Java - Integrity by Default

on YouTube ↗51m

" summary

Java is moving to strong encapsulation so module boundaries really prevent deep reflection and unsafe JNI unless the application explicitly grants permission via a centralized policy. The platform already restricts deep reflection since jdk16 and emits warnings (jdk21+) for agents and FFM, plans to remove most of sun.misc.Unsafe, and uses a per-module enable-native-access flag with an allow/warn/deny rollout. Claim: 99% of the Java 8→9 migration pain came from libraries using internals, and Microsoft attributes ~70% of security bugs to memory unsafety.

AI-written summary · about

" chapters (5)

1. 0:00Start
2. 1:18How Things Have Changed
3. 16:54The Importance of Integrity
4. 25:49Integrity by Default
5. 40:44Q&A

" related talks

• 21mIntegrity by DefaultNicolai Parlog, Ron Pressler · JavaOne 2025
• 46mIntegrity by DefaultRon Pressler · JavaOne 2025
• 41mFrom Cowboy Mode to Careful StewardshipNicolai Parlog, Mark Reinhold · JavaOne 2025
• 42mHidden security features of the JVM - everything you didn’t know and moreSteve Poole · Devoxx France 2023
• 48mHidden Security Features of the JVM - Everything You Didn’t Know and MoreSteve Poole · JCON EUROPE 2024
• 51mPrepare for JDK 9Alan Bateman · Jfokus 2016
• 18mThe Secret History and Tragic Fate of sun.misc.UnsafeMark Reinhold · JVM Language Summit 2015
• 47mJDK 9, 10, and 11: Pitfalls for the UnwarySimon Ritter · Oracle Code One 2018