Avoid Java Serialization: The Gift That Keeps On Giving
If you need to Deserialize an inputstream yourself, you should use an ObjectsInputStream with restrictions.
foojay is a place for friends of OpenJDK, providing free, reference materials and blogs for daily Java usage.
If you need to Deserialize an inputstream yourself, you should use an ObjectsInputStream with restrictions.

The following four short videos will take you step-by-step through installing, writing, and deploying an application to Payara Server.

I’ve gotten a lot of questions about continuous production profiling. Why to profile in production and why the heck leave it on …
With XML eXternal Entity (XXE) enabled, it is possible to create a malicious XML, and read the content of an arbitrary file on the machine.

Continuing from part 1, to exploit the recording by analyzing it, we have a tool named jfr that ships with the JDK. Let's get started!
The Java SE landscape is strewn with acronyms picked up over the last 25 years. Sometimes those acronyms even mean multiple things!

This presentation by Ondrej Mihalyi at DevOpsCon showcases the strength of combining MicroProfile and an OAuth service.

Tracking the OpenJDK is not an easy feat. It evolves rapidly under a release cycle of a new version every 6 months. Foojay helps out!
Java Flight Recorder is the profiler you can use in production, continuously, it is a feature in the JVM that traces the JVM with events.
with a few changes in our code we can easily solve the problem of having different strategies which using the same keys in our code.