RFR: 8254711: Add java.security.Provider.getService JFR Event [v2]

Valerie Peng valeriep at openjdk.org
Mon Sep 19 16:45:45 UTC 2022


On Mon, 19 Sep 2022 15:52:08 GMT, Sean Mullan <mullan at openjdk.org> wrote:

>> I had this as the original design actually. I'm not sure how interesting it would be to record such "no-service" type events. It would probably add 2-4 times the number of events for this event type to a typical recording, given that the framework iterates over the providers in preferential order.
>
> Yes, I think this would generate too much noise and detract from the main motivation for these events, which is to help users analyze the security of algorithms that are being used by their applications at the JCE layer.

Plus one regarding "too much noise". This event is at the Provider.getService() level and would reports all calls regardless the type and algorithm. Crypto services which supports the delayed provider selection may call Provider.getService() to query but may not use all available ones. So, even if the service is returned, it may not be actually used. Just saying.
Does JFR events support filtering? Or is the expectation of this being a collection of usages and analyze is done separately?

-------------

PR: https://git.openjdk.org/jdk/pull/9657



More information about the security-dev mailing list