Erik Costlow on foojay.io - Friends of OpenJDK

AI-Assisted Unused & Dead Code Removal

Sun, 28 Jun 2026 07:19:42 +0000

Why Your Codebase Is Forcing AI to Underperform, and What to Do About It

Your AI coding assistant is only as good as the codebase it works on. If your Java application carries years of dead & unused code, and most do, the AI spends its reasoning budget on code that nobody runs. The result is more hallucinations, worse suggestions, and higher token costs. Here’s what to do about it.

Find Undead Code in Your Java Environments

Mon, 17 Feb 2025 09:36:55 +0000

10-30% of the custom code in applications is undead code and can just be deleted. Eliminating undead code can enhance the overall performance and maintainability of your applications. Time vampire (n) – a service or application that is said to suck time from engineers by warming up and updating at preternaturally slow speeds.

You’re on deadline to finish a project, and you open the application to do your work. The application informs you that it needs to update before it will open. Based on past experience, you have half an hour to burn before this time vampire is ready.

Foojay Podcast #58: How Java Developers Can Secure Their Code

Mon, 30 Sep 2024 07:43:46 +0000

Three years after Log4Shell caused a significant security issue, we still struggle with insecure dependencies and injection problems.

In this podcast, we’ll discuss how developers can secure their code.

I talked with three authors who posted a security and code quality post on Foojay.io.

Video

Podcast Apps

You can listen and subscribe to the Foojay Podcast on:

Java: Where the Wild Code Isn't (On Security and Modularity)

Tue, 17 Sep 2024 08:41:00 +0000

In the last several years, the OpenJDK community has made Java significantly safer for users and developers while at the same time making it easier to design, build, and run applications quickly.

There are two core aspects that have led to this:

A secure JDK, where vulnerabilities are dealt with and patched.
A modular JDK, where different types or risk can be clearly delineated.
A Secure JDK {#h2-0-1-a-secure-jdk}

The core Java platform underlies all Java applications and is kept secure by a special OpenJDK Vulnerability Group. This group helps to perform different actions and security regression tests like fuzzing and ensuring old vulnerabilities do not recur.

Trash Pandas Love Enterprise Java Garbage Code

Tue, 13 Aug 2024 08:16:55 +0000

If raccoons were software engineers, they would feel at home inside many enterprise systems. These systems are often full of unused and dead code that was written, fully tested, then altered in a way that prevents teams from ever running it.

This garbage code — a raccoon’s favorite — is a maintenance burden that developers must work around to keep passing tests while other major changes are made. This code often doesn’t end up in the trash because it’s hard to know what can be safely removed without breaking the application. But you can better identify bad code if you understand how to look for it.

Improve DevOps Productivity with Azul Intelligence Cloud for Any JVM

Fri, 24 May 2024 09:46:34 +0000

For decades DevOps teams have been under pressure to do four things: make software faster, make it cheaper, keep it secure, and accelerate time to market.

But with fewer engineering resources, enterprises that use Java must find a way to speed up application innovation and fortify application security across their entire Java estate more efficiently.

The rewards (and costs of not doing so) are high – companies in the top quartile of McKinsey’s Developer Velocity Index (DVI) perform significantly higher than bottom-quartile companies:

Foojay Podcast #17: Execute Java Code with TornadoVM

Mon, 27 Mar 2023 08:45:20 +0000

TornadoVM is a programming and execution framework for offloading and running JVM applications on multi-core CPUs, GPUs, and FPGAs.

With the same code, some of your existing program code can be executed hundreds of times faster!

Podcast Apps

You can listen and subscribe to the Foojay Podcast on:

Java Security: Log4J, the SecurityManager, and Funding

Fri, 24 Mar 2023 09:28:00 +0000

A demonstration of log4j exploits, which defenses people tried, and which worked.

We’ll cover how groups responded effectively to patch to see what was common.

We’ll also look at open source funding models, subscriptions, and bug bounty programs to see why it’s sometimes hard to donate.

This talk uses actual exploit code that takes over systems through their log messages to open calculators.

Moving Security into the JVM

Fri, 17 Feb 2023 11:15:35 +0000

The threat model for Java applications is changing, with modern risk coming from the widespread scope and usage of Java and library vulnerabilities.

There are so many different versions of Java (both major and minor versions) and so many systems and libraries that it’s complex to know what everything is, where everything is, and if it’s what’s “out there” poses any security risk.

The new Azul Vulnerability Detection product by Azul is designed to help organizations deal with this evolving threat and manage the large scope of their Java environments.

Foojay Podcast #7: Security in Java -- what do we need to know?

Mon, 21 Nov 2022 10:22:14 +0000

For this Foojay Podcast**,** we invited security experts to dive into the fascinating world of secure coding and detecting vulnerabilities in your Java applications.

How can you make and keep your systems safe?

That’s what we want to find out…

Podcast Apps

You can listen and subscribe to the Foojay Podcast on:

Foojay Podcast #5: OpenJDK Discussion Panel

Tue, 20 Sep 2022 15:56:27 +0000

It’s September 20th, OpenJDK 19 has been released. In this podcast, we discuss the new features and the changes that this release brings.

