[fedora-java] Re: icedtea-plugin rocks!

[Thomas Fitzsimmons]

Andrew Overholt wrote:
> * Rahul Sundaram <sundaram at fedoraproject.org> [2007-09-22 11:14]:
>> Justin Conover wrote:
>>> Thanks for all you work, nice to have a java plugin for x64 browsers now!  
>>> A great added feature, not sure if it will be a hidden feature or talked 
>>> about.  Any chance of it being installed by default, so new users don't 
>>> have to think about java and can just be surprised?
>>> http://justinconover.com/images/icedtea-plugin_x64.jpg
>> That was agreed upon here
>>
>> https://www.redhat.com/archives/fedora-desktop-list/2007-August/msg00346.html
>>
>> Jesse Keating, can you make sure we do this before the next test release?
> 
> I'm pretty sure it can't be done because IcedTea isn't on ppc{,64} and
> we can't have arch-specific comps.xml.

I'm not subscribed to test list where this discussion continued, but I'll reply 
here.  Marc Schoenefeld (Red Hat security team) has been auditing IcedTea on and 
off for the past month, time permitting.  Marc do you have a preliminary feeling 
for whether a) the audit will be complete by e.g. mid-October, and b) whether 
gcjwebplugin is safe enough to enable by default?

> We already have arch specific comps.  Tools that consume comps do not
> care if something is listed as mandatory or default but nonexistent in
> the repository.  The most you'll get is a Warning from some things.

OK, this opens up another option for IcedTea inclusion in comps (see below).

In a follow-up post, Jesse wrote:

> The reasons behind the gcj plugin not being default were because of
> security and the code was not audited, and those that were involved
> didn't feel comfortable having such unaudited code running in a web
> browser.  Is this still the case or are we just ignoring it now?

This was for gcjwebplugin-on-libgcj.  The "icedtea-plugin rocks!" thread is 
referring to gcjwebplugin-on-IcedTea which is (audit-pending) much more secure. 
  To make gcjwebplugin-on-IcedTea installed and enabled by default as the 
original poster is proposing, we'd need to have IcedTea available in comps.xml. 
  It's too soon to replace GCJ with IcedTea, because of the architecture 
coverage issues, but does anyone see a problem with including IcedTea alongside 
GCJ in the default comps.xml?  That would mean that IcedTea and GCJ would be 
installed by default, and IcedTea would take precedence on architectures where 
it was available, and GCJ would be the fallback, selectable using alternatives. 
  Then the IcedTea plugin would be installed by default on architectures where 
it is available.  I like this approach because there is demand for IcedTea to be 
included by default.

Thoughts?
Tom