.Net Foundation Design Reviews, 29 May 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: .NET Design Review

Description

00:00:00 - Approved: RequireMethodImplToRemainInEffectAttribute https://github.com/dotnet/runtime/issues/35315#issuecomment-636093159
00:22:27 - Approved: Use of `EditorBrowsableState.Never` leads language service to claim it's gone https://github.com/dotnet/runtime/issues/720#issuecomment-636098716
00:35:08 - Approved: New API: ModuleInitializerAttribute https://github.com/dotnet/runtime/issues/35749#issuecomment-636105051
00:49:19 - Approved: Allow DynamicallyAccessedMembersAttribute on methods https://github.com/dotnet/runtime/issues/36708#issuecomment-636106955
00:53:31 - Approved: PrincipalPermissionAttribute ctor should be obsolete as error https://github.com/dotnet/runtime/issues/36972#issuecomment-636122871
01:25:30 - Approved: Use TimeSpan everywhere we use an int for seconds, milliseconds, and timeouts https://github.com/dotnet/runtime/issues/14336#issuecomment-636135854

A

All right so now we are live and I think we will start with this one here, which David can hopefully give us some more context on this. So we reviewed this last time with Yann wallet, check, I, think and basically the questions that we had was. Why is this thing needed? And why are these samples, because these samples talked about virtual functions and override behavior, but nothing here is really virtual. So it's a bit confusing and what this thing is supposed to solve.

B

Sorry more, oh.

A

Sorry I do not share my screen because that will be useful right. I mean YouTube can see my screen. Okay. Okay, let me just click on this thing here. It is require method in pull that that's the one.

A

See the screen: oh yes,.

C

We can perfect.

C

All right so I'm, just kind of hoping Yann will be able to show up, but he looks to be offline on teams. I hope this internet is in good shape, but I can answer your questions really quickly. So this is a feature that is needed for the Comerica returns feature, but is not exactly the same.

C

So covariant returns has two basic things that happen when you enable when you use the feature, one is that, via a method, imple a record, it's possible to override a method covariantly with a different return type and the other one is.

C

It follows on from that, as a request from the c-sharp team that method impuls have that this sort of method it will has a slightly different behavior than a normal sample medical records, and the way they end up working with normal metals is that they actually you end up, adding having multiple vtable slots and it's possible to join and split various different sets of the vtable slots, and this is in contrast to the desired c-sharp language level feature for a covariant returns.

C

So we came up with this attribute that changes the behavior of how method impulse work. So this is a it's a it's use. This attribute to change the behavior of method, impulse work, oh, and by the way, by the way, with covariant returns, methods can be used to override something covariantly, so the it takes the both features together to get the c-sharp language feature that work, and that's why this is actually the examples are written in terms of sort of void returns to emphasize the idea.

C

This is actually a feature that is technically independent of covariant return. Methanol, behavior but I did add another example in my comment down below of where why this is important.

C

Get right there, and so this is sort of written in pseudo c-sharp ease, because you can't actually write. The idea is well if you had a basic base type that defined a virtual method and you overrode it with on some derive type. We want it to not be possible to override things in the wrong way, which would otherwise work with a name and signature override.

C

So this. So it's about changing the way, overrides work and keeping all of the call maybe meet all of these names and being forced to call the same method each level of a hierarchy.

C

So question one. Does that make sense to everybody as to why there's two different things here? I had.

B

Just one question on it: so the first behavior that you described that can't match what c-sharp wants, because it's already existing and changing it with break is that right? Yes,.

C

We do have there are customers, we use method, able records and rely on the current behavior of how mass equals work so just changing how math animals work is not something that the runtime team was comfortable with doing I.

D

Know it's not exactly related to this attribute, but in the sample you have here. If this was delivered from three different assemblies, the runtime will handle it correctly right in particular, test arrived to could have been built when tests arrived. One was not yet overriding the method and increasing the variance right.

C

I mean yeah. You would have to build this with three different assemblies to get the c-sharp compiler to do something like this, but assuming the presence of multiple assemblies and cross assembly versioning. You could.

E

C

Sort of trouble.

C

So that's what it's for! The next question was about naming and I will admit that I am notoriously terrible. It may be, and I think Fadi is only slightly better, and so we kind of put a name on it. That made sense to us, with the hope that someone who knows about naming could help.

A

Yeah, so basically so can you describe it like? What is the semantics of the attribute when you put it on a method? It basically says first of all like if you try to override something like if you override, basically the the you know. Basically, if you override the one that is like from like three up the hierarchy with the other return type, then that becomes an error.

C

It becomes an error it. What it means is, as you do, the over what the overrides apply to all of the slots at once and keeps them together.

C

If there's us, there's a specific there's, a single spot in the in the description of how this works in the I suspect are about in the runtime implementation of the ACMA spec.

C

It actually I consider documentation, for this does not make it simple to identify the point in the spec which changes and we do need to have to get formal language written up for that, but it makes it so that, when you override the base method, you'll actually also will be overriding the override in test class derived one and then because you are overriding or write the test pass to write one with something that doesn't meet the signature of a test class derived one.

C

Then you would get a type of exception, but what the attribute is actually doing is forcing you both virtual methods.

D

So would it be reasonable to say that the attribute does something like override all compatible input signatures, because where it's just ignoring the return type in signature matching, but.

C

It doesn't actually it's unrelated to the signature matching. It's simply related to the fact that they're, the way of the O that the way the override is expressed via the method in forever, because you don't actually because the attribute isn't actually tied to covariant returns and all this other business.

C

It's actually tied to the way the virtual method is expressed as a.

C

Dot override and using a method able record instead of a name and signature override where you simply have a mark, the method as being virtual but not new slots. So it attempts to.

A

Override something maybe.

C

A

That's obvious to you, but like to me, it's like I to be the V table is just effectively an array of function pointers. So how do you know which ones belong together?.

C

So there are two different entirely independent ways that overrides work for virtual methods in dotnet. One Midway is so there's the rule is if a method is marked as virtual, it has an entry. It goes into the V table.

C

If it is a new slot virtual, it always gets a new entry in the B table, and if it's not a new slot virtual, it will attempt to find an entry which matches exactly my name and signature in a base type and then go into that slot or if it cannot find an exact match. You know in a base type, it will generate a new slot for it and then once a method is you have a method? That is a virtual method.

C

You can you can declare with a method it will record or in il syntax a dot over I keyword that this virtual table slot method should override the veto should replace the V tables. The contents of the vtable slot for another method and that's the method, imple style overriding, and what this attribute allows you to do- is treat that, though, that method it will style of writing as more similar to normal v table overriding, although in the in the context of the runtime, it's not it's not exactly identical, it becomes you still.

C

There are the issue. It's still observable that there are multiple V table entries in some ways, but not in ways that that are directly tied to making function calls it has to do with out over at work.

C

What's what c-sharp operations today or declarations today would generate the latter. Are there any? If you have a class which derives from a class in a different assembly and has a finalizar, you will generate a method imple record to override the finalizer.

C

And there's I believe there's one other circumstances that was described to me unless it's incredibly rare.

C

It can the other scenario. Will you see it more commonly.

C

Visual Basic doesn't do this I think it's thought about doing this handling the case of non because the name and signature is actually case sensitive.

C

There are, there may have been languages that allow case insensitive overrides via a dot over I keyword. I was thinking that VB did that, but I believe actually they simply renamed a method for you to match the base method.

C

So it's that's most commonly. We have seen it in a while obfuscators, which yeah, but there are obscure cases. Yeah existing method info feature is used.

A

So then, when you said like the they treat all the overrides together, then I guess the set is determined by going to particular method and effectively walking the chain right going to the override of the base and then walking its overrides right. So, but a given method will only have a single override why they will not have multiple override keywords and I already I.

C

Can you could have as many as you'd like and there are rules that describe exactly what happens, and this would be just declare this attribute would declare that all the the override keywords at a particular point have some specific behavior, because in practice, while it's technically possible to have multiple thought overrides on a single method, it's incomprehensible.

A

But basically there.

F

A

That this attribute would would basically cover all the overrides in the current method. Plus the chain of the base calls right. They would all be.

G

E

Them as the same and overriding would.

A

Always happen together effectively, so.

D

I assume it's not just name matching that you're not doing that. You're, not splatting over the entirety of a method group for all of its overloads. So there must still be some sort of some sort of compatibility matching or like.

C

D

Is it understanding what to over override.

C

Override be you declare, this is the method that is doing the override, and this is the overridden method and those are described to be an exact name and signature match and the.

G

C

Teacher includes return, types, parameter, types, custom, modifiers name right.

D

But how does this attribute or what's what is the runtime using in concert with this new attribute to know which other slots are also compatible? Oh so.

C

We so for the purpose of the covariant return future.

C

It is simply that a method imple override allows there to be a declare cleared method in a body method which don't have an exact name and signature match. It allows the signature to vary covariantly on return type and nothing else. That's the only variants committed right.

D

So is this attribute doing anything other than allow allow override.

C

With covariant return, it isn't doing, it does not actually change the covariant return behavior all it is not associated with a variant return in terms of its semantics in the runtime. What it's associated with is changing the rules about how method imple slots affected vtable slots affected by method impulse work in further derived types. So in the example here, the attribute would be on a test class derived one dot method and would change the behavior of the overriding that occurs within test class types to.

