Re: [External] : Re: JEP411: Missing use-case: Monitoring / restricting libraries

2021-05-07 Thread Peter Firmstone
On 7/05/2021 1:17 pm, Peter Firmstone wrote: On 6/05/2021 9:46 pm, Ron Pressler wrote: That is correct. Here is where this is mentioned for ForkJoinPool: https://docs.oracle.com/en/java/javase/16/docs/api/java.base/java/util/concurrent/ForkJoinPool.html And here it is for virtual threads

Re: JEP411: Missing use-case: Monitoring / restricting libraries

2021-05-07 Thread Peter Firmstone
What would help in future: 1. Define a core Java api, a javadoc annotation? If parts of it are deprecated, they will not be removed for eg 3 LTS releases, pick a number, it provides certainty.  Developers writing new software then know if they use this api, they will not be harmed by

Re: RFR: 8241248: NullPointerException in sun.security.ssl.HKDF.extract(HKDF.java:93) [v3]

2021-05-07 Thread Xue-Lei Andrew Fan
On Fri, 7 May 2021 12:01:16 GMT, Alexey Bakhtin wrote: >> Hello All, >> >> Could you please review the fix for the JDK-8241248? >> The issue happens during the TLSv1.3 handshake without server stateless >> session resumption in case of server receives several parallel requests with >> the

Re: JEP411: Missing use-case: Monitoring / restricting libraries

2021-05-07 Thread Ron Pressler
Many of the people who worked at Sun still work at Oracle on Java today, and that group includes all the people who signed their names on this JEP, but Java today has ten more years of baggage to maintain than it did back then. The speed at which things are removed after deprecation is meant

Re: JEP411: Missing use-case: Monitoring / restricting libraries

2021-05-07 Thread Peter Firmstone
On 8/05/2021 4:21 am, Ron Pressler wrote: Deprecation/removal JEPs, and this one is no exception, make the following claim: that the total good a certain JDK capability currently contributes to the Java ecosystem at large does not justify the cost of its maintenance, and it should,

Re: JEP411: Missing use-case: Monitoring / restricting libraries

2021-05-07 Thread Ron Pressler
Deprecation/removal JEPs, and this one is no exception, make the following claim: that the total good a certain JDK capability currently contributes to the Java ecosystem at large does not justify the cost of its maintenance, and it should, therefore, be removed — gradually, of course, and

Re: JEP411: Missing use-case: Monitoring / restricting libraries

2021-05-07 Thread Will Sargent
You may be interested in tweakflow [1] in that case -- it's a scripting language that doesn't allow arbitrary operations (as opposed to Groovy etc) and can even limit the execution time [2] I would probably not set up a security manager to monitor operations, as any situation which called for a

Re: RFR: 8266225: jarsigner is using incorrect security property to show weakness of certs [v2]

2021-05-07 Thread Weijun Wang
On Thu, 6 May 2021 20:57:13 GMT, Hai-May Chao wrote: >> Please review the change to jarsigner so it uses certpath security property >> in order to properly display the weakness of the certificate algorithms. > > Hai-May Chao has updated the pull request incrementally with one additional >

Re: RFR: 8240256: Better resource cleaning for SunPKCS11 Provider

2021-05-07 Thread Sean Coffey
On Wed, 21 Apr 2021 01:26:18 GMT, Valerie Peng wrote: >> Added capability to allow the PKCS11 Token to be destroyed once a session is >> logged out from. New configuration properties via pkcs11 config file. >> Cleaned up the native resource poller also. >> >> New unit test case to test

Re: RFR: 8240256: Better resource cleaning for SunPKCS11 Provider [v2]

2021-05-07 Thread Sean Coffey
> Added capability to allow the PKCS11 Token to be destroyed once a session is > logged out from. New configuration properties via pkcs11 config file. Cleaned > up the native resource poller also. > > New unit test case to test behaviour. Some PKCS11 tests refactored to allow > pkcs11 provider

Integrated: 8265426: Update java.security to use instanceof pattern variable

2021-05-07 Thread Patrick Concannon
On Mon, 26 Apr 2021 08:50:36 GMT, Patrick Concannon wrote: > Hi, > > Could someone please review my code for updating the code in the > `java.security` package to make use of the `instanceof` pattern variable? > > Kind regards, > Patrick This pull request has now been integrated.

Re: RFR: 8265426: Update java.security to use instanceof pattern variable [v5]

2021-05-07 Thread Roger Riggs
On Thu, 6 May 2021 14:42:20 GMT, Patrick Concannon wrote: >> Hi, >> >> Could someone please review my code for updating the code in the >> `java.security` package to make use of the `instanceof` pattern variable? >> >> Kind regards, >> Patrick > > Patrick Concannon has updated the pull

Re: RFR: 8241248: NullPointerException in sun.security.ssl.HKDF.extract(HKDF.java:93) [v3]

2021-05-07 Thread Alexey Bakhtin
On Thu, 6 May 2021 19:15:27 GMT, Xue-Lei Andrew Fan wrote: >> Unfortunately, simple pull() can not be used in this case. We have to check >> if the session found in the cache can be rejoined with parameters received >> in ClientHello and server context. Only rejoinable sessions should be >>

Re: RFR: 8241248: NullPointerException in sun.security.ssl.HKDF.extract(HKDF.java:93) [v3]

2021-05-07 Thread Alexey Bakhtin
> Hello All, > > Could you please review the fix for the JDK-8241248? > The issue happens during the TLSv1.3 handshake without server stateless > session resumption in case of server receives several parallel requests with > the same pre_shared_key. > The main idea of the fix is to remove

Re: RFR: 8264774: Implementation of Foreign Function and Memory API (Incubator) [v13]

2021-05-07 Thread Maurizio Cimadamore
> This PR contains the API and implementation changes for JEP-412 [1]. A more > detailed description of such changes, to avoid repetitions during the review > process, is included as a separate comment. > > [1] - https://openjdk.java.net/jeps/412 Maurizio Cimadamore has updated the pull

Re: [External] : Re: JEP411: Missing use-case: Monitoring / restricting libraries

2021-05-07 Thread Peter Firmstone
On 6/05/2021 9:46 pm, Ron Pressler wrote: Trying to convince people, at this point, after twenty five years that the Security Manager isn’t complicated after all might be too little too late. Static policy, terrible performance, no scalability at all, and the fact that you continually

Re: RFR: 8264774: Implementation of Foreign Function and Memory API (Incubator) [v12]

2021-05-07 Thread Alan Bateman
On Thu, 6 May 2021 14:23:27 GMT, Maurizio Cimadamore wrote: >> This PR contains the API and implementation changes for JEP-412 [1]. A more >> detailed description of such changes, to avoid repetitions during the review >> process, is included as a separate comment. >> >> [1] -

Re: RFR: 8265426: Update java.security to use instanceof pattern variable [v5]

2021-05-07 Thread Patrick Concannon
On Mon, 26 Apr 2021 17:52:05 GMT, Jesper Steen Møller wrote: > Changes look good, except for the unneeded parenthesis? > > (but I'm not a committer, so it's less useful) Hi Jesper, thanks for your suggestions and well spotted. I've addressed the issues and responded to your comments with the