I am writing about my experiences as a software engineer.
Git has supported signing for some time (version 1.7.9 released in 2012). As git's own documentation says, git is cryptographically secure but not foolproof . By cryptographically secure it means that every commit has a hash value and all future values are built on top of previous values. This makes tampering with the history of a repository extremely difficult without detection. By not foolproof…
In the complex software development environment that we are in there are countless layers of abstraction that we build upon. This is part of what enables development to be so productive in this day and age. Most of the time this is helpful. For the average developer to not have to worry about CPU registers, page size, TCP routes, etc allows focusing on what makes the software you build different…
On March 20, 2024, the Cyber Safety Review Board (CSRB) published its findings about the summer 2023 Microsoft Exchange Online intrusion by Storm-0558. The CSRB is a relatively new organization that, to this point, has produced two major reports on specific security incidents. The first was published in July 2022 and covered the vulnerability known as Log4Shell. The second review was this one…
Security is a constant battle in modern development. While there are always new exploits and things to protect against, we must not forget about the exploits and the security concerns that we have needed to protect against for years. This is why even after all of these years we still have SQL injection in the OWASP top 10. Recently I have had the opportunity to once again dig into the concerns and…
The image above has taken over the software development internet by storm over the last day. Particularly on Twitter/X, it seems to be about all people are talking about. Just twelve lines of code on a slide and you would have thought it was the craziest thing anyone had ever seen. So why are people freaking out? The reactions seem to fall into three different groups. Those who think this is the…
Occasionally you will find yourself given the opportunity to work within a new set of constraints in the technology field. I find it is almost always beneficial to embrace these situations as there is always something interesting to learn from them even if you don't need to develop within those constraints for long, the learnings from that environment can help you in other, seemingly unrelated,…
Recently MicKinsey came out with an article titled " Yes, you can measure software developer productivity ". After so much research by so many in software development including some of the biggest players such as Google, Meta, Microsoft, etc. McKinsey has come in and solved it for us. I of course am kidding. This piece is, unsurprisingly, just a marketing fluff piece aiming to drum up consultant…
Modern software development spends the vast majority of its time at an extremely abstract level. Gone are the days of the majority of developers having to worry about registers, manual memory management, and pointers. This has undoubtedly led to an improved velocity of the creation of software. We can now spend more of our time focused on delivering value to the users of the software we are…
Often when embarking on the implementation of a new piece of functionality or a new product entirely a common first step is to build a proof of concept (POC). Proof of concepts are a valuable tool in software development and provide various benefits. These benefits include the ability to test out new technology, validate ideas, gain stakeholder buy-in, and fail quickly. There is a reason that they…
To me, one of the allures of software development is what Fred Brooks famously labeled as working "only slightly removed from pure thought-stuff. [Software developers] build [their] castles in the air, from air, creating by exertion of the imagination." This starting from nothing and building up something of value is enjoyable. Put simply, software engineers want to write software. This thought…
A common issue that is experienced in software development is the disconnect between how the software is described as working and how it works in reality. This often can be caused by a well-meaning developer coming before you and either misunderstanding how the system works and documenting that misunderstanding as truth or documenting the reality at the time but the documentation has fallen out of…
As technologists, we spend much of our time learning the latest technologies, development practices, and tools. These are very important to the work that we do and thus we rightfully give them a lot of our attention. There are many resources from which to learn this information whether they be blog articles, conferences, certifications, videos, etc. Understanding the technology is only half the…
Software architecture can be a hard thing to pin down. While at times architecture may feel intimidating, anyone writing any code is participating in software architecture. From simple scripts to sprawling distributed systems there is always a software architecture whether planned or not. While every person that writes code participates in architecture, there are some that have the distinct role…
One of the commonly used techniques used by popular Java frameworks and libraries is object proxies. Even though it is a popular pattern used in many of the libraries that developers use daily, many developers have never directly built a Java proxy in their own code. While the use case may not come up commonly in everyday code, its usage makes sense in some cases and understanding how the…
In a recent project I worked on DynamoDB was used as the data store. The project was an internal utility that would get spiky utilization. It would go from zero traffic to a non-insignificant amount of usage in a short time. Combined with the almost zero operational overhead of managing a DynamoDB table and it was a solid choice as the data store for this tool. The Problem # After several months…
Being a software engineer presents a great opportunity in the current job market. There is a great need for software professionals which creates many opportunities for software engineers. At the same time, many motivated and passionate individuals work in the field. Given this, how does one stand out from others and fast track their growth as a software professional? Let us dig into a few ideas.…
Designing software is often a daunting task. We often confront problems that we may not initially know how to solve. Staring at a blank IDE with no clue where to start can lead to a programmer's version of writer's block. Similar to what is suggested to get over writer's block, simply writing something down and starting the process can be a great way to overcome this obstacle. This relates to a…
