JEP draft: Prepare to make final mean final • Hacker News Board

Re: JEP draft: Prepare to make final mean final

#141

Post by pjmlp » Thu, Apr 03, 2025, 9:58 AM UTC

immibis wrote: post #139

pjmlp wrote: post #127

Earlier quoted context omitted.

Yes it does, all of this is to make Java fully safe by default, in the age of cybersecurity laws, hence all loopholes are being closed down, in reflection, JNI and Panama. The security model was deprected, just like .NET dropped CAS in .NET Core, because it wasn't sound, and without applets, the OS security model was the right way.

If there's no security model then who are you protecting from who?

There is the OS security model, who said otherwise?

Supply chain attacks from misbehaving libraries using reflection or JNI/Panama, that is what secure by default is protecting from.

Re: JEP draft: Prepare to make final mean final

#142

Post by samus » Thu, Apr 03, 2025, 10:29 PM UTC

immibis wrote: post #138

samus wrote: post #135

Earlier quoted context omitted.

The excemptions outlined in the JEP still allow people to do pretty much whatever they want as granular as they want. They can even wholesale revert to the old behavior. I really don't see the issue. > And, likewise, if the JVM never sees a write instruction to a certain field, except once in the constructor, it should be able to treat it as if the field were final, and avoid reloading it after method calls. If it lo…

Instance variables can't be constant propagated, can they? Different instances have different values.

Of course they can, and it makes a lot of sense if they contain configuration settings or things like that. An instance might be held in a static final variable, and that reference can be inlined, but it's data can't unless it's an instance of a record or a hidden class, since for those classes final already means final.

Re: JEP draft: Prepare to make final mean final

#143

Post by immibis » Sat, Apr 05, 2025, 7:03 PM UTC

pjmlp wrote: post #141

immibis wrote: post #139

Earlier quoted context omitted.

If there's no security model then who are you protecting from who?

There is the OS security model, who said otherwise? Supply chain attacks from misbehaving libraries using reflection or JNI/Panama, that is what secure by default is protecting from.

What? This comment doesn't parse.