Mailing-List: contact dev-help@activemq.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@activemq.apache.org
Received-SPF: pass (nike.apache.org: local policy includes SPF record at
 spf.trusted-forwarder.org)
Content-Type: text/plain; charset=windows-1252
Mime-Version: 1.0 (Mac OS X Mail 7.1 \(1827\))
Subject: Re: ActiveMQ Console - moving toward a solution (starting with
 brainstorming)
From: Daniel Kulp <dkulp@apache.org>
In-Reply-To: <1391527874026-4677405.post@n4.nabble.com>
Date: Tue, 4 Feb 2014 11:08:20 -0500
Content-Transfer-Encoding: quoted-printable
Message-Id: <727C2CE7-39BE-4289-9C84-9F0437C5F982@apache.org>
References: <1391527874026-4677405.post@n4.nabble.com>
To: dev@activemq.apache.org


On Feb 4, 2014, at 10:31 AM, artnaseef <art@artnaseef.com> wrote:

> With the "problem definition" having collected a decent amount of
> information, let's start talking about where we want to be and =
possible ways
> to solve the problems.
>=20
> Before starting, this is "brainstorming".  So please, feel free to =
share any
> ideas without concern for absurdity.  And please be respectful of =
others
> sharing.  That means, provide actionable feedback, or perceptions, of =
the
> content of the idea and try to avoid pure criticism (negative feedback
> that's unactionable) and personal attacks.  We will filter the ideas =
later.
>=20
> First off, I want to argue that the solution to security concerns with =
the
> console, and the rest of ActiveMQ, is to pursue the best practice of =
not
> exposing ActiveMQ to untrusted sources.  So the following guidelines =
for
> ActiveMQ installations follow:
>=20
> * Avoid placing ActiveMQ's web console on the internet, or otherwise =
making
> it accessible to untrusted parties, by placing it behind firewalls and
> requiring internal network access or VPN access to reach the console.
> * Avoid opening ActiveMQ's transports to the internet, or otherwise =
making
> them accessible to untrusted parties to the extent possible, again =
using
> firewalls and network precautions.
> * Where absolutely necessary, using SSL with required =
client-certificates
> can greatly reduce security risks.  Any brokers whose SSL connectors =
are
> accessible to untrusted parties should also incorporate firewall =
protections
> to prevent access to other, non-SSL-secured ports on the same ActiveMQ
> instances.
>=20
> Should we do anything more on this front?

This sounds mostly like documentation things.   That definitely brings =
up the point that the docs at:

http://activemq.apache.org/web-console.html

need some major updates.  I=92d certainly start with removing all the =
references to ActiveMQ 4.  :-)


> For the "buggy" issue - I recommend to start fixing it.  Without any
> evidence that the time and effort to maintain the console is =
significant, it
> seems like this is more an issue of lack of motivation.  I'll start =
working
> on the bugs myself.

I=92m happy to help as well.   I=92ll start by getting the issues Tim =
brought up assigned to the we console component.  =20

Does everyone have access to assign themselves issues in JIRA?  If not, =
let me know and I can help out making sure people can do so.


> For look-and-feel, what makes sense?  I like the idea of a built-in =
console
> that is minimalistic - making it easy to navigate and get specific =
content,
> and having it consistent for everyone to make talking about their
> experiences, especially when reporting problems, straight-forward.  =
Note
> that does not mean I'm against a major change to look-and-feel.  And, =
a nice
> looking UI is awesome to have.  Should we promote the use of =
third-party
> UIs?  If so, how can we do so in a way that is acceptable to everyone? =
 Or,
> should we put in some effort on the built-in console - giving it a =
facelift
> while still keeping to a more streamlined/information-focused than =
something
> like Hawt.io.

I also would prefer a very stream lined ActiveMQ specific interface as =
well.   I=92m certainly OK with just a simple facelift if we fell thats =
needed, but I=92m not even sure that is needed.


--=20
Daniel Kulp
dkulp@apache.org - http://dankulp.com/blog
Talend Community Coder - http://coders.talend.com