Re: Planning for a World without Java Security Manager

2021-12-23 Thread David Smiley
I created one now: https://issues.apache.org/jira/browse/SOLR-15875 In the comment, I suggest this probably should be a SIP, and that there are possibly conflicting/redundant ideas (yet may be complementary?) in SOLR-14049. So, discussion is definitely necessary. That's really the point of a SIP

Re: Planning for a World without Java Security Manager

2021-12-22 Thread Marcus Eagan
It doesn't seem that bad, yet I know some people will freak. According to the proposal, it will say this: WARNING: A command line option has enabled the Security Manager WARNING: The Security Manager is deprecated and will be removed in a future release I think the modularization goal is great,

Re: Planning for a World without Java Security Manager

2021-12-19 Thread David Smiley
What is this warning message? Regardless, bin/solr could detect that this scenario is going to occur and print a message of its own so that users have better context on the situation. In other ways, we are investing in securing Solr. Modularization comes to my mind first. And I really wish for a

Planning for a World without Java Security Manager

2021-12-17 Thread Marcus Eagan
Hi, As a part of the Log4j madness we all have dealt with, I learned of JEP-411( https://openjdk.java.net/jeps/411). There is a wish to deprecate the Security Manager in Java 17 for eventual removal. I feel it is likely to land. As a result, I think we should start to think about what it means to