users@servlet-spec.java.net

[servlet-spec users] Re: [jsr340-experts] Configuring DENY semantic for uncovered HTTP Methods

From: Markus Eisele <myfear_at_web.de>
Date: Fri, 8 Feb 2013 07:05:51 +0100

Hi all,

it was a little bit hard to catch up on the recent discussion about
this after Jfokus. But here we go:
As Bill already mentioned, the Java EE platform EG is in strong favor
about fixing this; I am part of it.
I believe both Ron and Bill did explain the thoughts and ideas behind
the proposal and I am glad to read that this generally is an issue
with you, too.

Further on I do believe that this came in late to the Servlet EG and
already having the "judgment call" from Bill does make arguing with
you harder or even impossible. I apologize for that.
I received some of them before myself and I also didn't like it (e.g.
Logging ;)).

But at the end some things needs to be driven forward and this is a
very obvious and relevant thing to move on with. I screened the
http://java.net/jira/browse/SERVLET_SPEC issue tracker and tried to
find out about the state of discussion or even get an impression about
the already discussed proposals. But I didn't find any. Can someone
please collect them and make them available again? Or is Greg's
proposal the only thing so far? I got the impression that Mark also
did one? Wouldn't it be good to have a wiki page about it? If there
already is one, I didn't find it.

I do agree that working this out together would have been the best
(probably only) right thing to do. Having in mind, that the recent
transparency moves in the JCP also fosters the cross specification
works it is one of the lessons-learned for me so far. This isn't
something that _just works_. We have to make it work. If this doesn't,
at least in the mid term, I can tell you that I am in favor of the
architecture council mentioned by Bill.

As you already mentioned it might be a bigger mess to clear out if we
change things today. I disagree. I'm working with a couple of projects
every year and this is a re-occurring point of many security audits I
have seen. Closing that gap today is better than closing it tomorrow.
And breaking backward compatibility is a growing issue with many specs
(e.g. CDI). So, you are not the only one calling for a solution here
....

For now I can only ask for your support. Calling the next EE a Major
release is kind of an exaggeration at least to me and there is good
hope that we have a chance to pick this up again next time. Especially
as there are some other things I also would love to see changed in
that context. To me it seems reasonable to enter a new issue to the
tracker and I believe that Ron and Bill agree on catching up with it
again and working out a complete solution together!

Thanks for listening,
- Markus

___________
twitter.com/myfear
blog.eisele.net