A

So does the runtime actually care about covariance like basically, the the way understand is that the override behavior is used by C sharp, so that C sharp can tell you yeah override this other thing that has a different return tab because normally overrides are, as you said, signature which means return, type plus mod, a plus mod R, X, plus everything that they have as parameters right, and do you actually validate that the return radio is covariant on type load? Yes,.

C

But yes, it does the I believe mono does not, but the course you learn house.

D

So this attribute being placed on test class derive one's override of method, says that when the runtime loads test class derive to- and it finds a new override that it needs to it, make that both an override for virtual slots, I'm going to say 6, &, 7, sure.

C

D

Loose hand wavy stuff, but that the compatibility, the way that it determines both six and seven is by matching name and sig, except return.

D

Like how does it, how does the runtime know what all slots are affected when.

C

Arrived to exists, and it it's override, you know kicks in. So we have this method which says I'm base type method on /drive to, and it does not if, for instance, it does not have a method, it will override.

C

So it has a normal style override that would follow the existing name and signature rules and say: oh, that should override test class with virtual method method, because that's an exact name and signature match and that override as per normal and then because that over there's also the Dom override that dot override would be applied to make sure that the net test class around to that method also was overriding test class derived one method because of this attribute that we added and then it would do the a signature check of air to verify that this is an acceptable override and then that would fail if, for instance, we, the test class derived one had a was wasn't, was a was signature compatible but not named compatible, and so it was.

C

There therefore implemented via a dot method. It will override. With this attribute, then doing the override of the base type method would actually be permissible and would work and went over.

C

Or both be table slot step for the most derive or basin derived classes.

B

I'm gonna make a bold suggestion here, and that is there are several very smart people on this call being explained. What this feature is eloquently by before most expert in what this feature is: we've been going for 30 minutes and still don't quite understand it. Therefore, no one's gonna care and you can pick whatever name. You want fair enough that.

D

Yeah, so my my concern with the name is: it sounds like it's related to linker trimming with me. Not knowing anything. It sounds like it's don't. This is important, don't throw it away and we've taken a lot of stuff about trimming, and so it felt like it went in that bucket. So it'd be nice for it. If this is describing what it's doing, then it's fine and probably doesn't matter, but.

C

The name preserve based overrides doesn't seem any more wrong than the name. I came up with so.

C

It is what it is so I'm happy to change the name that I, don't think it really matters. The other question that was involved here was: should we use a method if applied honestly, it would be better to use a method attribute flag, except we don't have any doubt aspect. We could put it as a method in blood that would probably be okay. It's not really what Nathan impuls are for, but.

A

Yeah I was just asking because it seems like it's in the same bucket as some of the stuff that is on method input, but, like Yun, didn't seem to like it. So mmm actually it's appealing, we don't have any remaining bits left. So the custom attribute is fine. Yeah.

C

And yeah, nobody better use this thing directly, because they're gonna get in weird trouble, fortunately be hard to actually get that in that situation, because he sure doesn't generate these attributes.

C

A

Makes sense to me so then I would just say: let's go with the I got necessarily as a problem. I I person, just like Chris, replace overrides more because it easier tells me something with the other one. I literally don't understand what the name means. The society's gives me some idea, what the name might mean, but yes also the men that attribute. So nobody really cares that much I guess yeah.

D

I, like that, it has the word override in it, and it's related to overrides in both the C, sharp sense and the method since apparently so. Yeah I would vote for preserve, base overrides and then I'm willing to accept Steve suggestion that I'll never understand it and we should move on I.

A

Think I'm close to understanding what it does is that, even if that's not true that makes me happy enough.

D

Any objections to preserve base overrides attribute.

D

H

Was that a gavel I just heard in the background I.

C

D

I mean no, but you should have heard one in your head. So, okay, it's correct power of suggestion worked. I must.

H

Be delirious and from lack of sleep.

A

You're sitting outside it's possible that you.

I

Are in order that.

A

Your neighbors used one of them. Yes all right, so then next one I'm so I, don't know who marked this blocking. Was that me, because.

F

I don't know Claire.

E

Had emailed me about it,.

H

A

So what exactly? What did claire want us to do with it then.

B

Remove the obsolete, not roots.

D

Well, presumably remove the e-beam ever oh.

B

D

Whatever it was.

H

Yeah, isn't this a Roslin bug yeah.

D

I'd say this is a this: is a vs or Roslin or somebody bug not a like. We.

A

Don't want people.

D

To see this, when writing new code, so.

A

That's the so I had this discussion. I father rosenberg item. I think they resolved it. It won't fix. So they claim it's not a bug the behavior. It works it's designed. So the idea is that what you seen intellisense is a reflection of. Should you use this thing and if any of the platforms marks this thing as editor browsable, never then the language services. Well, then, you shouldn't use it. So we put it, we put a warning icon, we basically treat it as it. It doesn't exist and I basically someone gave up and said fine.

A

If that's what that's a way that you want and then that's what you want. I think we can independently decide that we make these things not editor possible, never which I have said multiple times before- that I'm really not a fan of obsoleting when we obsolete things always apply the tor browser, but never because it you know it's nuanced right. I am pursuing.

J

A

Of saying, like we just remove a little balls whenever and call it a day so.

J

This is only the problem only exists. If you have both the editor, browsable and obsolete, attribute correct it. Doesn't that's not the behavior that you get if you just apply the editor browsable attribute. Yes,.

A

So, to be clear like what does intellisense feature does is so this is the so the what you see is intelligence in a multi targeted project and normally what ends up happening is if the way the language service works, that it runs, intelligence and all projects and then aggregates the result, and if, if a particular memory, nutella sense is only present in one of those, then it shows the warning triangle and so what they basically do is they say.

A

Well, we treat editor browsable as it's not an intelligence, and so they aggregate effectively the outcome of that. So in that sense, it's in distinguishable where the a platform doesn't have it or whether a platform has it but marked it editor balls, but never, but yes, it is super obsolete, seems.

D

Weird that they're merging it based on Intel a sense because, like this will compile I, mean it'll, compile with a warning because it's obsolete but I.

K

D

With that, but.

A

The argument was you.

K

Shouldn't use it, let's, let me show you a warning triangle: fair.

L

J

You shouldn't use it because of the obsolete action, but not because of the editor browsable.

K

No because of editor probable death stare state like if you use, why would you market a bondsman ever that's.

J

Not it's not the behavior that or the meaning of the attribute that existed for you know twenty, maybe not twenty. Fifteen years like we cannot now change what a value.

K

Of an attribute means, so I don't disagree with you on that one, but I think there I think to me: that's a that's an independent decision.

A

Right, so the question is: first: should this be editor balls whenever and then? Regardless of that? Should the ide show up warning triangle in case of editor balls whenever right there like and because of one of them, not the other and so like, if you want to go egg in the middle there's this reference, which is now closed, where I had this argument with an english team and I lost that argument, art.

H

Is there a sufficient number of api's that are marked as both obsolete and editor browsable? Never where we actually care about this. You mean they'd, be care about the fact that.

A

The warning triangle doesn't show up no.

H

I mean like it so here's an example of an API that is marked as editor browsable, never and obsolete, and people are trying to use it in a multi target project. If not all three of those things are true. At the same time, then this is a non-issue, so my question is: in what scenarios are all three of these things true at the same time, and are those scenarios numerous enough for us to care about this issue at all? I, don't think the obsoletes relevant. This is just EP.

D

Never blood at multi.

H

Target sure, even ever in multi target like is it is there? Is there sufficient code base where people are calling api's that are marked as editor browsable? Never within a multi targeted project, I.

J

Did the thing that I worry about is now everybody who designs an API and wants to apply? This attribute needs to think whether that's gonna be a problem or not right, because.

D

Our like our discussion on how to do there our solution for how to do evolving default parameters. Is you take the the one that used to have all the defaults? Remove all the defaults mark, the method editor browsable? Never so it doesn't spoil intellisense and then add a new one with more defaults, yeah.

J

D

On the way that that lines things up, it's gonna give this warning, but like that's, not a, we don't want to leave them all visible because it's a mess, but if they're merging it just based on member name instead of member signature, then that would be fine and then the only problem would be things here like enums, where we can decide we'll leave it obsolete, visible, instead of obsolete hidden, would.

H

You actually use such an API in a multi targeted project, you're.

D

Calling the thing that took or like you're calling a thing you've specified three parameters: the fact that the core compiled binds to one that took seven and the the net standard to compile took one that had six. You don't care, you wrote the same c-sharp and it bound both ways. But.

J

Leave are you asking a question that that's what I was trying to say? Maybe I didn't explain it super. Well. If we accept this, it means that now from now on every time somebody wants to apply this attribute they need to in their head run through all the phases you know. Is it gonna either be using multi multi targeting scenarios? Do we care, like I'm, I, I, really.

G

J

Will lead to you know: Jared calls it like the you know, action that spooky action at the distance. Yes,.

M

J

You need to like consider so many moving parts before you can know what the behavior will be and whether you should be applying this attribute or not, and.

H

We can't get that concerned, but I've I thought that we were telling everyone like use, net standard, going for or just target and that core five specifically like there's no need to multi target anymore.

