Hi Everyone, I reported at the board meeting two days ago that you guys are making steps towards addressing this. The big issue that still remains is that hawtio in its current form unbranded as the default Apache ActiveMQ console must be fixed ASAP and addressed. *How* that is done is currently being discussed, but realize that discussion needs to conclude in a reasonable time frame, let's say before the next board meeting 3rd week of February 2014.
Cheers, Chris -----Original Message----- From: Robert Davies <rajdav...@gmail.com> Reply-To: <dev@activemq.apache.org> Date: Friday, January 17, 2014 1:32 AM To: <dev@activemq.apache.org> Subject: Re: [DISCUSS] Remove the old ActiveMQ Console >This discussion has been open a while - not exactly consensus but then >there¹s not really much difference either. There does seem to be general >consensus amongst the poor folks who actually maintain the old console >(me included) it should die quickly, but I think we should keep it around >optionally for those users who can¹t use anything else?. >We have to get this resolved quickly - so I¹ll start a vote and hope to >gain some consensus, at least within the PMC. > >thanks, > >Rob >On 16 Jan 2014, at 22:21, Gary Tully <gary.tu...@gmail.com> wrote: > >> I think the web-console should die, letting it rot in a subproject >> will not make it more secure,usable nor maintainable. >> >> Then we either - >> 1) skin hawtio with an Apache ActiveMQ brand and continue to ship it >> 2) document the extension points for third party consoles. >> >> I think dropping needs to be contingent on either 1 or 2. >> >> Imho, hawtio does it right with the jolokia jmx/http bridge and has >> some nice extension points so I am in favour of 1 >> >> On 2 January 2014 09:59, Robert Davies <rajdav...@gmail.com> wrote: >>> The old/original console is no longer fit for purpose, it is hard to >>>maintain, the source of a lot of security issues [1] over the last few >>>years. >>> >>> There is another thread about using hawtio as the console going >>>forward, and without going into all the gory details it is probably >>>likely that there may be no web console shipped at all in future >>>releases of ActiveMQ. The JMX naming hierarchy was improved for >>>ActiveMQ 5.8, such that its easy to view the running status of an >>>ActiveMQ broker from 3rd party tools such as jconsole, visualvm or >>>hawtio. Regardless of the outcome of the other discussion [2] - It >>>doesn¹t help the ActiveMQ project to try and maintain a static web >>>console any more. >>> >>> I propose we remove the old web console from the ActiveMQ 5.10 release >>>- thoughts ? >>> >>> >>> >>> [1] >>>https://issues.apache.org/jira/browse/AMQ-2714?jql=project%20%3D%20AMQ%2 >>>0AND%20text%20~%20%22XSS%22 >>> [2] >>>http://activemq.2283324.n4.nabble.com/Default-Web-Console-td4675705.html >>> >>> Rob Davies >>> >>> Red Hat, Inc >>> http://hawt.io - #dontcha >>> Twitter: rajdavies >>> Blog: http://rajdavies.blogspot.com >>> ActiveMQ in Action: http://www.manning.com/snyder/ >>> >> >> >> >> -- >> http://redhat.com >> http://blog.garytully.com > >Rob Davies > >Red Hat, Inc >http://hawt.io - #dontcha >Twitter: rajdavies >Blog: http://rajdavies.blogspot.com >ActiveMQ in Action: http://www.manning.com/snyder/ >