The natural world has only given us two units of time determined by the cosmos, that is the year and the day. Months, hours, minutes, and seconds are all human inventions that have no basis in the natural world. Days and years are not this way though. A day, of course, is one complete rotation of the earth and a year is one rotation around the sun. The unfortunate part about this is that these two…
Software development can be a fast-paced world, different fads come and go through the industry, many times what was old becomes new again and there are no less than three dozen vendors vying for you to build your system using their technology. This is just the nature of the industry. One of the many problems with this; however, is that often multiple fads or competing technologies can be found in…
Virtual threads in Java have been a long-awaited feature in the Java language and we are finally getting to play with it in as a preview feature of Java 19. Virtual threads were added in JEP-425 as part of Project Loom. The goal of Project Loom is to enable a high-throughput, lightweight concurrency model in Java, virtual threads are a core part of enabling that goal. Why are virtual threads…
SQL injection is an extremely critical security vulnerability. There is good reason that injection has had a prominent location in the OWASP Top 10 since its inception. Often the sophistication needed to successfully perform a SQL injection is low but the damage can be extremely high. This is a very concerning combination, we would at least hope that the most damaging of attacks would take a lot…
I have written before about UUIDs and other unique identifiers. As a reminder UUIDs are 128-bit identifiers that strive for unique identifier generation without requiring the generation to be done in a centralized location. The specification for UUIDs was written in 2005 and is defined in RFC 4122 . This specification has served the industry fairly well. Even so there have been many other…
Recently I was working on a piece of functionality where we ended up with a collection of items that each had a status of if they had been successfully handled or not. At this particular part of the application, we needed to do certain actions on items that were successfully processed and something else on those that had failed. The original code looked something like the following: List < String…
Software design patterns are defined as "a general, reusable solution to a commonly occurring problem within a given context in software design." These patterns often will naturally come out as you develop and even without learning their names or learning about them directly people will often use these patterns. The benefits of learning the formal name and definitions of software design patterns…
A couple of coworkers and I recently decided to read Modern Software Engineering by Dave Farley as part of a book club we run at work. This book comes to us from one of the pioneers of continuous delivery, the man that literally wrote the book on it . This book is fairly high-level but spurred some solid conversations among my colleagues that we found helpful. Overview # The book is broken into…
Every year about this time I am flooded with images and reminders that it is graduation time. This invariably reminds me of my own education. Several years ago I had the honor of graduating from Utah State University with a computer science degree. There is a solid amount of debate in the tech community about what kind of education is best for someone going into software. There are many options…
Several years ago I heard a man (I believe he was an airport architect) describe one of his job requirements as understanding wayfinding . Wayfinding is defined as encompassing "all of the ways in which people (and animals) orient themselves in physical space and navigate from place to place". In more modern usage, and the architect above's usage, it has been extended to refer to the user…
Whatever you are developing there is going to be at least some type of constraint you are working within. Often this can be something such as time or money. These are business-facing constraints. I have yet to see a project that had unlimited time to complete and where there were no economic decisions to be made. At other times we may be faced with technical constraints. These can be things such…
One of my favorite ways to learn is reading other people's code and having others read mine. A place we have that opportunity often is during code reviews. I know that code reviews are not everyone's favorite thing to do but I find them extremely valuable and enjoy doing them. Unsurprisingly, there are various levels of quality when it comes to code reviews. I have seen the whole range from a…
It is within human nature to take the easiest path from point A to B. This is very often a great thing. Why should we exert extra energy in accomplishing a task? Bill Gates is claimed to have said, "I choose a lazy person to do a hard job. Because a lazy person will find an easy way to do it." All of this being said, sometimes what initially seems like an easier way to do something can end up…
It is human nature to stay within our comfort zones. There is a reason "comfort" is in the name. That being said, it is no secret that very little learning is accomplished while staying in your comfort zone, and if there is anything we know about technology it is that it is constantly changing. Taking this to heart there are various methods you can go about leaving your comfort zone. So how do you…
In today's quick post I would like to cover a pitfall that I have seen several developers fall into when using the Okta Java SDK when verifying JWT signatures. I have found it interesting that two independent teams working on integrating with Okta via Oauth2 have run into this same problem when verifying JWTs. When you receive a JWT from a client you need to verify its signature before you can…
Imposter syndrome can affect anyone. It can affect a new parent or a seasoned veteran in a particular field. While some people and some situations lend themselves to imposter syndrome more than others, no one is immune. Often imposter syndrome is discussed as a negative thing that can stifle people and paralyze them. This is indeed true. I, however, would like to dig into it to see what benefits…
