rombert commented on PR #13: URL: https://github.com/apache/sling-org-apache-sling-commons-crypto/pull/13#issuecomment-5798836773
> The password is exposed to all other bundles via the registered service and its `getPassword` method anyways... I don't know of a way to restrict service visibility to just one bundle except for https://docs.osgi.org/specification/osgi.core/7.0.0/framework.servicehooks.html#d0e45897. Do you suggest to use a service find hook as well? If you're replying to my inline CF0001 comment - I don't think we should use service hooks; if we need to enforce something we'll do it via the API regions route. Thinking about it some more the main scenario that worries me is that the web console status dumps will contain cleartext passwords and hopefully marking the property as private will avoid that. If it doesn't we at least have a proper fix to submit in the Felix project. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
