asmhatreandClaude Sonnet 5
f59c1de96d
Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01B38FGKKam5SCGgwgduVAh3
2.1 KiB
9. JFR redaction (JEP 536) and the Vector API (JEP 537)
Prev: 8. PEM · Next: 10. Other 27 changes
JFR redacts secrets in the recording by default
A JFR file records the JVM's command-line arguments, system properties and environment variables. Those routinely hold passwords and tokens, and recordings get attached to tickets.
scripts/jfr-redaction.sh starts an Idle process with -Dapi.token=abc123 -Dregion=ap-south-1 ... --password=hunter2 --user=ankur
and DB_PASSWORD=hunter2 in the environment, then prints what reached the file (40):
| Configuration | -Dapi.token |
--password |
DB_PASSWORD |
region |
|---|---|---|---|---|
| JDK 26 | abc123 | hunter2 | hunter2 | ap-south-1 |
| JDK 27 default | [REDACTED] |
[REDACTED] |
[REDACTED] |
ap-south-1 |
27, redact-argument=--user*,redact-key=region |
abc123 (exposed) | hunter2 (exposed) | hunter2 (exposed) | [REDACTED] |
27, redact-argument=+--user*,redact-key=+region |
[REDACTED] |
[REDACTED] |
[REDACTED] |
[REDACTED] |
27, redact-argument=none,redact-key=none |
abc123 | hunter2 | hunter2 | ap-south-1 |
The trap in row 3: a list you supply replaces the built-in patterns. Without the + prefix you have silently turned the defaults off for everything you did not list.
The Vector API is still incubating
VectorDemo (25) computes a dot product with and without jdk.incubator.vector and asserts they agree within 0.1%.
The same class file runs on 26 (eleventh incubator, JEP 529) and 27 (twelfth, JEP 537): the only public API change between them is that VectorOperators changed from abstract to final
(50). The preferred species is machine dependent (S_512_BIT, 16 float lanes, on the machine that wrote the transcript).
For the API itself see the ankurm.com guide: https://ankurm.com/java-vector-api-jep-537-simd-guide/.
Prev: 8. PEM · Next: 10. Other 27 changes