Try to compile and run the following:
public class TestT{
  static class T1{
    static void t1Static(){
       System.out.println( "TestT$T1.t1Static" );
    }
  }

  static class T2 extends T1{
    static void t1Static(){
       System.out.println( "TestT$T2.t1Static" );
    }
  }

  public static void main( String[] args ){
    T1 t2 = new T2();
    t2.t1Static();
  }

}

the output is: TestT$T1.t1Static - it is very confusing even in the full accordance with Java spec. Such syntax should be simply deprecated and then removed from Java language. Only syntax like TestT.T1.t1Static() should be allowed.

While evaluating JOSSO ( Java Open Single Sign On ) solution I suddenly realize that servlet security spec( at least 2.3) has a gap and inconsistency.

I am talking about role-ref element in web.xml which is defined for servlet but not for security-constraint.

What I was trying to do: define a mapping from SSO defined role: lets say 'Administrator' to the webapp specific role 'myappadmin'.

I seem to be able to do it for servlet by:
<servlet>
   <servlet-class>xxxx.xxx</servlet-class>
   <servlet-name>xx</servlet-name>
<security-role-ref>
   <role-name>myappadmin</role-name>
   <role-link>Administrator</role-link>
</security-role-ref>
</servlet>

<security-role>
<role-name>Administrator </role-name>
</security-role>

I do not see anything like that for:

<security-constraint>
<web-resource-collection>
<url-pattern>/protected/*</url-pattern>

</web-resource-collection>
..........
</security-constraint>
That does not look consistent.

Really strange support for Applets in Java Web Start, it supports them, almost... it forces them to be applications via Applet Launcher. They cannot be page components with JWS anymore.

<Quote>: The Java Web Start software has support for launching Java Applets. This support provides easy migration of existing code to Java Web Start technology.
An Applet is launched using the applet-desc element instead of the application-desc element. </Quote>

I think that RMI should not have been invented at first place. But if they did introduce it why do not make it at least decent protocol. For example when a RMI interface or DAO declares a collection as a member we have to manually take care and make sure that client sidelibrary has the same collection implementation class as server ( or mess with RMI remote classloader - wish you good luck). Hell, why do not replace an unknown implementation of the collection with a compatible implementation from rt.jar? Look: for examle RMI interface declares Set as a type of return value type. Why the hell client application should be concerned about server side implementation of that Set? If server side developer wants to propagate true collection type to the client he-or-she will declare MySmartSet as a return type.