Avoid Java Serialization: The Gift That Keeps On Giving
If you need to Deserialize an inputstream yourself, you should use an ObjectsInputStream with restrictions.
Every article on foojay.io, newest first: OpenJDK, the JVM, Java tooling and the ecosystem around them, written by the Java community.
Brian Vermeer
6,240 viewsIf you need to Deserialize an inputstream yourself, you should use an ObjectsInputStream with restrictions.

Jadon Ortlepp
7,645 viewsThe following four short videos will take you step-by-step through installing, writing, and deploying an application to Payara Server.

Marcus Hirt
7,772 viewsI’ve gotten a lot of questions about continuous production profiling. Why to profile in production and why the heck leave it on …
Brian Vermeer
13,129 viewsWith XML eXternal Entity (XXE) enabled, it is possible to create a malicious XML, and read the content of an arbitrary file on the machine.

Brice Dutheil
4,085 viewsContinuing from part 1, to exploit the recording by analyzing it, we have a tool named jfr that ships with the JDK. Let's get started!
Helen Scott
15,068 viewsThe Java SE landscape is strewn with acronyms picked up over the last 25 years. Sometimes those acronyms even mean multiple things!

Jadon Ortlepp
3,110 viewsThis presentation by Ondrej Mihalyi at DevOpsCon showcases the strength of combining MicroProfile and an OAuth service.

Geertjan Wielenga
3,254 viewsTracking the OpenJDK is not an easy feat. It evolves rapidly under a release cycle of a new version every 6 months. Foojay helps out!
Brice Dutheil
9,411 viewsJava Flight Recorder is the profiler you can use in production, continuously, it is a feature in the JVM that traces the JVM with events.
Karl Heinz Marbaise
5,172 viewswith a few changes in our code we can easily solve the problem of having different strategies which using the same keys in our code.