CSR review request JDK-8233621, Mismatch in jsse.enableMFLNExtension property name

Sean Mullan sean.mullan at oracle.com
Thu Nov 7 21:32:26 UTC 2019


On 11/7/19 12:34 PM, Xuelei Fan wrote:
> As the property has a default value, so there is a problem to use two 
> properties for the same purpose.  We don't really know if an application 
> uses the misspelled name, or intended to use the default value.

But you know if an application has set the property (the misspelled one 
or the correct one), so I don't see the issue, but maybe I am missing 
something. Can you be more specific, or give an example where it would 
be an issue?

--Sean

> 
> For the current applications, if the implementation name get used, okay, 
> they get the expected behavior if we change to use the impl name, and no 
> worries.  However, if we change to use the doc name, the behavior get 
> changed, and problems come out.
> 
> For the current applications, if the doc named get used.  Applications 
> may expect it to work, but actually not.  If we change to use the impl 
> name, the application still does not work, no additional risks.  If we 
> change to use the doc name, the configuration works but the application 
> behavior also get changed (although it is the expected behavior).
> 
> I think the risk is pretty low if change to use the impl name.
> 
> Xuelei
> 
> On 11/7/2019 8:46 AM, Sean Mullan wrote:
>> I guess another option is to not change the name that is used in the 
>> docs, but change the code to look for both properties, trying the docs 
>> name first, and then the misspelled name.
>>
>> Not great, but probably the safest and least disruptive option.
>>
>> --Sean
>>
>> On 11/5/19 8:07 PM, Xuelei Fan wrote:
>>> I understand your points.  Between using the doc name and the code 
>>> name, I think using the code name is a little bit safer if someone 
>>> really use the impl name.  However, just a little bit.  I’m open to 
>>> use the doc name if we could get an agreement.
>>>
>>> Xuelei
>>>
>>>
>>>
>>>> On Nov 5, 2019, at 4:32 PM, Anthony Scarpino 
>>>> <anthony.scarpino at oracle.com> wrote:
>>>>
>>>> I understand the desire to change this, but are we sure the doc 
>>>> should be changed instead of the property?  I would tend to believe 
>>>> users code to the doc and don’t notice it wasn’t working.   Not 
>>>> reading the source code and code to that implemented name.  
>>>> Otherwise I’d assume someone would have filed a bug already in the 
>>>> 2yrs.
>>>>
>>>> I don’t want us to support two properties, I’m just not confident 
>>>> which way is right.
>>>>
>>>> Tony
>>>>
>>>>> On Nov 5, 2019, at 4:00 PM, Xuelei Fan <xuelei.fan at oracle.com> wrote:
>>>>>
>>>>> Hi,
>>>>>
>>>>> May I have the CSR reviewed?
>>>>>   https://bugs.openjdk.java.net/browse/JDK-8233652
>>>>>
>>>>> The system property, "jsse.enableMFLNExtension", was introduced in 
>>>>> JDK 9 (See JSSE Reference Guides). However, the implementation code 
>>>>> uses "jsse.enableMFLExtension" (without 'N') instead.
>>>>>
>>>>> As the system property may have been used in practice, it may be 
>>>>> better to change the CSR and doc accordingly.
>>>>>
>>>>> Thanks,
>>>>> Xuelei
>>>>
>>>



More information about the security-dev mailing list