Re: [VOTE] minimal JSR 154 only distribution
- Original Message - From: Remy Maucherat [EMAIL PROTECTED] To: Tomcat Developers List [EMAIL PROTECTED] Sent: Thursday, December 12, 2002 12:38 AM Subject: Re: [VOTE] minimal JSR 154 only distribution Jon Scott Stevens wrote: on 2002/12/11 5:06 PM, Glenn Nielsen [EMAIL PROTECTED] wrote: Looking at the original vote I realize that what you ask can't be done. Tomcat 4 is the RI of Servlet 2.3, JSR 154 is for Servlet 2.4. So it isn't possible to create a JSR 154 only dist of Tomcat 4. Glenn Very good point. I withdrawal my vote. A new vote will need to be made for Tomcat 5. I will re-submit when I can also submit a patch for it. =) As soon as I'm over a Scarab deadline (Dec 20th), I'm going to work on this and it is going to turn into another similar Anakia-style deal. If you remember correctly, people -1'd Anakia all over the place until I went and actually built the website using it. Now, to this day, Anakia is still used for the Jakarta site (as well as the main www.apache.org site). So, for something that people said sucks so badly and is such a terrible idea, it has worked very well for quite a while now. =) The same will be true for my minimal distribution idea. This is not getting anywhere. Actually, what you want is not a distribution for end users, but rather a distribution for people embedding Tomcat (like, say, for Cocoon, Slide, Scarab). If this packaging is clearly labelled as such, then I could live with it, as it will not confuse users (except those who can't read). Urm, err, the users that can't read may include you ;-). Jon withdrew the vote above. This means that this is officially 'not getting anywhere', at least until Jon re-submits his re-worked proposal. Other than that, I think having one and only one user oriented distribution (the implementation I favor for that one is with jboss-like profiles) should be a requirement. Remy -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED] -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Bill Barker wrote: Urm, err, the users that can't read may include you ;-). Jon withdrew the vote above. This means that this is officially 'not getting anywhere', at least until Jon re-submits his re-worked proposal. I know (and I can usually read, thanks), but since he's going to resubmit it later, I don't see any harm with talking about it. Remy -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Remy Maucherat wrote: Jon Scott Stevens wrote: on 2002/12/11 5:06 PM, Glenn Nielsen [EMAIL PROTECTED] wrote: Looking at the original vote I realize that what you ask can't be done. Tomcat 4 is the RI of Servlet 2.3, JSR 154 is for Servlet 2.4. So it isn't possible to create a JSR 154 only dist of Tomcat 4. Glenn Very good point. I withdrawal my vote. A new vote will need to be made for Tomcat 5. I will re-submit when I can also submit a patch for it. =) As soon as I'm over a Scarab deadline (Dec 20th), I'm going to work on this and it is going to turn into another similar Anakia-style deal. If you remember correctly, people -1'd Anakia all over the place until I went and actually built the website using it. Now, to this day, Anakia is still used for the Jakarta site (as well as the main www.apache.org site). So, for something that people said sucks so badly and is such a terrible idea, it has worked very well for quite a while now. =) The same will be true for my minimal distribution idea. This is not getting anywhere. Actually, what you want is not a distribution for end users, but rather a distribution for people embedding Tomcat (like, say, for Cocoon, Slide, Scarab). If this packaging is clearly labelled as such, then I could live with it, as it will not confuse users (except those who can't read). If the idea is creating more ant task like dist (the actual), distmin (a minimal Servlet Engine) distjon (the minimal + Jon's requirement). Then I will be +1 ;-) Other than that, I think having one and only one user oriented distribution (the implementation I favor for that one is with jboss-like profiles) should be a requirement. Remy -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED] -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Bill Barker wrote: Urm, err, the users that can't read may include you ;-). Jon withdrew the vote above. This means that this is officially 'not getting anywhere', at least until Jon re-submits his re-worked proposal. The fact that Jon withdrew the vote doesn't change any of the arguments and opinions that were expressed about profiles and minimal. IMO we are very close to consensus on profiles, and I think we can rich a consensus on an embeded. I think we should just change the subject line - and have another vote to make sure we're all on the same page. Costin -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Costin Manolache wrote: Bill Barker wrote: I think we should just change the subject line - and have another vote to make sure we're all on the same page. Sure, go ahead :) Remy -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Costin Manolache wrote: Bill Barker wrote: Urm, err, the users that can't read may include you ;-). Jon withdrew the vote above. This means that this is officially 'not getting anywhere', at least until Jon re-submits his re-worked proposal. The fact that Jon withdrew the vote doesn't change any of the arguments and opinions that were expressed about profiles and minimal. IMO we are very close to consensus on profiles, and I think we can rich a consensus on an embeded. I think we should just change the subject line - and have another vote to make sure we're all on the same page. Agreed. -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Glenn Nielsen wrote: Jon Scott Stevens wrote: on 2002/12/10 3:23 PM, Glenn Nielsen [EMAIL PROTECTED] wrote: Then we only have one download (perhaps large) but with a variety of different installs. Right now, I have to specially distribute Tomcat for Scarab. Instead, I want one small download that I can point people at and tell them to copy their scarab.war into. It should be a download which only contains code and data that Scarab requires (which is a minimal JSR 154 container). -jon Right. You need a distribution tailored for your use. Others may have slightly different dists they need. Where does it stop? Would we end up with 2-3 dozen different distributions? Tomcat can be used in so many different ways that it can be very difficult for those devs who vote to decide on how many dists there should be and what they should contain. A single distribution with the most used components which included ant with different install targets would be much more flexible. Those components not included with Tomcat could be installed by automating retrieval and installation from a remote site. This achieves your goal of being able to easily setup a servlet only instance of Tomcat _and_ meets the requirement of only having one distribution. The contentious issue would be what components are bundled with Tomcat and which can be installed but have to be retrieved from a remote site. I think this is a bad good idea. That's more or less what the Windows installer does or could do, and that's good as that's what Windows users expect. However, I doubt Unix people are used to or like installers and similar technologies. Profiles look similar to how well known servers work, so I clearly favor that solution. I think it would be time to do a wrap up vote. Remy -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
The real issue with Jon's proposal is not the fact that admin ( or any jsp ) won't run in the JSR154 distribution. It's more an issue of attitude. Yes, Jon can be annoying (and he is the second best person that I've seen at punching Costin's buttons ;-). However, this is about a concept, not a personality. It seems to me that we've pretty much reached a consensus on this. I agree with Glen's last post that what we should do is a core release with nsi/rpm/ant scripts to download the additional components that are required (and modify configs). The ant side could be similar to the download target. Given the separation between 154 and 152, I'm sticking with my vote for the core release to be 154-only (and, I'm consistent, since minimality is one of the features that I like in 3.3). Costin -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED] -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
RE: [VOTE] minimal JSR 154 only distribution
Howdy, As this is hopefully nearing a wrap-up vote... Right. You need a distribution tailored for your use. Others may have slightly different dists they need. Where does it stop? Would we end up with 2-3 dozen different distributions? Tomcat can be used in so many different ways that it can be very difficult for those devs who vote to decide on how many dists there should be and what they should contain. I agree with that. I think this is a bad good idea. That's more or less what the Windows installer does or could do, and that's good as that's what Windows users expect. Windows users (including myself part of the time) more or less expect crap. They don't mind having to reboot all the time. However, I doubt Unix people are used to or like installers and similar technologies. I think so too. And there's the not-insignificant hassle of keeping the installer itself bug-free, well-documented, etc. Profiles look similar to how well known servers work, so I clearly favor that solution. Ditto. As a user of JBoss and other servers, I like that. Yoav Shapira Millennium ChemInformatics -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Bill Barker wrote: It seems to me that we've pretty much reached a consensus on this. I agree with Glen's last post that what we should do is a core release with nsi/rpm/ant scripts to download the additional components that are required (and modify configs). The ant side could be similar to the download target. Given the separation between 154 and 152, I'm sticking with my vote for the core release to be 154-only (and, I'm consistent, since minimality is one of the features that I like in 3.3). I don't know about what consensus we reached :-) Bill - the minimal profile ( my original proposal ) is almost the same thing as the 154-only. The big difference is that it keeps the door open to add jasper-related runtime. Having a small download with the minimal profile that download other components is acceptable - but the main release should be the full ( minimal + various modules and profiles ). I don't think too many people like their production servers to go and download stuff :-) But this is a separate issue - and I have no problem with posting more binaries ( Remy already does the lite/full ) The question is - should we do 154-only, no 152 allowed or just minimal. And should we have 2 ( or N ? ) releases, or one release with multiple binary packages. I do like the idea of a repository of modules and experimenting with downloading ( or updating ) stuff. Jboss allows runtime-changes to almost any component ( without restarting ), and this is something I allways wanted to get ( the 3.3 modules kind-of support this feature or are very close ). But as part as a common release. Costin -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
- Original Message - From: Remy Maucherat [EMAIL PROTECTED] To: Tomcat Developers List [EMAIL PROTECTED] Sent: Wednesday, December 11, 2002 12:05 AM Subject: Re: [VOTE] minimal JSR 154 only distribution Glenn Nielsen wrote: Jon Scott Stevens wrote: on 2002/12/10 3:23 PM, Glenn Nielsen [EMAIL PROTECTED] wrote: Then we only have one download (perhaps large) but with a variety of different installs. Right now, I have to specially distribute Tomcat for Scarab. Instead, I want one small download that I can point people at and tell them to copy their scarab.war into. It should be a download which only contains code and data that Scarab requires (which is a minimal JSR 154 container). -jon Right. You need a distribution tailored for your use. Others may have slightly different dists they need. Where does it stop? Would we end up with 2-3 dozen different distributions? Tomcat can be used in so many different ways that it can be very difficult for those devs who vote to decide on how many dists there should be and what they should contain. A single distribution with the most used components which included ant with different install targets would be much more flexible. Those components not included with Tomcat could be installed by automating retrieval and installation from a remote site. This achieves your goal of being able to easily setup a servlet only instance of Tomcat _and_ meets the requirement of only having one distribution. The contentious issue would be what components are bundled with Tomcat and which can be installed but have to be retrieved from a remote site. I think this is a bad good idea. That's more or less what the Windows installer does or could do, and that's good as that's what Windows users expect. However, I doubt Unix people are used to or like installers and similar technologies. Profiles look similar to how well known servers work, so I clearly favor that solution. I think it would be time to do a wrap up vote. Well, (without checking), I believe that this one started last Friday and Jakarta Votes last one-week. Unless you propose an additional Vote (which will last one more week :), to replace this one, my count (of binding votes) is: 3 +1, 2 +0, 2 -0, 1 -1. I've also counted 3 non-binding +1s. The active committers have mostly all voted: Craig is semi-off tomcat (but does great work on tomcat-user :), Amy has always only ever voted on the projects she cares about, Kinman Jan have been blown off by the rest of us for months, so what do they care? AFAIK, the vote is wrapped up. Remy -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED] -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Bill Barker wrote: - Original Message - From: Remy Maucherat [EMAIL PROTECTED] To: Tomcat Developers List [EMAIL PROTECTED] Sent: Wednesday, December 11, 2002 12:05 AM Subject: Re: [VOTE] minimal JSR 154 only distribution Glenn Nielsen wrote: Jon Scott Stevens wrote: on 2002/12/10 3:23 PM, Glenn Nielsen [EMAIL PROTECTED] wrote: Then we only have one download (perhaps large) but with a variety of different installs. Right now, I have to specially distribute Tomcat for Scarab. Instead, I want one small download that I can point people at and tell them to copy their scarab.war into. It should be a download which only contains code and data that Scarab requires (which is a