Java - Integrity by Default

แชร์
ฝัง
  • เผยแพร่เมื่อ 6 พ.ย. 2024

ความคิดเห็น • 22

  • @emilszpakowski
    @emilszpakowski หลายเดือนก่อน +1

    Great talk. After seat-belts please do some more jet-packs (TCO!).

  • @gsestream
    @gsestream หลายเดือนก่อน +1

    so why a generic class MyClass cannot create an array of the K variable, claiming its generic array. like K[] myArray = new K[10]; in Java 21. if not already fixed in Java22, fix the Generic class instantiation unnecessary limitations. Every generic class is an Object and can be thus made into arrays. Higher rule applies. Just make an Object array and put each normal or generic class object into the Object array. then you have a permissible generic array. allow it to be fully type checked.

  • @flatmapper
    @flatmapper หลายเดือนก่อน +1

    The tone of speach is cool

  • @shadeblackwolf1508
    @shadeblackwolf1508 หลายเดือนก่อน +4

    Would it make sense to be able to enable these boundry breaking configs at the module level in the module declaration? That way, you could for example set it so only the trusted JNI based wrapper library for a system service can use JNI.

    • @0x150
      @0x150 หลายเดือนก่อน +4

      this has already been discussed in several JEPs, and ron has always voted against it. without him, it won't happen

    • @ronpressler1362
      @ronpressler1362 หลายเดือนก่อน +2

      See 39:39

    • @shadeblackwolf1508
      @shadeblackwolf1508 หลายเดือนก่อน

      ​@@ronpressler1362i have seen that but that is from the reverse perspective. That is "i declare i need x. Access". What i'm suggesting is kinda the reverse. Where i'm requiring my modules and granting them specific opens and exports, i'd like to be able to grant them these special privileged accesses, so i can have all these access controls specified in one place. Especially as it operates on the same logical level.

    • @DmitriyYankin
      @DmitriyYankin หลายเดือนก่อน +1

      @@shadeblackwolf1508 Imagine the next step. You specified all these "module_foo opens to native;" and everything works. Then you (Bob) decide to publish your library and someone (Alice) starts using it. What will happen then? 2 choices. 1st choice: Alice will get this module_foo that breaks integrity and Alice doesn't even know about granted access because it's in the module of a dependent library from you, Bob. 2nd choice: All your grants will not affect anything for Alice using your lib. And it makes module-info dependable on usage.

  • @VerhoevenSimon
    @VerhoevenSimon หลายเดือนก่อน +1

    Thank you for the great presentation.

  • @B_knows_A_R_D-xh5lo
    @B_knows_A_R_D-xh5lo หลายเดือนก่อน

    great

  • @Dude42666
    @Dude42666 หลายเดือนก่อน +3

    Does anyone know what he means by the Tip & Tail development model?

    • @BinaryRage
      @BinaryRage หลายเดือนก่อน +8

      It’s how the JDK is developed, and how they recommend library and framework authors navigate their increased release velocity: new features only in the latest release, stability and fixes for older releases. The implication being you can track the latest features and be only an LTS release behind maybe

    • @delabassee
      @delabassee หลายเดือนก่อน +4

      Make sure to check the keynote th-cam.com/video/NV4v7KXKQ-c/w-d-xo.htmlfeature=shared&t=240

  • @Salzui
    @Salzui หลายเดือนก่อน +2

    39:36 is he saying JNI will be removed entirely "in the end"?

    • @ronpressler1362
      @ronpressler1362 หลายเดือนก่อน +6

      No, it's just that you will eventually *have* to enable native access to use either JNI or some FFM features (now you'll only get a warning)

  • @Salzui
    @Salzui หลายเดือนก่อน +2

    The value of jdk updates is there, but a bunch of companies will question themself whether theyre worth it.

  • @gavinray9493
    @gavinray9493 หลายเดือนก่อน +3

    Content starts at 10:02

    • @Anbu_Sampath
      @Anbu_Sampath หลายเดือนก่อน +1

      First 10 minutes is really good content.

  • @shadeblackwolf1508
    @shadeblackwolf1508 หลายเดือนก่อน +7

    Mockito uses bytebuddy to instantiate an object without touching its constructor... Integrity is a long way off

    • @Salzui
      @Salzui หลายเดือนก่อน

      Integrity needs exceptions. Stuff like Mockito needs to continue existing sas its rather useful.

    • @mjduigou
      @mjduigou หลายเดือนก่อน +17

      A testing tool is somewhat of a special case that it is reasonable to allow since it doesn't run in production and I would be willing to provide special permissions when it is being used. I wouldn't want to offer the same for some random library that is part of my production runtime classpath.

    • @DmitriyYankin
      @DmitriyYankin หลายเดือนก่อน +3

      Integrity is not about killing those things. It's about explicit permission from you on such backdoors.