Feeds

Oracle updates Java versioning to allow more security fixes

New scheme skips numbers to leave room for emergencies

Build a business case: developing custom apps

Seemingly borrowing a page from the old, line-numbered BASIC programs of the 1980s, Oracle has adopted a new version numbering strategy for the Java Development Kit (JDK) – one that skips numbers, in case Oracle has to go back and plunk in new code later.

Traditionally, Oracle has issued new patches for the JDK on a predictable, regular basis, shipping Critical Patch Updates (CPUs) three times a year on an advertised schedule. That practice was designed to suit the needs of enterprise IT admins, who typically need lots of time to test new patches before they apply them.

But given how rapidly new Java vulnerabilities have been popping up of late, the database giant has been forced to break with tradition and release emergency patches off schedule, lest exploits run rampant.

That's been happening so often, in fact, that it has started causing problems for Oracle's version numbering system. The company has been forced to assign version numbers to the quick-fix, small patches that were originally intended for later CPUs, then renumber the CPUs – flummoxing those stodgy, risk-averse enterprise admins.

Now Oracle has had enough of it. "To avoid confusion caused by renumbering releases, we are adopting a new numbering scheme," the company announced in a bulletin issued on Tuesday, although "avoiding confusion" might be overstating it.

Here's how the new plan works: The JDK will keep its current versioning scheme, where each update is assigned a code that starts with the current major JDK version number, followed by a lowercase "u" and the current update number. So, for example, the current version of JDK 7 is update 7u21.

Traditionally, Limited Update patches – the kind that add new features and non-security fixes – have been assigned even numbers. CPUs, which only contain fixes for security vulnerabilities, are assigned odd numbers. None of that will change under the new system, but what will change is how the numbers are doled out for future planned updates.

Under the new scheme, Limited Updates will only be assigned numbers in multiples of 20. So, since we're on JDK 7 version 7u21 now, when the next Limited Update shows up it will be version 7u40. The one after that will be 7u60, and so on.

In between these feature updates, CPUs will be assigned odd numbers that are multiples of 5, added to the version number of the previous Limited Update. If you're following along, that means the next CPU should carry version number 7u25, followed by 7u30 and 7u35.

All of the numbers in between are up for grabs. As Oracle's bulletin explains, "This numbering scheme will leave several numbers between releases which will allow us to insert releases – for example security alerts or support releases, should that become necessary – without having to renumber later releases."

Emergency patches for security alerts will be assigned whatever is the next available number, odd or even, as long as it doesn't fall on a multiple of 5 or 20.

We know – clear as mud, right? But according to Oracle, this rather ham-fisted fix is the best approach for now, to maintain compatibility with old code that expects the JDK version number code to be formatted exactly the way it is today.

"A more elegant solution requires changing the version format of the JDK to accommodate multiple types of releases," the company writes. It adds, however, that this won't happen until some future major Java update, to give developers adequate time to prepare for the change – those lumbering enterprise admins raising their ugly heads again. ®

The essential guide to IT transformation

More from The Register

next story
Rupert Murdoch says Google is worse than the NSA
Mr Burns vs. The Chocolate Factory, round three!
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
Know what Ferguson city needs right now? It's not Anonymous doxing random people
U-turn on vow to identify killer cop after fingering wrong bloke
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.