3 ms·

That would also kill RMI (at least JRMP), and that too would be a good thing, RMI doesn't even pass through a router (unless you do RMI-IIOP - and that is very

That would also kill RMI (at least JRMP), and that too would be a good thing, RMI doesn't even pass through a router (unless you do RMI-IIOP - and that is very different from regular RMI - JRMP) For java backwards compatibility used to be very important, so this is big news for the platform. I think this remoting the bytecode with serialisation madness was once upon a time very important part of RMI/serialisation - back in the thin client java days this was supposed to be the way to distribute code across a network link, security was not the very first priority in the nineties (beats me why they made JRMP non routable)

MichaelMoser123 8y ago
Does not pass through firewall/NAT to be more specific
fs111 8y ago
JMX uses RMI underneath, so that would have to be fixed first before they can remove RMI
- parasubvert 8y ago
  JMX protocols are pluggable, so this likely will be doable. The main issue will be updating all the ancient servers running Java < v7.
parasubvert 8y ago
If you mean that JRMP leaks internal IP addresses in the protocol itself for callbacks and thus can't be NATted, that can be fixed with a couple properties to force the use of outer-IP DNS: java.rmi.server.hostname=myhostname.com java.rmi.server.useLocalHostname=true You also can tunnel JRMP through HTTP - there was a CGI script called java-rmi dating back to the late 1990's that I think was still distributed through Java 8 (!), and also an RMI Servlet Handler which was a bit more robust/performant. Spring also still has the RmiServiceExporter and HttpInvokerServiceExporter. I remember building Java applets and servers that did fixed income quotes & bond trading systems via streamed encrypted serialized Java objects circa 1999-2000. What a security nightmare, but no one knew better. I feel old.
- MichaelMoser123 8y ago
  if i remember correctly then you still you need to open a port in the router so that the server can call back the client - now good luck with persuading anybody to do this kind of insanity.

MichaelMoser123 8y ago

Does not pass through firewall/NAT to be more specific

fs111 8y ago

JMX uses RMI underneath, so that would have to be fixed first before they can remove RMI

parasubvert 8y ago
JMX protocols are pluggable, so this likely will be doable. The main issue will be updating all the ancient servers running Java < v7.

parasubvert 8y ago

If you mean that JRMP leaks internal IP addresses in the protocol itself for callbacks and thus can't be NATted, that can be fixed with a couple properties to force the use of outer-IP DNS: java.rmi.server.hostname=myhostname.com java.rmi.server.useLocalHostname=true You also can tunnel JRMP through HTTP - there was a CGI script called java-rmi dating back to the late 1990's that I think was still distributed through Java 8 (!), and also an RMI Servlet Handler which was a bit more robust/performant. Spring also still has the RmiServiceExporter and HttpInvokerServiceExporter. I remember building Java applets and servers that did fixed income quotes & bond trading systems via streamed encrypted serialized Java objects circa 1999-2000. What a security nightmare, but no one knew better. I feel old.

MichaelMoser123 8y ago
if i remember correctly then you still you need to open a port in the router so that the server can call back the client - now good luck with persuading anybody to do this kind of insanity.