Re: [libreoffice-users] Re: JRE older installs - Windows - now online - no need for Oracle account

Hi :)
Yes, those are the crucial points.
1.  It's mostly only Base that is affected by which version of java you are 
using.  If you don't use Base you might even be able to stop LibreOffice from 
trying to use java at all!
Tools - Options - LibreOffice - Java 
and un-tick the tick-box at the top.  If you can do that then you might find 
LibreOffice opens significantly faster.  


2.  You can have more than one version of java on your machine.  Most apps will 
try to use the newest version but you can force LibreOffice to choose one that 
works better for LibreOffice
Tools - Options - LibreOffice - Java 
So your web-browser can be nice and safe.  

3.  I think the exploits would only work if contained inside a document that you 
opened using LibreOffice?  ie after various anti-virus programs had nosed 
around.  


4.  Dependence on java is being slowly written out of LibreOffice to avoid this 
problem in the future although it's probably going to take a long time to remove 
it from Base completely!  I think  people are being steered away from Base 
back-ends that might depend on java.  


Regards from
Tom :)




________________________________
From: Sigrid Carrera <sigrid.carrera@googlemail.com>
To: users@global.libreoffice.org
Sent: Thu, 1 September, 2011 18:07:42
Subject: Re: [libreoffice-users] Re: JRE older installs - Windows - now online - 
no need for Oracle account

Hi Dave, 

On Thu, 1 Sep 2011 10:01:09 -0400
"David H. Lipman" <DLipman@Verizon.Net> wrote:

<snip />

> Please explain why you are promoting these older vulnerable and exploitable 
> versions of 
>
> JRE instead of the latest in the JRE 6 family, update 27.
> Since this is installed into the OS, not exclusive to a given application, it 
> leaves the 
>
> end-user open to the vulnerability/exploitation vector.

There is a speed difference for the different JRE's if you're using
the BASE component from LibreOffice. 

So, since it is possible, to have several JRE's installed in one OS,
the "recommendation" is to use the latest JRE for everything except
LibreOffice. Does this make sense? 

Sigrid
-- 
For unsubscribe instructions e-mail to: users+help@global.libreoffice.org
Problems? http://www.libreoffice.org/get-help/mailing-lists/how-to-unsubscribe/
Posting guidelines + more: http://wiki.documentfoundation.org/Netiquette
List archive: http://listarchives.libreoffice.org/global/users/
All messages sent to this list will be publicly archived and cannot be deleted