RE: Has IBM announced any reaction to Oracle's announced end of public updates for JDK 8

A couple of my thoughts.

1 - Two years will FLY by. We're halfway through 2018 already. Vendors
need to plan NOW! They have huge development cycles and often look at
maintenance money as a cash cow and feel it's stupid to waste that on
product development. Also consider this statement:
"Oracle will continue to provide Public Updates and auto updates of Java
SE 8, until at least the end of December 2020 for Personal Users, and
January 2019 for Commercial Users."
January 2019 is rapidly approaching.
However compare the table "Java SE Public updates" with the table "Oracle
Java SE support roadmap" and you see the "premier" support going out
several more years. Perhaps Java on IBM i falls under this?
But basically Java on IBM i looks to be at least two releases behind.

2 - It matters not one whit, not one teeny tiny bit, that IBM will address
some CVE security concern with JDK 8 with a PTF when it comes to audit
time. All the security scan has to say is that you are running an
outdated form of JVM and you fail the audit. Some might argue that the
security scan should see if the individual CVE is addressed but when you
consider the effort to test a CVE on a periodic scan may involve some
serious CPU crunching and be detrimental to performance you can see why
they don't do this. And do you really want them testing a CVE which says
"if you do this, that and the other thing you can expect to see smoke
rising out of the back of your system, Interpol at your door and perhaps
even some serious consequences"?




Rob Berendt