Top all-time · #5640
Wouter Coekaerts
Personal blog · wouter.coekaerts.beprogrammingsecurity
Wouter Coekaerts's personal blog at wouter.coekaerts.be covers programming and security. Since 2011, 14 different Hacker News readers have linked it 15 times, most often “The Java type system is broken”. It is still writing: the last post was on 2026-09-29, and you can follow it by feed.
Too few sampled comments (5) to say how often HN recommends it.?
Why HN links it
HN readers link this blog for its post arguing Java's type system is broken by compiler bugs, which commenters cite when discussing Java soundness, and for an irssi window switcher page.
Summarised by Claude from a sample of 5 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Wouter Coekaerts personal site
Most-linked posts?
- The Java type system is broken5 people · 6 mentions · first linked 2018-05-17
- /2011/spring-vulnerabilities2 people · 2 mentions · first linked 2013-01-09
What Hacker News says?
Java uses lazy linking, but Java's static type system is sound (modulo some bugs [1]). The Java VM type system is different from that of Java the language, but it is also sound. [1]: http://wouter.coekaerts.be/2018/java-type-system-broken
Comment linking /2018/java-type-system-broken
on “I Want Off Mr. Golang's Wild Ride”Submitted The Java type system is broken as a story · 291 points
HN discussionI don't use Rails, and read up on the vulnerabilities. Here's a quick summary: 1. This class of problems is not unique to Ruby. 2. Similar problems have been identified in Struts, and python's pickle. 3. Specifically in this case, YAML.load() can deserialize unintended object types. In the case of Struts the problem was the expression library used can also deserialize unintended object types (like File), plus settin…
Comment linking /2011/spring-vulnerabilities
on “Multiple vulnerabilities in parameter parsing in Action Pack”Submitted The Java type system is broken (2018) as a story · 29 points
HN discussionAny sufficiently advanced serialization standard will let you serialize/deserialize a wide variety of objects. When J2EE SOAP libraries are passing large amounts of XML back and forth over the wire, it is often going to get instantiated via calling a zero-argument constructor and then firing a bunch of setter methods. As J2EE has learned to its sorrow, there are some good choices for objects to allow people to deser…
Comment linking /2011/spring-vulnerabilities
on “What The Rails Security Issue Means For Your Startup”Submitted The Java type system is broken (2018) as a story · 4 points
HN discussion> You can get CCEs without explicit casts or compiler bugs though Using raw types is cheating. It's essentially using a different language and, as you say, the compiler will tell you that you are. > However, if you obfuscate it a little javac doesn't know about it anymore. It's a bug (rather, a few bugs): http://wouter.coekaerts.be/2018/java-type-system-broken (I assume that's where you got the example from) You sho…
Comment linking /2018/java-type-system-broken
on “Records Come to Java”Submitted Decapsulation: Breaking Java Strong Encapsulation as a story · 2 points
HN discussionhttp://wouter.coekaerts.be/irssi/window_switcher will change your life. Makes using dozens of channels practical. It gives you find as you type for channel names. e.g. to switch to #mono you could probably type control-g mo<enter> It shows the matched channel names in the status bar as it filters.
Comment linking /irssi/window_switcher
on “Irc in bash”Submitted Breaking java.lang.String as a story · 2 points
HN discussionSubmitted The Java type system is broken as a story · 2 points
HN discussionSubmitted The Java type system is broken as a story · 2 points
HN discussionSubmitted Java Puzzle 9: Tweet as a story · 2 points
HN discussionSubmitted Challenging Java Puzzles Regarding Synchronization. as a story · 2 points
HN discussionSubmitted Email address spoofing with RLO as a story · 1 points
HN discussion
