DOCSLIB.ORG

Language and Framework Support for Reviewably- Secure Software Systems

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Language and Framework Support for Reviewably- Secure Software Systems Language and Framework Support for Reviewably- Secure Software Systems Adrian Mettler Electrical Engineering and Computer Sciences University of California at Berkeley Technical Report No. UCB/EECS-2012-244 http://www.eecs.berkeley.edu/Pubs/TechRpts/2012/EECS-2012-244.html December 13, 2012 Copyright © 2012, by the author(s). All rights reserved. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission. Language and Framework Support for Reviewably-Secure Software Systems by Adrian Matthew Mettler A dissertation submitted in partial satisfaction of the requirements for the degree of Doctor of Philosophy in Computer Science in the Graduate Division of the University of California, Berkeley Committee in charge: Professor David Wagner, Chair Professor Deirdre Mulligan Professor Dawn Song Fall 2012 Language and Framework Support for Reviewably-Secure Software Systems Copyright 2012 by Adrian Matthew Mettler 1 Abstract Language and Framework Support for Reviewably-Secure Software Systems by Adrian Matthew Mettler Doctor of Philosophy in Computer Science University of California, Berkeley Professor David Wagner, Chair My thesis is that languages and frameworks can and should be designed to make it easier for programmers to write reviewably secure systems. A system is reviewably secure if its security is easy for an experienced programmer to verify, given access to the source code. A security reviewer should be able, with a reasonable amount of effort, to gain confidence that such a system meets its stated security goals. This dissertation includes work on on language subsetting and web application framework design. It presents Joe-E, a subset of the Java programming language designed to enforce object- capability security, simplifying the task of verifying a variety of security properties by en- abling sound, local reasoning. Joe-E also enforces determinism-by-default, which permits functionally-pure methods to be identified by their signature. Functional purity is a useful property that can greatly simplify the task of correctly implementing and reasoning about application code. A number of applications of the Joe-E language are presented and evalu- ated. The second part of this dissertation presents tool and framework enhancements for improving the security of web applications. I present techniques for retrofitting existing web applications to use template systems effectively to prevent cross-site scripting and content injection vulnerabilities while preserving functionality. I also show how HTML templates can be rewritten to normalize their output, improving the assurance of security provided by automatic escaping and other static analyses. These two applications of my thesis demonstrate that practical enhancements to lan- guages and frameworks can support developers in creating more secure software that is easier to review. Continued improvement in language and framework support for reviewability is a promising approach toward improving the security provided by modern software. i To everyone who has believed in me, especially my family. ii Contents List of Figures vii List of Tables ix Acknowledgements x 1 Introduction 1 1.1 Background . 1 1.1.1 Security Review . 1 1.1.2 Programming Languages and Abstractions . 3 1.1.3 Web Templating Languages . 4 1.2 Summary . 5 1.2.1 Joe-E: A Security-Oriented Subset of Java . 6 1.2.2 Improving Security of Template-Based Web Applications . 9 2 Joe-E: An Object-Capability Subset of Java 11 2.1 Introduction . 11 2.2 Goals and Overview . 17 2.2.1 Ease of use . 17 2.2.2 Supporting secure software . 18 2.2.3 Supporting security code review . 19 2.3 Approach . 20 2.3.1 Subsetting . 21 2.4 Design of Joe-E . 21 2.4.1 Memory Safety and Encapsulation . 22 2.4.2 Removing Ambient Authority . 