5 ms·

Desktop Java apps should just bundle a JRE. Launch4j: http://launch4j.sourceforge.net/ http://launch4j.sourceforge.net/ Legality: http://www.oracle.com/techne

by logn 12y ago

Desktop Java apps should just bundle a JRE. Launch4j: http://launch4j.sourceforge.net/ http://launch4j.sourceforge.net/ Legality: http://www.oracle.com/technetwork/java/javase/readme-142177.html#redistribution http://www.oracle.com/technetwork/java/javase/readme-142177....

joosters 12y ago
Nothing in that link claims that apps have to 'just' bundle the JRE only.
sp332 12y ago
At the rate Java has been fixing exploitable vulnerabilities lately, I would rather have just one copy to keep up-to-date. I know that's not a very Mac-like attitude though.
- tormeh 12y ago
  But you only need to update the JRE's that interface with the outside world, and unless there are bugs in the JVM's network code that would be only your Java browser plugin.
  - makomk 12y ago
    There have been bugs in networking related code in the JRE. For example, I believe it was recently discovered that their SSL implementation was completely and utterly broken and enabled a MITM attacker to totally disable encryption (the SKIP-TLS attack). Guess what most software is probably relying on to protect their auto-updater?
    - tomjen3 12y ago
      They SSL implementation was broken against an active attacker - this is very different from being broken totally. Obviously it is still very, very bad but it doesn't mean you shouldn't use it if you are not going to replace it with anything else.
- vbezhenar 12y ago
  Almost all exploitable vulnerabilities are related to the browser plugin. There's no danger of keeping outdated JRE inside some application.
  - JoachimSchipper 12y ago
    Unless you need Java Secure Sockets Extension to work - see smacktls.com.
VieElm 12y ago
New versions of IntelliJ IDE EAPs come with a JRE runtime if you choose that option. Jetbrains developers had major problems with subpixel font rendering on post-Apple JREs so they forked OpenJDK I think to fix it.

by logn 12y ago

joosters 12y ago

Nothing in that link claims that apps have to 'just' bundle the JRE only.

sp332 12y ago

At the rate Java has been fixing exploitable vulnerabilities lately, I would rather have just one copy to keep up-to-date. I know that's not a very Mac-like attitude though.

tormeh 12y ago
But you only need to update the JRE's that interface with the outside world, and unless there are bugs in the JVM's network code that would be only your Java browser plugin.
- makomk 12y ago
  There have been bugs in networking related code in the JRE. For example, I believe it was recently discovered that their SSL implementation was completely and utterly broken and enabled a MITM attacker to totally disable encryption (the SKIP-TLS attack). Guess what most software is probably relying on to protect their auto-updater?
  - tomjen3 12y ago
    They SSL implementation was broken against an active attacker - this is very different from being broken totally. Obviously it is still very, very bad but it doesn't mean you shouldn't use it if you are not going to replace it with anything else.
vbezhenar 12y ago
Almost all exploitable vulnerabilities are related to the browser plugin. There's no danger of keeping outdated JRE inside some application.
- JoachimSchipper 12y ago
  Unless you need Java Secure Sockets Extension to work - see smacktls.com.

VieElm 12y ago

New versions of IntelliJ IDE EAPs come with a JRE runtime if you choose that option. Jetbrains developers had major problems with subpixel font rendering on post-Apple JREs so they forked OpenJDK I think to fix it.