The java.*, javax.* and org.* packages documented in the Java Platform Standard Edition API Specification make up the official, supported, public interface. If a Java program directly calls only API in these packages, it will operate on all Java-compatible platforms, regardless of the underlying OS platform.
The sun.* packages are not part of the supported, public interface. A Java program that directly calls into sun.* packages is not guaranteed to work on all Java-compatible platforms. In fact, such a program is not guaranteed to work even in future versions on the same platform.
Each company that implements the Java platform will do so in their own private way. The classes in sun.* are present in the JDK to support Oracle‘s implementation of the Java platform: the sun.* classes are what make the Java platform classes work "under the covers" for Oracle‘s JDK. These classes will not in general be present on another vendor‘s Java platform. If your Java program asks for a class "sun.package.Foo" by name, it may fail with ClassNotFoundError, and you will have lost a major advantage of developing in Java.
Technically, nothing prevents your program from calling into sun.* by name. From one release to another, these classes may be removed, or they may be moved from one package to another, and it‘s fairly likely that their interface (method names and signatures) will change. (From Oracle‘s point of view, since we are committed to maintaining the Java platform, we need to be able to change sun.* to refine and enhance the platform.) In this case, even if you are willing to run only on Oracle‘s implementation, you run the risk of a new version of the implementation breaking your program.
In general, writing java programs that rely on sun.* is risky: those classes are not portable, and are not supported.
http://www.oracle.com/technetwork/java/faq-sun-packages-142232.html
转载：Why Developers Should Not Write Programs That Call 'sun' Packages