Apache Shiro security framework releases 3.0.0 • Hacker News Board

Re: Apache Shiro security framework releases 3.0.0

#11

Post by vips7L » Thu, Jul 09, 2026, 12:24 PM UTC

khurs wrote: post #4

iririririr wrote: post #3

Java the language is so good. too bad the entire ecosystem is worse than brain dead. overload controlled by xmls scattered all over the filesystem, most read at run time. the mvn-gradle-mvn-gradle-mvn-... frustration and migration (literal) circle. the O.G. supply chain attacker build systems (which doesn't even help actually getting dependencies). everything is so bad. but at least com.java.naming.reverse.the.resolv…

Your comment isn't relevant to the discussion, as the article is not about the merits of the language, but merely a Java Security Framework.

Their comment is also wildly wrong and outdated by two decades.

Re: Apache Shiro security framework releases 3.0.0

#12

Post by moondowner » Thu, Jul 09, 2026, 12:43 PM UTC

iririririr wrote: post #3

Java the language is so good. too bad the entire ecosystem is worse than brain dead. overload controlled by xmls scattered all over the filesystem, most read at run time. the mvn-gradle-mvn-gradle-mvn-... frustration and migration (literal) circle. the O.G. supply chain attacker build systems (which doesn't even help actually getting dependencies). everything is so bad. but at least com.java.naming.reverse.the.resolv…

> xmls scattered all over the filesystem

is this comment from 2015?

With e.g. Spring Boot and Gradle you can have large projects with zero xml files needed. That has been the case for years.

Re: Apache Shiro security framework releases 3.0.0

#13

Post by kitd » Thu, Jul 09, 2026, 12:48 PM UTC

moondowner wrote: post #12

iririririr wrote: post #3

Java the language is so good. too bad the entire ecosystem is worse than brain dead. overload controlled by xmls scattered all over the filesystem, most read at run time. the mvn-gradle-mvn-gradle-mvn-... frustration and migration (literal) circle. the O.G. supply chain attacker build systems (which doesn't even help actually getting dependencies). everything is so bad. but at least com.java.naming.reverse.the.resolv…

> xmls scattered all over the filesystem is this comment from 2015? With e.g. Spring Boot and Gradle you can have large projects with zero xml files needed. That has been the case for years.

With Polyglot Maven, you don't even need it in Maven either!

https://github.com/takari/polyglot-maven

Re: Apache Shiro security framework releases 3.0.0

#14

Post by Twirrim » Thu, Jul 09, 2026, 1:33 PM UTC

moondowner wrote: post #12

iririririr wrote: post #3

Java the language is so good. too bad the entire ecosystem is worse than brain dead. overload controlled by xmls scattered all over the filesystem, most read at run time. the mvn-gradle-mvn-gradle-mvn-... frustration and migration (literal) circle. the O.G. supply chain attacker build systems (which doesn't even help actually getting dependencies). everything is so bad. but at least com.java.naming.reverse.the.resolv…

> xmls scattered all over the filesystem is this comment from 2015? With e.g. Spring Boot and Gradle you can have large projects with zero xml files needed. That has been the case for years.

Agreed. In my current job, across several large java code bases that have been developed over the last 12 years, the only place I've seen xml come into play is for maven. We've hundreds or more similar scale code bases and I don't think I've ever seen it in use beyond that, though I only occasionally look at those code bases.

No one is ever reaching for xml or even thinking about it.

Re: Apache Shiro security framework releases 3.0.0

#15

Post by aweiland » Thu, Jul 09, 2026, 1:38 PM UTC

forkerenok wrote: post #7

In my junior-to-mid days (ca. 2010) Apache Shiro seemed like a breath of fresh air compared to Spring Security in terms of ease of integration. Good to see it's still around.

Yes it was. Also Apache Camel in lieu of Spring Integration as well.

Re: Apache Shiro security framework releases 3.0.0

#16

Post by ruszki » Thu, Jul 09, 2026, 2:39 PM UTC

moondowner wrote: post #12

iririririr wrote: post #3

Java the language is so good. too bad the entire ecosystem is worse than brain dead. overload controlled by xmls scattered all over the filesystem, most read at run time. the mvn-gradle-mvn-gradle-mvn-... frustration and migration (literal) circle. the O.G. supply chain attacker build systems (which doesn't even help actually getting dependencies). everything is so bad. but at least com.java.naming.reverse.the.resolv…

> xmls scattered all over the filesystem is this comment from 2015? With e.g. Spring Boot and Gradle you can have large projects with zero xml files needed. That has been the case for years.

Even in 2015, we have already started Spring projects without XML configuration.

But you shouldn’t be surprised. Very few people really can code in Spring nicely. For example, configuration in application.properties is still seems to be too complex to understand for most. Most accepted solution on StackOverflow is not the best at all (for example many-many includes unnecessary lines).