Podcast Apps

You can listen and subscribe to the Foojay Podcast on:

Spotify
Apple Podcasts
And most others…

Guests

Miroslav Wengner (OpenValue)
Mary Grygleski (CJUG, DataStax)
Deepu K Sasidharan (Okta, JHipster)

Podcast host

Erik Costlow (Azul)

foojay - Santa Claus Issues YuleLog4J Advisory

Fri, 24 Dec 2021 16:23:07 +0000

Christmas revelers and elves are urged to patch their fireplaces, as a Remote Combustion Effect (RCE) vulnerability has been discovered in the traditional holiday YuleLog4J. YuleLog4J is one of the most popular holiday celebrations, appearing in approximately 64% of fireplaces and streamed to millions of homes over Netflix and Amazon Prime .

The vulnerability occurs in the Jingle Naming and Directory Interface (JNDI), a utility that enables lookups of holiday cheer from remote sources. Unpatched versions of YuleLog4J can load potentially un-cheerful items such as coal, traditionally reserved as a stocking stuffer. The advisory was managed through coordinated disclosure between the North Pole and the GiftHub Security Research Team.

Log4j2 Isn’t Killing Java

Mon, 13 Dec 2021 18:51:34 +0000

In the season of resurrection, I’d like to join the ranks of those who have made long careers announcing the death of Java who follow up each obituary with an equally shocking revelation that it is alive again as one of the top programming languages 25 years running . Even before the recent log4j2 vulnerability allegedly “killing” it yet again, we have a joke in the Foojay chat that a Java museum would be called a cemetery for the number of times this has happened .

Foojay Podcast #4: Why Are There So Many JDKs?

Tue, 19 Oct 2021 15:38:35 +0000

In this podcast, we explore the topic of why there are so many JDKs, how are they the same, and how they are different. We balance the Java perspective with a special guest from the Rust foundation to learn how a peer ecosystem works.

Quick summary—the role of Java as a central system runtime lead to multiple implementations and the companies that make different distributions offer support and sponsor different work. For example Azul and Microsoft worked on Apple M1, and Bellsoft and Microsoft worked on Alpine Musl. All JREs are compatible through the TCK and vendors work together on security patches for the entire ecosystem.

Book Review: Quarkus for Spring Developers

Mon, 04 Oct 2021 08:25:37 +0000

Key Take-Aways

Quarkus and Spring are both powerful frameworks.
Developers with years of Spring experience can consult side-by-side examples to quickly shift code and tests to Quarkus.
Quarkus has moved quickly by leveraging proven technologies from existing Java frameworks and standards.
Cloud-Native and Java-Native-Image (GraalVM / Mandrel) combine to run Quarkus apps very quickly.

Quarkus for Spring Developers is a straight-forward guide to enable senior developers to quickly shift their Spring skills to leverage the “supersonic subatomic” Quarkus framework, and junior/mid-level developers to learn two frameworks at once.

Foojay Podcast #3: Journey to Jakarta EE

Tue, 31 Aug 2021 14:26:29 +0000

Foojay community members discuss the modernization of Jakarta EE applications from the older Java EE form, including backwards-compatibility, as well as forwards-excitement about cool new developments like Microprofile.

Podcast Apps

You can listen and subscribe to the Foojay Podcast on:

Spotify
Apple Podcasts
And most others…

Guests

Rudy De Busscher, product manager of Payara and EE contributor.
Josh Juneau, consultant and author of Jakarta EE Recipes .
Ivar Grimstad, Jakarta EE Advocate for the Eclipse Foundation .
Erik Costlow, Developer Relations for Contrast Security to secure Java/Jakarta EE applications.

Foojay Podcast #2: Embedded Java -- Robots and FX

Thu, 22 Jul 2021 14:13:32 +0000

Foojay community members and beyond discuss embedded Java:

James Gosling , creator of Java and embedded enthusiast. Distinguished engineer of AWS GreenGrass and former Liquid Robotics, an autonomous ocean vehicle powered by water.
Frank Delporte , engineer with Toadi, an autonomous lawn-mowing robot (no wires) and Pi4J contributor of Raspberry-pi based robots.
Johan Vos , founder of Gluon, helping make fully cross-platform applications where a single JavaFX codebase runs natively on embedded, iOS, Android, PCs, and browsers.
Erik Costlow , developer relations for Contrast Security, locating security flaws in backend systems. Developer of home fuel/gas sensors.

Podcast Apps

You can listen and subscribe to the Foojay Podcast on:

Announcement: Friends of OpenJDK Podcast #1

Fri, 09 Jul 2021 08:39:39 +0000

Foojay community members discuss recent news:

JavaFX Skins for cross-platform apps on Android, iOS, and regular computers.
BlockHound, for detecting cases of blocking in reactive (non-blocking) applications.
JEP 411, the SecurityManager deprecation
The recent Snyk/Azul community survey

Sorry, this recording got “lost in cyberspace…”

The SolarWinds Hack for Java Developers

Tue, 09 Feb 2021 07:39:53 +0000

In December 2020, an advanced persistent threat attacked many companies by injecting malicious code into a vendor application that belonged to SolarWinds. This technique is called a “supply chain attack,” because instead of targeting the victim directly, the attacker damaged something higher up the supply chain and simply waited. The US government uses SolarWinds, so by attacking SolarWinds in a way that would infiltrate the US government, the attacker effectively got their target.