Shib IdP - Metadata Download and Java 1.7.0_85

[Cantor, Scott]

On 7/23/15, 1:27 PM, "users on behalf of Nate Klingenstein" <users-bounces at shibboleth.net on behalf of ndk at internet2.edu> wrote:

>That’s fine, but every large deployment I know of has quite a bit of IP address “intelligence” built into DNS resolution to scale.  AWS ELB is my specific challenge here, but you could pick basically any “cloud” hosting service.

I don't understand what that has to do with this bug. Resolving the name to do a check is itself the bug.

>The LDAP issue Brent found is going to be even more fun if that proves to be an issue, and I don’t think ldaps has been against any recommendations.

Again, I don't see this affecting a majority of sites or even a significant minority unless RH pushes the fix. Java 8 adoption is quite low, and most people don't pay Oracle for updates. We should have a window to get a fix out.

Or of course there's the radical idea that maybe Oracle should fix their own bug and not rely on us to work around it?

And there's a trivial flag you can set on the JVM to work around it too. As problems go, I can think of many worse ones.

-- Scott