Minor thoughts (Re: [External] : Re: JEP draft: Prepare to Restrict The Use of JNI

[Peter Tribble]

On Tue, Sep 5, 2023 at 12:49 PM Ron Pressler <ron.pressler at oracle.com>
wrote:

>
>
> > On 5 Sep 2023, at 10:55, Simon Nash <simon at cjnash.com> wrote:
> >
> > On 04/09/2023 10:48, Ron Pressler wrote
> >>
> >> The end user of your application need not see the warning at all. If
> you, as the application author, pick a runtime based on a JDK version that
> has this warning for your application, then *you*, as the application
> author, will pass the flag to the Java runtime. Your application’s end user
> need not know about any Java flags; they need not even know your
> application is a Java application. These are all internal details of your
> application.
> >>
> > As I explained in an earlier message, I can release a new version of my
> application that has this change (I will use the new attribute in the
> launcher jar) but many users are still using older versions of the
> application without this change. They will see the scary warning and will
> not know what they need to do to make it go away.
>
>
> They will only see a warning if they configure the old version of your
> application to use a new Java runtime that they themselves provide. If they
> are developers who know how to use the JDK and configure its launcher to
> run your application, then why would they be scared? If they’re not
> developers, how would they obtain a new version of the Java runtime and
> configure your application to use it?
>
> I’m trying to understand how such a situation could arise and what kind of
> users we’re talking about.
>

That would be a pretty normal scenario.

A new version of the Java runtime could be pushed to a user by:

* The OS vendor, in a patch or update
* If in an organization, by the organization's IT department
* Ditto by an organization's security team
* Installation of a different application that updates Java as a side-effect

And probably a number of others. The point is that virtually none of us
live in a
perfect idealized world; we generally have to work under the assumption
that our
code could be used in a variety of different environments, including
different java
versions, and that we have no control whatsoever.

-- 
-Peter Tribble
http://www.petertribble.co.uk/ - http://ptribble.blogspot.com/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mail.openjdk.org/pipermail/jdk-dev/attachments/20230905/b2d7dd36/attachment-0001.htm>