Should setAccessible be part of Java or not? (was Re: It's not too late for access control)

[Andrew Haley]

On 14/07/16 16:54, mark.reinhold at oracle.com wrote:
> 2016/7/14 5:35:25 -0700, Andrew Haley <aph at redhat.com>:

>> At Red Hat we have many Java programmers.  We also have many
>> customers who are Java programmers.  I am trying to persuade people
>> to try out JDK 9 in order to give us the feedback we need to ratify
>> the JDK 9 specification.  But you know where this is going: the
>> changes to Jigsaw which we need are TBD, but with an assurance of
>> "I think we'll be able to work something out."  This is a tough
>> sell for me.
> 
> Is this any different than the usual chicken-and-egg problem of live
> software development?  Much of Jigsaw is still in flux as we work
> through issues in both the specification and the implementation.  If
> you have specific suggestions about how we could make it easier to
> persuade people to try JDK 9 then I'd like to hear them.

I take your point.  Many suggestions are likely to be of the form "fix
this issue on the known issues list."

> Also, nobody is asking you, or anyone else, to take anything on
> faith.  We are -- and long have been -- asking for feedback, both
> practical feedback based on running existing code against EA builds
> and design feedback from developers of all skill levels.

Sure.  I suppose the only way to make this work is to break things,
wait for feedback about what people need, and fix them.  The problem
that we have is that we are fairly late in the JDK 9 release cycle,
and still not sure if the specification of Jigsaw will work for us.
Or, for that matter, many large-scale Java programs.

>> I am also rather concerned that too much is going into Jigsaw.  Along
>> with much-needed modularization of the JDK itself we're getting access
>> controls such as the one we're discussing.  I understand the argument
>> for restricting setAccessible() in a module context (and the computer
>> scientist in me says "Yay!") but it's not a necessary part of
>> modularization and it should be discussed on its own merits.  Everyone
>> is going to be affected by Jigsaw, but you can't expect everyone to
>> read the minutiae of the discussion.
> 
> No, of course not, and that's exactly why we've been writing and
> talking publicly, for years now, about this work.

Indeed, but the kinds of changes that we're talking about --
particularly this one -- are not the things which people notice until
they bang their heads on them.  With JDK 9 it's quite likely that
people won't be deploying their own modules for some time, and
initially will want to run their JDK 8 programs with as little change
as possible.  It's quite likely that they wouldn't even know that the
setAccessible issue even existed until much later in the cycle,
*after* the specification was frozen.  And at that point they would
just decide to export everything to everyone because it would be the
easy way to get their job done.

Of course, some developers will do that anyway, but we don't want them
to have to.

Andrew.