Reinier, you raise a good point. Rather than the command line, what if the Security Policy File could have a new permission that allows module boundaries to be broken? This would allow you to control which jars can have free reign; probably useful for framework libraries like Spring.
Cheers, Paul On Fri, Dec 4, 2015 at 7:50 AM, Reinier Zwitserloot <rein...@zwitserloot.com > wrote: > On Tue, Dec 1, 2015 at 2:24 PM, Alan Bateman <alan.bate...@oracle.com> > wrote: > > > This seems a bit pessimistic. One thing that would be helpful is to get > > more help testing of these libraries with the EA builds. If there are > > libraries and applications on the class path today that are using core > > reflection then they should continue to work as they do in JDK 8. The > > *only* issue *starting out* should be where core reflection is being used > > to get at JDK internal types, in which case a command-line option might > be > > needed to keep those deployments working. > > > Emphasis mine: "only"? > > "Just add some command line switches" is not exactly a nice solution. From > personal experience, the vast majority of java users do not know how to add > configure command line switches to the various compile and build VMs being > started by their build tools of choice, for example. Also, not something > Alan mentioned here: Adding the command line switches is currently the > _ONLY_ solution, so tools that are aware of the issue can't even fix it, > other than by mangling modules (bad idea, I think we all agree on that I > assume), or advising the userbase not to actually USE any of the modularity > features and, preferably, to avoid switching to JDK9 altogether. > > Emphasis mine: "starting out"? > > This gets back to an earlier issue I raised on this mailing list: Okay, > starting out this isn't an issue, but by having no way to opt out of > export-based access control, it's a bit like switching from driving on the > left side of the road to the right: Unless the entire greater java > community switches in the same instant, we're all going to have a bad time. > A way to opt out needs to exist, and the fact that the discussion is still > going, and no plans have even been stated yet, means in my opinion that > jigsaw is not fully baked yet. > > --Reinier Zwitserloot >
