<div dir="ltr"><div>So from an external-to-Red-Hat perspective, leave the Java security manager off as the wildfly default setting. While security continues to become more important at the application level, I think you need to consider the explicit/implicit objectives of wildfly: (a) provide an implementation of the latest Java EE specs so developers/architects can work with it and prepare for future work on projects and in production, and (b) suggest/persuade non Red Hat customers to switch to JBoss. Turning on the Java security manager in wildfly by default could really sour a lot of developers/architects on Red Hat, not to mention wildfly. Consequently they would most likely just switch to using glassfish.<br>
<br></div><div>But you want want to keep it easy and obvious to turn on the Java security manager in wildfly.<br></div><div><br></div>Just my 2¢.<br><div><div class="gmail_extra"><br><br><div class="gmail_quote">On Sat, Apr 19, 2014 at 8:34 AM, David M. Lloyd <span dir="ltr"><<a href="mailto:david.lloyd@redhat.com" target="_blank">david.lloyd@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="">On 04/18/2014 05:44 PM, Bill Burke wrote:<br>
> Late to the discussion, but this came up in conversations at DevNation.<br>
><br>
> Are you sure you guys want to fully enable the Java security manager<br>
> going forward? Jboss has been around for, what 14 years now? How many<br>
> users/customers actually desire the Java Security Manager to be on by<br>
> default? Could it be a possibility that the majority of our<br>
> customers/users might freak out if they found that all of a sudden the<br>
> Java Security Manager is on when it has been off the last 14 years?<br>
><br>
> I don't know. Just seems to me that there is a lot of other cool ideas<br>
> that you guys have been discussing that might be more interesting to<br>
> wildfly's user base.<br>
<br>
</div>For the record I think Java's security model is pretty terrible. Years<br>
of really, really bad CVEs are pretty much all the evidence you need.<br>
But security manager support is a part of Java EE now, as of 7 - and<br>
worse yet it is inexorably tied up with several JAAS concepts, making it<br>
a constant pain for us, as users want to be able to use JAAS even though<br>
it is terrible and it itself is not formally a part of Java EE (it is,<br>
after all, the only standard authentication client API). Given our<br>
newer security initiatives, problems have arisen that we do have to<br>
solve, and that means we have to think about how it impacts this stuff too.<br>
<br>
So, this is why we've spent time dealing with this. There are tons of<br>
other things I for one would rather be doing, believe me. :-)<br>
<span class="HOEnZb"><font color="#888888">--<br>
- DML<br>
</font></span><div class="HOEnZb"><div class="h5">_______________________________________________<br>
wildfly-dev mailing list<br>
<a href="mailto:wildfly-dev@lists.jboss.org">wildfly-dev@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/wildfly-dev" target="_blank">https://lists.jboss.org/mailman/listinfo/wildfly-dev</a><br>
</div></div></blockquote></div><br></div></div></div>