minimal JSR 154 container). -jon Right. You need a distribution tailored for your use. Others may have slightly different dists they need. Where does it stop? Would we end up with 2-3 dozen different distributions? Tomcat can be used in so many different ways that it can be very difficult for those devs who vote to decide on how many dists there should be and what they should contain. A single distribution with the most used components which included ant with different install targets would be much more flexible. Those components not included with Tomcat could be installed by automating retrieval and installation from a remote site. This achieves your goal of being able to easily setup a servlet only instance of Tomcat _and_ meets the requirement of only having one distribution. The contentious issue would be what components are bundled with Tomcat and which can be installed but have to be retrieved from a remote site. I think this is a bad good idea. That's more or less what the Windows installer does or could do, and that's good as that's what Windows users expect. However, I doubt Unix people are used to or like installers and similar technologies. Profiles look similar to how well known servers work, so I clearly favor that solution. I think it would be time to do a wrap up vote. Well, (without checking), I believe that this one started last Friday and Jakarta Votes last one-week. Unless you propose an additional Vote (which will last one more week :), to replace this one, my count (of binding votes) is: 3 +1, 2 +0, 2 -0, 1 -1. I've also counted 3 non-binding +1s. The active committers have mostly all voted: Craig is semi-off tomcat (but does great work on tomcat-user :), Amy has always only ever voted on the projects she cares about, Kinman Jan have been blown off by the rest of us for months, so what do they care? It's not that I don't care about this issue but this thread has been getting out of control for me to read and respond. I just wanted this heated discussion/argument/flaming to settle down before I jump in. I agree with Martin that too many distributions can be confusing for users. I vote for one distribution with options to disable whatever you don't want. Simple yet everyone gets only what they want. Amy -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
On Wed, Dec 11, 2002 at 01:36:02PM -0800, Amy Roh wrote: Martin that too many distributions can be confusing for users. I vote for one distribution with options to disable whatever you don't want. Simple yet everyone gets only what they want. I'm a newb here, but it seems to me the fundamental issue is how difficult is it to add or subtract bits and pieces. If it was trivial (i.e. a simple unzipping or untarring) then the best thing to offer for download would be: 1 a minimal 2. a 'maximal' and all the modules in between for people to roll their own. Matt -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Bill Barker wrote: Well, (without checking), I believe that this one started last Friday and Jakarta Votes last one-week. Unless you propose an additional Vote (which will last one more week :), to replace this one, my count (of binding votes) is: 3 +1, 2 +0, 2 -0, 1 -1. I've also counted 3 non-binding +1s. The active committers have mostly all voted: Craig is semi-off tomcat (but does great work on tomcat-user :), Amy has always only ever voted on the projects she cares about, Kinman Jan have been blown off by the rest of us for months, so what do they care? AFAIK, the vote is wrapped up. I think waiting until Friday is not too much ( one week voting period is reasonable ). And since this vote didn't have too much prior discussion and clarifications - a new vote may also be a good idea, clarifying the various aspects. I'm willing to change my vote to +1 if the proposal is changed to minimal tomcat distribution ( i.e. don't explicitely exclude JSP ). That may mean only jasper-runtime.jar, or not even that ( if placing it in WEB-INF still works ). Changing the name to minimal also keeps the door open to have only JMX+classloader+ant+download scripts, and have catalina.jar ( i.e. JSR154 ) downloaded. Or some other servlet implementation can be selected - so running the 4.1 .jar will be possible for a while, and updates to the servlet impl. will be consistent with updates to all other components IMO a lot has been discussed, we have more options and informations - so a new vote may be the best idea and may yield real consensus. I think we are all very close in position and we all agree on minimal. I disagree on binding minimal to JSR154 ( in both directions - it is perfectly reasonable to add jasper-runtime or to remove the servlet container ). To increase the chance of a new vote with more consensus - I'm changing my vote to -1 on minimal JSR-154-only. Costin -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
[EMAIL PROTECTED] wrote: On Wed, Dec 11, 2002 at 01:36:02PM -0800, Amy Roh wrote: Martin that too many distributions can be confusing for users. I vote for one distribution with options to disable whatever you don't want. Simple yet everyone gets only what they want. I'm a newb here, but it seems to me the fundamental issue is how difficult is it to add or subtract bits and pieces. If it was trivial (i.e. a simple unzipping or untarring) then the best thing to offer for download would be: 1 a minimal 2. a 'maximal' and all the modules in between for people to roll their own. I think we all agree on such a model ( I haven't heard any opinion against such thing ). This is not an issue we disagree on. JSR154-only implies a distribution with a very specific set of features. That's not minimal and not the same thing with the discussion about modules ( even if it can support added modules ). As an example - jboss minimal doesn't include any service at all, just JMX and the hot deployment support. Costin -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
on 2002/12/11 1:36 PM, Amy Roh [EMAIL PROTECTED] wrote: I vote for one distribution with options to disable whatever you don't want. Simple yet everyone gets only what they want. Amy The vote was: Create a separate minimal JSR 154 only distribution of Tomcat 4.x: +1 [] 0 [] -1 [] -jon -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Create a separate minimal JSR 154 only distribution of Tomcat 4.x: +1 [ ] 0 [ ] -1 [x] [I will quickly change to a +1 if the minimal change I suggest is made. Others prob. will as well] Explanation: Beginners want ease of use over minimality because they want to get started. They can't choose between a dist. with Jasper + Manager vs. one without Jasper and Manager because they don't know what Jasper is ( though they prob. do know what JSP is ) and they don't know what the manager does. Advanced users want security, because they are admins and want to deploy rather than just play. Advanced users are more willing and able to go through extra steps in order to secure software. They are more likely to have the security paranoia (rightly) often conveyed in this thread. My *ideal* is that a script comes with the full distribution that moves all Jasper JARS, SSI stuff, Management, etc. to a temporary directory under the tomcat root. It can also replace ( if no mods have been made ) the web.xml file appropriately. Assuming everyone thinks this idea sucks for some reason or another, then I would go +1 as long as it is agreed that the minimal distribution is CLEARLY marked something along the lines that it is for experts only, and does not support JSP pages. (yes, I know it runs compiled jsp pages). Cause newbies often think to themselves minimal sounds good, cause it's less crap I'll have to understand, not realizing that they actually want/need the crap. -Dan -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Jon Scott Stevens wrote: on 2002/12/11 1:36 PM, Amy Roh [EMAIL PROTECTED] wrote: I vote for one distribution with options to disable whatever you don't want. Simple yet everyone gets only what they want. Amy The vote was: Create a separate minimal JSR 154 only distribution of Tomcat 4.x: +1 [] 0 [] -1 [] -jon Looking at the original vote I realize that what you ask can't be done. Tomcat 4 is the RI of Servlet 2.3, JSR 154 is for Servlet 2.4. So it isn't possible to create a JSR 154 only dist of Tomcat 4. Glenn -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
On 12/12/02 1:06 Glenn Nielsen [EMAIL PROTECTED] wrote: Looking at the original vote I realize that what you ask can't be done. Tomcat 4 is the RI of Servlet 2.3, JSR 154 is for Servlet 2.4. So it isn't possible to create a JSR 154 only dist of Tomcat 4. It is _NOT_... Tomcat is the servlet container included in the J2EE 1.3 reference implementation. There is no whatsoever reference implementation standalone of Servlet+JSP... The JCP did not bless that... Only with the new JCP agreement (however it's called) it will be possible to have an implementation of some spec which is included in a platform. And given that JSR-154 is not yet final there can't be (yet) a R.I.. But I believe that what Jon wants is just an implementation of the javax.servlet.** classes (let's try to be flexible and not stick to each single word as if it were the bible, I believe the message is quite clear)... Pier -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
on 2002/12/11 5:06 PM, Glenn Nielsen [EMAIL PROTECTED] wrote: Looking at the original vote I realize that what you ask can't be done. Tomcat 4 is the RI of Servlet 2.3, JSR 154 is for Servlet 2.4. So it isn't possible to create a JSR 154 only dist of Tomcat 4. Glenn Very good point. I withdrawal my vote. A new vote will need to be made for Tomcat 5. I will re-submit when I can also submit a patch for it. =) As soon as I'm over a Scarab deadline (Dec 20th), I'm going to work on this and it is going to turn into another similar Anakia-style deal. If you remember correctly, people -1'd Anakia all over the place until I went and actually built the website using it. Now, to this day, Anakia is still used for the Jakarta site (as well as the main www.apache.org site). So, for something that people said sucks so badly and is such a terrible idea, it has worked very well for quite a while now. =) The same will be true for my minimal distribution idea. -jon -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Pier Fumagalli wrote: On 9/12/02 23:51 Pier Fumagalli [EMAIL PROTECTED] wrote: Ehemm... With 24 pages of vulnerability notes? Ha.. Hahaha Hahahaha! :-) Correction to self... Not 24 pages... 24 notes... (Ok, I have an eyesight test tomorrow morning at 10:20 in SOHO... I know, I know...) ROFL. All of them got fixed aeons ago, and are for *all* releases of Tomcat; a few with JSPs source disclosure (and caused by the servlet container core, not Jasper), some others in the core. BTW, the search engine is a bit stupid, there's a lot less than 24 reports total ... Unbundling Jasper wouldn't help. Remy -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Jeanfrancois Arcand wrote: OK, seems I don't have any supports to stay with my -1 (seems nobody care about the AdminTool argument :-)). So I will change my mind and vote 0. You don't have to justify anything for that vote, you know ;-) BTW, all of Pier arguments are just false. Don't get fooled by the noise. Remy -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Jon Scott Stevens wrote: on 2002/12/9 7:27 AM, Remy Maucherat [EMAIL PROTECTED] wrote: I'd really like to avoid the proliferation of too many distributions. I don't agree with that. There is nothing wrong with giving users choices. There is many things something wrong with many distributions : - Users may be puzzled by seeing too many tomcat distributions. - Who will be the release managers for the 'alternative distributions', may be Jon is candidate ? -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Jon Scott Stevens wrote: on 2002/12/9 7:32 AM, Henri Gomez [EMAIL PROTECTED] wrote: What about using a minimal tomcat core with plugged modules to give access to jsp/jmx ? Will make both Costin, and Jon happy and let us have only one distribution with clear indication in server.xml on how to activate/desactive such module. That does not make me happy. You are missing my point. Read the subject line of this message. I read YOUR SUBJECT LINE, and that's why I feel that a common distribution with modules could be the solution. The idea being to provide a minimal tomcat binary and many external modules which will be linked at runtime if present, Apache 2.0 does it that way, why could we do the same. All we need is a more modular approach of TC 5, which should be able to load modules (JMX/JASPER) if available in classpath. If you take a look at how decent packaging tools like rpm/debian works, they are able to install a PRIMARY PACKAGE and OPTIONAL PACKAGES. For your purpose, scarab for example, you could only stay with the bare minimum TC 5, without installing the rest of TC 5. What about ? -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Pier Fumagalli wrote: On 9/12/02 17:14 Jeanfrancois Arcand [EMAIL PROTECTED] wrote: Youy don't need to learn JSP/Admin Tool if you don't use it. The actual Tomcat installation doesn't require you to learn the Admin Tool or JSP As I said 6 or so months ago... That thing is a security hole as big as the Empire State Building... As most of the stuff that make up tomcat... We have some bugs in JSR-154, few in Jasper, few in JSSI, few in CGI... All together it makes a load of em... I didn't understand the problem with the admin/manager tools, since they aren't mandatory and very easy to desactivate. If someone can come up with a Servlet-only distribution, at least I won't get holes from all the other (totally useless) components... JSP ? Pier (a _user_ now) And that's sad. -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Jon Scott Stevens wrote: on 2002/12/9 8:21 AM, Remy Maucherat [EMAIL PROTECTED] wrote: People cannot agree on everything. Here, we're talking about relatively minor topics. This issue won't end up in a division of the community, but rather in one additional binary distribution based on the same codebase. I can live with that (well, as long as I'm not the one building them all ;-) ). If the lack of consensus spreads to more serious topics (like a 4.2.x branch), then I would agree it could be worrying. Finally, Remy is starting to see the light. All I'm seeing is that I shouldn't pay attention to your posts (I should have learnt that a while ago, I guess) ;-) Is that good enough for you ? I'd really like to avoid the proliferation of too many distributions. I don't agree with that. There is nothing wrong with giving users choices. Sorry, no. You should try to give users as few choices as possible, if you're targetting your software at a broad audience (looking at the download stats, Tomcat has that kind of audience). You never read Joel on software, I suppose ... On the other side of the scale, advanced users who know what they want should be able to tweak the software to the death (that's my opinion; Joel doesn't concieve software for advanced users, appatrently). Tomcat allows that. However, the golden rule is that normal people shouldn't have to care (of course, it's far from perfect, and Tomcat is still way to hard to use for the average Joe, but that's another story, and I believe we're working on it). Remy -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