J

Well, if we remove the feet, multi targeting feature than sure, maybe.

H

You, don't you, don't remove them all high target in feature you just if you have fewer and fewer cases where people are actually doing it, then this just kind of becomes a non-issue just by virtue of the fact that people aren't writing code that runs into it right. So.

A

Let me let me just split this thing so like so, regardless of how the feature works, it seems like we shouldn't mark the savior editor browsable, never an obsolete, because we, the support, is in course LR now so I think, like this particular issue, we can probably resolve let's remove the both of these attributes, because they don't make sense for this particular feature. Independent of that I'm.

A

Totally fine with reopening this issue that that my father gets the rosin guys and say: let's have a conversation again on this behavior, because I agree with Jeremy I'm, not entirely sure how this feature now plays with overload groups, because it seems like when you look at the screenshot there.

G

A

A there's, a squiggly in the IDE for those cases and the example Jeremy cited- is perfectly fine right. The only reason we apply editor browsable is to just remove visual clutter, and if that results in you know, different visual clutter, yeah well, basically folds warnings, then it defeats the point. But now we basically just yeah. As you said, we change one clutter against another clutter which gives the user the wrong impression. So yeah.

G

The squiggly absolutely.

A

Should and that's I think a problem so don't know whether discreetly is there, because I Andrew is having some other. You know and lesser that runs that does the same kind of thing over that that's actually done by the idea already, because I think the warning triangle only appears in intellisense. It's still bad, but that's nowhere near as bad as it's clearly would be.

A

So like. Ok, let me do this. Let me just go into the issue again and let's, let's open this again and let's just say, okay, we would like to have a conversation on this and therefore larger group of people, maybe, instead of just me and Cyrus, and then.

N

Oopsie-Doopsie.

H

Sure so so it sounds like a we're saying. The the warning triangle is okay, but this quickly is unacceptable because the thing will compile just fine, that's Mannion, maybe yeah, and maybe there's a more different color squiggly because it is obsolete. You still need to suppress up.

D

D

The suggested edit that you have on the attributes emo is to remove the obsolete, but presumably the runtime team is the one who put the obsolete there and they did it with intent. I, don't I, don't know that we would remove the obsolete. That was an intentional obsolete just to make an experience better. If you know if it was intentful so.

A

I agree with that, but, like that's I had this conversation with the runtime team I'd see if you scroll up here, there's a basis that actually scroll down apparently so there's I said I'll be ok with these changes in because he said like originally, they were marked this way because we didn't have the support, but since three, oh, we have that support so that they are no longer valid. So we should just literally remove them and make them full-blown api's. So.

D

This isn't functionality we plan on taking away. This is functionality we lacked and have since added correct.

A

That's my understanding.

D

A

What they said, that's why I said I think for this issue. We.

D

A

Just remove these attributes and I think that's the correct call for this feature, but ok, I'm still concerned about the behavior.

A

Like a transition about this behavior, because in inter browsers will never API isn't meant to indicate won't work, all.

H

Right yeah because we can fix it, you're true for dotnet five, that we can't fix it for other targets where it's already been obsolete. Right.

N

A

All right so then, let's just say that is to change. You would like to make so.

M

A

Guess that's good enough.

A

All right so now we walk the tail.

A

So I don't know who marked this I guess it's! The audio did I think one pass one of the markers at that point.

D

F

F

But it almost stones like that.

A

Massive needs, work and then.

F

Okay, so what has changed.

A

Delete a single, a sinks and a sink on a client.

D

And something that looks a lot like the what we call it: options: bag from the new system, net API.

A

A

Yeah so last time they basically proposed to type derive from message handler.

A

Webassembly HTTP handler, then there's a new request. Caching, you request potentials in a new request mode enum and now what they're proposing is very different from that they're busy saying we have three new methods that take request: options.

A

And supposedly request options is new.

A

So my leader reaction is was an interface. Why is it not a base side and yeah other.

K

Than that I think I can live. That.

J

It's not only why it's an interface and a base type. Why do we need an abstraction for for this? Do we is there a more implementations than just HTTP request options of this abstraction.

H

This looks like it's following the typical asp net, like I HTTP feature pattern which we tend not to use in the VCO.

A

So what does this extension residue get from? Jason async is basically just I guess we already have that right. Yeah assume they're.

E

D

Padding the options as a thing to pass him yeah.

A

And then on the request message, we just add the request options and that's where the that's where the interface comes in, but the I agree with Chris, so that seems maybe could might as very exposed HTP request options there right.

D

Well because, essentially, it looks like by by exposing it as the interface I think they're, assuming no one will ever cast it and therefore that now they've exposed a read-only model instead of a readwrite model.

I

M

Design point David: Correy could look at this base in the components I. Don't.

A

Think anybody has look.

M

At it, since they changed.

O

L

Get by all from David Correy.

D

Before we go, Evans yeah come on I'm. One of my biggest pieces of feedback is that it looks like a feature that it was very similar to the feature they're trying to do for connections and that we should only figure out what we want that to look like once. Yeah.

B

B

The property back yeah, you know whatever else property magnet.

D

Is what we call yes, thank you Steve.

A

So let me do this, then let me move to somebody to review to API suggestion and then say.

F

Please, market API, ready.

K

J

Another thing that I think would be good to add is we need somebody from the team who has this added that proposal in the next review? I, don't you know like even if the networking team kind of looks at it and says reasonable, it would be good to have a person who understands why the design is done. The way it's done.

H

Do we have anyone from the language team here.

A

H

Basically, what they're proposing is an API to allow a method to be marked as a module initializer if you're not familiar with that concept. A module initializer is code that runs before any other code in the dol runs. So the idea is, it runs before type initializers static, initializers things like that. It's normally used at least we've actually used it in the past, with an ASP net to do things like capability checking and kill the checking I.

H

Imagine it could also be useful for things like loading, your own dependencies, but they've they've listed other things here. To be honest, I, don't know why we need an API for it, since it is something that's entirely, an implementation detail of the compiler itself, but sure.

D

Presumably it's they need to know which method you wanted to have that role.

A

D

F

A

Don't want language syntax right, they just want to say use.

F

The Assemblies at the attribute syntax to express net like.

H

I I guess my question was I I, don't know why they can't just fabricate one on the fly if they see module initializer in brackets, but Sobia well,.

A

That's not you.

B

What do you mean modular initializer? In brackets? Oh, you mean like a fake. They, they see something called initializer that looks like an attribute. It doesn't actually require it to exist. Yeah.

H

And then they just say: oh, this is a module initializer and omit the correct il like I. Don't know why they need an actual honest-to-god attribute for that, but because.

D

Now you'd have to decide if somebody does have a thing called module, initializer attribute did it bind to both or the declared one does that change the semantics meat like that sounds like a nightmare.

A

Also, intelligence doesn't work right and I. Can you get squigglies in the ide like there.

G

A

There's a I think in general I think it makes sense to say if there is no language syntax, they want the dedicated type so that everything just works. I. Think that to me, the question, though, is source.

H

Generators reformed yeah.

A

I think to me the question is: if it is an attribute that people are expected to apply manually I, don't think we want this thing to be in system, anthem, compiler services, because that's supposed to be the that nobody ever touches, because only the compiler looks there. So if human beings are looking.

H

A

Probably should be in some other namespace.

H

Only very very, very, very few people, like vanishingly few people, are going to apply. This attribute, like more people, are going to apply things like method in pull, and that's already in compiler services.

D

People are supposed to do it like you know, sta thread and thread static and other things that people use that are I mean sta thread, nobody uses it, they just let the template generator, put it there for them, but the those are in system. If we think it's rare than maybe interrupt services, it's kind of wrong, but I.

H

Mean it is a compiler specific feature: why would it be in compiler services, because then now they're going to be pulling in the using for all of that tributes that we want them to never ever ever touch, but the dirt I can literally count on both of my hands. Probably the total number of projects in the world which we missus attribute. Oh you're, so totally wrong. Everyone's been abused. The heck out of this know.

D

H

P

It's no no one understands his.

H

P

H

So so let me come back to my earlier point where people already widely used things like methanol today and that wasn't compile or services. So people who wants to change those behaviors are already going in the names neighs.

O

I, don't see that says, causing karma never heard so I mean that I can't ever I. Think if the argument is very few, people are using this.

A

Then putting the compiler service is probably acceptable, but be gently, and just my concern is if many people are using their name space. You know you have this very coordinated space. That is important right, because.

M

The bottom end.

A

To be used to the user code services, it's not really about whether it's a compiler feature, it's more! It's is our. You know our calls to do or usages of these API generated by the compiler or the generated by a human.

H

So this actually literally has no meaning what the runtime will ignore the attribute, if it season the attribute, is interpreted by the compiler to cause it to emit different, il like compiling this muffin right, but.

A

Anything, that's, it doesn't depend on another attribute, so do you have any put them into Diagnostics dog, whatever woods.

L

D

Let's being a sort of things that.

L

Are in smiler services we.

G

Do have the unsafe.

D

Class switch people use and and method in pole and the parent conditional week table also lives in services. So if this is a if this namespace is the namespace, if I really know what what I'm doing, then we we hope because I hope no one uses this feature. I expect every tiny little project is gonna, start abusing it. We're about using I, mean using it and not understanding the consequences, um so maybe to compile our service I guess.

