Backwards Compatability

[Richard Bair]

As embarrassing as it is for an Oracle memo of this type, this does perfectly illustrate the problem with the present Applet / JNLP based deployment mechanism. Igor has been looking at another mechanism whereby the JRE that you need to run with is shipped along with the app over JNLP. This type of deployment would require full permissions all the time (ie: you couldn't be unsigned and target a specific JRE that is shipped with your app). But this would allow people invested in Applet / WebStart to pin to a version of the JRE without having multiple JRE's installed on the system, or exposing the machine to additional security risks beyond what downloading an app would give you. We might also require a valid cert rather than a self-signed cert for this case.

Richard

On Jun 14, 2012, at 5:13 PM, Daniel Zwolenski wrote:

> Below is a little bit of a reminder of the problems with auto-updating and
> backwards compatibility - I find this announcement from Oracle themselves
> on their own products to be rather poignant. I think we should feed this
> sort of historic lessons learned into any and all conversations on JFX
> installation, auto-updates and backwards compatability topics.
> 
> Pinning to specific Java versions looks to be a necessity, but there is a
> contradictory requirement here: Applets need to be auto-updated to be
> secure in the browser, but updates are not backwards compatible (no matter
> how hard they try). Pure desktop apps can co-bundle the JRE to achieve
> version pinning, but applets are required to be installed, and installing
> multiple versions is not possible.
> 
> Is it time to kill off Applets? There are still a lot of legacy applets
> around but really the real world moved on a long time ago - perhaps a mercy
> stroke would be the best thing for it?
> 
> 
> -----Original Message-----
> 
> From: Oracle Applications Users Group [mailto:broadcast at oaug.com]
> Sent: Friday, 15 June 2012 1:10 AM
> Subject: Urgent Message from Oracle Corp: Disable JRE Auto-Update for All
> E-Business Suite End-Users****
> 
> ** **
> 
> Oracle Corporation has asked the OAUG to relay the following urgent message
> to our users community.****
> 
> ** **
> 
> All EBS desktop administrators must disable JRE Auto-Update for their end
> users immediately.****
> 
> ** **
> 
> URGENT BULLETIN:  Disable JRE Auto-Update for All E-Business Suite
> End-Users.****
> 
> https://blogs.oracle.com/stevenChan/entry/bulletin_disable_jre_auto_update**
> **
> 
> ** **
> 
> Why is this required?****
> 
> If you have Auto-Update enabled, your JRE 1.6 version will be updated to
> JRE 7.  This may happen as early as July 3, 2012.  This will definitely
> happen after Sept. 7, 2012, after the release of 1.6.0_35 (6u35).****
> 
> ** **
> 
> Oracle Forms is not compatible with JRE 7 yet.  JRE 7 has not been
> certified with Oracle E-Business Suite yet.  Oracle E-Business Suite
> functionality based on Forms -- e.g. Financials -- will stop working if you
> upgrade to JRE 7.****
> 
> ** **
> 
> Related News****
> 
> Java JRE 1.6.0_33 is certified with Oracle E-Business Suite****
> 
> https://blogs.oracle.com/stevenChan/entry/jre_1_6_0_33****
> 
> **