Java SE Update
Wolfgang Weigend Peter Doschkinow
1 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described for Oracle’s products remains at the sole discretion of Oracle.
2 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Die Java Plattform
Servers Desktop Embedded TVTV Mobile Card BD-J Key APIs Java EE JavaFX Java TV MSA
Plattform Java SE Java ME Java Card
Language Java Language Java Plattform
3 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Make the Future Java
Platform Completeness Modernization and Innovation Developer Productivity Open and Transparent Evolution Active Community Involvement Quality and Security
4 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Progress
Community Technology Oracle Stewardship OpenJDK Java SE Outreach • New public bug system • 50+ Security Enhancements, seven • Four regional JavaOne events with JRE 7 Updates over 5000 attendees • Infrastructure updates • JDK 8 Developer Preview available • Over 1 Mio touch points reached • 114 new contributors through evangelism JavaFX JCP Oracle Technology Network • All code is open sourced as part of • JCP next progress OpenJFX • Over 150.000 subscribers to Oracle • 20+ JUG’s participating in Java Magazine • Released Scene Builder 1.1 • 14 JSR’s finalized since last year • Over 100.000 @java followers on Java Embedded Twitter Java User Group’s • Java ME 3.3 client runtime available Java.net • Increase in JUG’s (Growth from • ARM 32-bit HardFP ABI support 197 to 228) • Over 852.512 members • Greater JUG interaction Java EE • Over 2300 public projects • Piloting code challenges • Launched Java EE 7, GlassFish 4.0 • Four new JSR’s
5 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. JDK 7 Funktionsumfang • Coin – Kleine Sprachverbesserungen • Dynamic Language Support • Concurrency und Collections Updates • Netzwerk und File System • Internationalisierung • JVM Konvergenz • Sicherheit
6 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Sprachen die auf der JVM laufen
Groovy JRuby … … Scala JavaScript Clojure
7 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Garbage-First G1 Garbage Collector • G1 Garbage Collector ist mit Oracle JDK 7 Update 4 und höheren Versionen vollständig unterstützt • Server-Style Garbage Collector • Multi -Processor Maschinen mit großem Speicher als Zielplattform • GC-Pausezeiten orientieren sich an hohem Durchsatz • Für Anwendungen mit großer Heap-Anforderung und geringer GC-Latency • Für 6 GB Heap-Größen oder höher und konstante, voraussagbare Pausezeiten unter 0,5 Sekunden
8 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Java Mission Control 5.2
9 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Java Flight Recorder – How is it built?
• Information gathering − Instrumentation calls all over the JVM − Application information via Java API • Collected in Thread Local buffers ⇢ Global Buffers ⇢Disk • Binary, proprietary file format • Managed via JMX • Java Flight Recorder − Start from JMC 5.2 or CLI • Activate Flight Recorder − -XX: +UnlockCommercialFeatures − -XX: +FlightRecorder
10 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Java Security Bestandsaufnahme
• Java in the browser has become a popular means to deliver exploits • Warum? – Old releases: Many users are not on the current security baseline, or have multiple releases of Java installed – Silent exploits: Traditionally, sandboxed apps would run without any indication to the user. This was a popular way to deliver malware – Insecure sandbox: The Java sandbox is expected to protect users, but too many exploits have been identified for that to be believable. – Vulnerability backlog: clear the backlog
11 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Why is Security Important to Oracle? Java is at the center of our applications
12 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. What is Oracle Doing in Java Security? Efforts are broad but the message is simple
• Defend Java applets – limit ability of attackers to use malicious applets as a means of attack • Accelerate Remediation – accelerate production of security fixes • New Security Features – new security countermeasures to strengthen Java • Java SE 8 postponed to „secure the train“
13 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Larger Security Policy Areas
SA / CPU RSS Feeds Deployment Architecture Review Security Blog Communications Peer Review eBlasts Lifecycle Security Testing Java.com Security Post Mortems Security
Remediation CPU Security Alerts
14 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Java Critical Patch Updates
