accumulo-notifications mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Christopher Tubbs (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (ACCUMULO-2432) MAC should have an option for creating it's own ssl certs
Date Thu, 19 Jun 2014 00:03:26 GMT

    [ https://issues.apache.org/jira/browse/ACCUMULO-2432?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14036690#comment-14036690
] 

Christopher Tubbs commented on ACCUMULO-2432:
---------------------------------------------

I understand that you're making a push for convenience, and I can appreciate convenience to
users, but I'm not sure (perhaps I've overlooked it) you've addressed the the point I've been
trying to make... that what you're doing is optimizing the convenience of a test case that
has little value, rather than provide testers with valuable test results.

bq. I have to know what the configuration properties are, I have to generate my SSL bits,
I have to set the proper Property.* variables in the configuration Map (hope those Properties
don't change across versions).

And those things I feel are the bare minimum needed to properly deploy or test the SSL feature
in Accumulo, and therefore have testing value. I don't think these can be short-circuited
or optimized or made more convenient (at least not as described here) without losing critical
value. SSL isn't just a contextless feature... Accumulo doesn't just allow you to "turn on
SSL" and be done with it... the context here is that the Accumulo provides a mechanism to
*configure* secure RPC with SSL. The user still has to do that configuration. We're not doing
them any service or providing any value by automating or obscuring the details of certificate
generation behind the curtain of Accumulo. There are already tools that make that convenient.
Users should be using those tools and interfacing with Accumulo in a way that doesn't sweep
those details under a rug. That's where they are going to get value in testing and in deployment.

I'm sure we can all see that there's a tradeoff here between value and convenience. Personally
(as I've argued) I think we've optimized that tradeoff already and that this proposal actually
loses testing value. Clearly, that's not something we agree on. Rather than pursue the argument
further, I suppose I could wait until there's a patch to consider.

> MAC should have an option for creating it's own ssl certs
> ---------------------------------------------------------
>
>                 Key: ACCUMULO-2432
>                 URL: https://issues.apache.org/jira/browse/ACCUMULO-2432
>             Project: Accumulo
>          Issue Type: Bug
>          Components: mini
>            Reporter: John Vines
>              Labels: newbie
>             Fix For: 1.7.0
>
>
> Currently ssl certs must be generated prior to starting mac, and passed in. We should
find a way to make that as seamless as possible.



--
This message was sent by Atlassian JIRA
(v6.2#6252)

Mime
View raw message