Shib IdP - Metadata Download and Java 1.7.0_85

[Cantor, Scott]

On 7/23/15, 1:38 PM, "users on behalf of Nate Klingenstein" <users-bounces at shibboleth.net on behalf of ndk at internet2.edu> wrote:

>My understanding is that I would need to try to get all those IP addresses into subjectAltNames, or get everyone to patch in time.  If I’m misinterpreting this, please let me know and I’ll stop worrying.

I took that suggestion as a joke. Are we under the impression this is intended behavior? It's really not, clearly, it's a bug. Specifically because their own verifier is calling that method. There's no way they intended this. They're not getting fried yet because adoption of both versions affected is tiny.

As far as people patching, there's the ability to set the flag in Java to turn off the bug, whether they intended that to happen or not. A patch is just one fix, and the real patch here is to Java to fix their bug.

>I’m worried about deployments that update software without reading all the release notes. I know that’s something you’d trash, but there is an awful lot of them.  I would not have expected this change and would agree with Brent’s “flabbergasted” unless I really misread it.

If you mean people updating to 8, that takes some real testing anyway and this will hit basically right away. I'd be more worried about Java 7 updates, but quite frankly I stopped automating Java updates a long time ago. It's not workable because, well, neither JVM source can be trusted.

This bug is not a lurker since it will bite basically on step 1 of starting up, so that's a good thing in comparison to more complex ones.

-- Scott