Rules for Java CPU’s − Main release for security vulnerabilities − Covers all JDK families (7, 6, 5.0, 1.4.2) − CPU release triggers Auto-update − Dates published 12 months in advance − Security Alerts are released as necessary − Based off the previous (non-CPU) release − Released simultaneously on java.com and OTN
15 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Java Critical Patch Updates and upcoming
15 th of October 2013 (transition to Oracle CPU schedule) 14 th of January 2014 15 th of April 2014 15 th of July 2014 14 th of October 2014 CPU‘s http://www.oracle.com/technetwork/topics/security/alerts-086861.html
16 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Java SE Update Release (1)
Version Features and Changes JDK 6u ● No more public updates ● JRE 6 is below security baseline JDK 7u6 ● Dynamic security baseline JDK 7u10 ● Security level ● Java Control Panel (JCP) option to disable Java in the browser ● Expiring JRE ● JNLP auto-download support removed ● Dynamic Toolkit (DT) auto-download for secure Java versions only ● Local applets blocked at default security level
17 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Java SE 7 Update Release (2)
Version Features and Changes JDK 7u21 ● Signed sandbox applications ● Location associated with certificate ● Dynamic blacklist of certificates and JARs ● Liveconnect changes JDK 7u25 ● Certificate revocation checking is on by default ● Manifest entries: “Permissions” and “Codebase” JDK 7u40 ● Better revocation checking performance ● Deployment Rule Set
18 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Java SE 7u40 – Deployment Rule Set Overview • For enterprises that have direct control of client desktops. • Allows use of legacy enterprise applications without modifying them to conform to new security requirements. • Avoid future security dialogs and restrictions. – Signed application jars will still be checked for valid signature,revocation, and blacklisting, but may be self-signed or expired
19 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Java SE 7u40 – Deployment Rule Set Deployment Rule Set JAR • The rule set is contained in an xml file, ruleset.xml. • The ruleset.xml file is then included in a jar file, DeploymentRuleSet.jar. • This JAR must be properly signed (verified by Trusted Certificate Authority and either timestamped or currently valid). • The JAR must then be installed on each client machine in the secure location
20 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Best Practices Deployment Methods • Deployment options: – Java Web Start – Browser applet – Self -Contained application (packager) • For deploying Self-Contained stand alone Java applications see http://docs.oracle.com/javafx/2/deployment/self-contained-packaging.htm
21 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Best Practices for secure Java web deployment Evaluate your application • Deployment Considerations – all-permissions or sandbox – liveconnect, JS->Java, Java->JS, roundtrip – JVM options – Java System properties – JRE Version – Location of artifacts - html/jnlp/JARs • are they all coming from same host? • lazy resources • 3rd party resources • Signed JARs
22 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Best Practices for secure Java web deployment Read Secure Coding Guidelines • Secure Coding Guidelines – http://www.oracle.com/technetwork/java/seccodeguide-139067.html • Lots of good recommendations regarding coding securely. • It has some discussion on subjects directly related to deploying Java securely on the web such as how to use doPrivileged blocks
23 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Best Practices for secure Java web deployment Signed JNLP • What is Signed JNLP? – Basically when the external JNLP file is duplicated in your main signed JAR – Copy of JNLP in signed JAR must match web server copy • JNLP-INF/APPLICATION.JNLP • JNLP-INF/APPLICATION_TEMPLATE.JNLP – Template specifies values that can be substituted by the external JNLP
24 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Best Practices for secure Java web deployment Prevent your JARs from being repurposed • Repurposing is when an attacker uses some of your JAR’s, with some combination of other JARs, JNLP files, applet tags or javascript using Liveconnect • Set optional “Codebase” manifest attribute to indicate origin – You can specify multiple locations – Prevents attacker copying JAR to another server – Examples: • Codebase: oracle.com • Codebase: https://*.oracle.com *.java.net
25 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Best Practices for secure Java web deployment Prevent your JARs from being repurposed • Signed JNLP prevents: – Your application being run with different application arguments, JVM arguments and system properties – Replacing your JARs with other extensions – Using your JARs in a non JNLP applet • Recommend using HTTPS – Prevents repurposing through man in the middle attack – Preventing applications from being repurposed: http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/no_redeploy.html
