change list for the latest Java was something about dropping support for MD5 but I'm not sure what that is. Our oldest signed jars (2011) contain "SHA1-Digest" hashes and our current jars contain "SHA-256-Digest". I'm not sure how to tell Java we trust an applet but I know we run at least a couple. In particular we print shipping labels from FedEx which requires applet, and the ever fun GSA Login button (http://fedpay.gsa.gov/) runs an applet with ActiveX controls that look like 1995.
[toc] | [prev] | [next] | [standalone]
| From | Arne Vajhøj <arne@vajhoej.dk> |
|---|---|
| Date | 2016-10-19 21:26 -0400 |
| Message-ID | <nu96fg$egc$1@gioia.aioe.org> |
| In reply to | #35814 |
On 10/19/2016 8:03 AM, Eric Douglas wrote: > On Tuesday, October 18, 2016 at 6:24:23 PM UTC-4, Roedy Green wrote: >> JDK 1.8.0_111 and 1.8.0_112 are out. > > 111 and 112? Which one works? Last update there was a 101 and 102 > and we had problems with 102. So I guess we stick with 111, even > though when we fixed the rest of the machines on our network by > removing 102 and installing 101 I just put 122 on my machine which > seems to be working fine. So, 111, or early release is at least up to > 122... I think this topic has come up so many times recently. 111 = 102 + security fixes 112 = 102 + security fixes + other fixes So I think the logical upgrade strategy is: 101 or 102 works and want to minimize risk => pick 111 want latest and greatest => pick 112 101 works, 102 does not work and bug not fixed in 111/112 => stay at 101 Arne
[toc] | [prev] | [standalone]
Back to top | Article view | comp.lang.java.programmer
csiph-web