on 2002/12/10 12:49 AM, Henri Gomez [EMAIL PROTECTED] wrote: - Who will be the release managers for the 'alternative distributions', may be Jon is candidate ? I already volunteered to manage the distribution that I propose. I have been doing distributions of servlet containers since you guys were in diapers. -jon -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
on 2002/12/10 12:53 AM, Henri Gomez [EMAIL PROTECTED] wrote: The idea being to provide a minimal tomcat binary and many external modules which will be linked at runtime if present, Apache 2.0 does it that way, why could we do the same. You are repeating my ideas that I have already said on the list. -jon -- StudioZ.tv /\ Bar/Nightclub/Entertainment 314 11th Street @ Folsom /\ San Francisco http://studioz.tv/ -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
on 2002/12/10 1:00 AM, Remy Maucherat [EMAIL PROTECTED] wrote: All I'm seeing is that I shouldn't pay attention to your posts (I should have learnt that a while ago, I guess) ;-) Is that good enough for you ? As Pier says: What-EVER! Sorry, no. You should try to give users as few choices as possible, if you're targetting your software at a broad audience (looking at the download stats, Tomcat has that kind of audience). You never read Joel on software, I suppose ... On the other side of the scale, advanced users who know what they want should be able to tweak the software to the death (that's my opinion; Joel doesn't concieve software for advanced users, appatrently). Tomcat allows that. However, the golden rule is that normal people shouldn't have to care (of course, it's far from perfect, and Tomcat is still way to hard to use for the average Joe, but that's another story, and I believe we're working on it). You admit Tomcat is to hard to use. The reason it is to hard to use is because it is bundled with a whole bunch of crap no one needs. I want to get rid of the crap and just let people download something simple. -jon -- StudioZ.tv /\ Bar/Nightclub/Entertainment 314 11th Street @ Folsom /\ San Francisco http://studioz.tv/ -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
On 10/12/02 8:57 am, in article [EMAIL PROTECTED], Henri Gomez [EMAIL PROTECTED] wrote: Pier Fumagalli wrote: Pier (a _user_ now) And that's sad. Not apparently, as I am the reason why noone picked up Tomcat 4 :-) Pier -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Jon Scott Stevens wrote: on 2002/12/10 12:53 AM, Henri Gomez [EMAIL PROTECTED] wrote: The idea being to provide a minimal tomcat binary and many external modules which will be linked at runtime if present, Apache 2.0 does it that way, why could we do the same. You are repeating my ideas that I have already said on the list. Yes but add the ability to activate/include modules, which is the Costin idea ;) -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Jon Scott Stevens wrote: on 2002/12/10 12:49 AM, Henri Gomez [EMAIL PROTECTED] wrote: - Who will be the release managers for the 'alternative distributions', may be Jon is candidate ? I already volunteered to manage the distribution that I propose. I have been doing distributions of servlet containers since you guys were in diapers. Jon, you're a little younger than me so, 'du respect'. BTW, we're not discussing here what has be done in the past but what should be done in the future. -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Henri Gomez wrote: The idea being to provide a minimal tomcat binary and many external modules which will be linked at runtime if present, Apache 2.0 does it that way, why could we do the same. Another solution can be seen in jboss. They do pack all the components ( or almost ), but also 3 config - minimal, default and all. One benefit is consistency. They do actually have 3-4 binary distributions - with the various servlet containers they support, but that's mostly because the integration of the container is not that integrated ( at least for tomcat ). I like very much Henri's proposal of fully-modular tomcat. The minimal would become JMX ( and modeler ). Then various profiles can be configured - by either a config file or placing some jars in a dir. You could have a JK-only ( for example jk + Axis - as a soap server ), or servlet only, or any other combination - all based on a simple config file. Yes - Jon will not be happy ( as far as I know Jon ) if jasper.jar is anywhere in the distribution, even if it is not used. I think the real argument against my minimal proposal is the current lack of the modular add-on mechanism. We almost have it, but something more is needed. There is one short-term solution - port the modules from 3.3 ( basically take the server/webapps/*/WEB-INF/lib and add this to the server loader, plus the config file ). Long term we can use JMX mlets to load the modules. We'll still have a single release of tomcat ( that doesn't mean we can't have more packages ). A single tomcat is quite important IMO - at least for our community. All we need is a more modular approach of TC 5, which should be able to load modules (JMX/JASPER) if available in classpath. If you take a look at how decent packaging tools like rpm/debian works, they are able to install a PRIMARY PACKAGE and OPTIONAL PACKAGES. For your purpose, scarab for example, you could only stay with the bare minimum TC 5, without installing the rest of TC 5. What about ? +1 Costin -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
on 2002/12/10 2:36 AM, Henri Gomez [EMAIL PROTECTED] wrote: Yes but add the ability to activate/include modules, which is the Costin idea ;) Nope...Read my message with the ascii chart in it... -jon -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
on 2002/12/10 7:30 AM, Costin Manolache [EMAIL PROTECTED] wrote: Yes - Jon will not be happy ( as far as I know Jon ) if jasper.jar is anywhere in the distribution, even if it is not used. If Jasper is in there, then it isn't a (repeat) 'minimal JSR 154 only distribution.' -jon -- StudioZ.tv /\ Bar/Nightclub/Entertainment 314 11th Street @ Folsom /\ San Francisco http://studioz.tv/ -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Henri Gomez wrote: Yes but add the ability to activate/include modules, which is the Costin idea ;) Actually - I think it is your idea :-) ( well, now it makes a lot of sense - I'm in how didn't I think of it mode ). That means I will drop my minimal proposal, or at least rewrite it to be one profile in the normal distribution. Remy's arguments are also very valid. I think we can focus on 4 profiles: - JSR154 only - minimal ( JSR154 + JSR152 ) - default ( the current set of features ) - all The main technical problem is the class loader - we probably need to place most jars in a repository - but not in the loader - and use the manifest or config files to pick what we need. Again, the jmx model may help us. ( jboss solution is to just copy the files - which does makes sense in a way ) Jon - would that be reasonable middle-ground for you ? It gives you a JSR154-only profile, included in the main distribution. The downside is that jasper will still be included ( disabled and invisible in your profile - visible in all others ). Costin -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Jon Scott Stevens wrote: on 2002/12/10 7:30 AM, Costin Manolache [EMAIL PROTECTED] wrote: Yes - Jon will not be happy ( as far as I know Jon ) if jasper.jar is anywhere in the distribution, even if it is not used. If Jasper is in there, then it isn't a (repeat) 'minimal JSR 154 only distribution.' It'll be a JSR154 profile. And a Tomcat distribution. It's up to Sun to release JSR152 or JSR154 or whatever else - we develop tomcat. Costin -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Costin Manolache wrote: Henri Gomez wrote: Yes but add the ability to activate/include modules, which is the Costin idea ;) Actually - I think it is your idea :-) ( well, now it makes a lot of sense - I'm in how didn't I think of it mode ). That means I will drop my minimal proposal, or at least rewrite it to be one profile in the normal distribution. Remy's arguments are also very valid. I think we can focus on 4 profiles: - JSR154 only - minimal ( JSR154 + JSR152 ) - default ( the current set of features ) - all The main technical problem is the class loader - we probably need to place most jars in a repository - but not in the loader - and use the manifest or config files to pick what we need. Again, the jmx model may help us. ( jboss solution is to just copy the files - which does makes sense in a way ) Big +1. There's an embryo of some configuration for the different CL, but it needs to get more powerful and flexible to support this. Copying files is bad, no question about it. Jon - would that be reasonable middle-ground for you ? It gives you a JSR154-only profile, included in the main distribution. The downside is that jasper will still be included ( disabled and invisible in your profile - visible in all others ). Hopefully reason will prevail. Remy -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
on 2002/12/10 2:52 PM, Costin Manolache [EMAIL PROTECTED] wrote: What Remy and Costin are agreeing on is one tomcat release that includes multiple profiles - so people can run jsr154 or minimal or default or all. (repeat) Which is what I already suggested. I don't know why you have the impression that I have to bother reading your messages. Costin Because you respond to them. Geeez Costin. -jon -- StudioZ.tv /\ Bar/Nightclub/Entertainment 314 11th Street @ Folsom /\ San Francisco http://studioz.tv/ -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
rant mode I don't know why people have the impression that they need support or some special motivation when voting on a proposal. Yes - your admin tool argument doesn't make sense. You can easily precompile the admintool ( and we should do it anyway ) and run it in the JSR154-only container - if you want to. And I don't think including it in the minimal is a good idea either ( if it can run without it, then it shouldn't be in minimal ). The vote was about creating a separate distribution of tomcat with certain content. You can vote +1 or -1 if you want to influence the result, or -0 or +0 if you don't want to change the result, but still want to say you agree or not. If you had a bad dream about it last night or you feel it will confuse users or whatever - it doesn't matter, this is not a veto but a majority decision on a proposal. And a +1 doesn't mean ( in this case ) that you'll have to help. It has this meaning ( in tomcat at least ) only on the final vote to release. A +1 only means that you feel it is a good idea and will make tomcat better. Has everyone lost interest in tomcat and doesn't care what happens ? This open source stuff and majority vote and so on doesn't work if people don't participate. I can understand that we all have little time - but at least read the proposals ( marked with [VOTE] or [PROPOSAL] so you can set your mailer and ignore everything else ) and send your opinion. A simple +-1, +-0 is enough and shouldn't consume that much time. One concern I had about Jon's proposal is the tensions it may create among committers, and especially those that work or use jasper. If their answer is we don't give a damn about tomcat releases - then I'm wrong. My other concern is that users will be confused if they have N downloads to choose from, and our efforts on documenting and testing will be diluted if we have N releases each with 3 people working on them. Costin Jeanfrancois Arcand wrote: OK, seems I don't have any supports to stay with my -1 (seems nobody care about the AdminTool argument :-)). So I will change my mind and vote 0. -- Jeanfrancois Pier Fumagalli wrote: On 10/12/02 0:30 Jeanfrancois Arcand [EMAIL PROTECTED] wrote: Now, don't tell me that ALL that collection of cruft doesn't have a bug... It's just that we are lucky and noone found them yet (given enough eyes... Linus says)... I never say that and I will never says that. But I least I have try during the Security Audit to fix some of the obvious one. Still Tomcat is probably not enough secure (and will never be). My point is if you are aware of such obvious one, then let me know and I will fix them. You said (quote) Jasper/AdminTool/etc. are secure... That's a pretty bold statement. From my experience, security audits and stuff are all right, until someone doesn't call up at 3 AM saying the server is down because of a DOS... Nah, I don't like being woken up in the middle of the night... But I don't think Tomcat is more secure without JSP I know, I know, what I think you don't care :-) The bible (for us Sun customers, _your_ customers): http://wwws.sun.com/software/security/blueprints/#minimum Solaris Operating Environment Minimization for Security: A Simple, Reproducible and Secure Application Installation Methodology - Updated for the Solaris 8 Operating Environment - November 2000 - by Alex Noordergraaf Discusses the process of minimizing an installation of the Solaris Operating Environment. Mimimization is the process of removing all unnecessary components and services from the Solaris software to reduce system vulnerabilities. Also introduces a simple technique for replicating these types of installations across a large number of systems. _YOUR_ security folks tought me that... Go and talk to them, they're down in SCA-7 if I'm not wrong... Paranoia is an irreversible process for us on the line-of-fire. To sum up: rule of the thumb #3, less code, less bugs (you folks from Sun preach that all over your Solaris Blueprints stuff, I learnt it when your employer was paying my salary). Wow, didn't know that... I've missed the chance to work with you :-) Don't worry, you would have _hated_ working with me (and proudly keeping up my record of being the most hated freak on the planet). I should studies my Tomcat history and learn who is doing what, what biases he/she have, and then vote appropriatly. Oh, no, I got paranoid after I left Sun and started working on the other side of the barricade... Trying to use in production what I was coding earlier... :-) So, please, don¹t come up on a mailing list saying that is secure, just say that noone has found a bug yet, because that (and only that) is the truth... I agree my wording was not appropriate. Should say that in french next time :-) Pas de problemes (where are the accents on this keyboard?) Pier -- To unsubscribe, e-mail:
