>The Security Manager was not so hard to maintain it merited a removal without replacement.
It sounds like the OpenJDK folk disagree with you, though. From the JEP:
>The Security Manager has not been the primary means of securing client-side Java code for many years, it has rarely been used to secure server-side code, and it is costly to maintain
>...Improve the maintainability of hundreds of JDK classes that currently delegate resource-access decisions to the Security Manager.
>The OpenJDK Core Libraries Group devotes significant time and energy to reviewing every change to any of these methods. Every new API must be designed, and its implementation carefully audited, with the least-privilege model in mind. However, only a tiny number of applications actually enable the Security Manager.
This seems like a big win in terms of maintainability of the core libraries.
This work is destructive for no reason.
But I am curious how classloaders will work now!?