23 2.4.3 Exceptions and Errors . 26 2.5 Programming Patterns . 28 2.5.1 Reachability and Object Graph analysis . 28 2.5.2 Leveraging Static Typing . 29 2.5.3 Defensive Consistency . 31 2.5.4 Immutability . 31 Contents iii 2.5.5 Attenuation of Authority . 32 2.5.6 Facets . 32 2.6 Implementation . 33 2.7 Conclusions . 36 3 Verifiable Functional Purity in Joe-E 37 3.1 Introduction . 37 3.2 Applications . 39 3.2.1 Reproducibility . 40 3.2.2 Invertibility . 40 3.2.3 Untrusted code execution . 41 3.2.4 Building robust systems . 43 3.2.5 Bug reduction . 43 3.2.6 Assertions and Specifications . 44 3.3 Definitions . 45 3.3.1 Side-effect freeness . 45 3.3.2 Determinism . 45 3.4 Approach . 46 3.4.1 Equivalence of reference lists . 47 3.4.2 Immutability . 48 3.5 Pure methods . 49 3.6 Implementation . 49 3.6.1 Side effects and Nondeterminism . 50 3.6.2 Immutability . 53 3.6.3 Verifying Purity . 53 3.7 Evaluation and Experience . 54 3.7.1 AES library . 55 3.7.2 Voting machine . 56 3.7.3 HTML parser . 57 3.7.4 Summary of patterns . 60 3.7.5 Waterken Server . 60 3.8 Discussion . 61 3.9 Conclusions . 62 4 Joe-E's Overlay Type System and Marker Interfaces 63 4.1 Introduction . 63 4.2 Overlay Type System . 65 4.2.1 Marker Interfaces . 66 4.2.2 Properties . 67 4.2.3 Formalizations . 67 4.3 Immutability . 72 4.3.1 Ensuring Final Means Final . 73 Contents iv 4.4 Identity-based Authority . 74 4.4.1 Power and Tokens . 75 4.4.2 Powerless . 76 4.5 Selfless and Equatable . 78 4.6 Conclusions . 81 4.7 Appendix: Proofs of Theorems . 82 4.7.1 Completeness . 82 4.7.2 Non-circularity . 83 5 Applications of Joe-E 85 5.1 Waterken . 85 5.1.1 Consistent Persistence . 86 5.1.2 Cache Coherence . 87 5.1.3 Remote capabilities . 88 5.2 Capsules . 89 5.2.1 Design . 89 5.2.2 Implementation . 90 5.2.3 Evaluation . 91 6 Related Work: Joe-E 99 6.1 Capabilities . 99 6.1.1 Object-Capability Languages . 99 6.1.2 Privilege Separation . 100 6.2 Security for Java and Related Languages . 100 6.3 Functional Purity . 101 6.3.1 Side Effects . 102 6.3.2 Functionally Pure Languages . 103 6.4 Overlay Type Systems . 104 7 Retrofitting Web Applications for Security Review of Cross-Site Scripting Resistance 106 7.1 Introduction . 106 7.2 Background . 108 7.3 Problem . 110 7.4 Approach . 112 7.4.1 Mitigation Mode . ..
Load more

Recommended publications
  • Debreach: Selective Dictionary Compression to Prevent BREACH and CRIME
    debreach: Selective Dictionary Compression to Prevent BREACH and CRIME A THESIS SUBMITTED TO THE FACULTY OF THE GRADUATE SCHOOL OF THE UNIVERSITY OF MINNESOTA BY Brandon Paulsen IN PARTIAL FULFILLMENT OF THE REQUIREMENTS FOR THE DEGREE OF MASTER OF SCIENCE Professor Peter A.H. Peterson July 2017 © Brandon Paulsen 2017 Acknowledgements First, I’d like to thank my advisor Peter Peterson and my lab mate Jonathan Beaulieu for their insights and discussion throughout this research project. Their contributions have undoubtedly improved this work. I’d like to thank Peter specifically for renew- ing my motivation when my project appeared to be at a dead–end. I’d like to thank Jonathan specifically for being my programming therapist. Next, I’d like to thank my family and friends for constantly supporting my aca- demic goals. In particular, I’d like to thank my mom and dad for their emotional support and encouragement. I’d like to thank my brother Derek and my friend Paul “The Wall” Vaynshenk for being great rock climbing partners, which provided me the escape from work that I needed at times. I’d like to again thank Jonathan Beaulieu and Xinru Yan for being great friends and for many games of Settlers of Catan. I’d like to thank Laura Krebs for helping me to discover my passion for academics and learning. Finally, I’d like to thank my fellow graduate students and the computer science faculty of UMD for an enjoyable graduate program. I’d also like to thank Professor Bethany Kubik and Professor Haiyang Wang for serving on my thesis committee.