Re: [VOTE] minimal JSR 154 only distribution
Why not have one distribution of Tomcat but with an ant installer with different targets. The ant installer builds a layout of files for running tomcat based on the target. Then we only have one download (perhaps large) but with a variety of different installs. Some of the options could grab any distributions not included with the tomcat dist from remote sites. Some possible targets... soap-server servlet servlet-jsp standalone And many others. Perhaps with options to update an existing install. Regards, Glenn Costin Manolache wrote: Henri Gomez wrote: Yes but add the ability to activate/include modules, which is the Costin idea ;) Actually - I think it is your idea :-) ( well, now it makes a lot of sense - I'm in how didn't I think of it mode ). That means I will drop my minimal proposal, or at least rewrite it to be one profile in the normal distribution. Remy's arguments are also very valid. I think we can focus on 4 profiles: - JSR154 only - minimal ( JSR154 + JSR152 ) - default ( the current set of features ) - all The main technical problem is the class loader - we probably need to place most jars in a repository - but not in the loader - and use the manifest or config files to pick what we need. Again, the jmx model may help us. ( jboss solution is to just copy the files - which does makes sense in a way ) Jon - would that be reasonable middle-ground for you ? It gives you a JSR154-only profile, included in the main distribution. The downside is that jasper will still be included ( disabled and invisible in your profile - visible in all others ). Costin -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED] -- -- Glenn Nielsen [EMAIL PROTECTED] | /* Spelin donut madder| MOREnet System Programming | * if iz ina coment. | Missouri Research and Education Network | */ | -- -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
on 2002/12/10 3:23 PM, Glenn Nielsen [EMAIL PROTECTED] wrote: Then we only have one download (perhaps large) but with a variety of different installs. Right now, I have to specially distribute Tomcat for Scarab. Instead, I want one small download that I can point people at and tell them to copy their scarab.war into. It should be a download which only contains code and data that Scarab requires (which is a minimal JSR 154 container). -jon -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
on 2002/12/10 3:15 PM, Costin Manolache [EMAIL PROTECTED] wrote: Yes - your admin tool argument doesn't make sense. You can easily precompile the admintool ( and we should do it anyway ) and run it in the JSR154-only container - if you want to. I thought that you need Jasper in order to run JSP's (compiled or not). -jon -- StudioZ.tv /\ Bar/Nightclub/Entertainment 314 11th Street @ Folsom /\ San Francisco http://studioz.tv/ -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Jon Scott Stevens wrote: on 2002/12/10 3:15 PM, Costin Manolache [EMAIL PROTECTED] wrote: Yes - your admin tool argument doesn't make sense. You can easily precompile the admintool ( and we should do it anyway ) and run it in the JSR154-only container - if you want to. I thought that you need Jasper in order to run JSP's (compiled or not). Yes, you need them since even if the classes are compiled, they are still having reference to org.apache.jasper.* -- Jeanfrancois -jon
Re: [VOTE] minimal JSR 154 only distribution
Jon Scott Stevens wrote: on 2002/12/10 3:23 PM, Glenn Nielsen [EMAIL PROTECTED] wrote: Then we only have one download (perhaps large) but with a variety of different installs. Right now, I have to specially distribute Tomcat for Scarab. Instead, I want one small download that I can point people at and tell them to copy their scarab.war into. It should be a download which only contains code and data that Scarab requires (which is a minimal JSR 154 container). -jon Right. You need a distribution tailored for your use. Others may have slightly different dists they need. Where does it stop? Would we end up with 2-3 dozen different distributions? Tomcat can be used in so many different ways that it can be very difficult for those devs who vote to decide on how many dists there should be and what they should contain. A single distribution with the most used components which included ant with different install targets would be much more flexible. Those components not included with Tomcat could be installed by automating retrieval and installation from a remote site. This achieves your goal of being able to easily setup a servlet only instance of Tomcat _and_ meets the requirement of only having one distribution. The contentious issue would be what components are bundled with Tomcat and which can be installed but have to be retrieved from a remote site. Glenn -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Yes - your admin tool argument doesn't make sense. You can easily precompile the admintool ( and we should do it anyway ) and run it in the JSR154-only container - if you want to. I thought that you need Jasper in order to run JSP's (compiled or not). Yes, you need them since even if the classes are compiled, they are still having reference to org.apache.jasper.* -- Jeanfrancois Then I wonder what the heck Costin thinks he is talking about. But then again, I have been wondering that for years now. =) -jon -- StudioZ.tv /\ Bar/Nightclub/Entertainment 314 11th Street @ Folsom /\ San Francisco http://studioz.tv/ -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
on 2002/12/10 4:23 PM, Glenn Nielsen [EMAIL PROTECTED] wrote: Right. You need a distribution tailored for your use. Others may have slightly different dists they need. Where does it stop? Would we end up with 2-3 dozen different distributions? Tomcat can be used in so many different ways that it can be very difficult for those devs who vote to decide on how many dists there should be and what they should contain. The line is very clear where it stops: A JSR 154 only container and a JSR 154 + JSR 152 container. That is why I'm not asking for any 'external' stuff to be included in the Tomcat distribution. I don't want to blur the lines. -jon -- StudioZ.tv /\ Bar/Nightclub/Entertainment 314 11th Street @ Folsom /\ San Francisco http://studioz.tv/ -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Jeanfrancois Arcand wrote: Jon Scott Stevens wrote: on 2002/12/10 3:15 PM, Costin Manolache [EMAIL PROTECTED] wrote: Yes - your admin tool argument doesn't make sense. You can easily precompile the admintool ( and we should do it anyway ) and run it in the JSR154-only container - if you want to. I thought that you need Jasper in order to run JSP's (compiled or not). Yes, you need them since even if the classes are compiled, they are still having reference to org.apache.jasper.* No, you don't. You can just copy jasper-runtime.jar in WEB-INF/lib and you're done. At least that used to work in 3.3 - I don't see any reason it'll not work ( except maybe some bugs ). Costin -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Costin Manolache wrote: Jeanfrancois Arcand wrote: Jon Scott Stevens wrote: on 2002/12/10 3:15 PM, Costin Manolache [EMAIL PROTECTED] wrote: Yes - your admin tool argument doesn't make sense. You can easily precompile the admintool ( and we should do it anyway ) and run it in the JSR154-only container - if you want to. I thought that you need Jasper in order to run JSP's (compiled or not). Yes, you need them since even if the classes are compiled, they are still having reference to org.apache.jasper.* No, you don't. You can just copy jasper-runtime.jar in WEB-INF/lib and you're done. At least that used to work in 3.3 - I don't see any reason it'll not work ( except maybe some bugs ). Is Jasper = Runtime + Compiler (jasper-runtime.jar + jasper-compiler.jar)? I was under the impression that when we discuss about removing Jasper, it was both part. Not only the compiler partIf it's only the compiler part, then yes you can still run the Admin Tool. -- Jeanfrancois Costin -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
on 2002/12/10 4:59 PM, Costin Manolache [EMAIL PROTECTED] wrote: Yes - your admin tool argument doesn't make sense. You can easily precompile the admintool ( and we should do it anyway ) and run it in the JSR154-only container - if you want to. I thought that you need Jasper in order to run JSP's (compiled or not). Yes, you need them since even if the classes are compiled, they are still having reference to org.apache.jasper.* No, you don't. You can just copy jasper-runtime.jar in WEB-INF/lib and you're done. At least that used to work in 3.3 - I don't see any reason it'll not work ( except maybe some bugs ). Costin Huh? jar -xvf jasper-runtime.jar created: META-INF/ extracted: META-INF/MANIFEST.MF created: org/ created: org/apache/ created: org/apache/jasper/ created: org/apache/jasper/logging/ created: org/apache/jasper/util/ created: org/apache/jasper/runtime/ created: org/apache/jasper/resources/ ... -jon -- StudioZ.tv /\ Bar/Nightclub/Entertainment 314 11th Street @ Folsom /\ San Francisco http://studioz.tv/ -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Jeanfrancois Arcand wrote: Costin Manolache wrote: Jeanfrancois Arcand wrote: Jon Scott Stevens wrote: on 2002/12/10 3:15 PM, Costin Manolache [EMAIL PROTECTED] wrote: Yes - your admin tool argument doesn't make sense. You can easily precompile the admintool ( and we should do it anyway ) and run it in the JSR154-only container - if you want to. I thought that you need Jasper in order to run JSP's (compiled or not). Yes, you need them since even if the classes are compiled, they are still having reference to org.apache.jasper.* No, you don't. You can just copy jasper-runtime.jar in WEB-INF/lib and you're done. At least that used to work in 3.3 - I don't see any reason it'll not work ( except maybe some bugs ). Is Jasper = Runtime + Compiler (jasper-runtime.jar + jasper-compiler.jar)? I was under the impression that when we discuss about removing Jasper, it was both part. Not only the compiler partIf it's only the compiler part, then yes you can still run the Admin Tool. Yes, jasper=runtime + compiler. Last time I checked ( and I know no particular reason why this wouldn't work now ) the runtime can be included in the container - or it can be included in WEB-INF/lib for each precompiled app. Jasper doesn't particulary care where the runtime is located. A JSP is translated to a servlet. Jasper runtime is just one library that the generated servlet uses. You _can_ ( at least with the older jasper - and probably you can easily get the current one to work, if it doesn't already ) run jasper generated ( pre-compiled ) servlets with any servlet container ( weblogic, whatever ) - as long as the container doesn't include an older version of jasper ( that would mess the class loader). The real issue with Jon's proposal is not the fact that admin ( or any jsp ) won't run in the JSR154 distribution. It's more an issue of attitude. As a note - my proposal for minimal container ( that I consider now dead - I think the multi-profile solution is much better ) did not include the jasper compiler either. You don't need jasper compiler or javac on an embeded or production server to run JSPs. By including the runtime I didn't actually meant the current runtime, which could be easily included in the webapp by the precompiler, but whatever tomcat-specific optimizations we'll do ( I made a number of proposals about using the lower-level tomcat constructs for output, etc - didn't get too much enthusiasm, but I still think that it is the right way and can make JSPs much faster than the equivalent servlets ). Assuming such optimizations are done - they'll have to be included in the minimal container. Since right now there's no tomcat-specific optimization in jasper - my minimal proposal would be almost the same as the JSR154-only container, however it keeps the door open ( and includes the runtime as a matter of convenience ). Costin -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