A

That I can get behind it. If you say people are generally speaking the intended today's business for things that the compiler generates the uses is poor or students are generating them, but usually you don't want them to call these api's, which is probably true for on saving us, will be true for method employed as well, then I think it's fully fair to say either the scene goes in there and the six given the world, everyone to you, then to you sustain they can they can find it.

A

M

Me just write this.

A

M

H

Apart the attribute attributes correct for the that's a fun sentence: it should be method.

D

Says that's okay,.

H

Because we're not pretty the run spine itself is not interpreting this attribute, nor are tools like I all Spy. The only entity that ever looks at the attribute list.

A

M

Anything else as units.

B

H

It actually is a really useful feature for people. You know.

O

You say that until you realize everybody's dead, looking because people take locks in this pool.

O

Fortunately, it's cold outside the litter lock. It doesn't.

N

Cover people from having all.

N

A

Yeah this one bully request one-time presences, 12 they've advanced on the Killeen, alright.

M

O

M

This one we need the runtime team, because I could give it quickly, but this is one of those features that is feeling involved so needs want. Our.

E

M

Did I can see.

J

I would say it kind of you know, maybe for the future. The name of this interface is so nice and appealing and I don't know if we want to know it, for you know, call me well.

I

D

Mean in.net almost there, everything is not the.

I

D

Is a cast of objects? Oh yeah, the.

H

Name would definitely by the way this belongs in a prop service is not gonna. Polish persist, like definitely yeah.

A

This is closest Apple to go direction. I.

M

L

M

Feature that said, I think you already know.

A

But that's the same thing. We probably need to actually come on this I I.

D

Mean I think this is we already approved dynamically access members attribute teachers need us to add a new attribute target because.

A

I mean it can't fly any any history on this tonyia rival.

D

Just like the title is allowed on methods and there's a comment right in the two-thirds down on your screen. Now stop that this is that all.

G

They want to do is add a.

D

E

Specifically, methods on the type clasps.

D

Yeah so I proposed the API, a boxed, it looks like we haven't, revealed return, generic parameter, parameter and property, and then you want to oh I.

A

Get it DoDEA fools the actual field in its limits it here, because it's the different issue and the only one have this point thing: yeah.

E

M

It seems totally fine to me, which.

D

It seems if it's.

I

The thing that the feature needs them yeah sure.

O

Yeah this one definitely is no need for discretion. Oh.

H

Man, so this is where in I want to introduce the intentional breaking change to the city full-time. So there are a bunch of cast attributes which are holdovers from the early days a full framework. They control things like I'm allowed to access network I'm allowed to access a file system. So on one of those attributes is called principle. Permission attribute, which says.

G

H

The current thread principle, and if it is this user or number the security group, by their allowable permission, to access this method or deny prevention acts. This is not that these activities are declarative, put them on methods and the runtime enforces them at all method. Entry points in the full framework in dotnet for these attributes have no education whatsoever and then the runtime enforce them. Now.

H

This is a problem, because, when you're reporting your code from full framework to dot neck or if you have these attributes on your methods, you're not going to receive any type of compiler warning or error, and they know up at runtime, meaning they fail open right. We already have. We already have at least one bug report of somebody who was surprised that their code was executing when they believed it should not have executed.

H

My recommendation here is: we kill the ability to specify principle permission attribute on methods in dot at five.

A

H

A

I mean basically so I think the difference from people on the call, because I have used this as well in the past. This is different from normal cast in the sense that normal cast is really about sandboxing. The the process itself versus this one is really used for people as a convenient way to enforce application level security that they have like they have Edmonds and non Edmonds, or they have.

A

You know, call center people on calls and their people, and they want to basically protect their code, and they just rely on the infrastructure to do it for them right and yeah. It's a kind of license.

H

This is actually popular. This is popular to put on methods inside of web services, especially.

G

H

Services that impersonate their their callers- because you can- you can put this attribute on an MVC controller, for instance, and it will control all calls into that controller in full framework.

J

And I I have this so that we go through obsolete as warning and then maybe next release obsolete as error. This seems to be because I understand there are some users who may be. You know, shooting themselves in the foot with this, but there may be others who ported they called and they kind of don't care and suddenly we would break them.

H

J

H

With that is it's it's literally the equivalent of saying in your code. I want to do a check to make sure that this user is some account before executing the method and us ignoring that statement in the car.

J

Yeah I understand yeah I, understand that, but because some of this, so some of this code was written explicitly, somebody said they want that some of it can be kind of accidental left over and nobody cares anymore right and suddenly we just like you know it becomes an error. That seems like something.

K

That we've never done before I think so, let's just this just have two independent discussions on this because I think I.

C

A

Agree with Levi the problem today is you have zero indication that your code I mean because if you test security, then usually what you do is you test that stuff works right and then you may also test that stuff doesn't hurt, but that's usually harder. So people will run the Epson production they work. Fine, except that not everybody connects as everything which is probably not what they wanted and I.

G

A

That I think that I would agree with Levi. That's a problem we should fix and to me honestly putting absolute on. It seems like a reasonable thing to do and honestly even putting it as error. True is also fine in my opinion, because it's a it's it's a compile time error right. You know I'm, actually breaking anybody before all forward. So if people recompile, if people poured their code from don't net framework to donate core, for example, they need to get an error message that tells them like yeah. This stuff doesn't work now.

A

Maybe error is too harsh because you literally break forward progress that people can make, but I'd say the minimo, making it obsolete makes sense to me. Yeah.

H

So I wanted to distinguish just regular oscillation of all of the cast attributes, which I think we should do anyway as warning versus this particular issue, which is that this one very particular member the constructor, should be obsolete as error and again. The reason for that is you, as a developer, went out of your way to specify this, and you should receive a compile-time error. Saying hey like this does not do what you think it does and in fact it's probably going to lead to a security hole in your application right.

D

H

You to address it before you can compile successful.

D

Because you know you mentioned if the being error blocks forward progress, but it doesn't because in this case we're saying commenting out, this line of code has the same effect as if we didn't mark it as obsolete. So the the forward progress. Is you just comment out all those errors which is generally how I get through errors I.

A

Guess that's fair because there's an attribute. It also is fairly easy to comment out. Probably I buy that this does.

P

No warn apply to.

B

Absolution mark de Serre, true no.

A

Unfortunately, not no.

H

You have to address, it is.

P

That true, even if you give it a diagnostic ID.

H

That's my testing show that was the case. Like my testing showed that, if obsolete is error is true, you can't call the API under any circumstance is that reflection needs.

D

H

Reflection, but you can't called you, can't apply an attribute using reflection, which is all this is intended to do so. One of the other proposals, I had here by the way, was um if we don't want to obsolete this constructor as error. One of the other things we could do is remove all of the attribute argit's from this attribute, which is the.

D

H

Well, it means that you could use the attribute programmatically if you wanted to, but you just can't apply to anything yeah.

A

I, don't like that, because I think the benefit of obsolete in the constructor is you know what people are doing and you basically tell them. This won't work versus. If you remove the attribute targets, the compiler gives you a very generic error. Message like this attribute can't be applied or something like this. One will tell you I know what you're trying to do. This ain't work and here's a link, but you can read more well. It doesn't do what you think and that's basically one.

H

Of the other things I said in this proposal is I'm intentionally not not obsolete any other members, because maybe you still want to be able to call get custom, attributes and inspect this thing like I. Whatever that scenario is not dangerous, it's useless, but it's not dangerous.

A

Yeah exactly that case, it's kind of weird, if you literally make the construct an error, because that means people couldn't have a plat it right, I mean you could only get it from.

D

It already CFM's.

H

In previous CFM's, yes right.

B

Programmatics, that would could be pretty the beginning of the method to pulling the place what this does or what it's better to do. Yes, and we would conclude whatever that is in the message or the thing that the message links to right, yeah.

H

Yeah, basically, it's kind of like an argument, a null check at the beginning of your method. You basically say, if thread doc, her and principal dot identity equals equals to something or not equal, something through.

A

Hezbollah is enrolled, yeah.

F

D

A

I mean it's also something where potentially I could imagine. I was doing a coat fixer for it. Just spits out the one line of code I mean that would not be entirely horrible.

P

Is that a better route and on by default, analyzer plus fixer I mean the thing.

A

Is I've I think do mean analyzer versus hoping obsolete is almost indistinguishable because they would do the same thing so they're, so it would be, let's say, obsolete, plus fixer. Well,.

B

You need the analyzer and so we're gonna write the analyzer anyway I'm wondering if yeah.

A

I mean like it so I'm just saying for my resulting user experiences really isn't any any difference. The only difference would be if, if we don't have a code fixer now, when we do the code fixer later then marking it arrow now has the down that people will comment it out. So they will no longer have a target to invoke the code fixer on right, so the value of the fixer will go down if we mark it arrow now.

A

If that makes sense, so.

H

The code fixer is not as straightforward as one would think. The reason for that is, if you want something that is runtime compatible with what this would have done, you have to go through principle permission as a type which I want to obsolete, not as part of this proposal, but eventually and I. Don't think we want a fixer that puts API is it will be obsolete in the near future. In your code to.

B

My concern, which is if we can it's the same, please say when someone should replace this with we're: gonna be yeah.

D

That part of the problem is we.

