(feel like POLLing and RTing these days - catching up with my Sling stuff ;-)
Hi, The more I talk to Carsten, the more I realize that he and others are right - scripting is evil. Untyped variables, poorly-specified languages, weird "I told you we're dynamic" bugs...this does not really fit with our Enterprise strategy for Sling. With one exception, maybe...due to its inherent type safety, and available enterprise-level tooling, JSP is probably the only scripting language that deserves to stay. As this might be a bit controversial, I'm starting with a [POLL] - the idea would be to remove (or at least deprecate, as a first step) the pluggability of script engines, and keep only the JSP engine. Or maybe just keep a handful of "officially approved" script engines, marked as such with a cryptographically-safe value (based on a secret key shared by Sling PMC members only) in their manifest file. People can then move their code to Java servlets and maybe some JSP, enjoying the reduced number of bugs along the way. Or request their favorite scripting language to be validated, but we'd then need to define a test suite to verify our enterprise-level requirements for languages besides JSP. If we disagree on this (I hope we don't), we might envision two variants of Sling: the Enterprise version with no scripting (except JSP and validated engines, as indicated), and the shoot-yourself-in-the-foot version with no restrictions. And re-evaluate in a year from now. We might want to make a decision on this *before* our next release, to avoid having to deprecate stuff right after it. But right now this is just a [POLL] to gather opinions. WDYT? -Bertrand
