Peter Firmstone on foojay.io - Friends of OpenJDK

JEP 411: Java's Security Model and the Principle of Least Privilege

Thu, 03 Jun 2021 07:47:51 +0000

Java, like most platforms or languages has layers of security, this article intends to look at Java’s Authorization layer, which is unlike in other languages, and to distinguish between two different ways this layer is typically utilized, why one is effective while the other isn’t and investigate why JEP 411 only considers the least effective method and hopefully increase awareness of the Principle of Least Privilege as it’s applied to Java Authorization, improve adoption, encourage people to take advantage of the improved security it provides, as well as prolong its support and possibly even improve it in future.

Why JEP 411 Will Have a Negative Impact on Java Security

Sat, 22 May 2021 07:43:06 +0000

JEP 411 specifies the “deprecation of the Security Manager for removal in a future release. The Security Manager dates from Java 1.0. It has not been the primary means of securing client-side Java code for many years, and it has rarely been used to secure server-side code. To move Java forward, we intend to deprecate the Security Manager for removal in concert with the legacy Applet API (JEP 398).” Below, Peter Firmstone describes how this relates to the principle of least privilege and what the impact of this JEP will be. Agree or disagree, add your comments, or your full articles on this topic are also welcome here on Foojay.