Endre's Tech Corner!

Does not seem to be working on hotspot 1.6.0_27. I...

2012-01-09T15:45:12.444+01:00

Does not seem to be working on hotspot 1.6.0_27. I'm using -XX:+UseThreadPriorities -XX:ThreadPriorityPolicy=2. I get no warning and the thread dump says all threads are priority 10. This is on CentOS (variant of linux used for webservers and clusters). Would be great if you could confirm!
Anyway, relying on an un-fixed bug is asking for trouble. Many thanks for this post!

Thanks, that was just what I needed. Very elegant ...

2011-03-03T11:30:49.416+01:00

Thanks, that was just what I needed. Very elegant solution!

Wow Thanks So much! This really helped!

2011-02-09T13:39:37.360+01:00

Wow Thanks So much! This really helped!

Thanks a lot Emre. You just saved me a lot of work...

2010-11-07T04:56:00.452+01:00

Thanks a lot Emre. You just saved me a lot of work too.

Although I really think you should use types in the Map declaration:

private final Map<Integer,ReleasedAction> _map = new HashMap<Integer,ReleasedAction>();
instead of

private final Map _map = new HashMap();

Else it won't compile in my end. (Maybe it just gets filtered out because of html-escaping?)

Anyway with the above fix it works as specified and it would have taken me a great deal of time to figure it out for myself and it probably wouldn't have been just as sophisticated :)
So thanks again.

Sune

Endre, Thanks. This is very helpful information. ...

2010-09-02T17:29:22.664+02:00

Endre, Thanks. This is very helpful information. Please keep this web site up! -Pete

AND the remove() method needs to set installed=nul...

2010-08-29T17:48:32.538+02:00

AND the remove() method needs to set installed=null; *sigh* sorry.

Sorry I meant Map in my second question.

2010-08-29T17:47:46.752+02:00

Sorry I meant Map in my second question.

Thank you very much for this wonderful fix! It is ...

2010-08-29T17:47:05.754+02:00

Thank you very much for this wonderful fix! It is a great drop in fix for a problem that could have cost me a whole evening!

I made a small change though, I changed install() to a static that instantiates and installs the fix if it hasn't been installed yet.

private static RepeatingReleasedEventsFixer installed;

public static void install() {
if (installed == null) {
installed = new RepeatingReleasedEventsFixer();
Toolkit.getDefaultToolkit().addAWTEventListener(installed, AWTEvent.KEY_EVENT_MASK);
}
}

public static void remove() {
if (installed != null) {
Toolkit.getDefaultToolkit().removeAWTEventListener(installed);
}
}
I guess one could turn it into a proper Singleton by adding a private constructor to it.

Some questions though:

1) Why did you use HashMap not TreeMap? Wouldn't a hashmap be slower due to calculating the hashes?

2) Why did you create the Map without specifying the type? E.g. I changed it to Map I wonder what you think about that.

Thanks again, Barend Scholtus

Hero. Thanks.

2010-08-27T10:23:57.339+02:00

Hero. Thanks.

Thanks, I'm happy if it is of any help!

2010-03-14T04:35:57.693+01:00

Thanks, I'm happy if it is of any help!

Excellent write up, thank-you for the code too.

2010-03-13T18:48:42.004+01:00

Excellent write up, thank-you for the code too.

Hi Endre, you really should give the NetBeans a tr...

2010-01-06T11:16:53.245+01:00

Hi Endre, you really should give the NetBeans a try! It has separate debugger and profiler but some of their features overlap in the way you're describing here:

- the debugger has a heapwalker, you can stop the debugged application at any time and browse the heap

- the profiler supports "profiling points", kind of breakpoints for profiling. You can measure time between two profiling points, take performance/heap snapshots by hitting a profiling point and much more

- when profiling an application a heapdump is taken and opened automatically on OutOfMemoryError

Thanks, I'm very glad you liked it! :-)

2009-11-29T16:14:09.635+01:00

Thanks, I'm very glad you liked it! :-)

Hi, Endre - I just started some swing programming ...

2009-11-29T04:43:44.701+01:00

Hi, Endre - I just started some swing programming with my only clientside GUI experience being SWT. THIS IS A GREAT ARTICLE! It explains what is actually happening rather than telling you about a bunch of interfaces and how you add listeners.
"MouseEvents goes to the most specific ("deepest") child component residing under the mouse, while KeyEvents are sent to the focused window, routed using the KeyboardFocusManager to the focused component in this window." is just such a simple AND significant statement if someone is doing a relatively complex GUI. THANKS!
Ray Case

Thank you a lot! You helped me out.

2009-03-20T10:03:00.000+01:00

Thank you a lot! You helped me out.

Hello,

Please add your site at http://www.s...

2009-03-19T16:20:00.000+01:00

Hello,

Please add your site at http://www.sweebs.com. Sweebs.com is a place where other people can find you among the best sites on the internet!
Its just started and we are collecting the best found on the net! We will be delighted to have you in the sweebs listings.