    [Show full text]
  • Turbo.Lua Documentation Release 2.1.2
    Turbo.lua Documentation Release 2.1.2 John Abrahamsen Nov 02, 2018 Contents 1 Hello World 3 2 Supported Architectures 5 3 Supported Operating Systems7 4 Installation 9 5 Object oriented Lua 11 6 Packaging 13 7 Dependencies 15 8 License 17 9 Tutorials 19 9.1 Get Started With Turbo.......................................... 19 9.1.1 Installing Turbo......................................... 19 9.1.2 Hello World........................................... 20 9.1.3 Request parameters....................................... 20 9.1.4 Routes.............................................. 20 9.1.5 Serving Static Files....................................... 21 9.1.6 JSON Output.......................................... 22 9.2 Asynchronous modules......................................... 22 9.2.1 Overview............................................ 22 9.2.2 Example module........................................ 24 10 API documentation 27 10.1 Turbo.lua API Versioning........................................ 27 10.1.1 Preliminaries.......................................... 27 10.1.2 Module Version......................................... 27 10.2 turbo.web – Core web framework.................................... 28 10.2.1 RequestHandler class...................................... 28 10.2.2 HTTPError class........................................ 32 10.2.3 StaticFileHandler class..................................... 32 10.2.4 RedirectHandler class...................................... 33 10.2.5 Application class........................................ 33
    [Show full text]
  • Fundamental Data Structures Contents
    Fundamental Data Structures Contents 1 Introduction 1 1.1 Abstract data type ........................................... 1 1.1.1 Examples ........................................... 1 1.1.2 Introduction .......................................... 2 1.1.3 Defining an abstract data type ................................. 2 1.1.4 Advantages of abstract data typing .............................. 4 1.1.5 Typical operations ...................................... 4 1.1.6 Examples ........................................... 5 1.1.7 Implementation ........................................ 5 1.1.8 See also ............................................ 6 1.1.9 Notes ............................................. 6 1.1.10 References .......................................... 6 1.1.11 Further ............................................ 7 1.1.12 External links ......................................... 7 1.2 Data structure ............................................. 7 1.2.1 Overview ........................................... 7 1.2.2 Examples ........................................... 7 1.2.3 Language support ....................................... 8 1.2.4 See also ............................................ 8 1.2.5 References .......................................... 8 1.2.6 Further reading ........................................ 8 1.2.7 External links ......................................... 9 1.3 Analysis of algorithms ......................................... 9 1.3.1 Cost models ......................................... 9 1.3.2 Run-time analysis
    [Show full text]
  • The Checker Framework Manual: Custom Pluggable Types for Java
    The Checker Framework Manual: Custom pluggable types for Java https://checkerframework.org/ Version 2.5.7 (4 Nov 2018) For the impatient: Section 1.3 (page 13) describes how to install and use pluggable type-checkers. Contents 1 Introduction 12 1.1 How to read this manual . 13 1.2 How it works: Pluggable types . 13 1.3 Installation . 13 1.4 Example use: detecting a null pointer bug . 13 2 Using a checker 15 2.1 Writing annotations . 15 2.2 Running a checker . 16 2.2.1 Using annotated libraries . 16 2.2.2 Distributing your annotated project . 17 2.2.3 Summary of command-line options . 17 2.2.4 Checker auto-discovery . 19 2.2.5 Shorthand for built-in checkers . 19 2.3 What the checker guarantees . 19 2.4 Tips about writing annotations . 20 2.4.1 Write annotations before you run a checker . 20 2.4.2 How to get started annotating legacy code . 20 2.4.3 Annotations indicate non-exceptional behavior . 22 2.4.4 Subclasses must respect superclass annotations . 22 2.4.5 Annotations on constructor invocations . 23 2.4.6 What to do if a checker issues a warning about your code . 24 3 Nullness Checker 26 3.1 What the Nullness Checker checks . 26 3.2 Nullness annotations . 27 3.2.1 Nullness qualifiers . 27 3.2.2 Nullness method annotations . 28 3.2.3 Initialization qualifiers . 28 3.2.4 Map key qualifiers . 28 3.3 Writing nullness annotations . 29 3.3.1 Implicit qualifiers . 29 3.3.2 Default annotation .