I agree with Costin's interpretation of the Jakarta voting rules (even if I don't agree with his -0 on this particular vote :). Since it is a majority vote, justifying a -1 is optional. soapbox I'd like to point out that we have at least 3 non-binding +1 votes on this already. It seems that there is a community out there for a Servlet-only release, and IMHO, we should listen to them. /soapbox - Original Message - From: Costin Manolache [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Sunday, December 08, 2002 11:32 PM Subject: Re: [VOTE] minimal JSR 154 only distribution Jon Scott Stevens wrote: requirement in JSR 154 to provide the Admin Tool, I don't see how your argument is valid for what I'm proposing. A majority vote doesn't require arguments or validity of arguments. I like the idea or I don't like the idea is all that's needed. Valid arguments are required for a veto. I don't think it would be good for tomcat community if it will pass with 3 +1 votes, 2 -1 votes and one -0. I hope that more tomcat committers will send at least a +0 or -0, and even better +1 or -1. There is no need to get into too much debate - just yes and no would help. Costin -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED] -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Jeanfrancois Arcand wrote: Jon Scott Stevens wrote: Create a separate minimal JSR 154 only distribution of Tomcat 4.x: +1 [] 0 [] -1 [X] -jon (1) Jasper is very a very small jar file. (2) The Admin Tool should go with the minimal distribution of Tomcat. We decided to include JMX in Tomcat distribution...what's the point having JMX and not the Admin Tool? Maybe JSP is not required by all Tomcat users, but I'm sure a lot of them like to have the Admin Tool . If the vote actually passes, I'd like to have only one minimal Tomcat distribution, which would mean no admin and no Jasper (with separate optional Jasper binaries available). JMX can be used directly (using a MX4J connector + MC4J, assuming MC4J updates to MX4J 1.1.1 as we did) to administer the server, without the need to use the admin webapp. Remy -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Jon Scott Stevens wrote: on 2002/12/7 9:37 AM, Glenn Nielsen [EMAIL PROTECTED] wrote: I will consider voting +1 if any of the other tomcat devs who want this will volunteer to be the release manager for the servlet only distribution. I would find this handy when using Tomcat as a SOAP server where JSP is not needed. Glenn Well this thread make some noise. I will volunteer to be the release manager. How will you synchronise with main branch ? Will you wait TC 5 release to make the SMALL TC5 distro or will you follow another cycle of release ? -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Pier Fumagalli wrote: On 8/12/02 0:43 Jon Scott Stevens [EMAIL PROTECTED] wrote: on 2002/12/7 4:25 PM, Pier Fumagalli [EMAIL PROTECTED] wrote: Jon, I'm very sorry mate, you're 4 months too late :-( I lost my fight about this very same topic back then... Maybe to late for your opinion, but honestly, I haven't been that impressed with Jetty. In my case it speeds up my stuff around 3/4 times faster. And the footprint is considerably slower... Depends on the app... I make benchs between TC 4.1.16 and latest jetty, and TC 4.1 was about 30% faster on servlet (didn't test JSP). I saw very little if any speed increase with Jetty and Scarab and I actually consider Jetty's distribution to be packed with more crud than Tomcat's...but maybe I'm just biased by Tomcat. At this point, I don't think that with JSR 154 and JSR 152 being separate, there is much that anyone here can say negative about distributing JSR 154 only engine. Clearly there is a demand. Clearly it is a good thing to have options. What think JCP about a JSR 154 only engine ? -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
What I would love to see is a tree of downloads where each one gains more and more features (it is additive). Such as: JSR-154 Implementation / \ Jasper Velocity / \ \ Admin Tool (JMX) Java Server Feces Scarab That way, you only need to download what you need. Bundles are easily created by simply picking off the branch of the tree that you want. If you want the Tomcat distribution with web based administration abilities, then you grab it at the Admin Tool level and so on. We can even build an ant based system which is able to help us manage the selection of components to include in the distribution. This would be similar to the way that we currently have jar repositories and dependencies, but on an application level. Click here to install Jasper, Struts, etc. Not only does this provide our users the ability to simply get what they need (and add it after the fact if they don't have it), it helps us focus on providing a pluggable system which is separate from the other systems (ie: clean dependencies). I personally think that this is a much cleaner way of providing distributions because it does not require people to learn or deal with things they do not care about. Options are a good thing. Let's not limit ourselves. One last point, we should be able to experiment around here. The negative votes have been based on biases about what I think about Jasper and my opinions. They are not based on the idea that experimentation is a good thing and I think that is just plain wrong and very closed minded. Who are you to decide what our users may or may not like? In the end, if things don't work out, then fine at least we learned something and we can move on to the next thing. What do we really have to loose here? -jon -- StudioZ.tv /\ Bar/Nightclub/Entertainment 314 11th Street @ Folsom /\ San Francisco http://studioz.tv/ -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Jeanfrancois Arcand wrote: Jon Scott Stevens wrote: Create a separate minimal JSR 154 only distribution of Tomcat 4.x: +1 [] 0 [] -1 [X] -jon (1) Jasper is very a very small jar file. (2) The Admin Tool should go with the minimal distribution of Tomcat. We decided to include JMX in Tomcat distribution...what's the point having JMX and not the Admin Tool? Maybe JSP is not required by all Tomcat users, but I'm sure a lot of them like to have the Admin Tool . Not to pick on Jean Francois, but many times I have seen tomcat devs discuss what the users want or use when discussing features. I have no real idea what features tomcat users use or what features they want, other than anecdotal. Are there any facts behind the statement but I'm sure a lot of them like to have the Admin Tool.? -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
RE: [VOTE] minimal JSR 154 only distribution
As an end user. I don't use the admin tool, don't know what it is. I do use both JSP and Servlets. M -Original Message- From: Glenn Nielsen [mailto:[EMAIL PROTECTED]] Sent: 09 December 2002 14:06 To: Tomcat Developers List Subject: Re: [VOTE] minimal JSR 154 only distribution Jeanfrancois Arcand wrote: Jon Scott Stevens wrote: Create a separate minimal JSR 154 only distribution of Tomcat 4.x: +1 [] 0 [] -1 [X] -jon (1) Jasper is very a very small jar file. (2) The Admin Tool should go with the minimal distribution of Tomcat. We decided to include JMX in Tomcat distribution...what's the point having JMX and not the Admin Tool? Maybe JSP is not required by all Tomcat users, but I'm sure a lot of them like to have the Admin Tool . Not to pick on Jean Francois, but many times I have seen tomcat devs discuss what the users want or use when discussing features. I have no real idea what features tomcat users use or what features they want, other than anecdotal. Are there any facts behind the statement but I'm sure a lot of them like to have the Admin Tool.? -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED] -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
I have interest in the admin tool - but I don't trust it yet and for my production work - and I am still stuck on the 4.0.X series. I think the admin tool is essential for a full distribution - but useless in a minimal distribution. The user base wanting the min distribution already have the know-how to do what ever they need and the admin app would get in the way. For the new user - the admin tool is very important as a guide for simple changes in an simple manner until they get experience with manipulating server.xml themselves. I went through the same experience with weblogic 6. The admin tool was nice - but once I knew the XML attributes to place in their config files - the admin interface was (mostly) useless. I believe the same will be the same for tomcat users. The use of the admin app will be inversely proportional to the user's skill level. Additionaly, if I create Listeners or other custom classes which need configured in server.xml - I don't want to use the admin app. I'd rather hand write the file myself. I am sure most admins in the same predicament would feel the same. In a nutshell - I think the admin app is helpful to new users. Personally - I don't have enough experience with it to judge if it is better than just editing server.xml by hand. -Tim Glenn Nielsen wrote: Jeanfrancois Arcand wrote: Jon Scott Stevens wrote: Create a separate minimal JSR 154 only distribution of Tomcat 4.x: +1 [] 0 [] -1 [X] -jon (1) Jasper is very a very small jar file. (2) The Admin Tool should go with the minimal distribution of Tomcat. We decided to include JMX in Tomcat distribution...what's the point having JMX and not the Admin Tool? Maybe JSP is not required by all Tomcat users, but I'm sure a lot of them like to have the Admin Tool . Not to pick on Jean Francois, but many times I have seen tomcat devs discuss what the users want or use when discussing features. I have no real idea what features tomcat users use or what features they want, other than anecdotal. Are there any facts behind the statement but I'm sure a lot of them like to have the Admin Tool.? -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
RE: [VOTE] minimal JSR 154 only distribution
Jon, Create a separate minimal JSR 154 only distribution of Tomcat 4.x: +0, i could be +1 but i'm out of time to offer any help in tomcat as a whole, and of course for this particular proposal, but i dont see anything wrong in it, more i do see it as another step, in the GTU Path ( GTU stand for Great Tomcat Unification :).. Saludos, Ignacio J. Ortega -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Ignacio J. Ortega wrote: Jon, Create a separate minimal JSR 154 only distribution of Tomcat 4.x: +0, i could be +1 but i'm out of time to offer any help in tomcat as a whole, and of course for this particular proposal, but i dont see anything wrong in it, more i do see it as another step, in the GTU Path ( GTU stand for Great Tomcat Unification :).. Nota that adopting modules for Tomcat could be a way to satisfy everybody needs. In such case I'm +1 to have a minimal Tomcat which will load modules to have JSP, JMX, admin supports. If anything could be set in server.xml, it will help have an uniq distribution, that everybody will be able to tune for its own use. -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Remy Maucherat wrote: If the vote actually passes, I'd like to have only one minimal Tomcat distribution, which would mean no admin and no Jasper (with separate optional Jasper binaries available). JMX can be used directly (using a MX4J connector + MC4J, assuming MC4J updates to MX4J 1.1.1 as we did) to administer the server, without the need to use the admin webapp. Now - this is not nice ! I don't know why my proposal for a minimal tomcat that includes jsr152 and jsr154 shouldn't be allowed. Ok, I'll make a VOTE and try to gather the votes - hopefully I'll get at least 3 +1 votes ( and you'll at least -0 it :-). Costin -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Costin Manolache wrote: Remy Maucherat wrote: If the vote actually passes, I'd like to have only one minimal Tomcat distribution, which would mean no admin and no Jasper (with separate optional Jasper binaries available). JMX can be used directly (using a MX4J connector + MC4J, assuming MC4J updates to MX4J 1.1.1 as we did) to administer the server, without the need to use the admin webapp. Now - this is not nice ! I don't know why my proposal for a minimal tomcat that includes jsr152 and jsr154 shouldn't be allowed. Ok, I'll make a VOTE and try to gather the votes - hopefully I'll get at least 3 +1 votes ( and you'll at least -0 it :-). I'd really like to avoid the proliferation of too many distributions. The light distribution confused a lot of users who didn't know what they needed, from what I've seen (from what I've read on tc-user). To restate it: if we do a minimal version and it is voted to be Jasper less, then I think we shouldn't have a third minimal-but-with-Jasper distribution. Rather, I'd have a separate binary holding the Jasper JARs. That's just my preference anyway. BTW, in such vote, it should be Yes or No. If you don't care, then you shouldn't vote. Remy -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Remy Maucherat wrote: Costin Manolache wrote: Remy Maucherat wrote: If the vote actually passes, I'd like to have only one minimal Tomcat distribution, which would mean no admin and no Jasper (with separate optional Jasper binaries available). JMX can be used directly (using a MX4J connector + MC4J, assuming MC4J updates to MX4J 1.1.1 as we did) to administer the server, without the need to use the admin webapp. Now - this is not nice ! I don't know why my proposal for a minimal tomcat that includes jsr152 and jsr154 shouldn't be allowed. Ok, I'll make a VOTE and try to gather the votes - hopefully I'll get at least 3 +1 votes ( and you'll at least -0 it :-). I'd really like to avoid the proliferation of too many distributions. The light distribution confused a lot of users who didn't know what they needed, from what I've seen (from what I've read on tc-user). To restate it: if we do a minimal version and it is voted to be Jasper less, then I think we shouldn't have a third minimal-but-with-Jasper distribution. Rather, I'd have a separate binary holding the Jasper JARs. That's just my preference anyway. BTW, in such vote, it should be Yes or No. If you don't care, then you shouldn't vote. What about using a minimal tomcat core with plugged modules to give access to jsp/jmx ? Will make both Costin, and Jon happy and let us have only one distribution with clear indication in server.xml on how to activate/desactive such module. -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Jon Scott Stevens wrote: One last point, we should be able to experiment around here. The negative votes have been based on biases about what I think about Jasper and my opinions. They are not based on the idea that experimentation is a good thing and I think that is just plain wrong and very closed minded. Who are you to decide what our users may or may not like? In the end, if things don't work out, then fine at least we learned something and we can move on to the next thing. No Jon - my vote wasn't based on your biasses about jasper, but on the biasses of many members of the tomcat community. 5.0 was supposed to be the release we make togheter, as a united community based on consensus. There is one jakarta project where experimentation without consensus was the operating mode - and I certainly don't like the result. You may remember about the division of the tomcat community on 3.3/4.0 - and I don't think 69K of code ( jasper runtime ) would justify another division. What do we really have to loose here? Consensus. Costin -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Costin Manolache wrote: Jon Scott Stevens wrote: One last point, we should be able to experiment around here. The negative votes have been based on biases about what I think about Jasper and my opinions. They are not based on the idea that experimentation is a good thing and I think that is just plain wrong and very closed minded. Who are you to decide what our users may or may not like? In the end, if things don't work out, then fine at least we learned something and we can move on to the next thing. No Jon - my vote wasn't based on your biasses about jasper, but on the biasses of many members of the tomcat community. 