Regards
Kris

[Crossposting!] Yes, exactly!

2009-03-10T18:36:00.000+01:00

[Crossposting!] Yes, exactly!

Well, I still don't quite get it: I presume that i...

2009-03-10T18:35:00.000+01:00

Well, I still don't quite get it: I presume that if you are paranoid, you're running with a SecurityManager already (as Applets do). You'd also sign these jars. The idea of checking classloaders was interesting. However, what about the check against WantedClass.class: This will fail if we're not talking about the same class that NeedingClass has loaded itself.

My point boils down to: If you are able to switch out the WantedClass in any way, what's the point of the friend security mechanisms in the first place? Isn't this really a) for making a pretty API (in the "normal case" when running java "command line" without SecurityManager, as in this case, then all bets are off: You can do ANYTHING), and b) when you're in a SecurityManaged mode, in which case you'd make it impossible to instantiate this class from anywhere else.

If the question is what I can manipulate, I could just recompile the entire thing and use that?! I thought that your initial entry were basically trying to make a "friend" logic for the runtime classes - and I don't quite see how I could manipulate anything there without getting caught, in a security managed scenario.

An example where you could bypass the suggested solution, in a relevant security-conscious world, would be great.

BTW, when some evil person is able to sneak in pat...

2009-03-10T18:28:00.000+01:00

BTW, when some evil person is able to sneak in patched classes, something is wrong anyway, even without the friends pattern (you want to sign your JAR then to ensure consistency). So maybe this is all just fluff and checking for the proxy to be set twice and checking the (enclosing) class of the proxy (or some other known unique property) plus checking the classloader is more the enough. And of course, you should check what kind of data/functionality you actually expose and if it is really security relevant.

Well no. When talking about security you should no...

2009-03-10T18:15:00.000+01:00

Well no. When talking about security you should not assume things about the source of the code. For applets, I could think of a scenario where a fishing site uses your JAR (your applet jars can easily be downloaded and embedded in another site) and replaces one class inside (if not signed), OR prepend the classpath with the hacked class. Attackers can probably also play tricks with classloaders, so that the same class gets loaded again into the VM, but from a different source (yeah, this is possible). The only way to be really safe is using the security access control mechanisms of the VM, and sign your JAR. Unfortunately, this requires the _user_ to install an appropriate security policy (because you need to guard calls to setProxy()), which is quite unintuitive ('what? you need a policy to run your own code? wtf?').

At least, you should also check for identical classloader in your setProxy() method. But this wouldn't help in the first scenario. I don't see an easy and practical solution for the super paranoid. But I guess this is why there is no 'friend' in the Java language, as this opens up a can of worms with respect to security.

I thought that if you can manipulate the classpath...

2009-03-10T17:30:00.000+01:00

I thought that if you can manipulate the classpath, then pretty much all bets are off at any rate - you most probably also have control over the Security policy and -Manager then too?

In a really paranoid scenario, an attacker would r...

2009-03-10T17:04:00.000+01:00

In a really paranoid scenario, an attacker would replace your WantedCode class, i.e. you wouldn't have a distinct EvilCode class, but instead attacking code would pretend to _be_ WantedCode infact. This could be done by hacking the classpath or similar. In this scenario your check would pass, and you would execute the evil code. The solution is to introduce a security permission, check for it in setProxy() and call setProxy() with privileges enabled (AccessController.doPrivileged() ). However, this requires a security policy to be set up, which makes it a big difficult to run as e.g. applet. I'm working on an example.

Very glad to be of help!

2009-02-18T23:24:00.000+01:00

Very glad to be of help!

This helped me. Thanks, Steve

2009-02-18T17:59:00.000+01:00

This helped me. Thanks, Steve

That worked for me - thank you very much!

2009-01-08T17:05:00.000+01:00

That worked for me - thank you very much!

Endre's Tech Corner!

Does not seem to be working on hotspot 1.6.0_27. I...

Thanks, that was just what I needed. Very elegant ...

Wow Thanks So much! This really helped!

Thanks a lot Emre. You just saved me a lot of work...

Endre, Thanks. This is very helpful information. ...

AND the remove() method needs to set installed=nul...

Sorry I meant Map in my second question.

Thank you very much for this wonderful fix! It is ...

Hero. Thanks.

Thanks, I'm happy if it is of any help!

Excellent write up, thank-you for the code too.

Hi Endre, you really should give the NetBeans a tr...

Thanks, I'm very glad you liked it! :-)

Hi, Endre - I just started some swing programming ...

Thank you a lot! You helped me out.

Hello,Please add your site at http://www.s...

[Crossposting!] Yes, exactly!

Well, I still don't quite get it: I presume that i...

BTW, when some evil person is able to sneak in pat...

Well no. When talking about security you should no...

I thought that if you can manipulate the classpath...

In a really paranoid scenario, an attacker would r...

Very glad to be of help!

This helped me. Thanks, Steve

That worked for me - thank you very much!

Hello,

Please add your site at http://www.s...