spring-boot

Based on [1] it seems like one `management.endpoints.web.exposure.include=*` is enough to expose everything including the heapdump endpoint on the public HTTP API without authentication. It's even there in the docs as an example. Looks like there is a change [2] coming to the `management.endpoint.heapdump.access` default value that would make this harder to expose by accident. Let's look for `env` next... [1] https://docs.spring.io/spring-boot/reference/actuator/endpoi... [2] https://github.com/spring-projects/spring-boot/pull/45624

I'm the original author of the Spring Boot feature for heapdumps: https://github.com/spring-projects/spring-boot/pull/5670. It seems that users commonly misconfigure Spring Boot security or ignore it completely. To improve the situation, I made this PR: https://github.com/spring-projects/spring-boot/pull/45624. When the PR was created in 2016, endpoints were marked as "sensitive" and, for example, the heapdump endpoint would have to be explicitly enabled. However, Spring Boot has evolved over the years, and only the "shutdown" endpoint was made "restricted" in the later solutions. My recent PR will address that weakness in Spring Boot when users misconfigure or ignore security for a Spring Boot app so that heapdumps won't get exposed by default.

Dotnet and java usually have similar libraries for most things, but sometimes it comes down to how different they are or what they support. Let's look at general distributed messaging abstractions. The most modern-featureful one for dotnet I know of is MassTransit: https://masstransit.io/documentation/concepts. You can see it supports a handful of queues and some interesting patterns. Compare this to the list of features in Apache Camel: https://camel.apache.org/components/4.4.x/eips/enterprise-in... Additionally, the _support_ of the libraries for common open-source (and closed-source infra) is usually vastly different: - https://pulsar.apache.org/client-feature-matrix/ - Small features being first party like https://github.com/awslabs/amazon-sqs-java-extended-client-l... vs https://github.com/raol/amazon-sqs-net-extended-client-lib - Mi

> The second point doesn't seem like a positive on the whole, except maybe for the company selling it, in the "there's good money to be made in being part of the problem" sense. No argument there (I don't miss those firm's doc standards). But you can make a lot of money being part of the problem in the business universe. > The comment gives the appearance of being helpful while actually just adding confusion and wasting everyone's time. That's definitely a concern; if the tool doesn't work it doesn't work, potential or no. I think the first comment (https://github.com/spring-projects/spring-boot/pull/39754/fi...) looks helpful, although it is repeating info you can find in the class docs, the fact you have to go to the class docs to find it is an issue. A tool that could on--the-fly generate "Give me context for this function" (and give t

I agree on that example. But contrast with this example: https://github.com/spring-projects/spring-boot/pull/39754/fi... A function named `apply` with no documentation; you have to go up to the class to find the docs. And yes, it's not DRY to repeat the docs, but the fact the tool can pull relevant context into this location is helpful if it could be used as an on-the-fly doc generator (assuming, of course, it gives true output). People (understandably) don't want to repeat themselves but they also can't predict what entrypoint a reader enters their class from. I've definitely bounced off APIs before because something like `apply` isn't doc'd even though it's doc'd in source twenty lines away (because I'm busy; I'm not scanning entire source files on the off chance that the thing I'm looking for is nearby).

Can someone familiar with the Spring Boot codebase confirm if these comments are useful or not? At a glance - and I'm not a java developer - a handful of the comments seem to add some specific context that's not obvious from the code alone: https://github.com/spring-projects/spring-boot/pull/39754/co...

It's weird that some people including you directly attack my competence. As a power user you should have plenty of experience getting something to work that is not properly document, does not work how the documentation promised it to, or has weird problems on top of it. Look at idiotic things like this: https://github.com/spring-projects/spring-boot/issues/33044 Take any similar issue and you'll see a bunch of people who try to find a solution for them because they just aren't repeatable at all. The underlying issue is the auto configuration doing things you can't follow quite properly. It's like it wasn't mean to be understood. Issues like the one I linked above also show me that the spring dev crowd also doesn't understand the ecosystem anymore. The problem is complexity and automagic. /e: this is what I mean in a nutshell https://news.

An interested reader can decide for themselves: https://github.com/spring-projects/spring-boot/tree/main/spr...

> Spring has gotten so bloated. I'd call Spring feature-rich than bloated. You can always shed weight that you don't want to carry. > Plus there's multiple ways of doing the same thing. e.g. JPA, spring-data. That's because there are different ways to solve a problem. Someone may want an ORM-based approach to connect to the database; they can choose spring-data-jpa. Someone may want to use JDBC with a light abstraction on top of it; they can choose spring-data-jdbc. It's all about choices and right tradeoffs and Spring offers plenty of them. > they don't provide easy upgrade paths between majors versions That's not my experience. I've been happily upgrading 2.x.x versions and plan to upgrade to 3.2.x when it is ready. But depending on the codebase, I admit it can be painful. Projects like OpenRewrite[1] might help here. > and they stop

I think too that Spring Boot opt-out autoconfiguration is an issue. Take a look at https://github.com/spring-projects/spring-boot/issues/25742#... I included a workaround allowing to opt-in for autoconfiguration instead of opting out. I have used the filter for more than 2 years without issue.

Correction: found an issue with bean validation. https://github.com/spring-projects/spring-boot/issues/11343

The GitHub flow [1] is to use pull requests for everything. Aside from being a great code review tool, you can execute CI and other checks on them, even making it required for those checks to pass before merging [2]. You can quite easily hook your own checks [3], like the one from the original post or even a check whether the committer signed a CLA (Spring Boot does this [4]). [1] https://guides.github.com/introduction/flow/ [2] https://help.github.com/articles/enabling-required-status-ch... [3] https://developer.github.com/v3/repos/statuses/ [4] https://github.com/spring-projects/spring-boot