SECURITY BAKED INTO THE JVM: SIXTEEN SUBJECTS ON THE WIRE

Summary from the TLDR InfoSec newsletter

The fourth installment of a JGDMS security series details how the DirtyChai JVM fork securely propagates user identity across remote calls. To mitigate denial-of-service attacks, the implementation strictly caps requests at 16 Subjects and 64 principals per Subject. Rather than blindly instantiating caller-asserted principal classes, the receiving side enforces a strict four-type allowlist and relies on inert placeholders for unrecognized inputs. Additionally, a SubjectAwareExecutor wrapper preserves calling identities across virtual-thread boundaries, while distributed transactions now require all participants to individually hold commit permissions before a manager will finalize them.