26 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Best Practices for secure Java web deployment Signing JARs • Moving to a model where jars must be signed (required by Jan 2014) – More friendly user experience with valid CA signed jars – Always sign with a valid CA certificate, sandbox and all-permissions – Timestamp JAR signatures (more robust future validation) – Revoke your certificate if it is compromised – Import certificate into key store during development • Import from the Java Control Panel • Import from command line • Self-signed or local CA certificate treated as valid CA certificate
27 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Java SE 7u45 Security Features and Changes
• Protections Against Unauthorized Redistribution of Java Applications − Starting with 7u45, application developers can specify new JAR manifest file attributes: − Application-Name − Caller-Allowable-Codebase − This attribute specifies the codebase/locations from which JavaScript is allowed to call Applet classes − Application-Library-Allowable-Codebase • Restore Security Prompts – New button is available in the Java Control Panel (JCP) to clear previously remembered trust decisions • TimeZone.setDefault Change – java.util.TimeZone.setDefault(TimeZone) method has been changed to throw a SecurityException if the method is called by any code with which the security manager's checkPermission call denies PropertyPermission("user.timezone", "write")
28 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Java SE 7u51 Security Highlights (January 2014)
• Self-signed/unsigned blocked by default – Block self-signed and unsigned at High (default) – Manifest “permissions” attribute required on High (default) security level – All applets written before 7u25 will no longer run by default
29 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. JDK 8 – Zeitplan Detailplanung für M6 bis Release-Freigabe • Feature Complete — All features have been implemented and integrated into the master forest, together with unit tests • Developer Preview — A reasonably stable build suitable for broad testing by the developer community is published. This build will include all planned features unless otherwise stated • All Tests Run — All planned tests have been run, at least once, on all supported platforms • Ramp down — Phases in which increasing levels of scrutiny are applied to incoming changes. In phase 1, only P1 -P3 bugs can be fixed. In phase 2 only showstopper bugs can be fixed • API/Interface Freeze — After this point APIs and other interfaces, including those defined in component JSRs, can be changed only in order to fix showstopper bugs • Zero Bug Bounce (ZBB) — The bug backlog is completely addressed. No open bug with a fix targeted to the release is older than 24 hours, and other bugs have been deferred to a future release • Final Release Candidate — The date by which the final release candidate must be declared and submitted for testing. One or more release candidates will be declared after the planned ZBB date; if another is necessary after this milestone then the GA date will be at risk • General Availability — Final release, ready for production use
30 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. JDK 8 geplant für 2014 Innovation Java for Everyone Client • Lambda JSR 335 • Profiles for constrained devices • Deployment enhancements • Language Interoperability • JSR 310 – Date & Time API‘s • JavaFX 8 • Nashorn • Non-Gregorian calendars • Public UI Control API • Unicode 6.1 • Java SE Embedded support Core Libraries • ResourceBundle • Enhanced HTML5 support • BCP47 locale matching • 3D shapes and attributes • Parallel operations for core collections API‘s • Globalization & Accessibility • Printing • Improvements in functionality • Improved type inference Tools Security General Goodness • Compiler control & logging • Limited doPriviledge • JSR 308 – Annotations on Java Type • NSA Suite B algorithm support • JVM enhancements • Native app bundling • SNI Server Side support • No PermGen limitations • App Store Bundling tools • DSA update to FIPS186-3 • Performance Improvements • AEAD JSSE CipherSuites
31 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Lambda Ausdrücke JSR-335
