<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Sep 12, 2013 at 9:57 AM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On 9/12/13 9:25 AM, "Marvin S. Addison" <<a href="mailto:marvin.addison@gmail.com">marvin.addison@gmail.com</a>> wrote:<br>
><br>
>Can you say a bit more about why you think setuid is mandatory? That<br>
>doesn't follow from anything in the discussion that I can tell. The<br>
>desire for privileged ports comes to mind as a reason to setuid root,<br>
>but most Java webapp deployments I'm familiar with don't do that for<br>
>security reasons.<br>
<br>
</div>If you don't trust it as a web server, then that means you're running<br>
Apache or something else in front of it, or using firewall tricks or a<br>
load balancer to forward traffic, either of which (to me) defeats the<br>
primary purpose of bundling.<br>
<br>
The people who will benefit most from bundling are the same people who<br>
won't know how to work around it running on port 8080 and will almost<br>
never be load balancing it. The support burden of it not being a plug and<br>
play package would be very large and be entirely about Jetty support,<br>
which is not a burden I'm prepared to take on. It's hard to see how we<br>
could avoid that support role if we're shipping the container ourselves.<br></blockquote><div><br></div><div>I don't see how you're going to get out of the support game for Jetty. If you list Jetty as the only container to which the project supports running the software, and I externally download it & have trouble you're gonna get a question on -users. You have the same problem today with Tomcat. At the very least if you bundle in a specific Jetty version, that limits the scope of questions for configuring Jetty to just that version. A comparison from another project I'm involved in -- Grouper. The grouper project ships a pre-configured Tomcat as part of our installer package. Now, I will grant that Grouper has a smaller install base than shibboleth, but even so, we rarely get any tomcat-specific questions on the -users list.</div>
<div><br></div><div>Dave</div><div><br></div></div>-- <br>David Langenberg<div>Identity & Access Management</div><div>The University of Chicago</div>
</div></div>