Nicolas Fränkel's blog
My current company has settled on using Gradle. It doesn’t make me very happy, but you need to learn to work with constraints. Plus, I must admit that the developers who actually implemented the build files did a pretty good job overall: they used Kotlin instead of Groovy, they moved code to regular plugins, etc. This week, I worked on improvements to a new project and set up Renovate.
The constraint system stops a bad call before it leaves the JVM. The Safe Codebase Audit Pipeline stops bad code before a client ever loads it. What remains is identity: who is calling, and can you verify it? Most frameworks answer with a token check at the door. A filter validates a bearer token, sets a thread-local variable, and hopes that nothing downstream forgets to look at it. DirtyChai…
I ve been a big fan of Renovate for a couple of years already. Renovate scans your repositories, detects outdated package versions, and opens pull requests to automatically bump them. It s similar to Dependabot in that it keeps your dependencies up to date. If I had to compare them in one sentence, I d say Renovate is less integrated in the GitHub ecosystem, but handles more ecosystems and, more…
The IoT/IIoT world has a data model problem and the concept of Digital Twin has made this issue more important. Plenty of people have tried to fix it. RFC 9880 and its Semantic Definition Format (SDF) are a serious attempt: a JSON-based, ecosystem-neutral way to describe what a device is and what it does. I have had some experiences with this specification, and I ve understood that the format…
In Part 1, the minimal deployment showed constraints traveling with the proxy: authentication, encryption, hardened deserialization, all declared in configuration and enforced at the call boundary. The proxy is a JAR. That JAR was downloaded and unmarshalled before any constraint ran. That step is the earlier problem. Distributed Java systems that load remote code are vulnerable to supply chain…
I keep coming back to java.util.ServiceLoader. I have used it to put a JSON layer behind a contract, so the core code carries no direct dependency on any particular JSON library, and I can swap the implementation without touching callers. The same shape works for JWT handling, where the concrete library might be jose4j or another JOSE implementation, and you can easily find other decoupling…
Last year, I motorized the rolling shutters on the southern façade of my apartment. My idea was to manage them via Home Assistant. I had a couple of automations in mind: In the evening, roll down the shutters of my bedroomIn the morning:If it s too hot outside, roll down all shuttersIf it s too cold outside, roll down all shuttersIn other cases, roll up all shutters but my bedroom s Living in…
The more distributed a system, the harder it is to secure. Code crosses JVM boundaries. Objects are serialized across trust boundaries. Third-party proxies run inside your process. The usual answer is a network firewall. It helps, but it operates at the wrong level. Java 17 deprecated the SecurityManager, Java 24 put the final nail in its coffin. Most developers didn t notice.
I started as a Java developer, but for some time now, I have broadened my horizons. Recently, I thought about how early languages were dedicated to a single target and platform, and now they are broadening their focus. In this post, I want to write down my thoughts in the hope that it may be useful to others, probably to my future self. Definitions You may have been wondering about the title…
There is an evergreen debate in the Java world: should you always use BigDecimal for money? The short answer is no. The real answer is: it depends on your computational context: the precision you need, the rounding rules you must follow, and the performance budget you have. The problem is that this conversation is often driven by dogma rather than engineering.
In the first post of this series, I focused on the project foundations: what should I do to create a video from photos taken from the same position year after year? I dedicated the second part to aligning images. It wasn t as easy as I expected. I stumbled upon new concepts, such as ORB and RANSAC. In this third and final post, I want to tackle the video creation itself, explain some 'artistic'…
Before working for 2 years on the Apache APISIX API gateway, I was mainly oblivious to API gateways. It s only by working with them that I understood their value. Decoupling the client and the server unlocks a lot of options: moving authentication to the API Gateway, securing APIs, deduplicating API requests, etc. In this post, I want to describe how the same pattern applies to AI. AI gateways AI…
In the previous post, I described the Seasons project: a time-lapse of hundreds of pictures taken from nearly the same viewpoint over the years. The hardest challenge wasn t taking the pictures or assembling them, but aligning them. You might have noticed the nearly part about viewpoint in the above paragraph. Indeed, it s an approximation. I m a human being, not a tripod. The position changes…
I live close to nature. I regularly go for a run in the countryside. Over several years, during my runs, I ve taken pictures from the same position, always roughly the same angle. I had a vague idea in the back of my mind, as an 'artistic' project. One day, I d turn those photos into a time-lapse video, one that would show the passage of seasons across a single place. Spoiler, here s the work in…
Good engineers make decisions based on data. Most businesses assumed that the more data, the better the decision. Then, several factors put a halt to the hoarding of ever more data. GDPR and its localized counterparts, and the cost of storage. However, before the GDPR came into effect, the Datensparsamkeit approach already existed. Datensparsamkeit is a German word that s difficult to translate…
I continue to experiment with AI in the context of software engineering. I m fortunate that my team supports me in exploring different ways to improve our daily work. This week, I designed a team of autonomous agents to implement features, from design to implementation. Why autonomous agents? A long time ago, we were delighted when the IDE offered auto-completion. In the previous two years, things…
I noticed some time ago that three Mastodon features had stopped working on my blog. Each of them seemed like a separate problem, but they had the same root cause. In this blog post, I aim to describe these issues and propose a simple solution. Domain verification Mastodon allows you to prove that you own a domain.
A couple of years ago, I wrote that The Builder pattern is a finite state machine!. A state machine consists of states and transitions between them. As a developer, I want to make illegal states unrepresentable, i.e., users of my API can t create non-existent transitions. My hypothesis is that only a static typing system allows this at compile-time. Dynamic typing systems rely on runtime…
Last month, I became aware of GitHub agentic workflows. I read the site carefully, but the use cases weren t very exciting to me. I tried the continuous documentation It didn t work out initially, and because of my lack of involvement, I left it as it was. However, I succeeded in another one that I want to describe in this post. With lessons learned here, I managed to make the documentation…
I like to analyze codebases I start working on, or that I left for months. I ask my coding assistant, case in point, Copilot CLI: 'analyze the following codebase and report to me improvements and possible bugs.' It s vague enough to leave room for crappy feedback, but also for some interesting insights. I did it last week on a code base. Copilot returned a list of a dozen items. I asked it to…
Leading your organization to use OpenTelemetry is a challenge. In addition to all the usual project hurdles, you ll face one of these two situations: convince your teams to use OpenTelemetry, or convince them to move from the telemetry tool they are already using to OpenTelemetry. Most people don t want to change. You ll need lots of effort and baby steps. My tip is the following: the fewer the…