5.0 was supposed to be the release we make togheter, as a united community based on consensus. There is one jakarta project where experimentation without consensus was the operating mode - and I certainly don't like the result. You may remember about the division of the tomcat community on 3.3/4.0 - and I don't think 69K of code ( jasper runtime ) would justify another division. What do we really have to loose here? Consensus. People cannot agree on everything. Here, we're talking about relatively minor topics. This issue won't end up in a division of the community, but rather in one additional binary distribution based on the same codebase. I can live with that (well, as long as I'm not the one building them all ;-) ). If the lack of consensus spreads to more serious topics (like a 4.2.x branch), then I would agree it could be worrying. Remy -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Jon Scott Stevens wrote: What I would love to see is a tree of downloads where each one gains more and more features (it is additive). Such as: JSR-154 Implementation / \ Jasper Velocity / \ \ Admin Tool (JMX) Java Server Feces Scarab That way, you only need to download what you need. Bundles are easily created by simply picking off the branch of the tree that you want. If you want the Tomcat distribution with web based administration abilities, then you grab it at the Admin Tool level and so on. We can even build an ant based system which is able to help us manage the selection of components to include in the distribution. This would be similar to the way that we currently have jar repositories and dependencies, but on an application level. Click here to install Jasper, Struts, etc. Not only does this provide our users the ability to simply get what they need (and add it after the fact if they don't have it), it helps us focus on providing a pluggable system which is separate from the other systems (ie: clean dependencies). I personally think that this is a much cleaner way of providing distributions because it does not require people to learn or deal with things they do not care about. Options are a good thing. Let's not limit ourselves. Youy don't need to learn JSP/Admin Tool if you don't use it. The actual Tomcat installation doesn't require you to learn the Admin Tool or JSP One last point, we should be able to experiment around here. The negative votes have been based on biases about what I think about Jasper and my opinions. They are not based on the idea that experimentation is a good thing and I think that is just plain wrong and very closed minded. Who are you to decide what our users may or may not like? In the end, if things don't work out, then fine at least we learned something and we can move on to the next thing. I'm with this group since August, and did not see any post from you since last week. So my vote is certainly not based on your biaises :-). And I am not using the Admin Tool at all personnaly What do we really have to loose here? Simplicity. But since we don't have any statistic about the user (what we want, what he use when he download Tomcat), it is hard to prove he doesn't use JSP/Admin Tool/JMX, and hard to prove he doesn't use it. -jon -- Jeanfrancois -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Glenn Nielsen wrote: Jeanfrancois Arcand wrote: Jon Scott Stevens wrote: Create a separate minimal JSR 154 only distribution of Tomcat 4.x: +1 [] 0 [] -1 [X] -jon (1) Jasper is very a very small jar file. (2) The Admin Tool should go with the minimal distribution of Tomcat. We decided to include JMX in Tomcat distribution...what's the point having JMX and not the Admin Tool? Maybe JSP is not required by all Tomcat users, but I'm sure a lot of them like to have the Admin Tool . Not to pick on Jean Francois, but many times I have seen tomcat devs discuss what the users want or use when discussing features. I have no real idea what features tomcat users use or what features they want, other than anecdotal. Are there any facts behind the statement but I'm sure a lot of them like to have the Admin Tool.? No, there aren't. Just based on my reading of Tomcat-users(IMBW). But can we say that as well with JSP (people don't need it ?). If yes, then I will change my vote and help building a minimal distribution without JSP. -- Jeanfrancois -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED] -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Henri Gomez wrote: What about using a minimal tomcat core with plugged modules to give access to jsp/jmx ? There is already some support for that ( server/webapps is very similar with the 3.3 modules - i.e. trusted components ). It'll need few changes to deal with the loader issues ( i.e. they should be included in the server loader - quite easy ). The option I preffer for that is to use JMX. Each pluggin will be an mbean that is loaded using either an mlet-like or via a deployment descriptor ( server/webapps is also fine - using webapps as plugin units ). JMX notifications can be easily used to have the plugin loading/unloading very flexible. Costin -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
on 2002/12/9 7:27 AM, Remy Maucherat [EMAIL PROTECTED] wrote: I'd really like to avoid the proliferation of too many distributions. I don't agree with that. There is nothing wrong with giving users choices. -jon -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
on 2002/12/9 7:32 AM, Henri Gomez [EMAIL PROTECTED] wrote: What about using a minimal tomcat core with plugged modules to give access to jsp/jmx ? Will make both Costin, and Jon happy and let us have only one distribution with clear indication in server.xml on how to activate/desactive such module. That does not make me happy. You are missing my point. Read the subject line of this message. -jon -- StudioZ.tv /\ Bar/Nightclub/Entertainment 314 11th Street @ Folsom /\ San Francisco http://studioz.tv/ -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
on 2002/12/9 7:51 AM, Costin Manolache [EMAIL PROTECTED] wrote: No Jon - my vote wasn't based on your biasses about jasper, but on the biasses of many members of the tomcat community. So, you speak for these people? I don't think so. 5.0 was supposed to be the release we make togheter, as a united community based on consensus. My proposal has nothing to do with that. There is one jakarta project where experimentation without consensus was the operating mode - and I certainly don't like the result. You may remember about the division of the tomcat community on 3.3/4.0 - and I don't think 69K of code ( jasper runtime ) would justify another division. I find it really funny that you are now forced to work on 4.x. Consensus. What consensus? This has nothing to do with which container to use. It has everything to do with giving people options. -jon -- StudioZ.tv /\ Bar/Nightclub/Entertainment 314 11th Street @ Folsom /\ San Francisco http://studioz.tv/ -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
on 2002/12/9 8:21 AM, Remy Maucherat [EMAIL PROTECTED] wrote: People cannot agree on everything. Here, we're talking about relatively minor topics. This issue won't end up in a division of the community, but rather in one additional binary distribution based on the same codebase. I can live with that (well, as long as I'm not the one building them all ;-) ). If the lack of consensus spreads to more serious topics (like a 4.2.x branch), then I would agree it could be worrying. Remy Finally, Remy is starting to see the light. -jon -- StudioZ.tv /\ Bar/Nightclub/Entertainment 314 11th Street @ Folsom /\ San Francisco http://studioz.tv/ -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
on 2002/12/9 9:14 AM, Jeanfrancois Arcand [EMAIL PROTECTED] wrote: I personally think that this is a much cleaner way of providing distributions because it does not require people to learn or deal with things they do not care about. Options are a good thing. Let's not limit ourselves. Youy don't need to learn JSP/Admin Tool if you don't use it. The actual Tomcat installation doesn't require you to learn the Admin Tool or JSP Read what I wrote again. I said Learn or deal with and I made no specific point about the JSP/Admin Tool. I'm with this group since August, and did not see any post from you since last week. So my vote is certainly not based on your biaises :-). You vote is based on a lack of history and a view of the larger picture. Simplicity. But since we don't have any statistic about the user (what we want, what he use when he download Tomcat), it is hard to prove he doesn't use JSP/Admin Tool/JMX, and hard to prove he doesn't use it. Exactly my point. -jon -- StudioZ.tv /\ Bar/Nightclub/Entertainment 314 11th Street @ Folsom /\ San Francisco http://studioz.tv/ -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Jon Scott Stevens wrote: on 2002/12/9 7:51 AM, Costin Manolache [EMAIL PROTECTED] wrote: No Jon - my vote wasn't based on your biasses about jasper, but on the biasses of many members of the tomcat community. So, you speak for these people? I don't think so. No, I speak for myself. I like and use jasper - and I think the tomcat official releases should include both tomcat and jasper. Just like you don't speak for the users. 5.0 was supposed to be the release we make togheter, as a united community based on consensus. My proposal has nothing to do with that. 2 -1 and one -0 vote versus 3 +1 votes doesn't look like a consensus. If Sun or anyone else wants to release a JSR154-only product - they can do it and we should make it easy to do so. I don't think we should do it ( as tomcat community ). I heard the argument about user choice and freedom to experiment on avalon ( to justify everyone releasing his own container ). I think their current attempt to have a single product is a move in the right direction. Consensus. What consensus? This has nothing to do with which container to use. It has everything to do with giving people options. Is Apache http having n different releases with all the possible combinations of modules ( to give users choice ) ? They include all the modules in the httpd repository ( some disabled by default ). That also goes against my proposal for minimal tomcat as well - and supports Remy's argument that we should have one release. Costin -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Jon Scott Stevens wrote: If Sun or anyone else wants to release a JSR154-only product - they can do it and we should make it easy to do so. I don't think we should do it ( as tomcat community ). Why? So far, you haven't even given a real reason. That may be because every reason you don't like is not real. So far you qualified as invalid every reason that everyone mentioned. You are so funny! How quickly you seem to change your mind. Go back and I have a feeling almost everyone changed his mind in some issues in the last 2 years. You seem to be one exception, and I don't know if this is a good thing :-) Is Apache http having n different releases with all the possible combinations of modules ( to give users choice ) ? They include all the modules in the httpd repository ( some disabled by default ). They don't distribute PHP. So, why should we distribute JSP? PHP is not developed by the httpd community. ( but php.apache.org ). Jasper is developed by the tomcat community - same mailing list, same avail list. Anyway - as long as Bill is supporting the no-jasper release, I won't change my vote to -1 ( but keep it -0). I haven't contributed that much to jasper - and it's up to jasper people to decide what they feel ( by voting +1 or -1 ). Costin -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
On 9/12/02 3:59 Jeanfrancois Arcand [EMAIL PROTECTED] wrote: (2) The Admin Tool should go with the minimal distribution of Tomcat. We decided to include JMX in Tomcat distribution...what's the point having JMX and not the Admin Tool? Maybe JSP is not required by all Tomcat users, but I'm sure a lot of them like to have the Admin Tool . That is what I'm asking myself... What's the point in all this useless crap? Pier -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
On 9/12/02 9:16 Jon Scott Stevens [EMAIL PROTECTED] wrote: What I would love to see is a tree of downloads where each one gains more and more features (it is additive). Such as: JSR-154 Implementation / \ Jasper Velocity / \ \ Admin Tool (JMX) Java Server Feces Scarab Jon... That spelling of JSF is (C) and TM Pier 2002 :-) Pier -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
On 9/12/02 17:14 Jeanfrancois Arcand [EMAIL PROTECTED] wrote: Youy don't need to learn JSP/Admin Tool if you don't use it. The actual Tomcat installation doesn't require you to learn the Admin Tool or JSP As I said 6 or so months ago... That thing is a security hole as big as the Empire State Building... As most of the stuff that make up tomcat... We have some bugs in JSR-154, few in Jasper, few in JSSI, few in CGI... All together it makes a load of em... If someone can come up with a Servlet-only distribution, at least I won't get holes from all the other (totally useless) components... Pier (a _user_ now) -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Pier Fumagalli wrote: On 9/12/02 17:14 Jeanfrancois Arcand [EMAIL PROTECTED] wrote: Youy don't need to learn JSP/Admin Tool if you don't use it. The actual Tomcat installation doesn't require you to learn the Admin Tool or JSP As I said 6 or so months ago... That thing is a security hole as big as Can you give me an example of a security hole? I would be interested to fix those holes the Empire State Building... As most of the stuff that make up tomcat... We have some bugs in JSR-154, few in Jasper, few in JSSI, few in CGI... All together it makes a load of em... Yes, you are right (think about Windoses). Is the reason to have an only 154 distribution is security? That a very different story... If someone can come up with a Servlet-only distribution, at least I won't get holes from all the other (totally useless) components... True. But if Jasper/AdminTool/etc. are secure, then that doesn't that no a good reason IMO. -- Jeanfrancois Pier (a _user_ now) -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
On 9/12/02 23:06 Jeanfrancois Arcand [EMAIL PROTECTED] wrote:
Pier Fumagalli wrote:
On 9/12/02 17:14 Jeanfrancois Arcand [EMAIL PROTECTED] wrote:
Youy don't need to learn JSP/Admin Tool if you don't use it. The actual
Tomcat installation doesn't require you to learn the Admin Tool or JSP
As I said 6 or so months ago... That thing is a security hole as big as
Can you give me an example of a security hole? I would be interested to
fix those holes
They come up every now and then... That's why Costin wanted that all-private
for your eyes only noone who is not cross checked with the FBI gets in
security mailing list, right?...