    [Show full text]
  • Improving Scalability of Symbolic Execution for Software with Complex Environment Interfaces
    Improving Scalability of Symbolic Execution for Software with Complex Environment Interfaces THÈSE NO 6719 (2015) PRÉSENTÉE LE 13 JUILLET 2015 À LA FACULTÉ INFORMATIQUE ET COMMUNICATIONS LABORATOIRE DES SYSTEMES FIABLES PROGRAMME DOCTORAL EN INFORMATIQUE ET COMMUNICATIONS ÉCOLE POLYTECHNIQUE FÉDÉRALE DE LAUSANNE POUR L'OBTENTION DU GRADE DE DOCTEUR ÈS SCIENCES PAR Stefan, BUCUR acceptée sur proposition du jury: Prof. J. R. Larus, président du jury Prof. G. Candea, directeur de thèse Prof. V. Adve, rapporteur Prof. J. Kinder, rapporteur Prof. W. Zwaenepoel, rapporteur Suisse 2015 2 Abstract (German) Manuelles Testen von Software ist aufwändig und fehleranfällig. Dennoch ist es die unter Fach- leuten beliebteste Methode zur Qualitätssicherung. Die Automatisierung des Testprozesses ver- spricht eine höhere Effektivität insbesondere zum Auffinden von Fehlern in Randfällen. Sym- bolische Softwareausführung zeichnet sich als automatische Testtechnik dadurch aus, dass sie keine falsch positiven Resultate hat, mögliche Programmausführungen abschliessend aufzählt, und besonders interessante Ausführungen prioritisieren kann. In der Praxis erschwert jedoch die so- genannte Path Explosion – die Tatsache, dass die Anzahl Programmausführungen im Verhältnis zur Programmgrösse exponentiell ansteigt – die Anwendung von Symbolischer Ausführung, denn Software besteht heutzutage oft aus Millionen von Zeilen Programmcode. Um Software effizient symbolisch zu testen, nutzen Entwickler die Modularität der Software und testen die einzelnen Systemkomponenten separat. Eine Komponente benötigt jedoch eine Umgebung, in der sie ihre Aufgabe erfüllen kann. Die Schnittstelle zu dieser Umgebung muss von der symbolischen Ausführungsplattform bereitgestellt werden, und zwar möglichst effizient, präzis und komplett. Dies ist das Umgebungsproblem. Es ist schwierig, das Umgebungsprob- lem ein für alle mal zu lösen, denn seine Natur hängt von der gegebenen Schnittstelle und ihrer Implementierung ab.
    [Show full text]
  • Thirty Ways to Improve the Performance of Your Java™ Programs
    Thirty Ways to Improve the Performance of Your Java™ Programs Glen McCluskey E-mail: [email protected] Version 1.0, October 1999 Copyright © 1999 Glen McCluskey & Associates LLC. All Rights Reserved. Java and all Java-based marks are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and other countries. Throughout this paper, when the Java trademark appears alone it is a reference to the Java programming language. When the JDK trademark appears alone it is a reference to the Java Development Kit. The author would like to thank Steve Buroff, Craig Hondo, John Spicer, and Clay Wilson for assistance with proofreading. Thirty Ways to Improve the Performance of Your Java™ Programs Contents 1 Introduction........................................................................................................................................... 4 1.1 When to Worry About Performance................................................................................................ 4 1.2 Performance Issues Not Covered in This Paper ............................................................................. 4 1.3 Just-in-Time Compilers and Java Virtual Machines....................................................................... 4 1.4 Environment and Tools Used in Code Examples............................................................................ 5 1.5 How Examples Were Timed ............................................................................................................ 5 1.6 Performance Analysis Tools ..........................................................................................................
    [Show full text]
  • Simple Java - Foreword 86
    1 | 183 Contents I Freface 7 II Java Questions 11 1 How to Check if an Array Contains a Value in Java Efficiently? 13 2 Top 10 Questions about Java Exceptions 16 3 Why Field Can’t Be Overridden? 18 4 Constructors of Sub and Super Classes in Java? 20 5 Java Enum Examples 23 6 Java Access Level for Members: public, protected, private 24 7 The Interface and Class Hierarchy Diagram of Java Collections 25 8 Top 9 questions about Java Maps 28 9 Java equals() and hashCode() Contract 33 10 What does a Java array look like in memory? 35 11 The Introduction of Java Memory Leaks 38 12 Frequently Used Methods of Java HashMap 40 13 How Java Compiler Generate Code for Overloaded and Overridden Methods? 42 14 String is passed by “reference” in Java 43 15 FileOutputStream vs. FileWriter 46 16 HashSet vs. TreeSet vs. LinkedHashSet 46 17 How to Write a File Line by Line in Java? 52 18 What can we learn from Java HelloWorld? 54 19 Top 10 questions of Java Strings 58 20 How does Java handle aliasing? 61 21 How Static Type Checking Works in Java? 63 22 Interview Question - Use Java Thread to Do Math Calculation 64 23 Why String is immutable in Java ? 65 24 ArrayList vs. LinkedList vs. Vector 67 25 Java Varargs Examples 72 26 HashMap vs. TreeMap vs. Hashtable vs. LinkedHashMap 73 27 What is Instance Initializer in Java? 80 28 Top 10 Methods for Java Arrays 81 29 Java Type Erasure Mechanism 84 30 Simple Java - Foreword 86 31 Top 10 Mistakes Java Developers Make 86 32 How to make a method thread-safe in Java? 92 33 What Is Inner Interface in Java? 94 34 Top 10 questions about Java Collections 96 35 Set vs.
