High-Secure Java Serialization
Talkat JCON Europe 2023 · on Thursday, 2023-06-22· at 10:00· Cinema 7, Im Mediapark 1, 50670 Köln, Germany·
summary
Claims Java built-in serialization causes most platform vulnerabilities and shows a new implementation built from scratch: an open-source Eclipse Serializer (snapshots on Maven Central) that uses no code executed at deserialization, stores only data not metadata, and keeps referential integrity via swizzling preserves referential integrity. It supports custom type handlers and legacy type mapping for class evolution, handles cyclic and deep graphs without stack recursion, claims microsecond‑level performance (100k-object tests beat Java’s format and avoid JSON/XML bloat), and is adopted into a storage engine.
AI-written summary · about
chapters (13)
- 0:00Introduction and legal
- 1:44What is serialization
- 3:51Java serialization risks
- 8:35Limitations of current frameworks
- 13:10Why we built a new serializer
- 14:17Key security and design principles
- 16:05How the serializer works
- 22:07Benefits and API overview
- 24:14Custom type handlers
- 31:25Handling class changes
- 33:13Object graph communication
- 35:39Project status and resources
- 37:24Q&A
related talks
42mEclipse Serializer – Biggest Security Flaw of Java Is Eliminated
38mBuild High-Secure Applications with Eclipse Serializer
41mJava Serialisation: A Modern Fairytale
47mA Modern Fairy Tale: Java Serialization
53mWhy We Hate Java Serialization And What We're Doing About It
45mSerialization & Object Graph Communication
42mSerialization and Object Graph Communication
35mDangerous Serialization