Subject: Warning Signs: PSA Video

From: Heart Association Announcement <[email-masked]>
Date: Tue, 10 Jun 2014 09:33:56 -0700

Would you Rather Die from a heart attack then do something to prevent it now?

- Heart Disease is the No. 1 killer of Women - 

Have your experienced any of the Following:

- Uncomfortable pressure, squeezing, fullness or pain in the center of your chest?
- Pain or discomfort in one or both arms, the back, neck, jaw or stomach?
- breaking out in a cold sweat, nausea or lightheadedness?

These are all symptoms of an on-coming heart attack. 

View the top Way to Heart Attack Prevention > http://www.punbyte.com/heart/assoc/psa/video.index

[ Warning: If you have any of these signs, dont wait more than five minutes before calling 9-1-1 ]

/

We hope that you find this information useful.
To stop further wellness announcements - write Member Update Systems at nine one six sevenROAD 177_Oakwood, OH 45873 or visit http://www.punbyte.com/o4jtfr.4iujf

@bestsss I'd put using a direct CharBuffer in the "too much effort" bin, but that's certainly debatable. I remember reading the sun article without any mention of GC (which alone made it dubious at best), but that one's pretty old I think.. was it really released after Java5 and the inclusion NIO (and hence charbuffers)? Actually the direct charbuffer is one of only 2 ways I know of on how to avoid the basic problem. And using unsafe to create a char array or string outside the GC heap is certainly even more complex (and less portable).   Voo Jan 16 '12 at 20:49  return "Manager of Operations" if thats what your requirements specified, else you would just use the base class's implementation. Also you could make Person an abstract class and thereby make sure down-stream classes implement a Title property.   Raj Rao Nov 12 '10 at 20:21 
14	  	
Its important to remember that one might say "Composition over inheritence" but that does not mean "Composition always over Inheritence". "Is a" means inheritence and leads to code reuse. Employee is a Person (Employee does not have a person). If you add an ActionListener to JPasswordField (probably the usual case), you get the password String as the action "command". It can also get stuck in the underlying Document. But still, it's a pointless tick in your employer's pointless tick list.   Tom Hawtin - tackline Jan 16 '12 at 22:52
10	  	
char[]? Why not byte[]? In any thread dump/heap analyzer you can see Strings, and it's easy to notice if one contains password. For char[] it's harder, but still, if your heap analyzer will display chars one by one it'll be same as String. For byte[] it's unlikely.   mvmn Jan 17 '12 at 22:38
	
I am not an expert, but may it be related to strings are objects and are passed by reference thus creating multiple instances in memory?   scott lafoy Dec 5 '12 at 17:33
2	  	My understanding is that with the amount of memory reorganizing that can be done with the runtime, copies of even a char[] might be left in memory and never be cleared until that memory is reused. I don't know a source that validates that though. Either way I doubt the String would get cleared at GC time but rather at the time an Object is reallocated over that memory.   Mark Peters Jan 16 '12 at 14:30 
17	  	
@Mark Peters: If the GC kicks in, before you empty the char-array, you have another copy. But this copy is at least in a heavy used area of the memory, so the chances are high it gets overwritten fast.   Mnementh Jan 16 '12 at 14:32
  	  	
+1 for explaining; as I guessed it's not much of a security improvement, but it should offset the inconvenience. Even though my guess is that most people will just make a String out of the array.   Viruzzo Jan 16 '12 at 14:36
  	  	
Correct. But, unless it's encrypted, it can still be read.   Bogdacutu Jan 16 '12 at 19:19
3	  	
I extremely doubt that any GC is overwriting the young generation - seems like an extreme overhead for no real advantage. At least hotspot doesn't do this afaik (although depending on the implementation we may get basically the same effect as overwriting - we could map different virtual memory to the same physical pages). Personally I think a char array is a nice compromise between effort and won security: Using strings doesn't make live much easier and using anything other than char[] to avoid the GC problem is horribly convoluted and complicated.   Voo Jan 16 '12 at 19:37 
  	  	
if you need to overwrite anything, you should use Direct Buffer but again, I have voiced my opinion multiple times: to cover the tracks one need to go to down to socket buffers which is not even possible in java.   bestsss Jan 16 '12 at 20:28
  	  	
@Voo, a direct CharBuffer is the best compromise but the guys at Sun didn't spot that and the article ala String considered dangerous got too much ground and widespread citation.   bestsss Jan 16 '12 at 20:2
I actually quite like this example, because, what if an Employee is both a Manager and and an Agent. In environments where you can't inherit from more that one class, you have a problem and you most likely end up with duplicate data. With composition you can handle this in an elegant way. And the overhead is minimal, even in environments where multiple inheritance is possible I would prefer this solution.   netiul Apr 14 at 8:21 
  	  	
Classes certainly aren't required for composing things together. Indeed, classes often prevent composition by hiding the composable bits inside application-specific wrapThis is one of the better answers, in my opinion - I will add to this that trying to re-think your problems in terms of composition, in my experience, tends to lead to smaller, simpler, more self-contained, more reusable classes, with a clearer, smaller, more focused scope of responsibility. Often this means there is less need for things like dependency injection or mocking (in tests) as smaller components are usually able to stand on their own. Just my experience.