5 ms·

This doesn't refute the point you're replying to, you're essentially saying "Nuh uh it's the best" Too many knobs and dials can be a big problem, and verifying

This doesn't refute the point you're replying to, you're essentially saying "Nuh uh it's the best" Too many knobs and dials can be a big problem, and verifying you have everything set up optimally for production is tough with all that configuration present.

abiox 9y ago
> Too many knobs and dials can be a big problem, and verifying you have everything set up optimally for production is tough with all that configuration present. this seems like a tautology. too many knobs is too many.
- thaumasiotes 9y ago
  "Too many" of something is bad by definition, but it's not a "big problem" by definition.
- seandougall 9y ago
  I don't think it's a stretch to read the comment as "Java EE has too many knobs and dials", which is very much not a tautology. (Whether it's true or not is another matter, and not a point I'm qualified to argue)
w4tson 9y ago
"general problem of Java EE style architecture." What style is that? The style of composing persistence technology, Authentication and Authorization, dependency injection, messaging, web communication etc to make a business application? If you know of a magical tech that doesn't aim to solve these problems in a standardized modular way so that the developer isn't socket programming from the ground up then please chip in. "There are many moving pieces and many permutations of how they interact together." Agreed. The problem space isn't todo apps or "Hotdog/No hotdog". "It's practically impossible to understand it in its entirety, and thus impossible to guarantee that it's secure." I don't understand the finer points of the myriad of TLS cypher suites etc, probably means I can't guarantee that they're secure. But what other option do I have? roll my own? Nope I'll take sensible defaults and twiddle the knobs where the client's requirements demand something different. "You're basically plugging holes as you find them, but you're never sure that there aren't more holes you don't know about." - this is FUD.
- yogthos 9y ago
  The JEE stack is a monolith with many deeply intertwined components. The alternative is having a stack composed of small focused libraries that can be composed to fit the needs of the particular application. I'm not talking about understanding the finer points of the internals such as the implementation of the TLS cypher. I'm talking about the complexity of how different moving pieces fit together in the stack. This isn't FUD, it's the reality and it causes security breaches all the time in the real world.

abiox 9y ago

> Too many knobs and dials can be a big problem, and verifying you have everything set up optimally for production is tough with all that configuration present. this seems like a tautology. too many knobs is too many.

thaumasiotes 9y ago
"Too many" of something is bad by definition, but it's not a "big problem" by definition.
seandougall 9y ago
I don't think it's a stretch to read the comment as "Java EE has too many knobs and dials", which is very much not a tautology. (Whether it's true or not is another matter, and not a point I'm qualified to argue)

w4tson 9y ago

"general problem of Java EE style architecture." What style is that? The style of composing persistence technology, Authentication and Authorization, dependency injection, messaging, web communication etc to make a business application? If you know of a magical tech that doesn't aim to solve these problems in a standardized modular way so that the developer isn't socket programming from the ground up then please chip in. "There are many moving pieces and many permutations of how they interact together." Agreed. The problem space isn't todo apps or "Hotdog/No hotdog". "It's practically impossible to understand it in its entirety, and thus impossible to guarantee that it's secure." I don't understand the finer points of the myriad of TLS cypher suites etc, probably means I can't guarantee that they're secure. But what other option do I have? roll my own? Nope I'll take sensible defaults and twiddle the knobs where the client's requirements demand something different. "You're basically plugging holes as you find them, but you're never sure that there aren't more holes you don't know about." - this is FUD.

yogthos 9y ago
The JEE stack is a monolith with many deeply intertwined components. The alternative is having a stack composed of small focused libraries that can be composed to fit the needs of the particular application. I'm not talking about understanding the finer points of the internals such as the implementation of the TLS cypher. I'm talking about the complexity of how different moving pieces fit together in the stack. This isn't FUD, it's the reality and it causes security breaches all the time in the real world.