4 ms·
As a Java developer, this gives me the lesson not to use smart meta programming facilities, like reflection, where possible. You reduce amount of code, but at t
by solomatov 9y ago
As a Java developer, this gives me the lesson not to use smart meta programming facilities, like reflection, where possible. You reduce amount of code, but at the cost of making your protocols injectable to arbitrary code often in unobvious ways.
- tannhaeuser 9y agoThat's a good conclusion to take away. But reflection and dynamic bytecode manipulation is used in Java all over the place. Class loaders are a core Java feature, and reflection is used in almost all modern annotation-based packages for DB access, object serialization, remoting, dependency injection, etc. Heck, any JITing language requires process images allowed to execute code in dynamic memory segments, such that basic NoExecute hardware features can't be used. Combine this with Java server-side apps being run in a single process/address space, and I hope you can see that, if nothing else, from a security PoV Java is a dead end.