On Thu, Apr 12, 2018 at 10:12 PM, Mark Raynsford via osgi-dev <
osgi-dev@mail.osgi.org> wrote:

> On 2018-04-12T20:32:13 +0200
> Peter Kriens <peter.kri...@aqute.biz> wrote:
> > Caught between a rock and a hard place with only one way forward …
> I should make the point that I don't hate the JPMS. I do think that
> it's just barely the minimum viable product, though.
> The JVM really did need a module system, both for the maintenance of
> the JDK itself and the future features that the system enables.
> > Oracle’s strategy is a mystery to me.
> I think their strategy is fairly explicable, but I think they did make
> some mistakes with some of the specifics (filename-based automodules!).
> There's a pattern that Oracle tend to follow: They solicit opinions from
> everyone vigorously, and then they implement the smallest possible
> subset such that the fewest possible people are pissed off by it. If
> there's a possibility of doing something wrong, nothing is done
> instead.

While I've seen that principle operate at other times (remember how
controversial erasure was in Java 5?), I'm not sure it's worked that way in
the JPMS case. In fact JPMS does far more than it needed to.

The key feature of JPMS that could not be achieved before, even with
ClassLoaders, was strictly enforced isolation via the accessibility
mechanism, as opposed to the visibility mechanism that is employed by OSGi.
That strict isolation was needed primarily to allow Oracle to close off JVM
internals from application code and thereby prevent a whole class of
security vulnerabilities. Remember that Oracle was being absolutely
slaughtered in the press around 2011-12 over the insecurity of Java, and
most corporates uninstalled it from user desktops.

But they could have achieved this with a thin API, comparable to
ProtectionDomain. If they had done that then OSGi (and other module systems
like JBoss) could have chosen to leverage the API to enforce strict
separation between OSGi bundles.

But they didn't do that. Instead they implemented a whole new, incompatible
module system with its own metadata format, including changes to the Java
language spec. Then they restricted the ability to apply strict isolation
to artifacts that are JPMS modules. With the thin API they could have still
built their own module system on top, following their own ideas of how
modules should work, and competed with OSGi on a fairer playing field.

> Being incomplete and "too strict" is considered preferable to
> any kind of maintenance burden or making a mistake that people then
> come to depend upon. Then, after a version of something is released,
> the dust settles and the people that are still complaining after a year
> or so of implementation are asked for comments again. The process
> repeats! You can see this going on with quite a few of their projects.
> A good example of this with the JPMS is that there was a vigorous
> insistence that the module graph be a DAG. Now, some way into the first
> year, it's going to be allowed to be cyclic but only at run-time. I
> think the process does eventually produce results, but it takes a long
> time to get there and demands a lot of patience from the people
> involved. Most VM features seem to start off utterly spartan and then
> grow to support the use-cases that people wish they'd supported right
> from the start.
> Java in particular has awful press, and a userbase that seems to become
> incomprehensibly enraged over all good news and all bad news
> indiscriminately, so that doesn't help the perception of the process
> (or the results).
> I think the key will be to continue complaining for as long as it takes
> to get better interop between OSGi and the JPMS. :)

Interop already works just fine in one direction: OSGi bundles depending on
JPMS modules, with a combination of the changes in R7 to export java.*
packages from the system bundle and some creative use of
Provide/Require-Capability. But bidirectional interop will likely always be
impossible or very hard, because JPMS modules are only allowed to depend on
JPMS modules. This was clearly a deliberate strategy to tilt the table
towards JPMS, but it may be backfiring since -- as you've pointed out --
applications can only migrate to modules when all of their dependencies are
modules, including third party libraries, and the migration of libraries
has been exceedingly slow.


> --
> Mark Raynsford | http://www.io7m.com
> _______________________________________________
> OSGi Developer Mail List
> osgi-dev@mail.osgi.org
> https://mail.osgi.org/mailman/listinfo/osgi-dev
OSGi Developer Mail List

Reply via email to