# Security Baked Into the JVM: why fork Apache River and OpenJDK?

DevFeed: [Security Baked Into the JVM: why fork Apache River and OpenJDK?](<https://devfeed.tech/articles/security-baked-into-the-jvm-why-fork-apache-river-and-openjdk-18928.md>)

Original publisher: [Read original article](<https://blog.frankel.ch/security-baked-into-jvm/1/>)

Author: Peter Firmstone

Published: 2026-06-28T00:00:00Z

Content type: opinion

Language: en

Sources: [Nicolas Fränkel](<https://devfeed.tech/sources/nicolas-frankel.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Java](<https://devfeed.tech/topics/java.md>), [openjdk](<https://devfeed.tech/topics/openjdk.md>), [Architecture & Design](<https://devfeed.tech/topics/architecture-design.md>), [Remote Procedure Call (RPC)](<https://devfeed.tech/topics/rpc.md>), [Networks](<https://devfeed.tech/topics/networks.md>)

Tags: [authorization](<https://devfeed.tech/tags/authorization.md>), [dirtychai](<https://devfeed.tech/tags/dirtychai.md>), [discovery](<https://devfeed.tech/tags/discovery.md>), [distributed](<https://devfeed.tech/tags/distributed.md>), [ipv6](<https://devfeed.tech/tags/ipv6.md>), [java](<https://devfeed.tech/tags/java.md>), [jgdms](<https://devfeed.tech/tags/jgdms.md>), [jini](<https://devfeed.tech/tags/jini.md>), [jvm](<https://devfeed.tech/tags/jvm.md>), [lock-free](<https://devfeed.tech/tags/lock-free.md>), [microservices](<https://devfeed.tech/tags/microservices.md>), [openjdk](<https://devfeed.tech/tags/openjdk.md>), [rpc](<https://devfeed.tech/tags/rpc.md>), [security](<https://devfeed.tech/tags/security.md>), [self-healing](<https://devfeed.tech/tags/self-healing.md>), [technical](<https://devfeed.tech/tags/technical.md>)

## AI overview

This article introduces DirtyChai, a community fork of OpenJDK that restores Java authorization infrastructure, and JGDMS, a security-hardened fork of Apache River for dynamically discoverable microservices over IPv6. It argues that distributed systems require security beyond network firewalls and outlines the projects' complementary roles, including authorization, service discovery, hardened deserialization, transport security, proxy trust verification, and codebase safety checks.

## Source excerpt

The more distributed a system, the harder it is to secure. Code crosses JVM boundaries. Objects are serialized across trust boundaries. Third-party proxies run inside your process. The usual answer is a network firewall. It helps, but it operates at the wrong level. Java 17 deprecated the SecurityManager, Java 24 put the final nail in its coffin. Most developers didn't notice.