<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#ffffff">
Hmm....<br>
Sorry to come to the conversation late on this, but this e-mail is
raising a potential red flag for me. I apologize if this has been
already addressed and I missed it, but...<br>
<br>
Controlling the lifecycle of a non-embedded container from a build is
something you want to be very careful about from a security
perspective. <br>
<br>
Now, if you have a plugin that requires an explicit command as well as
a link in a settings.xml, that seems perfectly reasonable. <br>
<br>
I am worried that a someone running "mvn test" for application foo.war
could startup non-foo wars because they were deployed to a local
container. <br>
<br>
Also, I am concerned that it may startup the wrong container and cause
similar problems. I usually work on multiple applications at a time
and have a container for foo.war and a separate container for bar.war.
I may think it is starting up foo's container, but it may startup bar's
container and cause trouble. <br>
<br>
For me, that can get really dangerous because my applications contact
external resources on startup as well as access things like files and
bdb databases that are not suitable for usage by multiple
applications. They could corrupt the file with simultaneous writes or
more likely write duplicate or erroneous data.<br>
<br>
<br>
I know I sound like a member of the "tin-foil-hat-club" here, but I
deal with patient data, so my apps are required by law to be paranoid
about security. <br>
<br>
On 12/27/2009 03:54 PM, Dan Allen wrote:<br>
<br>
<br>
<blockquote
cite="mid:19758da0912271254i52b09937hc71e7b2a05d9d4b9@mail.gmail.com"
type="cite">
<p>Awesome, that will be a good feature to get in. </p>
<p>- Dan Allen</p>
<p>Sent from my Android-powered phone:<br>
An open platform for carriers, consumers<br>
and developers.</p>
<blockquote type="cite">On Dec 27, 2009 1:35 PM, "Aslak Knutsen" <<a
moz-do-not-send="true" href="mailto:aslak@conduct.no">aslak@conduct.no</a>>
wrote:<br>
<br>
Arquillian 'starts' it, but the container impl does not actually start
a not started jboss instance.
<div><br>
</div>
<div><a moz-do-not-send="true"
href="https://jira.jboss.org/jira/browse/ARQ-48" target="_blank">https://jira.jboss.org/jira/browse/ARQ-48</a></div>
<div><br>
</div>
<div>
<p><font color="#500050">-aslak-
2009/12/27 Dan Allen <<a moz-do-not-send="true"
href="mailto:dan.j.allen@gmail.com">dan.j.allen@gmail.com</a>>
>
> +1 on the standalone CDI bootstap. I think...</font></p>
-- <br>
--
<p><font color="#500050">Aslak Knutsen; +47 952 38 791; fax +47 22
33 60 24
</font></p>
<p><font color="#500050">Kongens gate 14; Boks 805 Sentrum, 0104
Oslo;
<a moz-do-not-send="true" href="http://www.conduct.no">http://www.conduct.no</a>;
mailto:<a moz-do-not-send="true" href="mailto:aslak@conduct.no">aslak@conduct.no</a>
Conduc...</font></p>
</div>
</blockquote>
</blockquote>
<br>
</body>
</html>