JEP 411: Disable warning message with flag?

[Mikael Sterner]

For the record, I want to point out that the latest revision to the
JEP 411 draft didn't solve the issue highlighted below, since applications
embedding a Java runtime still would not be able to suppress the warning
issued when setting a security manager. Such applications will thus have
to stay at Java 16 or earlier while migrating away from the Security
Manager, instead of being able to stay at Java 17+.

Regardless of the decision taken on allowing the suppression of warnings
(I stated my case), I think JEP 411 could benefit from being more clear
about the actors involved, and what their role is in relation to the Java
runtime. Currently it talks about the "users" and "developers" of a Java
application, but seems to assume that "users" benefit from knowing about
details (deprecated APIs) that typically would only concern "developers",
at least in a post-JRE world.

In a post-JRE world, the concept of "users" and "their Java applications"
doesn't make sense, since how would a "user" even know that their
application used Java, when the "developer" has hidden the Java runtime
behind jlink/jpackage, a launch script, or the Invocation API? I would
thus question the second goal of JEP 411 for such applications.

Yours,
Mikael Sterner

On Fri, May 21, 2021, at 19:33, Mikael Sterner wrote:
> The current version of JEP 411 (Deprecate the Security Manager for 
> Removal) has as its goal "Warn users if their Java applications rely on 
> the Security Manager.". To that end it proposes to "Issue a warning 
> message at startup if the Security Manager is enabled on the command 
> line."
> 
> I would suggest adding a flag to disable the warning message, for use 
> in cases where an application ships to end users with a Java runtime 
> included. Because in those cases, the warning is meant for the 
> developer of the application and not end users. End users would not be 
> the ones providing/upgrading the Java runtime, and in many cases it 
> would not be acceptable to have a warning displayed on startup that 
> could confuse users.
> 
> If a flag to disable the command line warning is not added, the effect 
> will be that the Security Manager is not possible to use in such 
> applications already in Java 17 (counting on the proposed target), 
> which seems rather harsh given the short notice.
> 
> If the flag is added, developers of applications that use the Security 
> Manager will still notice the warning (until disabled) but they get 
> more time to migrate to better solutions like process isolation. As a 
> bonus, for hard-to-migrate cases you can stay on Java 17 with the 
> Security Manager for as long as you're willing to pay, since many 
> vendors seem to plan to offer long term support for it.
> 
> Yours,
> Mikael Sterner