    [Show full text]
  • Prototyping Symbolic Execution Engines for Interpreted Languages
    Prototyping Symbolic Execution Engines for Interpreted Languages Stefan Bucur Johannes Kinder George Candea École Polytechnique Fédérale de Lausanne École Polytechnique Fédérale de Lausanne École Polytechnique Fédérale de Lausanne stefan.bucur@epfl.ch Royal Holloway, University of London george.candea@epfl.ch [email protected] Abstract 1. Introduction Symbolic execution is being successfully used to automat- Developers spend much of their time writing unit and perfor- ically test statically compiled code [4, 7, 9, 15]. However, mance tests and manually tracing hard-to-reproduce bugs; increasingly more systems and applications are written in ideally, these tasks would be automated. Symbolic execution dynamic interpreted languages like Python. Building a new is a particularly successful technique for exploring multiple symbolic execution engine is a monumental effort, and so execution paths fully automatically. It has been used to find is keeping it up-to-date as the target language evolves. Fur- bugs and to generate high-coverage test suites for Windows thermore, ambiguous language specifications lead to their media format parsers [16], Windows device drivers [19], implementation in a symbolic execution engine potentially and the Linux Coreutils [7], and it has helped to reproduce differing from the production interpreter in subtle ways. crashes for debugging [29]. Symbolic execution enumerates We address these challenges by flipping the problem and feasible execution paths by using a constraint solver to syn- using the interpreter itself as a specification of the language thesize inputs that drive the program down paths that have semantics. We present a recipe and tool (called CHEF)for not been covered before.
    [Show full text]
  • Transient Typechecks Are (Almost) Free
    Transient Typechecks Are (Almost) Free Richard Roberts School of Engineering and Computer Science, Victoria University of Wellington, New Zealand [email protected] Stefan Marr School of Computing, University of Kent, UK [email protected] Michael Homer School of Engineering and Computer Science, Victoria University of Wellington, New Zealand [email protected] James Noble School of Engineering and Computer Science, Victoria University of Wellington, New Zealand [email protected] Abstract Transient gradual typing imposes run-time type tests that typically cause a linear slowdown. This performance impact discourages the use of type annotations because adding types to a program makes the program slower. A virtual machine can employ standard just-in-time optimizations to reduce the overhead of transient checks to near zero. These optimizations can give gradually-typed languages performance comparable to state-of-the-art dynamic languages, so programmers can add types to their code without affecting their programs’ performance. 2012 ACM Subject Classification Software and its engineering → Just-in-time compilers; Software and its engineering → Object oriented languages; Software and its engineering → Interpreters Keywords and phrases dynamic type checking, gradual types, optional types, Grace, Moth, object- oriented programming Digital Object Identifier 10.4230/LIPIcs.ECOOP.2019.5 Funding This work is supported by the Royal Society of New Zealand Marsden Fund. 1 Introduction “It is a truth universally acknowledged, that a dynamic language in possession of a good user base, must be in want of a type system.” with apologies to Jane Austen. Dynamic languages are increasingly prominent in the software industry.
