Inside Java is a podcast for Java Developers brought to you directly from the people that make Java at Oracle. We'll discuss the language, the JVM, OpenJDK, platform security, innovation projects like Loom and Panama, and everything in between.
Given how prevalent Java is on web servers throughout the internet, security in Java is of critical importance. There's the security of the JDK itself, of course, which is overseen by the OpenJDK Security Group, which you should report JDK vulnerabilities to. But there are also the algorithms and features Java offers applications that are built on top of it and the cryptographic road map is an essential part of that development process. In recent years, post-quantum encryption has made big splashes but Java now also supports PEM texts and is considering the adoption of Argon2.
In this "Ask the Architects" episode of the Inside Java Podcast, recorded during JavaOne 2026, Nicolai Parlog talks to Sean Mullan, Lead of the OpenJDK Security Group and Tech Lead of the Oracle Security Libraries Team.
"Ask the Architects" is our podcast show, where we talk to experts in OpenJDK about their work on the Java language, API, and runtime.
Show notes:
OpenJDK Security Group: https://openjdk.org/groups/security/
Oracle JDK Cryptographic Roadmap: https://www.java.com/en/jre-jdk-cryptoroadmap.html
Post-Quantum Hybrid Key Exchange for TLS 1.3: https://inside.java/2026/02/17/tls-post-quantum-hybrid-key-exchange/
JEP 542 - PEM Encodings of Cryptographic Objects: https://openjdk.org/jeps/542
JEP Draft for Argon2: https://openjdk.org/jeps/8377081
17 Sept 2026
"AOT Caching - Netflix' Practice vs OpenJDK's Theory" [I/O]
Java projects that want to reduce their launch times need to look into Java's new ahead-of-time capabilities. A training run is used to populate a cache that, in production, allows the JVM to short-circuit many operations, like class loading and linking, profile gathering, and - probably soon - JIT compilation. To get the most out this feature, a good training run is essential. Netflix approach is pretty much the ideal one: use a canary deployment of a new version to collect training data and create the cache for the remaining deployments from that. But, from time scales to checkpointing, from managing to inspecting cache files, there are a number of details to consider.
In this "Input/Output" episode of the Inside Java Podcast, recorded during JavaOne 2026, Nicolai Parlog talks to Martin Chalupa, Senior Performance Engineer at Netflix and John Rose, JVM Architect at Oracle and Lead of OpenJDK's Project Leyden.
"Input/Output" is our new show, where we talk to people outside of OpenJDK to bring you their perspectives and insights into what's happening in the Java ecosystem. This special episode comes with an OpenJDK architect to boot.
Show notes:
JDK 27: https://jdk.java.net/27
Project Leyden: https://openjdk.org/projects/leyden/
Martin's talk at JavaOne 2026: https://www.youtube.com/watch?v=4kEh8hxAP4U
10 Sept 2026
"Declassifying the Java 27 Release!" [IJN]
Java 27 is heading for release on September 15th. As with every release of the JDK there are a host of changes that will impact developers, from new features, to changes in behavior of existing features. In this episode of the Inside Java Newscast we will be "declassifying" all the developer impacting changes in Java 27.
Contact Inside Java
Guest appearances
Books guests
Based on episode analysis; this does not confirm that the show is currently accepting guests.
Host of Inside Java?
Claim your podcast to manage its listing and keep your show details accurate.
Pod Engine is an independent podcast discovery and analytics service and is not affiliated with or endorsed by this podcast. Artwork and show content belong to their owners. Full legal notice.
Explore this show Podcast research with Pod Engine