• Functional Interfaces: “An interface with one method” • Vorschlag zum Sprachumfang von Java SE 8 − 0.6.1 Early Draft Review 3 Specification bis März 2013 file:///C:/Java/jsr335-0.6.1/index.html − Prototype Binaries verfügbar : http://jdk8.java.net/lambda/ • Lambda Expressions (closures) /* (int x, int y) {return x+y; } */ • Parameter Liste → -> Operator → Expression od. Statements (String x) -> {return !x.isEmpty();} • Was hergeleitet werden kann, kann auch weggelassen werden x -> !x.isEmpty() 32 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Lambda Ausdrücke State of the Lambda 4th Edition
Today we write:
Collections.sort(people, new Comparator
/* This is a very verbose way to write "sort people by last name"! */
With lambda expressions, we can make this expression more concise:
Collections.sort(people, (Person x, Person y) -> x.getLastName().compareTo(y.getLastName()));
33 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Erweiterung der Core Libraries mit Lambdas • Keine einfache Aufgabe – Java SE 7 has 4024 standard classes • Modernize general library API’s • Improve performance – Gains from use of invokedynamic to implement Lambdas • Demonstrate best practices for extension methods
34 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Concurrency Updates • Scalable update variables – DoubleAccumulator , DoubleAdder , etc – Multiple variables avoid update contention – Good for frequent updates, infrequent reads • ConcurrentHashMap updates – Improved scanning support, key computation • ForkJoinPool improvements – Completion based design for IO bound applications
35 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Bulk Data Operations für Collections Filter, Map, Reduce for Java • Add functionality to the Java Collections Framework for bulk operations upon data • This is commonly referenced as “filter/map/reduce for Java” • The bulk data operations include both serial (on the calling thread) and parallel (using many threads) versions of the operations – Serial and parallel implementations • Operations upon data are generally expressed as lambda functions • Parallel implementation builds on Fork-Join framework
36 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Parallel Array Sorting • Additional utility methods in java.util.Arrays – parallelSort (multiple signatures for different primitives) • Anticipated minimum improvement of 30% over sequential sort – For dual core system with appropriate sized data set • Built on top of the fork -join framework – Uses Doug Lea’s ParallelArray implementation – Requires working space the same size as the array being sorted
37 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Lambda Ausdrücke – Parallelisiert State of the Lambda Libraries Edition List
− More readable − Better abstraction − No reliance on mutable state − Runs in parallel − Works on any data structure that knows how to subdivide itself Concurrent Bulk Data Operations in Java collections API’s (JEP 107) − filter/map/reduce 38 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Lambda-Form Representation für MethodHandles Assembly language code re-written in Java • Improve performance, quality, and portability of method handles and invokedynamic • Reduce the amount of assembly code in the JVM • Reduce native calls during method handle processing • Better reference implementation of JSR 292 (invokedynamic)
39 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Project Nashorn
• ECMAScript 5.1 compliant JavaScript that runs on the JVM − Accessible via javax.script API or jjs command line • Replacement for Rhino • Exploits JSR-292 via Dynalink • Fully part of the OpenJDK • Available on Java SE and Java ME • Nashorn - Der Weg zur polyglotten VM
40 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Project Nashorn Invokedynamic Bytecode und „MethodHandle“
41 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Nashorn Debugging - Experiments
• Debugging options − IDE integration of Nashorn − Common API for non-Java languages − Chrome/Safari wire protocols − Askari
o Askari is a sample JS debugger demonstrated at JavaOne SF 2013
o https://github.com/wickund/nashornexamples
42 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Annotations on Java Types • Annotations can currently only be used on type declarations – Classes, methods, variable definitions • Extension for places where types are used – e.g. parameters • Permits error detection by pluggable type checkers – e.g. null pointer errors, race conditions, etc
public void process(@notnull List data) {…}
43 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Date and Time API
• A new date, time, and calendar API for the Java SE platform • Supports standard time concepts – Partial, duration, period, intervals – date, time, instant, and time-zone • Provides a limited set of calendar systems and be extensible to others • Uses relevant standards, including ISO-8601, CLDR, and BCP 47 • Based on an explicit time-scale with a connection to UTC
