RE: [Springframework-developer] Keep Spring Focused

[Ben A. <ben...@ac...>]

Hi all

> Another interesting point is where there might be multiple 
> implementations.
> Take security. From what I've seen, Ben's security stuff is 
> great and has an amazingly high level of documentation. So 
> there's no question it meets Spring's quality criteria, and 
> that it's of interest to many Spring users.
> But it's difficult to say that this should be "the security 
> framework for Spring" because security is such a tricky area. 
> J2EE tried that and it didn't work. So something like this 
> being a sep product makes sense; a one size fits all solution 
> is impossible.

It seems the consensus is to keep the core lean and I agree. 

The related issue is Spring's "marketability" if it lacks an approach to
certain core capabilities. To illustrate, I've found there are four groups
of user expectations towards Spring security:

1. Those who expect Spring core to provide security
2. Those who would like Spring core developers to review/endorse some
external security component(s)
3. Those who just want a maintained, external, compatible security component
(Acegi Security System today)
4. Those who don't need Spring security (maybe they're writing their own or
just don't require security)

The present Spring "component ecosystem" doesn't support the many users in
groups one and two. Those in group three aren't particularly well catered
for either, as there is no central resource where existing AND POTENTIAL
users of Spring can discover related projects. Whilst there are the mailing
lists, many evaluators won't spend the time wading through them - particular
if another framework seems to obviously offer the desired capabilities. This
is disappointing for Spring, as it misses out on potential users who would
have fit into group three (ie not requiring any "official" component, just a
viable one).

I'd respectfully suggest the community develops some sort of
review/endorsement program so that reasonably related components - including
but not limited to security - can receive some form of "official" review. I
respect this takes up the time of community members, but the time invested
is far less than writing something from scratch. If a component is "up to
Spring standard" - with unit test coverage reports, reference documentation,
and JavaDocs - evaluation shouldn't demand copious amounts of time either.
Review does not represent a guarantee, but simply an indication of
reasonable treatment of a particular problem domain.

If evaluation is too much, can we at least have a list of links on the
Spring web site with a disclaimer indicating they have not been reviewed? At
least this would help new users and those evaluating Spring. 

Best regards
Ben