Should setAccessible be part of Java or not? (was Re: It's not too late for access control)

[Andrew Haley]

On 14/07/16 10:56, Alan Bateman wrote:
> On 14/07/2016 10:03, Andrew Haley wrote:
> 
>> On 14/07/16 09:59, Andrew Dinn wrote:
>>> If this aspect of how Java currently works is to be removed then I
>>> believe it needs to be done so on the basis of a publicly established
>>> consensus, preferably under the aegis of the JSR EG. It certainly does
>>> not seem right to me that  such a goal should be adopted by an
>>> implementation team without such consultation.
>>
>> It goes much wider than Jigsaw: such a basic language change needs all
>> stakeholders to be consulted.  Most of them surely won't be reading
>> the Jigsaw list, yet will still be affected.
>>
> This project (and JSR) is not proposing to remove setAccessible as that 
> would break many things. The comment that Andrew Dinn picked up started 
> with "In the very long term ..." and is a throw away comment on where 
> the platform needs to go long term. In general then we need to find 
> better solutions for things that setAccessible is used for today. That 
> could take years and many major releases. It's a bit like the Unsafe 
> issue in that regard.

OK.  But "in the very long term" such a basic language change needs
all stakeholders to be consulted.

> Confusion aside, we have taken a first baby step towards degrading 
> setAccessible so that it can't be used to break into non-exported 
> packages. There was discussion about this on the EG mailing list last 
> year, much discussion on it here too.

Yes, indeed, and that is potentially a significant problem.  My
comment stands: there is a serious possibility that his will make it
impossible to use (non-exported) Jigsaw modules for some kinds of
programming.  This is exactly the kind of decision that needs all
stakeholders to be consulted.

It ought to be possible to have some kind of conditional export which
only allows such access by (e.g.)  suitably privileged frameworks or
tools.  But I have no desire to get involved in such design issues: I
am only going to say that this is an issue which requires wider
consultation.

Andrew.