Want a list of the past ones?
http://search.cert.org/query.html?col=certadvcol=incnotescol=vulnotesht=0
qp=qt=tomcatqs=qc=pw=100%25ws=1la=enqm=0st=1nh=25lk=1rf=2rq=0s
i=1
(err, page 1 out of 24)...
the Empire State Building... As most of the stuff that make up tomcat...
We have some bugs in JSR-154, few in Jasper, few in JSSI, few in CGI... All
together it makes a load of em...
Yes, you are right (think about Windoses). Is the reason to have an only
154 distribution is security? That a very different story...
For me it is... For others it might be a different reason... I joined Apache
because of a friend, you because of your employer... SO? Reasons are
different, outcome is the same...
If someone can come up with a Servlet-only distribution, at least I won't
get holes from all the other (totally useless) components...
True. But if Jasper/AdminTool/etc. are secure, then that doesn't that no
a good reason IMO.
Ehemm... With 24 pages of vulnerability notes? Ha.. Hahaha Hahahaha! :-)
Rule of the thumb #1... Not even
public class Main
public static void Main(String argv[]) {
System.out.println(This program doesn't have a bug);
}
}
Doesn't have a bug, allright? Because to execute that little statement my
proc actually does some bazillion operations, and god knows how many INC,
ADD, SUB and MUL my proc does to get that out...
So, rule of the thumb #2. No software ever written is _ever_ secure (Just
consider that the Boeing 777 software - which is the most secure OS on
this planet as far as research goes - Has only one bug every 180.000 lines
of code)...
Now, don't tell me that ALL that collection of cruft doesn't have a bug...
It's just that we are lucky and noone found them yet (given enough eyes...
Linus says)...
To sum up: rule of the thumb #3, less code, less bugs (you folks from Sun
preach that all over your Solaris Blueprints stuff, I learnt it when your
employer was paying my salary).
So, please, don¹t come up on a mailing list saying that is secure, just
say that noone has found a bug yet, because that (and only that) is the
truth...
Pier
--
To unsubscribe, e-mail: mailto:[EMAIL PROTECTED]
For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
On 9/12/02 23:51 Pier Fumagalli [EMAIL PROTECTED] wrote: Ehemm... With 24 pages of vulnerability notes? Ha.. Hahaha Hahahaha! :-) Correction to self... Not 24 pages... 24 notes... (Ok, I have an eyesight test tomorrow morning at 10:20 in SOHO... I know, I know...) Pier -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Pier Fumagalli wrote: They come up every now and then... That's why Costin wanted that all-private for your eyes only noone who is not cross checked with the FBI gets in security mailing list, right?... Wrong. The list is for all tomcat committers - and all security information will be posted after the fix is done. The list is created - and will hopefully be used next time a security problem is found. Ehemm... With 24 pages of vulnerability notes? Ha.. Hahaha Hahahaha! :-) Again ? There are 24 results - not 24 pages of results. And if you go down the page - many are not in tomcat. Try the same thing for apache. Yes - any code may have vulnerabilities, and the more code you have, the more bugs you'll have. We can only do our best so that our code has fewer bugs - but that shouldn't stop us from distributing the code we write ( i.e. tomcat and jasper ). Costin -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Pier Fumagalli wrote:
On 9/12/02 23:06 Jeanfrancois Arcand [EMAIL PROTECTED] wrote:
Pier Fumagalli wrote:
On 9/12/02 17:14 Jeanfrancois Arcand [EMAIL PROTECTED] wrote:
Youy don't need to learn JSP/Admin Tool if you don't use it. The actual
Tomcat installation doesn't require you to learn the Admin Tool or JSP
As I said 6 or so months ago... That thing is a security hole as big as
Can you give me an example of a security hole? I would be interested to
fix those holes
They come up every now and then... That's why Costin wanted that all-private
for your eyes only noone who is not cross checked with the FBI gets in
security mailing list, right?...
Not sure is the real reason. We were doing a Security Audit during that
time and as a community, we where trying to find a better list to
declare possible security issues and fix them before the public is informed.
Want a list of the past ones?
http://search.cert.org/query.html?col=certadvcol=incnotescol=vulnotesht=0
qp=qt=tomcatqs=qc=pw=100%25ws=1la=enqm=0st=1nh=25lk=1rf=2rq=0s
i=1
(err, page 1 out of 24)...
;-)
the Empire State Building... As most of the stuff that make up tomcat...
We have some bugs in JSR-154, few in Jasper, few in JSSI, few in CGI... All
together it makes a load of em...
Yes, you are right (think about Windoses). Is the reason to have an only
154 distribution is security? That a very different story...
For me it is... For others it might be a different reason... I joined Apache
because of a friend, you because of your employer... SO? Reasons are
different, outcome is the same...
Yep. That why we are trying to reach concensus.
If someone can come up with a Servlet-only distribution, at least I won't
get holes from all the other (totally useless) components...
True. But if Jasper/AdminTool/etc. are secure, then that doesn't that no
a good reason IMO.
Ehemm... With 24 pages of vulnerability notes? Ha.. Hahaha Hahahaha! :-)
Rule of the thumb #1... Not even
public class Main
public static void Main(String argv[]) {
System.out.println(This program doesn't have a bug);
}
}
Doesn't have a bug, allright? Because to execute that little statement my
proc actually does some bazillion operations, and god knows how many INC,
ADD, SUB and MUL my proc does to get that out...
So, rule of the thumb #2. No software ever written is _ever_ secure (Just
consider that the Boeing 777 software - which is the most secure OS on
this planet as far as research goes - Has only one bug every 180.000 lines
of code)...
Did I say that every software are secure? Your are right and I will not
argument at all. But from your previous posting, I was under the
impression you were aware of security holes
Now, don't tell me that ALL that collection of cruft doesn't have a bug...
It's just that we are lucky and noone found them yet (given enough eyes...
Linus says)...
I never say that and I will never says that. But I least I have try
during the Security Audit to fix some of the obvious one. Still Tomcat
is probably not enough secure (and will never be). My point is if you
are aware of such obvious one, then let me know and I will fix them. But
I don't think Tomcat is more secure without JSP I know, I know, what
I think you don't care :-)
To sum up: rule of the thumb #3, less code, less bugs (you folks from Sun
preach that all over your Solaris Blueprints stuff, I learnt it when your
employer was paying my salary).
Wow, didn't know that... I've missed the chance to work with you :-) I
should studies my Tomcat history and learn who is doing what, what
biases he/she have, and then vote appropriatly.
So, please, don¹t come up on a mailing list saying that is secure, just
say that noone has found a bug yet, because that (and only that) is the
truth...
I agree my wording was not appropriate. Should say that in french next
time :-)
-- Jeanfrancois
Pier
--
To unsubscribe, e-mail: mailto:[EMAIL PROTECTED]
For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
On 10/12/02 0:30 Jeanfrancois Arcand [EMAIL PROTECTED] wrote: Now, don't tell me that ALL that collection of cruft doesn't have a bug... It's just that we are lucky and noone found them yet (given enough eyes... Linus says)... I never say that and I will never says that. But I least I have try during the Security Audit to fix some of the obvious one. Still Tomcat is probably not enough secure (and will never be). My point is if you are aware of such obvious one, then let me know and I will fix them. You said (quote) Jasper/AdminTool/etc. are secure... That's a pretty bold statement. From my experience, security audits and stuff are all right, until someone doesn't call up at 3 AM saying the server is down because of a DOS... Nah, I don't like being woken up in the middle of the night... But I don't think Tomcat is more secure without JSP I know, I know, what I think you don't care :-) The bible (for us Sun customers, _your_ customers): http://wwws.sun.com/software/security/blueprints/#minimum Solaris Operating Environment Minimization for Security: A Simple, Reproducible and Secure Application Installation Methodology - Updated for the Solaris 8 Operating Environment - November 2000 - by Alex Noordergraaf Discusses the process of minimizing an installation of the Solaris Operating Environment. Mimimization is the process of removing all unnecessary components and services from the Solaris software to reduce system vulnerabilities. Also introduces a simple technique for replicating these types of installations across a large number of systems. _YOUR_ security folks tought me that... Go and talk to them, they're down in SCA-7 if I'm not wrong... Paranoia is an irreversible process for us on the line-of-fire. To sum up: rule of the thumb #3, less code, less bugs (you folks from Sun preach that all over your Solaris Blueprints stuff, I learnt it when your employer was paying my salary). Wow, didn't know that... I've missed the chance to work with you :-) Don't worry, you would have _hated_ working with me (and proudly keeping up my record of being the most hated freak on the planet). I should studies my Tomcat history and learn who is doing what, what biases he/she have, and then vote appropriatly. Oh, no, I got paranoid after I left Sun and started working on the other side of the barricade... Trying to use in production what I was coding earlier... :-) So, please, don¹t come up on a mailing list saying that is secure, just say that noone has found a bug yet, because that (and only that) is the truth... I agree my wording was not appropriate. Should say that in french next time :-) Pas de problemes (where are the accents on this keyboard?) Pier -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
I guess the high art of potty humor is not lost on idiots. My buttocks are clenched in anticipation for the Pier (C) and TM fart jokes. :) Justyna Pier Fumagalli wrote: On 9/12/02 9:16 Jon Scott Stevens [EMAIL PROTECTED] wrote: What I would love to see is a tree of downloads where each one gains more and more features (it is additive). Such as: JSR-154 Implementation / \ Jasper Velocity / \ \ Admin Tool (JMX) Java Server Feces Scarab Jon... That spelling of JSF is (C) and TM Pier 2002 :-) Pier -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED] -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
On 10/12/02 1:06 Justyna Horwat [EMAIL PROTECTED] wrote: I guess the high art of potty humor is not lost on idiots. My buttocks are clenched in anticipation for the Pier (C) and TM fart jokes. :) Damn you know me far too well, Justy! :-) Pier -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
OK, seems I don't have any supports to stay with my -1 (seems nobody care about the AdminTool argument :-)). So I will change my mind and vote 0. -- Jeanfrancois Pier Fumagalli wrote: On 10/12/02 0:30 Jeanfrancois Arcand [EMAIL PROTECTED] wrote: Now, don't tell me that ALL that collection of cruft doesn't have a bug... It's just that we are lucky and noone found them yet (given enough eyes... Linus says)... I never say that and I will never says that. But I least I have try during the Security Audit to fix some of the obvious one. Still Tomcat is probably not enough secure (and will never be). My point is if you are aware of such obvious one, then let me know and I will fix them. You said (quote) Jasper/AdminTool/etc. are secure... That's a pretty bold statement. From my experience, security audits and stuff are all right, until someone doesn't call up at 3 AM saying the server is down because of a DOS... Nah, I don't like being woken up in the middle of the night... But I don't think Tomcat is more secure without JSP I know, I know, what I think you don't care :-) The bible (for us Sun customers, _your_ customers): http://wwws.sun.com/software/security/blueprints/#minimum Solaris Operating Environment Minimization for Security: A Simple, Reproducible and Secure Application Installation Methodology - Updated for the Solaris 8 Operating Environment - November 2000 - by Alex Noordergraaf Discusses the process of minimizing an installation of the Solaris Operating Environment. Mimimization is the process of removing all unnecessary components and services from the Solaris software to reduce system vulnerabilities. Also introduces a simple technique for replicating these types of installations across a large number of systems. _YOUR_ security folks tought me that... Go and talk to them, they're down in SCA-7 if I'm not wrong... Paranoia is an irreversible process for us on the line-of-fire. To sum up: rule of the thumb #3, less code, less bugs (you folks from Sun preach that all over your Solaris Blueprints stuff, I learnt it when your employer was paying my salary). Wow, didn't know that... I've missed the chance to work with you :-) Don't worry, you would have _hated_ working with me (and proudly keeping up