H

Can we can we.

D

H

We can say what it can be replaced with, but what it can be replaced with is really dependent on your scenario. So, for example, if you're inside of an ASP nut application like you should use the ASP nut attributes rather than programmatic attacks, if you're inside of a wind forms or WPF application, then you should use programmatic trucks instead of an attribute and so on.

D

I

D

Fixer kind of can suggest multiple fixes, yeah.

H

And if you're inside of a library, like god, help you.

A

But that gets to the point right. I think we should I personally believe like having a fixer that is 80%. Correct, is still more available than having no fixer like in the end of the day like you have to be in. One of the fixes to can do is like immediate comment and says like this might not work in all cases, so make sure to read this document over here.

A

But the problem is that people generally don't read guidance, and so, if you just make their code slightly better, then you're still making most code better, because otherwise people will just do a random choice or not. Do anything just comment out the attribute, which is probably not right in most of the cases right so.

H

A

H

Out the attribute at least you're, taking the explicit step to remove something that you believe to be a security truck like once. You start.

L

H

Your code, like that's on you, to understand the consequence of what that commenting out done sure.

A

Like I'm just trying to be pragmatic about like if our goal is to get more people to write, correct code, then if you have an existing app that requires the behavior just commenting. The line is probably not resulting in more correct behavior, it you can say yeah. The onus is on the developer now, because we there's no longer a promise that we have to fulfill, but the net effect is still the same right. So.

D

H

Sorry that since.

D

We have experienced writing analyzers and fixers now, hooray.

D

What about a path where we say right now, we'll let it go error is warning there. Sorry, not error is warning out. Obsolete is warning and if the fixer gets written to replace it with thread dot, current principal dot is enroll thing, because even if it's checking for an exact user name, the user name is in that role at least on Windows like we now have a fixer. We could also add a second fixer to the same problem that is used as the asp.net attribute.

D

If we wanted and then once we have a a thing that somebody can do a apply this fixer for then we can flip it to error. True of no there's no going back now so which it may all.

G

Be the same release, it's.

D

Making sure that we, hedge our, are things that are in disparate repositories. One.

H

Of the things that was mentioned earlier is it's okay. If the fixer is 80% correct, what happens if I'm in the 20% case, where the fixer sees this attribute? I right click say fix. It injects the wrong code into my method and that I deploy into production.

D

Do you change your code? It's on. You know.

H

I did what Microsoft old me to do.

H

Microsoft changed my code. I did not yeah.

D

I mean, like so part of the question like I, don't know what the, because, if principal permission is sealed and it's creating a permission then presume a principal version attribute is creating a permission. Presumably it's creating the principal permission, permission and that that is doing the same thing. The only the only context will do only contextual difference.

D

I can speak would be if or whether or not thread that current principal is there, but that would have Cavs would have had the same problem of if you're, in a mode where the current principal doesn't get said, it'll behave differently, so I I'm, not quite understanding. The scenario where the code we would generate would be wrong. It could be less good than other code, but I don't see where it would be wrong. If there's a bunch of nuance to the principal permission, permission then then sure, but.

H

So I encourage you to take a look at the implementation of principal permission and imagine what it would be to inject that implementation at into the top of every method that has principal permission attribute call it.

B

Isn't that it's not what someone wanted when they applied the attribute.

H

Yes, that file is 300 lines of code.

B

Okay, but they're, not that file is handling all possible cases. The code that's injected and handles one specific case. No, the the.

H

The code that 300 line of code handles the you're right it handles the various different security actions, names roles that might exist, but we would have to do the same thing. What are.

B

The things our would have to do the same thing the code it would generate would handle whatever the specific things that were mentioned in the attribute. So.

H

D

H

20 or 30 lines, encode them well.

D

Two-Thirds of the code in this, in principle permission dot, CS, is Kaz Union and intersect. Yeah yeah.

F

D

That out, it's just the demand method, which is 50 lines of code and doesn't look like it's very clean code.

D

So, yes, it's maybe 20 lines of code, but probably a lot less, because a lot of it's about the state that it managed from its constructor, so I mean 20 lines of code is still high, but I think that we can probably get there and or to throw in the comment that says, like you know, make sure or verify this before deploying and if somebody checks in code that says verify before deploying well, we did warn them with the fixer. I mean it's not great.

D

If, if someone literally does a bulk fix blind commit, then like there's nothing, we could have done to help them anyway.

H

So the so we want the fix for them to accompany this I.

D

I think it has goodness and while I can appreciate that, there's some some nuance trading off my security hat and my my user experience hat I I- think it's better to have it than not.

H

Okay, somebody is.

A

That noise unrelated.

A

H

The gavel of applause: it's.

D

My hand who's bored, so it started drumming on my leg. It.

H

Needs to be so is there? Is there push back against obsoleting as error and having a fixer in the same release, assuming we can do them both I.

A

Think in the same release is fine. Like I said like to me, the only concern is, if you split them apart then making it an error, will make the fix, I guess less useful, but we do the same release. It's fine. Where would such a fixer live? It would go in with the other fixers in the rosin and lasses people, okay, and it would ship of the donate five SDK right and we would it's so much what Stephen said, but if we do obsolete them is obviously always on.

A

If it's the chasm analyzer, then we would turn it always on, and then the fixer would also always be on.

G

A

I mean the fixer is effectively like if you have code, while it suggested so.

J

Levi one question: how many customers do you know that like ran into this issue like? Is it a very big problem, or you heard from one customer that they were surprised.

H

So there there is, there are two customers that I've heard of that encountered problems when they were migrating their stuff on the.net, core I know that using this attribute is very, very common in asp.net applications, especially people who have customized SharePoint components.

H

If you are migrating, those applications onto asp net core you're, probably going to run into problems, one one thing that I think will bite people is that this attribute might be in their libraries that they're using and when they're migrating those libraries to run on down back or even though those libraries are consumed by asp net applications that they're going to encounter at the incorrect behavior at that point.

H

But this won't help that yeah, it I mean if you recompile it'll help or if you attempt to open the project at all in Visual, Studio it'll help as long as you target the correct version of done that core. If.

D

You mean libraries, they they wrote themselves that they're migrating sure. But yes,.

H

They wrote themselves.

D

In dependency, libraries, which means that it's only when the dependency actually updates, no.

H

In any any such library generally, you would write yourself and share between your client and your server code, but the library is part of that cohesive application set like the dependencies generally. Don't include this attribute. It doesn't make sense just as.

B

One point of reference: I realize it's not a complete picture. Api's of dotnet shows this prince principal prudish, naturally being used by 0.2% yeah.

A

I was just looking at the two.

B

A

Levis point.

O

It down really yeah.

A

We don't really have coverage for web sites right because API poor telemetry is mostly desktop. Apps.

B

Complete picture but yeah, it is ya, know and.

H

It's a good data point to like it's generally. You would really only see this when you're reporting your app itself. Libraries I'm, pretty confident we're not going to break libraries here. I.

I

Don't people run API over applications, no yeah.

A

But the problem is that if you have an existing web forms app like the the the API port works over binaries right, it doesn't and usually don't have binaries for web sites in many cases. So that's why I think the vast majority of API poor data is is effectively desktop, apps console apps and libraries, so it has a very heavy bias towards that.

A

So yeah I would I would agree with Levi like I mean to me that I mean based on anecdotal evidence. I think this thing at some point used to be fairly popular people used to shoot out of this, because it was convenient to do broad-based security any of EPs, it's kind of weird to do it on the client I've seen it too, but you know, as the data suggests, it's not very popular in client. My.

H

Slits, sometimes in Windows services, but not out commonly yeah.

A

I guess I think most of the time like the the the fact that it's not used by libraries also gives me hope, because to your earlier point right and libraries- god help you, but we don't have a replacement for it, but it will also be very weird to ship, a library that has dedicated users and roles, so seems fine.

A

I mean one of the options we have is we can we can do the the more you know, cool, walk. One thing we can just say: well how about we just don't make it an arrow. We just make it a warning and don't shoot the fixer and then see how many people actually complain, because.

G

They could well.

A

Because, then, you can say like we can dilute the fixer later, but we told.

D

People that this.

A

Stuff will not work, I mean.

D

As soon as we mark, it is warning where this one probably requires a dedicated page, if not added so probably a dedicated diagnostic ID, and then the page is gonna say if you had code like this, then write code like this and now it's copy paste instead of a fixer. So there's not the difference. Is we made someone do more work. So if we're just, if we're trying to measure how much screaming people do then sure well,.

J

I think also a guide would avoid the problem that somebody just write, clicks and says fix it for me, and then it does something wrong if there is a risk of it. If it's a guide like how-to guide, I think the how-to guide can say you know if this is your case. This is what you do. If this is your case, oh, do you do something slightly different and by the way there are some other unusual cases you on your own, okay, whereas fixer can I cannot do that. I.

A

J

A

Would just degree of Jeremy, though like Timothy, so when we say there could be a page, we will basically I think in practice. You will not spend a lot of time. Writing that page right, if you're, not willing to by the end lines that we're also not very willing to write that page. In my opinion and if you're very willing to write the page, then we probably also very willing to about the analyzer right. So that's that's why I said the two media compromise would be we just mark. We just put a string there.

