Afty

What happens if the origin changes? Suppose I have a passkey for Twitter.com, and now the site is named X.com? Is there some way to migrate the passkey?

That statement about not being a supported Google product is just boilerplate that they make you put on Google open source products. I wouldn’t read much into it. I say this as an ex-Googler who open sourced several projects and had to put that disclaimer on them.

You're getting some flack for this, but I agree with you based on what we've seen with Error Prone. The people who design programming languages are human, and they make mistakes. Unfortunately, if your language becomes successful, it becomes nearly impossible to fix these mistakes while retaining backwards compatibility.

Many of our checks are essentially working around problems with the language or API design. For example, our ForOverride checker (http://errorprone.info/bugpattern/ForOverride) addresses the fact that existing Java visibility modifiers are not expressive enough for some things the Guava team wanted to do. Our HashtableContains checker (http://errorprone.info/bugpattern/HashtableContains) addresses an issue with a poorly-named method in the old Hashtable API, which really should be deprecated but is infeasible given the old code that uses it.

We package a specific revision of javac and use it for Error Prone. Currently this is a ~year old version of javac 9, which means that:

1) You have to execute your compiler on JDK >=8.

2) You cannot target bytecode <= Java 5.

The standard annotation processing APIs don't provide enough information to do the analyses we want to do, so we do hook into javac internals.

It does require a lot of effort to keep up with OpenJDK updates, but that's my team's job, and we have to do the work anyway to keep Error Prone running inside Google. We tie Error Prone to a specific version of javac, which matches the one we are currently using inside Google (https://github.com/google/error-prone-javac), so we don't have to support multiple different internal APIs. We are currently using a version of javac 9 from about a year ago, and we're planning a bump to something close to head maybe in Q1.

Eclipse integration would be a pain but would look a lot like what the Checker Framework does.