Building a distributed system is not easy. There are many concerns a distributed system developer must take into account at all times. The more concerns a developer must keep track of, the more likely something is going to slip through the cracks and be missed. Often these concerns that need to be addressed and maintained are not core to the problem that is being solved, often labeled…
I recently had the pleasure of reading Chris Richardson's "Microservice Patterns" book. Even though this book is now around three years old I still find it very applicable which can't be said for many books in the technical arena, especially one focused on actionable insights. I think it is a worthwhile read for any developer starting their journey into the microservices arena. Let's dive into…
Throughout all the recent items as we have discussed Java serialization, we have been discussing many of the challenges that come along with it. While on the surface it looks simple to implement, in reality, it is far from it. Due to the effectively hidden constructor provided by the serialization framework Serializable code is open to many potential issues that need to be protected against.…
Kafka Streams is a powerful tool that adds a high-level abstraction on top of Kafka's rock-solid infrastructure to enable building streaming applications. It has several features mainly grouped around two concepts, KStreams which represents an infinite stream of data, and KTables which represent a projection of a stream's data. Even calling these two concepts different is not completely true due…
In a previous section, we discussed different ways to make singleton objects in Java. One of the methods we discussed followed the following pattern: public class Elvis { public static final Elvis INSTANCE = new Elvis ( ) ; private Elvis ( ) { . . . } public void leaveTheBuilding ( ) { . . . } } By making the constructor private we prevent unexpected creations of the Elvis object. The problem with…
In a previous post the different levels of compatibility that the Avro data serialization system can facilitate was discussed. Understanding the different options helps us make the right determination between the tradeoff between flexibility in schema evolution and the compatibility our data will enjoy. To fully realize the schema evolution benefits this compatibility gives you at deserialization…
I have recently been working more and more with Avro as a data-interchange format. Avro aims to provide a format that has rich data structures, a fast and compact binary format, integrations with many languages out of the box, and even a remote procedure call (RPC) capability. Avro is a format very similar in spirit to Protobuf, Thrift, MessagePack, etc. They all have fairly similar design goals…
In a previous item, a date range class was discussed. It includes Date fields and is careful to avoid breaking its invariants of its start date needing to come before its end date. The way that it accomplishes that is via careful coding of its constructor as well as its accessors. Let's refresh our familiarity with this class: public final class Period { private final Date start ; private final…
There are many ways an attacker of a system can look to gain access to an account. Unfortunately, in the battle between the person attacking a system and the person charged with protecting it the requirements are not even. While the attacker only needs to find one way in to be successful, the protector must not miss anything. Even though this doesn't feel fair it is the way of the world. Many of…
Don't care about the how and just want to use it? Try it here: https://wordle-cheater.netlify.app The game Wordle has taken the internet by storm. Its simple rules and ability to share and compete with friends (all while not having the privacy losing trappings of many social games) leads to a winning combination. In our lives that can sometimes be a bit chaotic I feel like this simple game where…
As discussed in our previous post, the serialized form of an object is part of its API. This means that it is something that we should respect for some time going forward and that if we break it, we will be causing an unnecessary burden to the users of our code. This being the case, we should take great care in determining what structure the serialized version of our classes take. That is what…
In the last topic, we covered why we should avoid using the built-in serialization framework in Java. A big part of that serialization system is the _Serializable _ interface. This interface indicates some of the magic promised by Java's serialization. Simply add this interface (which requires no methods to be implemented) and all of a sudden you have serialization. Unfortunately, this is not the…
Java's built-in serialization has been part of the language since 1997, just two years after its inception. Even from the beginning of its life as part of the language it has been known to be risky. While the goal was well-intended, that of distributing objects with little effort, in hindsight it is largely agreed that it was not worth the costs in correctness, performance, security, and…
Even on modern systems that have many CPU cores and thus can be concurrently executing multiple threads, they are likely no match for the number of threads in a runnable state on a system. For this reason, we have the thread scheduler which determines which threads will run and for how long. Implementations of thread schedulers strive for equality in how they treat threads but their exact…
Lazy initialization is the pattern of putting off the creation of an object or process until it is needed. The idea behind this pattern is that you may never need the object and thus you saved the initialization costs. The main reason that lazy initialization is used is as an optimization. The other use that lazy initialization has is breaking tricky circular dependencies in your code. As…
Users of classes you write need to know how they behave. One of the attributes of your class that a user needs to know is whether the class is thread-safe or not. Outside of this documentation a user of the class needs to guess about the class's thread-safety. This can lead either to excessive synchronization or insufficient synchronization which can lead to invariant issues. It is important to…
At the core of each Object in the Java language there are three methods, wait , notify , and notifyAll . These methods allow you low-level concurrency control options. Up until Java 5, this was the go-to option for facilitating concurrency control. However, since the release of Java 5 (in 2004) there are now higher-level tools that can be used that are much easier and less error-prone. This being…