My position on module security/access control

[Stephane Epardaud]

On 10/12/15 02:29, mark.reinhold at oracle.com wrote:
> With the exception of escape hatches such as setAccessible, the
> reflection APIs have always worked in exactly the same way as the
> corresponding static constructs. Your proposal would address the issue
> of making it easier for frameworks to migrate to modules, but it is
> not the only approach to that problem (about which more later).

Is that really true? Are they caller-sensitive to check if
package-private or protected fields/methods can be accessed? I did not
have that impression, but perhaps I misremember.