Exporting - the wrong default?

[David M. Lloyd]

On 07/29/2016 09:20 AM, dalibor topic wrote:
>
>
> On 28.07.2016 16:59, David M. Lloyd wrote:
>> You don't have to add new
>> public packages to the exported list, because exporting all by default
>> is a safe/sane default as well as being intuitive.
>
> Is it safe to assume that all potentially headache inducing Guns and
> Bullets are always kept under lock in non-public classes?

Of course, that's why we had non-public classes in the first place.  The 
only reason users use public for this kind of thing (despite the 
availability of less permissive access modes) is because the language 
gives no useful way to share these classes outside their packages; this 
is why I proposed this exact behavior as an alternative.  This is better 
than the alternative suggestion: just export everything to everybody, 
defeating the point of the security measure in the first place.  Also, I 
propose that this is much closer to the original spirit of the Java 
language than the complex knot we have on the table before us now.

At some point you must have *some* kind of faith in the user.  If you 
can trust the user to know to put the right packages in the module 
descriptor - a task that at best can be described as "side-channel" - 
then surely you can trust the user to know which classes are "safe" to 
be made public and which are not (which, I might add, is something that 
any regular Java user already knows how to do).

-- 
- DML