A

We may even give the diagnostic ID for good measure, but because that's very cheap for us to do and then, if you have people complain, we may add the page and if enough people complain, we do the rest as well. Right, that's I mean.

H

We should add the page anyway, honestly, like we need to talk about the same yeah.

A

If you feel that strongly, then, let's just let's just do the analyzer then as well, but.

J

Analyzer the issue is not just what this is not just work. Its reliability, analyzer needs to be hundred percent, reliable and page doesn't have to be. Why.

A

Would it have to be hundred percent reliable, the.

H

Page, we don't want to write the wrong thing into your code.

J

A

But, like house is different from 99% of court fixes that the idea already gives you today. None of them are a hundred percent. They are all like I give you some code to start with, but you may have to tweak it right. I mean if you.

J

Exposes you to security, yeah.

H

Like if, if I'm returning the wrong exception message, I don't really care if I'm allowing a non admin to access. My admin portal, I, guess sure.

A

Like you so I guess, the designer would have to draw in the center's that you're not more permissive right. But if you like, if you call the wrong API and you say like, if not is in role throw, then the problem that you probably have is that the thing will throw more often than it probably should have. But you probably don't have this problem that it will throw less often right and so that.

H

Seems to be like a reasonable.

A

Starting point as well do.

H

We have precedent for a fixer saying: I, don't really know what you're doing you have to go. Read this page. Instead, what.

A

Jeremy said you just offer multiple things with.

H

Sorry say that again.

B

There's none offered well.

D

P

D

For the analyzer well,.

A

All you just have to.

D

A

A option B option C to your show, fixer a B and C, and let the user pick which one to invoke right I get there multiple.

H

Options, that's the soft.

A

H

Yeah, but if we, if we write the analyzer to handle all my cases, that were pretty confident that we can get correct, then my my concern level goes down quite about.

A

H

A

You could just say, look at the attribute and say: oh they use this one. So this is the line of code we published in the mid yeah.

N

D

The analyzer is easy. You use the principle permission attribute yeah, the fixer is Oh. What one.

N

D

Option is inject thread current principal that is enroll another another fixer would be to replace the one attribute with the asp.net attribute and etc, and multiple fixers for the same problem is something that the system handles, and somebody would.

G

Have the option.

D

Of picking go apply the use the asp.net attribute to every violation of this in this, whatever they go up to document.

A

Project solution and so project always.

D

A

H

Okay, yeah I feel a lot better about that. Then, as long as as long as we would be able to target the fixer two things that we're confident that we can generate the correct go for yeah, yeah and.

I

H

Everything else like read the docs.

D

Okay, which will have to once, we have the analyzer, we have to have the documentation for the analyzer and then we'll just we could use the same diagnostic ID for both maybe read, maybe weird, to have both the straight compiled for obsolete and the analyzer to produce the same ID, but it should be fine.

D

Maybe the trigger off of the compile error I mean.

A

D

It needs the rest of the agnostic. State are.

A

There any other attributes you would apply this to, because I think the value will go up if you apply multiple attributes and so multiple obsolete attributes on different eyes, because then you can tie them all together. This.

H

This is the only one that's causing active harm to the ecosystem. All of the other cast attributes are no ops, so I don't really care. In that case, I.

A

Don't care, then, let's just go with the normal.

D

Big yeah, the big sweeping statement that we made with with Kaz is like that we made deny fail because we weren't gonna, make it work. So all the all the Cavs permissions throw on deny yeah well.

H

Not the attributes only the permissions, the attributes can never throw because there's no code running so.

I

H

Could roll into as part of this security action, don't deny should be obsolete? Is error as well? I.

D

Mean seems fine, it's it's throw everywhere in core, but the the this one is a because it it's implicitly a deny is the problem, and- and so this one I I, don't know that there are any other because I don't I intentionally, don't know anything about Cavs, so I don't know if there are others that are in the same bucket of this looks like it's testing for a thing that would always be there, because we said that everything's always there, but but this is external to the runtime, so we couldn't actually prove it.

D

Was there I hope it's the only one, but if there is anything else, then we should get it in the same release. It's.

H

The only one I'm aware of but you're that's a good point. I'm.

H

There are the the other things that would go along the lines of what you just said is if, and as you said whenever, whenever you have a a programmatic permission and then you called deny, like you said we throw at that point, but we don't throw in the attributes themselves because again no codes running what we could do as part of this is we could have an analyzer that says: hey. You have a cast attribute here. That also has security action. Dot deny passed into it.

H

That attribute is not going to be honored by the core runtime. You must fix us in your code.

H

And there's no fixer there, because there's literally no way to do what you were trying to accomplish.

H

D

H

Literally is removed the attribute yeah.

D

Having an analyzer that says that produces a diagnostic, if you use any code access security attribute that use a security action, deny seems legit because it won't work, yeah or whatever. The right words are for that. I.

A

Think that would also.

G

A

Problems right or security concerns because you tell people that it won't work and then I think there's.

H

No fixer at that point no.

A

The fixer is just react attack. You should I mean down the line. Kath yeah.

H

So how about the Sun? Let me let me open up a separate issue to track creating an analyzer for that, potentially with an observation of security, action, dot deny and maybe whatever else needs to be in there okay I mean honestly, we should obsolete, is warning, quite literally, every single type in the security permissions namespace like we should do that. We should obsolete as error. This thing that we were considering as part of this issue, plus a few other things.

A

And the thing of era is, we just have to keep in mind? We can't suppress it, but everything everything else we can be variable, but the error ones. We have to be very deliberate, which ones we tackle.

D

A

D

Can't quote: suppress it by you know, making a conditional compile, but.

J

Just to make my position clear, I, just yeah would do it in stages like first as warning. Let people you know like give them one release. Maybe even one dot released to prepare and then say it's God. You know you didn't read the warnings too bad immediately obsoleting, as error seems like geez such a. You know, strong hammer, yeah.

D

But I mean if we did it for assuming our current plan still holds, and five is not LTS, but six is LTS, making it warning in five and error and six to some, probably bigger than 50% of our user base. That's the same as we made it error in the first release, yeah.

H

A

H

Why I do understand their concern there? Well, that's the the the reason I wanted two special cases so is because, like this, this is so egregiously bad. If it's seen in your code, you must take immediate action to address it.

A

So then, to summarize so for this issue, so basically we are happy with the observations, energy. We are also happy with making it an error. We should also provide a fixer with the potential suggestions either apply. It spin echo attributes using the threads principle whatever, and we should also consider generic analyzer that, once on security, action did not use such across all attributes or anything else.

H

Obsolete as warning everything in security permissions, but maybe that's the separate thing, yeah.

A

That I would check out separately. Yeah I definitely agree with that statement, though alright, then let me just approve this here as it is so we haven't talked about it. Smoking somewhere. You haven't really talked about what the message will be, but I guess that's not something we need to review here. Cuz, that's just where it's smoothing yeah.

F

A

H

You would just say like hey this: this doesn't actually deny and.net Corsi this URL for more information, yeah.

A

Actually, let me just add at least this one, because they're pretty sure we want to have an attribute there right.

F

H

D

And then, if it, my, my quick gut check says that if, if, if everything just works, if we use the same diagnostic ID in the obsolete error here and the the analyzer that has to exist in order to trigger the fixer, then we should do that.

H

So, are we using the better off solution mechanism here to give it a different diagnostic, ID, honestly like if the only.

F

Attribute you use it.

A

Is one I'm fine, with only giving it a URL and URL is already part of the new thing right? You couldn't give a URL before it would have to.

D

Be for making if we're making a fixer, that means we have an analyzer, and that means we have a diagnostic ID for the analyzer, which means. Why would we? Why would one of them get the generic obsolete and the other one gets the specific obsolete? Sorry.

A

I'm confused by that like, if you have an analyzer, doesn't if you know general, if you have a fixer, doesn't mean you have an analyzer. There are also openings right, I.

D

Think what what.

B

I feel like the.

D

Fixer triggers off the diagnostic ID yeah.

B

What some other diagnostic! It.

D

Doesn't reanalyze the code? It usually ends up having to.

F

Talking I, guess yeah, the more we.

D

Analyze the code to know how to fix it, but it I guess that's it's activated by the diagnostic ID.

H

The diagnostic ID of the obsolete attribute or the diagnostic ID of the analyzer, or they.

A

Just kind of the.

H

D

Principle you clear.

A

D

Diagnostic ID wakes it up yeah.

A

You in principle you could say your fixer fixes the obsolete. You know the generic obsolete diagnostic, but that no means your fixer will get invoked for everything, that's obsolete and you have to always say no I'm, not handing this no I'm not handling this, in which case you're better off just saying this guy gets a diagnostic ID and then you only trigger on that one got it yeah.

D

And if, if the compiler producing a diagnostic from this is enough to wake up a fixer, then we don't need the separate analyzer class I just I, don't know that we've ever thought of that. So I don't know if it will work. It.

F

Could just be two pipelines.

D

In the compiler, sir.

F

What was the question.

D

Whether the obsolete attribute producing a diagnostic will cause it a fixer to run or if we need to redundantly right the analyzer, for it know.

A

It over that was one of the things we discussed with the team, because.

D

A

The same pipeline like and by.

M

A

Also means you should be able to remove an obsolete or make it an analyzer. All right, I mean technically this one Intel is true, because it would only work for sous-chef MVB, but you know the.

