> On 18 May 2021, at 03:39, Peter Firmstone <peter.firmst...@zeus.net.au> wrote: > > > Is it also possible to consider directing file access and network access > through single points of access? This will simplify the process so we don't > need to scour the entire codebase for usages. >
Of all your suggestions, I think this is the one that will be seriously considered from a cost/benefit perspective, although probably not as part of this JEP. > What about doPrivileged calls? Will they remain in existing Java library > code, so we can utilise them? To avoid viral permission propagation? Doubtful. That is where much of the cost is, and it would mean investing significant resources into supporting a use-case that what seems like the vast majority of security experts think is a wrong-headed approach, for the sake of the few who disagree. Even as an additional mechanism that might, maybe, block exploiting some vulnerability as a result of some particular bug in some cases, sometimes, maybe, the high cost doesn’t justify what we believe is the extra defence gained compared to the gain of such an effort directed elsewhere. — Ron
