Andrew Overholt wrote:

• Rahul Sundaram sundaram@fedoraproject.org [2007-09-22 11:14]:

...

Justin Conover wrote:

...

Thanks for all you work, nice to have a java plugin for x64 browsers now! A great added feature, not sure if it will be a hidden feature or talked about. Any chance of it being installed by default, so new users don't have to think about java and can just be surprised? http://justinconover.com/images/icedtea-plugin_x64.jpg

That was agreed upon here

https://www.redhat.com/archives/fedora-desktop-list/2007-August/msg00346.htm...

Jesse Keating, can you make sure we do this before the next test release?

I'm pretty sure it can't be done because IcedTea isn't on ppc{,64} and we can't have arch-specific comps.xml.

I'm not subscribed to test list where this discussion continued, but I'll reply here. Marc Schoenefeld (Red Hat security team) has been auditing IcedTea on and off for the past month, time permitting. Marc do you have a preliminary feeling for whether a) the audit will be complete by e.g. mid-October, and b) whether gcjwebplugin is safe enough to enable by default?

We already have arch specific comps. Tools that consume comps do not care if something is listed as mandatory or default but nonexistent in the repository. The most you'll get is a Warning from some things.

OK, this opens up another option for IcedTea inclusion in comps (see below).

In a follow-up post, Jesse wrote:

The reasons behind the gcj plugin not being default were because of security and the code was not audited, and those that were involved didn't feel comfortable having such unaudited code running in a web browser. Is this still the case or are we just ignoring it now?

This was for gcjwebplugin-on-libgcj. The "icedtea-plugin rocks!" thread is referring to gcjwebplugin-on-IcedTea which is (audit-pending) much more secure. To make gcjwebplugin-on-IcedTea installed and enabled by default as the original poster is proposing, we'd need to have IcedTea available in comps.xml. It's too soon to replace GCJ with IcedTea, because of the architecture coverage issues, but does anyone see a problem with including IcedTea alongside GCJ in the default comps.xml? That would mean that IcedTea and GCJ would be installed by default, and IcedTea would take precedence on architectures where it was available, and GCJ would be the fallback, selectable using alternatives. Then the IcedTea plugin would be installed by default on architectures where it is available. I like this approach because there is demand for IcedTea to be included by default.

Thoughts? Tom