F

A

If what, if our rules get more complicated and then we might do that right, we move the obsolete and make an analyzer, and that should have no observable side-effects. Unless.

H

D

H

Preserve the diagnostic ID at that point you.

D

Can clear the analyzer pipeline, you can't clear the that's a very, very, very small difference. All.

A

H

A

H

Makes sense go ahead, yeah.

A

So then, the only thing we should agree on its diagnostic ID, which so we should just come up with some.

H

Pops 1000 no BS 1000.

D

H

Animal X, 1,001 1,002 yeah.

A

So they so my care level is relatively low from aesthetic standpoint. The problem is that we need to be careful that we pick a prefix that only we control right, and that was the discussion area. The language team was well.

A

Some people said all that just used the effects cup model, which is you know, fully qualified names effectively, but that unfortunately, doesn't really work on the user experience because they render the string in plenty places where, if it starts with Microsoft, and the only thing you ever see is Mike and then that's the end of it right so I don't know like let's have a separate meeting on this, because we also have this generic.

A

You know, let's obsolete some stuff thing that I still have to do and I would just once we have ten or fifteen items, I think it's easy for us to just come up with something you know prefix and numbering scheme. For that sure, I propose BCL and then running number, not great, but poly, doable, yeah, alright,.

E

A

Yeah, you have it here, breaking change and then.

A

I'm not sure what that would sex.

K

What's breaking in I.

A

Love breaking differently, but it seems fine I, don't think we do yeah.

D

I think breaking change just means. We need that. We need to write the doc about it in the breaking changes in this release. Document yeah.

H

We need to get resources to write the fix or them, because I guess we just signed ourselves up for work.

H

N

D

The API has approved both aspects are required to go in the same release.

H

I mean I can I can do the observation in relatively short order and get it in, but I don't have either the expertise or the bandwidth to write a fixer.

H

So it might come in in a future preview. I guess yeah yeah previews that are as.

A

H

Not sticklers yeah, if we're not stickler, is that they have to come in in the same preview, then that makes life easier, yeah I, don't think.

D

We care about that, but none of our I don't think any of our analyzers have moved into the pipeline for previews. Yet it's.

H

Not perfect yeah, alright, so then, and we get some bad. What to write the fixer come like December that.

D

Be post release.

D

A

Not an expert in releases, but if you do your work after the release is done, I'm pretty sure it's not making that really all right. So then let's get the next one. Then anybody have contacts in this one.

G

So I prepared this but I, don't think because I updated the labels and everything yeah late last night, I don't think there was time to include David and soar up to the previews meaning. But it's also my first time doing the dotnet reviews.

G

Presentation so I just didn't know. What's.

K

A

G

I wrote down as much as I could, but maybe it's not so.

A

My first question is like is all of this API new, like you, have a list of stuff here like? Is this everything and its new or is there more stuff.

G

A

It's if you has an existing classes and then you have new.

G

And then I have lower down okay.

A

That seems like.

G

A

G

G

A

It's even a girl to one David or drop.

G

A

Then, let's do that needs David, Fowler and.

A

Who I'm sure I spelled incorrectly in my notes, but I.

F

A

Names that Khan can barely spell my own name all right, then, let's just walk the back. Look at this one, so everything that's blocking is now approved. I just looked at the emails, there was some discussion with Maroni that I think we can conclude as well and then we're basically left with just different generic backlog of non blocking issues.

A

No, not this one.

A

Which I can't believe I'm living long enough to see that be actually looking at the backlog?.

D

Yeah I mean for the GC info to pull all my conversation into a stream I think we should go ahead and, just proactively add the GC kind computed property. How do you feel Steve sorry, my dog's writing.

E

Crazy, so I was on mute.

A

Yeah I didn't feel strongly enough like it seems. Useful I also would not like force my hand and say it needs to be done in this release. I guess seems.

D

Like I just think it's weird that we would add get me the memory info of a kind, and we have get me a memory info and you in my own II, can tell what kind it was. No one else can yeah.

A

I mean the computation doesn't seem crazy, but yeah. It's also, probably not what you would consider intuitive and.

D

Having it as a computed, property means that we're responsible for knowing when to update it, instead of be like, oh well, there's now this new kind of there's this new enum value and like you just need to know that when generation is when concurrent is false and this other property returns, true that it meant this other word so right so I would I suggest we add the computed property to me. Oh nice proposal and then I prove that I.

A

Think she didn't file issue for the other things we just followed up on the existing. He should have already approved right so right. That's why I just responded on emailing all right. So then I guess here we go so this.

G

A

News so let's just open three and that's probably all we can ever get to anyways.

A

Father crying vandemeyer so in the year 2015, so we're only five years later. This I think we already kind of do that like we basically try to do time, spend everywhere, but, like I, don't think they've ever done a pass.

A

So when was this marked API ready for review.

F

Sojo market, but whereas the API.

H

Proposal because because you blessed it the API proposal, I guess is everything here in green.

K

H

The one immediate thing that stands out as a problem is granularity might be an issue.

A

H

A

Resolution of the taxman yeah.

H

Because time span itself is good to 100 nanosecond intervals, but the things that it's binding to are probably only good to the second or millisecond level, the best, not a deal-breaker, but something to be aware of I.

D

Mean they can they can decide that they're gonna do instead of truncating cast that they can do the ceiling cast, and so you asked for a millisecond plus 100 nanoseconds. So that's two milliseconds yeah.

H

But now-now that means that we have to do a judgment, call on every single place where this API is being added right.

F

D

Mean yeah for the ones that it's used as input, some of the ones that I think it's.

D

H

D

So the problem with something like regular expression attribute I guess is: are we so? Let's pretend that one wasn't an attribute? Are we trying to keep the properties in sync, because we do we have a guideline like all guidelines and they're people who break it? We have a guideline that says: don't recompute one property based on another, but do we want to say that we want this one to be an exception and they they do keep each other in sync,.

H

I would assume otherwise it wouldn't make sense.

H

D

You feel christophe, I.

J

Weave Levi's I mean we either don't do it or we have to do okay.

D

J

D

Thing I can agree with that as well. Just we just we have a thing that says: don't do it so I'm making sure that we're comfortable with with understanding the the reason behind the rule and ignoring it here by.

J

The way additional issue I'm sure some of you are aware of with time outs as time spans people have a problem. We've seen in usability, studies and I talked to Steve about it. People don't understand how to specify infinite time out, because they are looking for time times found out infinite and it's not there.

J

We didn't add it right. Well, we have. We have a type called the infinite time out. I think if I remember correctly, but nobody finds it here.

H

We have timeout or infinite time span, yeah.

J

And then nobody finds it and you know and they get confused. So that's a bit of an issue and if I remember correctly, we cannot fix it for some reason that I, don't remember the reason I just remember. We cannot add infinite time out to time span or infinite. Oh.

D

J

D

Get at it in five, but we can't add it and like standard no.

J

No I know I, think I, remember the issue. There is already property called infinite on on time span, but it's not what we can use as a infinite timeout and then we didn't want to add a separate property called infinite. Timeout to time span right.

B

There's a there's a timeout in a time span, the request was to add a time, span, infinite and the or infinite timeout, or something like that, and we couldn't come up with a good.

E

I

H

Also because most people would probably pass timespan max value and then wonder why they're getting exceptions.

D

Right so presume, like I, don't know if that means we want to on. Maybe we want to take on the timeout class and add a conversion method that takes time spans and produces the milliseconds where, yes, it sounds obvious, but it would handle timespan that max value goes to timeout that infinite and I mean it's. It's only like four lines of code, but let's put the four lines of code in one place and let everybody use it.

H

Or their particular API is proposed here that our pain points for people places where people have really really wanted timespan for a while I, don't.

A

Think so, I think that the based on the thread as I read it we basis said like this needs to be actionable, so please do a scan over the BCL and propose actually a P is, and this is what reflect Roenick did, and so he basically just said: here's all the things I found and then he bucketed into his things that I think I'm straightforward here, things that are hard and here's things where we have to really think about how to do it. You.

G

A

So these are the things that he thought was easy and then he is very basis, reuse, a bunch of properties, so not sure how to launch of them, and then he said well, this one used the different resolutions so I'm not sure how to do them, and then he also added some markers. Like you know, yeah this should be a div and other stuff. So like it's well, it's.

G

A

It's actionable as we can get it I think if you want to collect more data on what is actually painful to people, maybe but I think there might be more work to just walk the list and call it a day know.

H

The stuff, that's in the front of the list, I think, is actually pretty actionable. Bios advice, I think I saw a call to like system timers taught timer in there somewhere and like stuff like that I, wouldn't we would just say like no more changes to system timers.

A

But yeah yeah I mean I, also keep in mind you. This comment, it's like probably at least a few years old at this point, so I'm sure that might be my eyes. No, but I.

H

Bet the first part is actionable by us. I bet. We could do that. Yeah I mean I. Think.

D

You can there's no cheese in my crackers.

A

Yeah, maybe we can do most of that. The question is, is where that you want right and then also the develop. A value right, like my personal gut feel, is like I.

