On my mac,I find a proess".vscode/extensions/redhat.java-1.40.0-darwin-arm64/jre/21.0.6-macosx-aarch64/bin/java" connect 104.16.72.101 this is why

[darth-j]

Is this normal？this ip is from cf,Instead of redhat

[rgrunber]

We package a JRE for most supported platforms. This is definitely something we provide for darwin-arm64 : https://github.com/redhat-developer/vscode-java/releases/tag/v1.40.0 .

$ unzip -Z1 ~/Downloads/java-darwin-arm64-1.40.0-476.vsix | grep 'java$'
extension/jre/21.0.6-macosx-aarch64/bin/java

As for the IP address, https://otx.alienvault.com/indicator/ip/104.16.72.101

$ dig +short services.gradle.org
104.16.73.101
104.16.72.101

We do have code that would attempt to download the correct gradle distribution defined by a particular project.

[darth-j]

This behavior should be communicated proactively. When using Lulu on macOS, the domain name for session requests is not displayed; only the IP address is visible. This lack of transparency, without prior notification, may cause users to question the security of the application.think you

[rgrunber]

Yes, but even VS Code itself makes many outbound requests without notifying. The underlying Java process that starts the language server used by vscode-java can make even more outbound requests than the one listed above.

If you have a completely fresh Maven, or Gradle project that has external dependencies, it will make requests to Maven/Gradle services in order to resolve them. That might be a particular Gradle distribution version, Maven plugin/dependency, etc. It may even direct to a mirror of the content. Many of these are defined by the project itself. We do have java.import.maven.offline.enabled & java.import.gradle.offline.enabled to reduce these for those users that want more control but then a project might not build at all unless the dependencies have been cached.

[rgrunber]

Going to close this for now as for most IDE tooling that deal with import/build of managed projects, downloading over the internet is pretty standard. There are options to restrict this as mentioned above (often labeled as offline). I think part of the issue may be that this is calling java from a user-installed location and certain antivirus systems do label this as a possible threat.