Bug#645881: critical update 29 available

[Russ Allbery]

Florian Weimer <fw at deneb.enyo.de> writes:
> * Philipp Kern:

>> sun-java6 is sadly still a very high profile package.  I won't go and
>> break all those installations which force sun-java6 over openjdk-6
>> locally, either in unattended installations or through other means.

> It's really unfortunate that most of those installations seem to need
> sun-java6-plugin, which the package which is actually dangerous to
> install.

I'm not sure that we actually know that.  popcon tends to overweight
desktop systems, since servers more often have security policies that
don't allow use of popcon for one reason or another.

I know we (Stanford) have a whole ton of server systems that are using
sun-java6 with Tomcat or similar application architectures.  We're working
on migrating them all to OpenJDK, of course, but we don't expect to finish
that until the wheezy release unless something that seriously affects
server use of the Sun JDK crops up.  (And we have some vendor apps that
unfortunately so far have refused to even consider or test OpenJDK.
Sigh.)

We know that OpenJDK doesn't work with some of our applications currently,
mostly for stupid reasons, like a web service that doesn't support any
remotely modern SSL implementation.

-- 
Russ Allbery (rra at debian.org)               <http://www.eyrie.org/~eagle/>