A

There's nothing wrong. These exercises. Just for my taste, the pay-for-play isn't quite there right. Like you know, brain has a brain, brine race is concerned, but then the question really boils down to like: okay is it's just a few AP? Is you you? You actually hit day-to-day, but we can just do the three AP ice and then we get the maximum bang for the buck because, realistically, like you know, we can always tune up the BC.

A

Alright, considering the amount of AP eyes we have so I would just do them when we stumble over them and then you know fix them one at a time, because realistically we don't have to fix them all right and some of them will be harder and then it's just like. Well, how much time do we spend on some API that maybe nobody ever call sure.

H

It and then make sense of refers to way to go to three of years of that and what four parameters or properties are called time out and taken, isn't and then say like okay, maybe the top 20. These are candidates for changing my usage, because we by you said, go.

H

Intersected with oldest we're getting here and then see what falls out.

M

I'll even go further and say: oh the simple ones that would just do, because if you want to tender to make a dip in other ones, if it's quite a thing can would they say like on.

A

A somebody somebody vodka tackle it.

A

Like one seems to interesting, but also like it's been a mystery, it's a custom to my baby eyes, I.

I

A

Because the application is all problems right, I mean now. Any property is what nobody seconds when Valentine's Day should we could hide one of them by then yeah.

M

Something to accept the fact that you decide about API anyone.

D

Yeah, do you think that, if that we probably should also wish, could consider a static method on.

G

D

Out for turning the time span up max value and.

D

Maybe it gets the opinionated, it uses total milliseconds or stealing of total milliseconds. Instead of a floor of 12, milliseconds and and whatever sort of default policy, we think that we want to build it in so we add that are deferring to millisecond ones. We just say by all time out of that time span two milliseconds.

O

F

About this right, that was it.

J

The other thing is that people just don't find time up. Nobody knows that this type exists, yeah.

D

But I think, if we're going through and we're going to add the same, if time out is zero or it's a time out that infinite time expand or it's time out that max value, then negative, one otherwise is take total milliseconds and take the ceiling of that or take total milliseconds and truncate it like it's a couple of lines of code that we're gonna do in a couple places and at least some what we can flip the utility method. That says this is the this to the policy we're doing anywhere. That's duplicated.

H

Two people right now in a hard coat, the literal negative point at all sites, rather than is entitled because.

H

This is three of you, guys are taken out. Obviously, I.

D

Mean I think that I have used timeout that infinite before just to avoid the magic.

J

Number so what I've seen people do is because, if it's a name to that, you can define it constant they've named, define it constant that is section 8 and then defaults to the constant.

J

So another thing like we cannot make time spawn partly accounts. Correct, that's correct! You give all these features to mobility.

J

I'm saying it because I assume now that is true, this is being we could meet up later. You would make along and then you know it is a long imitator but I think still. It requires lots of tricky features both in the choir and there aren't that many.

H

Yeah I mean just for Wednesday constant. There are, of course, for people who can't see the camera.

D

Has a little syntax can abused it as a cost field. Yes,.

H

Especially, but.

D

The runtime doesn't understand it well,.

H

The one-time costs per kind of funny the runtime doesn't care like you can you can specify, literally whatever you want to do as a cost of runtime? That's yeah it just bit dings stuff into whatever type you need to get represented all.

D

Right so so what.

N

Are we saying forward.

D

This issue that we want to do it with the one or not to do it. My policy, we want to take my case honestly.

A

Like I meant at the point where, then you have an action of what's in here, so we can decide it be, have you prove it and then say it fell into the troop ers and it still the goals and the marking up for grabs I mean in practice. I think it. If the work item here is just should we do it I think the answer is yes very, have guidance as we should do again, so in that sense, I think it's relatively clear how the panel would be.

A

The problem is only that in the particular context of an API. The question is well, you know what is the resolution of the timer and what are the properties, resistant assets right and I think what I would probably prove he is just if there is a method that takes an end and he noble to take sometimes 23 straightforward. Any other pattern like if you have properties, for example, I, would probably just table or even camp and say. Is it really worth it to expose to another property that just admitted.

M

Seconds over the seconds, it seems.

I

M

Works didn't do it at.

I

All I know you're suggesting that any key are that is submitted. That adds an overload of an.

B

Existing API, where these missing API has an engine, has a time span. His blanket approved. Yes,.

A

Unless somebody can point out that there's subtle behavior issues but they're, hoping that maybe I will later they're, probably like. Oh, you have to actually know the implementation studies.

M

A

Thing is, if you take this list here, this is the I see that list right, so I would just say: I would have proved this list here and proven that this is not workable.

A

And then effectively say: I would motherfu these guys here because they seem to be more problematic than they're happening and then for the same.

H

H

And whether the actual behavior, that's being added, what rounds down rounds up, how superior handling has to be on the cases? Yes, I.

D

E

D

Question on that, one just I got fine, but no I'm, just making sure that we've decided that we do think case-by-case evaluate you should have had the time spans handled is better than trying to to do public utility method on.

B

Always be the safest value, the time span, you check it against the bounds and you call them a taste right. Yeah.

D

And so, and okay, so yeah, if we're gonna, do the same thing everywhere. Then I think that the first such PR sort of as the onus of making I'm out died time span two milliseconds.

M

A

For that, but I think that seems to me, like it's very straightforward. Sting of it I would probably get any PP I thought that I would just say. That's the behavior of.

D

You never be like it's a couple special cases and around a decision right.

A

M

D

In it, which is but.

A

It's like about striking either.

O

H

Budgets, it would be easier if we didn't have to make sure that, like ot to use the center less than or equal to you know, every single review like this comes in just like all the help from other water hands. Sure like.

A

H

O

That, if you guys feel something.

A

That they need something API then I've, you've seen between the API to the review decided, which type this guy lives on I'm and I, had to be held, arrested on tiny spenders and seem outrageous to me. Living apart is and then.

D

I was yeah time out, so it links the two together.

O

M

O

Imitation decisions yeah, it.

D

Just means we get to defer the decision came and then just to clarify we're saying that if any of the methods that take up time spent isn't in our virtual we're saying that the overhead should be non virtual and called virtual, because changing virtual, it means is yep. Yes,.

M

A

D

I think it's a thing: I didn't see the word virtual and any of the ones where the time span was proposed as an input, input parameter to a method and that's probably fine I'm. Just like that's the that's the edge case. There is do we copy the virtual keyword or not and I, like the answer being.

H

The only other thing that's, the problem is uh if, if you're delegating to an existing method and using this holder, real the helper, throw an exception, the existing method.

D

That's just that's just API Doc's of what exceptions to the time span throws versus the interims.

H

Maybe maybe the implementation of the unconsenting method doesn't even look at the ant in certain circumstances, so it never pellets to parameter the nail calls it. The parameters validated and most to these ap is the interim.

B

Checks that it's negative water, greater and the timespan one checks that it fits within it, and it's negative one here.

F

M

So we have to find I believe you concluded there. So I think this issue as well.

M

So I just think this group here so this plus.

C

M

Be discussed earlier, which is the whole type of situation.

D

Report was it so now.

I

D

Time span: infinite because we already had Times, writes.

M

The way supposed to Lucy should they Christopher what up whether people can't find it right. This was the proposal that he had and I put another spin on it to say, infinite spinal, so that it's clear that it's long and I would be infinite. They do because it was concerned about the.

A

Same thing with it, because even.

M

A

What effectively it's minus one and it's very specific to the way s wedding time Ellsberg, but it's not infinite time to spend right concept-wise but because, but because it couldn't agree on the shape we didn't.

M

Feel like it was important enough should be open this, or, should we just say I'm not doing this list I'm fine.

A

D

Not doing things.

B

For the issues called.

H

Read information I mean there is still something to the point for earlier, where apparently, this sort of failure for people discovering these discovering the equivalent to time spent on infinite. That's.

O

Fine I think that so is.

B

B

Is negative one yeah yeah yeah.

D

I mean if we, if we did it I, think we'd be exactly where we were on, looks like September 3rd of emo suggested for the time out. Steve says: I, don't love, it I think it's necessary, but it needs to be. If we add it, it needs to be super clear. It's this exact number. It's the same as its time out that infinite time spam, it cetera so I I, don't think we have any data that says if it's changed other than wrapping these new API is.

D

If somebody wants infinite time out, they can't figure out to do with the time span.

O

A

I think that's it. It goes back to like what's worse right, I mean that.

O

Option they have, is you.

A

Know Stephen kind of hinted at this, but having mystery shopper throw out, they have this thing called smart completion. So you could imagine that when you open up an API in your pass in an argument that is mark times been dead, autocomplete suggests time. Outdoor infinite time span right, like that, it's not outrageous right and.

M

I think that's kind of the spirit of what this thing would fix, but it's about to discover everything um and.

O

There's no judge, we really.

H

Shouldn't trust it'll just be nice. If the idea would help people long Spence, it seems like we have evidence of people.

A

But they also don't have enough data to possibly time or do I think it seems also somewhat of a more advanced than I. Am it doesn't strike me as a notion scenario, all right so there? This is what we had and then I was a dedicated review the next week missing for the big three items that we have probably taken our if I get its based on what I just stole from Miriam and then the first will probably gone take more than an hour combines took em all.

A

They say this to me: do with creation to next Tuesday and maybe should be good blocking once right now. Anything else sweep then have a great weekend in the next to next week.

J