    [Show full text]
  • Concolic Execution of Nmap Scripts for Honeyfarm
    Concolic Execution of NMap Scripts for Honeyfarm Generation Zhe Li Bo Chen Department of Computer Science Department of Computer Science Portland State University Portland State University Portland, Oregon, USA Portland, Oregon, USA [email protected] [email protected] Wu-chang Feng Fei Xie Department of Computer Science Department of Computer Science Portland State University Portland State University Portland, Oregon, USA Portland, Oregon, USA [email protected] [email protected] ABSTRACT and honeynets) or to selectively terminate the operation of the script Attackers rely upon a vast array of tools for automating attacks by denying access (such as with web application firewalls). Unfortu- against vulnerable servers and services. It is often the case that nately, due to the massive code bases being used and the volume of when vulnerabilities are disclosed, scripts for detecting and exploit- vulnerabilities that are being discovered, it is difficult to keep such ing them in tools such as Nmap and Metasploit are released soon approaches up to date and to scale them to the number of vulnerabil- after, leading to the immediate identification and compromise of ities that are being disclosed. Thus, it is important that automated vulnerable systems. Honeypots, honeynets, tarpits, and other decep- defenses keep up with this arms race and attempt to make some tive techniques can be used to slow attackers down, however, such of the most common tasks an adversary relies upon more difficult approaches have difficulty keeping up with the sheer number of and time-consuming. In particular, as reconnaissance and targeting vulnerabilities being discovered and attacking scripts that are being are critical in an attack, slowing down or degrading this capability released.
    [Show full text]
  • Fundamental Data Structures Zuyd Hogeschool, ICT Contents
    Fundamental Data Structures Zuyd Hogeschool, ICT Contents 1 Introduction 1 1.1 Abstract data type ........................................... 1 1.1.1 Examples ........................................... 1 1.1.2 Introduction .......................................... 2 1.1.3 Defining an abstract data type ................................. 2 1.1.4 Advantages of abstract data typing .............................. 5 1.1.5 Typical operations ...................................... 5 1.1.6 Examples ........................................... 6 1.1.7 Implementation ........................................ 7 1.1.8 See also ............................................ 8 1.1.9 Notes ............................................. 8 1.1.10 References .......................................... 8 1.1.11 Further ............................................ 9 1.1.12 External links ......................................... 9 1.2 Data structure ............................................. 9 1.2.1 Overview ........................................... 10 1.2.2 Examples ........................................... 10 1.2.3 Language support ....................................... 11 1.2.4 See also ............................................ 11 1.2.5 References .......................................... 11 1.2.6 Further reading ........................................ 11 1.2.7 External links ......................................... 12 2 Sequences 13 2.1 Array data type ............................................ 13 2.1.1 History ...........................................
    [Show full text]
  • A Song of JIT and GC
    Ga m e of Performance A Song of JIT and GC QCon London 2016 Monica Beckwith [email protected]; @mon_beck https://www.linkedin.com/in/monicabeckwith www.codekaram.com 1 About Me • Java/JVM/GC Performance Engineer/Consultant • Worked at AMD, Sun, Oracle… • Worked with HotSpot JVM for more than a decade • JVM heuristics, JIT compiler, GCs: Parallel(Old) GC, G1 GC, CMS GC 2 ©2016 CodeKaram Many Thanks • Vladimir Kozlov (Hotspot JIT Team) - for clearing my understanding of tiered compilation, escape analysis and nuances of dynamic deoptimizations. • Jon Masamitsu (Hotspot GC Team) - for keeping me on track with JDK8 changes that related to GC. 3 ©2016 CodeKaram Agenda • The Helpers within the JVM • JIT & Runtime • Adaptive Optimization • CompileThreshold • Inlining • Dynamic Deoptimization 4 ©2016 CodeKaram Agenda • The Helpers within the JVM • JIT & Runtime • Tiered Compilation • Intrinsics • Escape Analysis • Compressed Oops • Compressed Class Pointers 5 ©2016 CodeKaram Agenda • The Helpers within the JVM • Garbage Collection • Allocation • TLAB • NUMA Aware Allocator 6 ©2016 CodeKaram Agenda • The Helpers within the JVM • Garbage Collection • Reclamation • Mark-Sweep-Compact (Serial + Parallel) • Mark-Sweep • Scavenging 7 ©2016 CodeKaram Agenda • The Helpers within the JVM • Garbage Collection • String Interning and Deduplication 8 ©2016 CodeKaram Interfacing The Metal Java Application Class loader Java Runtime GC APIs JIT Compiler Java VM OS + Hardware 9 ©2016 CodeKaram Interfacing The Metal Java Application Class loader Java Runtime
    [Show full text]