Tootfinder

Opt-in global Mastodon full text search. Join the index!

@frankel@mastodon.top
2026-08-09 16:54:35

Guest author Peter Firmstone continues his brilliant series of #Security baked into the #JVM, with his third post: two Subjects, one call
This part covers the two kinds of identity a call carries, how SPIFFE manages process credentials without keystores, and how three identity layers coexist on a singl…

Security Baked Into the JVM: two Subjects, one call
The constraint system stops a bad call before it leaves the JVM. The Safe Codebase Audit Pipeline stops bad code before a client ever loads it. What remains is identity: who is calling, and can you verify it? Most frameworks answer with a token check at the door. A filter validates a bearer token, sets a thread-local variable, and hopes that nothing downstream forgets to look at it. DirtyChai answers differently.

@frankel@mastodon.top
2026-10-04 17:24:15

Guest author Peter Firmstone continues his exploration of #security baked into the #JVM.
This 5th part is about what the caller is then allowed to do:
how incoming arguments are validated before they become objects,
why permissions are granted to what the code is, rather than where it came f…

Security Baked Into the JVM: no single party controls the outcome
A URL is a name, and names get reused. Replace the bytes behind https://repo.example.org/order-processor.jar and every permission granted to that URL still applies, now to code nobody audited. So far in this series, Part 1 declared constraints on a remote call, Part 2 vetted code before a client loaded it, Part 3 established who is calling, and Part 4 carried that chain of identities across the wire.

@frankel@mastodon.top
2026-08-23 16:15:59

Guest author Peter Firmstone continues to explore and analyze the theme of #Security Baked Into the #JVM.
Today's focus is on multi-Subject dispatch: how up to sixteen user Subjects cross a call on the #JERI…

Security Baked Into the JVM: sixteen Subjects on the wire
Alice calls the order service. The order service calls the ledger on her behalf. At the second hop, the ledger has to decide whose authority the debit is being made under. Most stacks answer badly. Forward Alice’s bearer token verbatim, and the ledger cannot tell her from the service that relayed it. Drop the token and the ledger sees a machine, with no record that a human started the chain. Neither option lets the ledger authorize the combination.

@frankel@mastodon.top
2026-07-19 16:55:05

Guest author Peter Firmstone continues to explore and analyze the theme of #Security Baked Into the #JVM.
Today's focus in on the Safe Codebase #Audit

Security Baked Into the JVM: the Safe Codebase Audit Pipeline
In Part 1, the minimal deployment showed constraints traveling with the proxy: authentication, encryption, hardened deserialization, all declared in configuration and enforced at the call boundary. The proxy is a JAR. That JAR was downloaded and unmarshalled before any constraint ran. That step is the earlier problem. Distributed Java systems that load remote code are vulnerable to supply chain compromise: an attacker can replace a legitimate JAR with one containing malicious bytecode.