Eclipse Serializer – Biggest Security Flaw of Java Is Eliminated
summary
Claims a practical fix for Java deserialization attacks by shipping Eclipse Serializer (from the MicroStream split) and the Eclipse Store engine that already use it. It separates data and metadata and assigns internal object IDs to preserve referential integrity, performs type analysis once at runtime, supports arbitrary graph depth and off‑heap storage, and deliberately executes no code during deserialization. Tests show sizable performance gains versus JDK serialization, integration with storage and grids (Hazelcast tested), and it is open source on Maven Central.
AI-written summary · about
chapters (14)
- 0:00Introduction and welcome
- 1:06What is serialization
- 4:16Serialization in Java ecosystem
- 7:12Security flaws in Java serialization
- 11:50Eclipse Serializer project origins
- 13:17Eclipse Serializer design differences
- 19:06Serialization capabilities and limits
- 22:28Performance comparison
- 23:35Benefits and open source
- 25:25Custom type handlers
- 31:17Legacy type mapping
- 32:55Live code demonstration
- 37:39Future developments
- 41:54Q&A session
related talks
38mBuild High-Secure Applications with Eclipse Serializer
41mHigh-Secure Java Serialization
41mThe Evolution of Data Processing with Java
41mJava Serialisation: A Modern Fairytale
22mEclipseStore – The new, ultra-fast Java persistence for the cloud
47mA Modern Fairy Tale: Java Serialization
44mCaching Unleashed: Revolutionizing Java Performance
45mCaching Unleashed: Supercharge Your Database Application