Tom HawtinThomas Hawtin's WeblogUser supplied objects may not behave as expected- November 25, 2006 Apache Harmony had a little security flaw in its implementations of ThreadLocal. A field of Thread mapped ThreadLocals onto their thread-local values. However, it used Object.equalshashCode to determine equality, not ==System.identityHashCode. The problem is that ThreadLocal can be supplied by untrusted code. Some malicious coder may decide it's a great idea to subclass ThreadLocal. Not to override initialValue, but equals and hashCode. Try initialising thread-local values four billion or so...http://www.jroller.com/tackline/entry/user_supplied_objects_may_not Multicore processors can hide bugs- November 24, 2006 It is well known that bug dormant on single-threaded hardware become apparent on multiprocessor, multicore or simultaneous multithreaded systems. What I did not foresee was these systems hiding bugs that appear on simpler machines. With the rise of dual-core and SMT machines amongst developers, these bugs are increasingly likely to be overlooked until customers start to complain. I came across the problem trying to run the GUI of a program that is supposed to find bugs. It appears that: A task.http://www.jroller.com/tackline/entry/multicore_processors_can_hide_bugs Incorrect stack depth for security checks in java.util.concurrent.atomic.- November 19, 2006 Remember Bug 6243400 It's approaching the first anniversary of the Sun Alert Notification for this bug. I think that's time enough to be able to show it. My report is from March of last year and 1.5.0_04 was released just over three months later. Not sure why it has been changed from Bug to RFE. --- Note: you can send us updates about your Incident --- --- by replying to this mail. Place new information --- --- above these lines. Do not include attachments. --- --- Our system ignores...http://www.jroller.com/tackline/entry/incorrect_stack_depth_for_security System.setSecurityManager(null);- November 16, 2006 Google Code Search or a plain old google will find plenty of hits. I find it difficult to imagine what is going through the mind of someone who would write such a thing. System.setSecurityManager(null); removes all Java security from the entire process. Executed as an applet, any other applet running will have full access to the machine. Yay! Sun Java WebStart only runs one application per process, but other JNLP implementations share. It is also not unlikely that the code can be repurposed...http://www.jroller.com/tackline/entry/system_setsecuritymanager_null Sun Alert ID: 102622 and time to disclose- November 15, 2006 The timeline: 9 August 2005 Allude to the security vulnerability in e-mail to security-alertsun.com. 27 December 2005 Noticing that it hasn't been fixed in u6, go into detail and provide example code. 12 August 2006 (according to freshmeat) Patched JRE released (1.5.0 u8). 14 November 2006 Sun Alert ID: 102622 - A Security Vulnerability in the Java Runtime Environment Swing Library may Allow an Untrusted Applet to Access Data in Other Applets Now it's not an Earth-shattering bug....http://www.jroller.com/tackline/entry/sun_alert_id_102622_and A serialisation optimisation for everyone- November 13, 2006 Here's a little optimisation. From a static initialiser, call ObjectStreamClass.lookup on all the classes you are going to serialisedeserialise. Assign the result to a static field. That's it. Reflection only becomes efficient if you keep hold of the artifacts. Keeping hold of ClassLoader produce causes leaks. So, serialisation use a complicated soft reference cache. If we keep hold of the artifact ourselves for the duration they are needed, then the cache will not miss. Reflection objects...http://www.jroller.com/tackline/entry/a_serialisation_optimisation_for_everyone F3: Y- November 12, 2006 F3 is a static-typed scripting language with type inference (in the mold of ML) that has been hitting the Sun weblogs. There is not much to impress so far. You'd think the introduction may start with something really tilted to unusual features of the language. To their credit, the first example isn't something that can't be written in a similar fashion in good old fashioned Java. The example is a (titleless) frame with button. And I thought Matisse was the r0x0rz for this stuff. You really...http://www.jroller.com/tackline/entry/f3_y Serialisation optimisation for experts: Don't do it.- November 9, 2006 JavaLobby recently had a thread about Serialization and performance. Unfortunately the microbenchmark had some serious issues. So I have attempted to correct the issues, but have kept the original scope. This measures serialisation performance of very simple objects, that do not contain references to other objects (other than a String). The version of Pojo that attempted to define serialPersistentFields actually got the name wrong, so was the equivalent of the plain version. Perhaps there...http://www.jroller.com/tackline/entry/serialisation_optimisation_for_experts_don Closure mining: bottom up- November 6, 2006 While closures bring little more to Java than saner syntax, they do make practical different ways of doing things. So I wondered what sort of applications they would have straight in the Java library. It's a bottom up approach. You'd get laughed at if you tried to find patterns this way. But it's much easier to make up idioms this way. Attempting to trawl through some large "typical" source base sounds far too much like work. The categories I noticed: Iteration over structures iteration...http://www.jroller.com/tackline/entry/closure_mining_bottom_up Dynamically loading JDBC drivers- November 1, 2006 Apparently, sometimes it would be useful to be able to load JDBC drivers dynamically. Unfortunately, DriverManager will not allow access to drivers with classes that are not linkable from the calling class loader1. One solution is to hack the application class loader to add extra sources. There is an URLClassLoader.addURL method, but it is protected so no good if you don't have control of construction of the ClassLoader. I think we can do better. Even with a SecurityManager set. The...http://www.jroller.com/tackline/entry/dynamically_loading_jdbc_drivers |