3 ms·

We originally thought about doing that, but we decided not to. It is likely that some users have installed sun-java6 in order to use applications that are incom

We originally thought about doing that, but we decided not to. It is likely that some users have installed sun-java6 in order to use applications that are incompatible with OpenJDK. If we silently replace sun-java6 with OpenJDK, they may experience unexpected failures or odd behaviour that will be difficult to diagnose.

saurik 15y ago
... and just deleting the version of Java they have installed is somehow more reasonable? Honestly, the fact that this is even being seriously considered by Ubuntu is pretty much a death blow to me ever trusting a package update from the project again... what's next: a security update that uninstalls Apache from my web server, or one that uninstalls Exim from my email server?
- mdeslaur 15y ago
  So we would be more trustworthy if we left millions of users vulnerable to being silently compromised by malware? No, Apache and Exim wouldn't get removed, the source is available so a fix can be issued.
  - saurik 15y ago
    Strawman. Every other suggestion on this page is more reasonable than the one Ubuntu is choosing, whether it be replacing the package with one that is 90% functionally equivalent (openjdk) to printing giant warnings during the package upgrade process. The decision made by Ubuntu is so uncaring for its user community that this reads like comedy.
    - buntoo 15y ago
      Removing packages seems to be the way Linux distros handle this type of issue https://rhn.redhat.com/errata/RHSA-2011-0368.html https://rhn.redhat.com/errata/RHSA-2011-0368.html https://rhn.redhat.com/errata/RHSA-2008-1045.html https://rhn.redhat.com/errata/RHSA-2008-1045.html
    - gldalmaso 15y ago
      I disagree. Many people leave windows in favor of Ubuntu for increased security against virus and malware. I agree that there could be more transparent feedback to the user who probably will never check to see what's being update and why, but I don't think this reads like comedy at all.
  - nirvdrum 15y ago
    Maybe a balance and not remove it on servers? I have a pretty locked down environment and trust my ability to read advisories and take necessary precautions. It's weird to presume your users can't deal with that.
- azernik 15y ago
  Actually, I do think the Ubuntu solution is more reasonable. I installed sun-java6 for precisely the use case mdeslaur described, and I'm pretty sure that the errors from a missing JDK will be much more clear and noticeable than the subtler (but still work-killing) ones from OpenJDK.
regularfry 15y ago
Can it not be done to require explicit confirmation at upgrade-time, the same way a license agreement would? It needn't be silent.
- obtu 15y ago
  Upgrades are silent and unattended. Tools build on that, sysadmins rely on that.

saurik 15y ago

... and just deleting the version of Java they have installed is somehow more reasonable? Honestly, the fact that this is even being seriously considered by Ubuntu is pretty much a death blow to me ever trusting a package update from the project again... what's next: a security update that uninstalls Apache from my web server, or one that uninstalls Exim from my email server?

mdeslaur 15y ago
So we would be more trustworthy if we left millions of users vulnerable to being silently compromised by malware? No, Apache and Exim wouldn't get removed, the source is available so a fix can be issued.
- saurik 15y ago
  Strawman. Every other suggestion on this page is more reasonable than the one Ubuntu is choosing, whether it be replacing the package with one that is 90% functionally equivalent (openjdk) to printing giant warnings during the package upgrade process. The decision made by Ubuntu is so uncaring for its user community that this reads like comedy.
  - buntoo 15y ago
    Removing packages seems to be the way Linux distros handle this type of issue https://rhn.redhat.com/errata/RHSA-2011-0368.html https://rhn.redhat.com/errata/RHSA-2011-0368.html https://rhn.redhat.com/errata/RHSA-2008-1045.html https://rhn.redhat.com/errata/RHSA-2008-1045.html
  - gldalmaso 15y ago
    I disagree. Many people leave windows in favor of Ubuntu for increased security against virus and malware. I agree that there could be more transparent feedback to the user who probably will never check to see what's being update and why, but I don't think this reads like comedy at all.
- nirvdrum 15y ago
  Maybe a balance and not remove it on servers? I have a pretty locked down environment and trust my ability to read advisories and take necessary precautions. It's weird to presume your users can't deal with that.
azernik 15y ago
Actually, I do think the Ubuntu solution is more reasonable. I installed sun-java6 for precisely the use case mdeslaur described, and I'm pretty sure that the errors from a missing JDK will be much more clear and noticeable than the subtler (but still work-killing) ones from OpenJDK.

regularfry 15y ago

Can it not be done to require explicit confirmation at upgrade-time, the same way a license agreement would? It needn't be silent.

obtu 15y ago
Upgrades are silent and unattended. Tools build on that, sysadmins rely on that.