<div dir="ltr">Hi<br><div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Jun 17, 2013 at 3:26 PM, Dan Mashal <span dir="ltr"></span>wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="HOEnZb"><div class="h5"><br>
<br>
</div></div>There is no way in hell anyone here is going to fix the security holes<br>
in Java (open or closed).<br>
<br>
The only way to avoid the security holes caused by java is to not use it.<br></blockquote><div><br></div><div>That is too extreme. It is certainly possible to fix security issues in IcedTea and OpenJDK. Otherwise Fedora wouldn't be including it in the distribution and building a lot of packages using openJDK. If we don't include IcedTea by default and there are future security issues, it still needs to be fixed but the chances of it affecting users are reduced however we might be creating problems for users who are relying on IcedTea-Web to do their banking or other critical tasks and IcedTea-Web is not easily installable via the Firefox plugin search and it is a entirely un-obvious name for users to install using the package manager. Not a lot of people understand that Java applet source was never open sourced by Sun or Oracle and is not part of the OpenJDK project. If we can fix Firefox to install IcedTea on demand, that would be great. <br>
<br></div><div>Rahul<br></div><div><br><br></div></div></div></div></div>