1. It opens up more avenues for security attacks
As opposed to what? Doesn't the marshalling of *anything* over the wire open
up this possibility? Are some avenues for security attacks acceptable and
others are not. I think that this is manageable in many circumstances.
2. does not perform as well as local classes
The performance penalty is a one-time cost. In fact, for many applications
this will be spread out and greatly mitigated.
3. introduces a constant source of environment misconfiguration
Whether the classes are dynamically loaded, or not, environment
misconfiguration can occur. I don't agree with your assumption that it will
be a "constant" source of problems. We manage it quite well, without *any*
environment misconfiguration in our RMI world.
I don't want to create a religious debate. It seems that the "pure" CORBA
camp feels dynamic class marshalling is a very bad activity. Maybe it is not
possible for CORBA to support this behavior. RMI has to resort to the aid of
an HTTP server (or shared file system) to support class marshalling. I would
think that CORBA (with its separate ORB) could support this behavior
securely and more efficiently than RMI.
Regardless, I can point to personal experience whereby it has greatly
enhanced the deployment and versioning of our applications.
Some (maybe only WebLogic?) have embraced the concept, and I was wondering
if others have been challenged by versioning of classes and the deployment
headaches that can result. EJB is new and many people haven't come up
against some of these challenges in real-world applications. I don't believe
it is too soon to begin discussing the issue, and perhaps, possible
solutions.
jim
----- Original Message -----
From: Eric R. Williams <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, November 08, 1999 11:51 AM
Subject: Re: Deploying & Maintenance
> I thought that RMI-IIOP did *not* dynamically load classes from the
> server.... this type of thing is not standard CORBA. (Ie, you can't
> assume what "language" is on the other end... no guarantees that it
> is Java.)
>
> And IMO, dynamic class loading (ie, from the impl server) was one of
> the biggest drawbacks of RMI-JRMP. It opens up more avenues for
> security
> attacks, does not perform as well as local classes, and introduces a
> constant source of environment misconfiguration.
>
> -eric
>
>
> Alan Greenspan wrote:
> >
> > > ...
> > >
> > > I was very disappointed to find that CORBA does not allow the dynamic
> > > distribution of classes. For example, if I have a parameter of type
> > > Employee<interface>, and I marshall a class that implements this
> > interface,
> > > the class that implements must be present on the client. There were
many
> > > times that I took advantage of RMI's ability to do this "on the fly".
> > >
> >
> > RMI-IIOP dynamically loads implementation classes the same way as
RMI-JRMP.
> > I don't think there are any issues here for EJB.
> >
> > Alan
> >
> >
===========================================================================
> > To unsubscribe, send email to [EMAIL PROTECTED] and include in the
body
> > of the message "signoff EJB-INTEREST". For general help, send email to
> > [EMAIL PROTECTED] and include in the body of the message "help".
>
>
===========================================================================
> To unsubscribe, send email to [EMAIL PROTECTED] and include in the
body
> of the message "signoff EJB-INTEREST". For general help, send email to
> [EMAIL PROTECTED] and include in the body of the message "help".
>
>
===========================================================================
To unsubscribe, send email to [EMAIL PROTECTED] and include in the body
of the message "signoff EJB-INTEREST". For general help, send email to
[EMAIL PROTECTED] and include in the body of the message "help".