my record of being the most hated freak on the planet). I should studies my Tomcat history and learn who is doing what, what biases he/she have, and then vote appropriatly. Oh, no, I got paranoid after I left Sun and started working on the other side of the barricade... Trying to use in production what I was coding earlier... :-) So, please, don¹t come up on a mailing list saying that is secure, just say that noone has found a bug yet, because that (and only that) is the truth... I agree my wording was not appropriate. Should say that in french next time :-) Pas de problemes (where are the accents on this keyboard?) Pier -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Jon Scott Stevens wrote: on 2002/12/7 4:25 PM, Pier Fumagalli [EMAIL PROTECTED] wrote: Jon, I'm very sorry mate, you're 4 months too late :-( I lost my fight about this very same topic back then... Pier Maybe to late for your opinion, but honestly, I haven't been that impressed with Jetty. I saw very little if any speed increase with Jetty and Scarab and I actually consider Jetty's distribution to be packed with more crud than Tomcat's...but maybe I'm just biased by Tomcat. At this point, I don't think that with JSR 154 and JSR 152 being separate, there is much that anyone here can say negative about distributing JSR 154 only engine. Clearly there is a demand. Clearly it is a good thing to have options. Well, I'm the one who did the (cleaner) separation between the two JSRs, if you remember. Removing JSPs is just a matter of removing the jasper JARs + the jsp-api JAR + the servlet mapping in conf/web.xml. When I wrote a separate distribution is not needed, I mean that removing JSP support from a TC 5-dev distribution is easy enough and is not worth the risk of confusing users bt having more download options. Remy -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Jon Scott Stevens wrote: Create a separate minimal JSR 154 only distribution of Tomcat 4.x: +1 [] 0 [] -1 [X] -jon (1) Jasper is very a very small jar file. (2) The Admin Tool should go with the minimal distribution of Tomcat. We decided to include JMX in Tomcat distribution...what's the point having JMX and not the Admin Tool? Maybe JSP is not required by all Tomcat users, but I'm sure a lot of them like to have the Admin Tool . -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
- Original Message - From: Jeanfrancois Arcand [EMAIL PROTECTED] To: Tomcat Developers List [EMAIL PROTECTED] Sent: Sunday, December 08, 2002 7:59 PM Subject: Re: [VOTE] minimal JSR 154 only distribution Jon Scott Stevens wrote: Create a separate minimal JSR 154 only distribution of Tomcat 4.x: +1 [] 0 [] -1 [X] -jon (1) Jasper is very a very small jar file. (2) The Admin Tool should go with the minimal distribution of Tomcat. We decided to include JMX in Tomcat distribution...what's the point having JMX and not the Admin Tool? Maybe JSP is not required by all Tomcat users, but I'm sure a lot of them like to have the Admin Tool . Well, now Costin can change his vote and kill this (based on the current vote count). IMHO the admin web-app is a pretty toy, but needs much more work to be usable in a production environment. Since both Remy and Jeanfrancois are very concerned with the ability to include the admin web-app, I'm looking forward to their contributions to improving it :). -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED] -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
on 2002/12/8 7:59 PM, Jeanfrancois Arcand [EMAIL PROTECTED] wrote: (1) Jasper is very a very small jar file. That isn't the question. (2) The Admin Tool should go with the minimal distribution of Tomcat. We decided to include JMX in Tomcat distribution...what's the point having JMX and not the Admin Tool? Maybe JSP is not required by all Tomcat users, but I'm sure a lot of them like to have the Admin Tool . I have never used the Admin Tool. Ever. I don't even know how to use it or what it does. I don't need it and I don't want it. Since I was talking about a JSR 154 ONLY implementation of a Servlet Container (see subject line of this message) and there is absolutely no requirement in JSR 154 to provide the Admin Tool, I don't see how your argument is valid for what I'm proposing. =) -jon -- StudioZ.tv /\ Bar/Nightclub/Entertainment 314 11th Street @ Folsom /\ San Francisco http://studioz.tv/ -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
- Original Message - From: Jon Scott Stevens [EMAIL PROTECTED] To: tomcat-dev [EMAIL PROTECTED] Sent: Sunday, December 08, 2002 10:45 PM Subject: Re: [VOTE] minimal JSR 154 only distribution on 2002/12/8 7:59 PM, Jeanfrancois Arcand [EMAIL PROTECTED] wrote: (1) Jasper is very a very small jar file. That isn't the question. (2) The Admin Tool should go with the minimal distribution of Tomcat. We decided to include JMX in Tomcat distribution...what's the point having JMX and not the Admin Tool? Maybe JSP is not required by all Tomcat users, but I'm sure a lot of them like to have the Admin Tool . I have never used the Admin Tool. Ever. I don't even know how to use it or what it does. I don't need it and I don't want it. Since I was talking about a JSR 154 ONLY implementation of a Servlet Container (see subject line of this message) and there is absolutely no requirement in JSR 154 to provide the Admin Tool, I don't see how your argument is valid for what I'm proposing. +1 =) -jon -- StudioZ.tv /\ Bar/Nightclub/Entertainment 314 11th Street @ Folsom /\ San Francisco http://studioz.tv/ -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED] -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Jon Scott Stevens wrote: requirement in JSR 154 to provide the Admin Tool, I don't see how your argument is valid for what I'm proposing. A majority vote doesn't require arguments or validity of arguments. I like the idea or I don't like the idea is all that's needed. Valid arguments are required for a veto. I don't think it would be good for tomcat community if it will pass with 3 +1 votes, 2 -1 votes and one -0. I hope that more tomcat committers will send at least a +0 or -0, and even better +1 or -1. There is no need to get into too much debate - just yes and no would help. Costin -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
on 2002/12/8 11:32 PM, Costin Manolache [EMAIL PROTECTED] wrote: I hope that more tomcat committers will send at least a +0 or -0, and even better +1 or -1. There is no need to get into too much debate - just yes and no would help. I agree. Especially since what Jeanfrancois was debating as his -1 reason had nothing to do with what the vote was about. =) -jon -- StudioZ.tv /\ Bar/Nightclub/Entertainment 314 11th Street @ Folsom /\ San Francisco http://studioz.tv/ -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
It would cause nightmares if you knew how badly I've got my e-mails cross-linked :). This is to +1 the original VOTE. While I'm personally a heavy JSP user, having patched TC 3.3.x to allow it to run in servlet-only mode, I see the need for offering a servlet-only container. According to the Costin-vote-watch, we still need at least one more (binding) +1 to authorize a servlet-only release of Tomcat. - Original Message - From: IAS [EMAIL PROTECTED] To: 'Tomcat Developers List' [EMAIL PROTECTED] Sent: Friday, December 06, 2002 11:02 PM Subject: RE: [VOTE] minimal JSR 154 only distribution I'm very glad to see this vote proposal because it seems to me like the first step of Servlet/JSP mutual independence. Two months ago I proposed Tomcat architectural refactoring plan (at that time Tomcat subproject plan) on http://www.mail-archive.com/tomcat-dev@jakarta.apache.org/msg34720.html. I also showed JSF+Struts+Catalina ensemble on http://www.mail-archive.com/tomcat-dev@jakarta.apache.org/msg35116.html and a possible Jasper-Catalina relationship on http://www.mail-archive.com/tomcat-dev@jakarta.apache.org/msg35119.html. I sincerely understand a very few of Tomcat committers share interest in this issue like jean-frederic clere's seconding on http://www.mail-archive.com/tomcat-dev@jakarta.apache.org/msg34768.html. In my humble opinion, in terms of technology, it is not imperative that Servlet should go with JSP. In fact, the mother of Tomcat, JServ also started as a Servlet engine. In other words, Servlet technology itself is independent one. It also implies that Java Web developers have freedom of choosing dynamic page generation technology over Servlet. We can say we have right to use JSP, but on the other hand, we have right not to use JSP in purely technical perspective. However, I totally agree on the need that we deliver JSP equipped Tomcat for the majority of Tomcat users who are very familiar with JSP (even cannot live without JSP like me :-). I guess the problem is Who will do (or exactly speaking, be willing to do) the job, i.e. making Servlet-only-Tomcat since we need a considerable number of Tomcat committers (Costin said 3) for that. If we get wide support from Tomcat committers but they can't afford the job, how about gathering Servlet-only-Tomcat team whether they belong to committers or not? I hope there would be many people who will volunteer for that, including myself. The detailed processes respecting the work could be discussed from now on, and this chance might be a new attempt to develop greater Tomcat empowered by volunteers. Thanks in advance. IAS === Lee, Changshin (Korean name) IAS (International name) Company Web Site: http://www.tmax.co.kr Personal Web Site: http://www.iasandcb.pe.kr --- Senior Researcher Java Technology Evangelist JCP member - http://jcp.org/en/participation/members/L RD Institute Tmax Soft, Inc. JCP member - http://jcp.org/en/participation/members/T == -Original Message- From: Jon Scott Stevens [mailto:[EMAIL PROTECTED]] Sent: Saturday, December 07, 2002 1:09 AM To: tomcat-dev Subject: [VOTE] minimal JSR 154 only distribution Create a separate minimal JSR 154 only distribution of Tomcat 4.x: +1 [] 0 [] -1 [] -jon -- StudioZ.tv /\ Bar/Nightclub/Entertainment 314 11th Street @ Folsom /\ San Francisco http://studioz.tv/ -- To unsubscribe, e-mail: mailto:tomcat-dev- [EMAIL PROTECTED] For additional commands, e-mail: mailto:tomcat-dev- [EMAIL PROTECTED] -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED] -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
On 6/12/02 16:09 Jon Scott Stevens [EMAIL PROTECTED] wrote: Create a separate minimal JSR 154 only distribution of Tomcat 4.x: +1 [X] 0 [ ] -1 [ ] Or simply use Jetty :-) Pier -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Jon Scott Stevens wrote: Create a separate minimal JSR 154 only distribution of Tomcat 4.x: +1 [] 0 [] -1 [X] - I think this distribution doesn't have much interest (Jasper is rather small + the vast majority of users want the feature) - As the release manager, I feel lazy, and would like to minimize the possibilities of screwing up a distribution - Some Tomcat features depend on Jasper (like the admin webapp) - If we follow Costin's ideas on bundling, full-tomcat will bundle lots of projects; we can also bundle Velocity here (probably on the condition that it moves to commons-logging, to harmonize dependencies) - Users are used to the idea of having JSP support bundled, so this could further increase support issues (even if you put no JSP in bold, I think people will report that their JSP doesn't work) I'll add a checkbox in the Windows installer for Jasper eventually (as well as a few other components), and I think this is enough. Personally, I think this is a yes or no vote, so I don't think either choice needs a justification. Remy -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Bill Barker wrote: It would cause nightmares if you knew how badly I've got my e-mails cross-linked :). This is to +1 the original VOTE. While I'm personally a heavy JSP user, having patched TC 3.3.x to allow it to run in servlet-only mode, I see the need for offering a servlet-only container. According to the Costin-vote-watch, we still need at least one more (binding) +1 to authorize a servlet-only release of Tomcat. Now it needs 2 -1 votes :-) Bill - let me understand this - do you really want and need this ? Costin -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
Re: [VOTE] minimal JSR 154 only distribution
Remy Maucherat wrote: - As the release manager, I feel lazy, and would like to minimize the possibilities of screwing up a distribution You don't have to do that - one of the people who voted +1 will have to volunteer as release manager for that release, and they are supposed to maintain it. - If we follow Costin's ideas on bundling, full-tomcat will bundle lots of projects; we can also bundle Velocity here (probably on the condition that it moves to commons-logging, to harmonize dependencies) It seems Jon is more interested in a release without jsp then in a release that includes velocity. Too bad. Personally, I think this is a yes or no vote, so I don't think either choice needs a justification. The majority decision works only if enough people vote. So far we have: +1: Jon, Pier, Bill -0: Costin -1: Remy Anyone else ? Costin -- To unsubscribe, e-mail: mailto:[EMAIL PROTECTED] For additional commands, e-mail: mailto:[EMAIL PROTECTED]
