On Mon, 24 Apr 2006, John Taylor wrote:
> > this is a consequence of the Luddite way I [refuse to] set up
> > my desktop, so you may choose not to regard this as a bug.
> >
> JavaWeb start provides the service used to control the browser. If
> you're not launching using JWS then we can't control the browser (Noel -
> could we fallback to the JDIC browser control?). I'm going to change
The vulnerability comes from relying on a browser at all, which
presumably Java can't guarantee exists. I'm not sure, but I'd guess
that JDIC wouldn't work either for my laughably primitive desktop
setup. As I say, you may choose to regard that as my problem.
> > - PlasticHubListener.getMessageRegisteredIds() does not include in
> > the returned list applications which are registered as accept-all
> > (i.e. regustered with an empty list of messages). I'd argue that
> > it should do.
> >
> >
>
> I'd argue the opposite, for practical rather than aesthetic reasons. I
> reckon that the "send me everything" option should only be used by
> applications such as message loggers. You don't really want these
> showing up in the list of applications to which you can, for example,
> send VOTables. I'm prepared to be persuaded that this is an abuse of
> the spec though, and we should handle it differently.
I'm with you part of the way, but...
Logger-type applications will probably implement non-trivial responses
for some of the messages, such as /info/getName or /test/echo, so
it may not be wise to assume they should be excluded from such a list.
Moreover you might actually want to send a VOTable to one of these
loggers for some reason - debugging is one that springs to mind,
but there could be others.
I would argue at least that the result of getMessageRegisteredIds( msgId )
should be the same as the keys of the result of
request( sender, msgId, args ) and friends - it was failure of such an
assertion in one of my unit tests that caused me to notice this.
So I'd maybe accept a ruling that said accept-all listeners didn't
get returned for either of these calls.
On the whole though, I believe that clarity of purpose will be best
served by treating an application which claims to accept all messages
as if it accepts all messages, otherwise documenting what special
cases apply to what situation will get baroque. At the very least
though, if we're going to do it the way you argue above, it must
be explicitly documented so.
Mark
--
Mark Taylor Astronomical Programmer Physics, Bristol University, UK
m.b...@br... +44-117-928-8776 http://www.star.bris.ac.uk/~mbt/
|