44 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Java SE 8 Compact-Profile mit Speicherbedarf
45 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Java SE 8 Compact-Profile mit Packages
Compact1 Profil Compact2 Profil Compact3 Profil Vollständige JRE java.lang java.sql java.lang.management java.applet java.io jvax.sql javax.management java.awt java.nio javax.xml javax.naming java.beans java.text org.w3c.dom java.sql.rowset javax.activity java.math org.xml.sax javax.security.auth.kerberos javax.rmi java.net java.rmi org.ietf.jgss javax.rmi.CORBA javax.net javax.rmi javax.script org.omg java.util javax.transaction javax.xml.crypto javax.accessibility java.util.logging java.util.prefs javax.imagio java.security javax.security.sasl javax.print javax.crypto javax.security.acl javax.sound javax.security javax.lang.instrument javax.swing javax.annotation.processing javax.activation javax.lang.model javax.jws javax.lang.model.element javax.xml.bind javax.lang.model.type javax.xml.soap javax.lang.model.util javax.xml.ws javax.tools javax.annotation
46 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. JavaFX ist das strategische Java-UI für Rich-Client-Anwendungen Einheitliche Applikationsentwicklung für Java- und Web-Anwendungen • Browser Plug-in, Web Start, Native Executables • Hardware Accelerated Graphics (DirectX, OpenGL) • JavaFX wird mit HTML-DOM ausgestattet − JavaFX mit WebView für HTML5 Features (Web Sockets, offline Browsing, lokale Datenbank) − Leistungsfähige JavaScript Engine − JavaFX als Applet eingebettet in einer Web-Seite lauffähig JavaFX 2.0 Plattform Sprachwechsel • Java als native Sprache - anstatt JavaFX Script • JavaFX APIs in Java implementiert • Vorteile bei Verwendung von Generics, Annotations und Multithreading für JavaFX JavaFX 2.2.45 verfügbar und mit NetBeans 7.4 unterstützt • Migrationspfad für Swing- und SWT-basierte Anwendungen • JFXPanel Komponente ermöglicht das Einbinden von JavaFX Anwendungen in Swing • Open Source mit OpenJFX und im JCP standardisiert JavaFX Scene Builder 1.1 GA 47 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. JavaFX via Open Source auf dem Weg ins JDK 8
Open Source Konvergenz Standardisierung OpenJFX Project under Common license with Oracle committed to OpenJDK Java SE (in place) JavaFX standardization First phase to focus on JavaFX to be included JSR to be submitted UI Controls in Java SE by JDK 8 through JCP JavaFX for Java SE Embedded (ARM)
48 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Launch JavaFX Applications • Support the direct launching of JavaFX applications • Enhancement to the java command line launcher
49 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Java Roadmap
JDK 7u21 JDK 7u40 + 7u45 JDK 8 (Q1 2014) JDK 9 • Java Client • Java Flight Recorder • Lambda • Modularity - Jigsaw Security • Java Mission Control • JVM Convergence • Interoperability Enhancements • Java Discovery Protocol • JavaScript Interoperability • Cloud • Native Memory Tracking • JavaFX 8 • Ease of Use • Local Security Policy • Optimizations
2013 2014 2015 2016
Java ME Embedded 3.4 Java ME Embedded 8 Java SE Embedded 8 Java Embedded 9 • Fast follow-on • Java ME CLDC 8 & ME Embedded • Complete JVM convergence • Java ME and SE 9 • QSC platform only Profile 8 • New Compact Profiles • Modularity based on • Enhanced on-device • „Little sibling“ of Java SE 8 • Significantly smaller base runtime Jigsaw debugging, monitoring • New & enhanced Embedded API • Embedded JRE customization tool • New portable architecture • Support for ARM, Power PC & x86 • Small and full profiles • Java Flight Recorder/Mission Java ME SDK 8 Control • Improved developer tooling & • Simple migration of ME CDC 50 Copyright © 2013, Oracle and/or its affiliates. All rigexperiencehts headless applications reserved. Java Roadmap
Java 8 Feature Beyond Java 8
• Lambda – JSR 335 • Modular Platform – Jigsaw • Data & Time API – JSR 310 • Unified Type System • Nashorn JavaScript Engine • Language Interoperability • Security Enhancements • Memory-efficient data structures • Java on GPU’s – Sumatra
51 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Zusammenfassung Java SE 7 • Inkrementelle, evolutionäre Änderungen Java SE 8 • Funktionale Programmierung: Lambda Java ME • Konvergenz mit Java SE Java SE 9 • Modularisierung: Jigsaw Java EE 7 − Neue API’s Java als Plattform nutzt Innovationen im Ökosystem und paßt sich dem Änderungprozess der IT an
52 Copyright © 2013, Oracle and/or its affiliates. All rights reserved. Vielen Dank für Ihre Aufmerksamkeit!
53 Copyright © 2013, Oracle and/or its affiliates. All rights reserved.