Foojay Podcast #36: J-Fall Report, Part 3

Transcript

Automatically generated from the audio, so it can contain errors in names and technical terms. Suggest a correction.

[0:00] Part three of my j4 report will teach us more about Maven user interface development and Juke welcome to the f j podcast all your news about OpenJDK in episodes 33 and 34 of the Foojay podcast you got the first two parts of my jall report but on that single day conference I had many more interesting interviews so this is part three later we will talk about Juke desktop applications and security but first Maven it’s one of the most used tools in Java development and I learned a lot from different experts who joined me for an interview let’s start with Exel who gave both a workshop and a talk my name is AEL ree I’m speaking this year so I’m super happy H yesterday I also had a workshop so extremely happy let let amend that so two things at the same time what was the long session yesterday about this yesterday was a workshop about mayen and going beyond the basics so I really believe that we have to revisit our fundamental tools and Maven is one of the fundamental Tools in our industry so I love that we get the opportunity to revisit this really important topics and understand our tools okay is there a

[1:26] War between Maven and Gradle you know I think and this is really important that we have choices because we don’t see the world in the same way and sometimes we don’t have to solve the same things in the same condition like you can see I’m I’m a consultant so I’m always answer like which sh which is the best tool and I will answer it depends it I think we had that word it depends in every interview I already had everybody’s going to use it but the next thing is I’m going to say like AEL what is the best tool and I will say the one that you use the actually you use the one that you know how to use and the one that you like to use and the one that can solve your problem of course but usually at least in that we have a little bit of Common Sense and usually we try to pick the one that is not going to give us headaches mhm although we do love complexity but no okay and so you also have a talk today yes about this is GitHub actions it’s like camera GitHub actions so again what I’m trying to do here is to Showcase very common unuseful or very highly adopted tools to Showcase some of the small

[2:55] Functionalities that maybe we are not aware of that can make our life easier yeah for example small details and not so small details you know what I like to talk about sometimes is the monsters under the bed like the Gess where you like oh my God yeah I love GitHub actions I have some pet projects just being able to upload your codes and don’t care about deployment that’s a onetime thing you need to do nobody loves it and then if the GitHub action or your pipeline in any other system is okay then indeed that will do some work for you the repeating work and indeed I love GitHub actions too I mean if if you want the compelling reasons and because if you want to talk about deployment and release you know that I can go on that one too but no one of the reasons that I propose a lot Ino action is because the amount of Java developers that are using GitHub and GitHub actions like in GitHub is Java is still the third language most used for the projects and they have more than 20 million projects stored okay so that’s another index we can use next to the toobi index so Java is really used a lot exactly is the

[4:23] Third programming language in GitHub so the first one is going to be JavaScript the second one is Python and the third one is Java okay good thank you for this short conversation have fun today yesk I think it’s coffee time yes I’m totally going to enjoy that okay thank you after the coffee break I had a chance to talk further about Maven and open source contributions with Martin my name is Martin Mish what am I doing here at jall well jall is the Dutch Java conference I am Dutch it’s a whole match for me to be here no questions I mean I should be here I want to be here because here is where I meet speaker friends colleagues past colleagues current colleagues maybe future colleagues so I’m enjoying a day full of knowledge experiences memories everything do you speak yourself today yes I will be speaking at roughly 5:00 P PM so I have still time to build up my nerves okay and what is your talk about I’m going to discuss open source citizenship but mainly from the Enterprise perspective this time so it’s not about people sitting in their attic at 9 p.m. in the Friday afternoon

[5:35] This is about companies using open source and well then what is that all is it just your company using open source or are you going to give something back that’s what it talks about and I know that in your company where you work for you are indeed collaborating and giving back to the community and yeah working on several open source project that’s right yeah that that’s part partially where the talk comes from but it’s also deeper within it’s the it’s the strong feeling that if a company wants to be successful with open source it’s not only about consuming it’s about making sure that you understand the product you’re using and that you help nurture that product and that Community by by giving something back and it doesn’t have to be much but every little bit helps and what projects are you collaborating to I myself I’m collaborating on AI Maven so I’ve been a committer for a couple of years recently joined the project management committee as well and I have a few colleagues that also do that on a more regular basis than myself actually because well time time limits also apply

[6:50] Within your work but the great thing is I do get some company time to work on a pet M if necessary and in that way help help AI Maven grow and improve over time I think Maven is one of the most used tools within the Java Community how big is the community who is collaborating in the maven project well we just heard this morning that shat said there’s roughly 10 million Java developers in the world studies show that roughly 75% of them use Maven so well you do the math that seven to eight million people using Maven and now the question to you how many many people do you think work on Maven on a regular basis how contribute to the open source project I have no idea I hope it’s are a few hundreds but probably not I wish you were right I think the hardcore members the people that put the most time in it and I don’t even count myself to them by the way is under 10 maybe 10 if you are being generous that’s 10 10 people working on a product used by millions it’s like like that Meme where you have the a stacked blocks and then a little

[8:04] Block below that is holding all the others up yeah the guy in Nebraska right yeah the one single person maintaining that one little library that everyone is using everyone’s using indeed yeah well in a way that if you purely look at the numbers that’s also how it works with Maven and there are a few people that devote a lot of their time there are more companies by the way that now do this and have people that actually put working time into working on Maven and the funny thing is like a couple of weeks ago we did a hober Fest event at info support and I still remember that one of the participant said to me wow this was so inspiring I always wanted to do this but you know if I do this on Friday night in my etic time is limited I’m tired after a work of week a week of work and now being being able to work just two days with like-minded Engineers or artists as sh calls them look at what I can achieve in just two days it’s amazing I want to do this more often and that really made my day him being enthusiastic about I want to do this is great I have it in my talk is

[9:22] You can learn so much from an open source project you can learn so much about how it’s organized what technology it’s using like for if you look in OpenJDK itself there’s a whole history there of time zone records for instance yes so a source project can be a history book and you can learn a lot from how other projects are managed and developed y absolutely yeah how can people join for instance the maven project how does this work how do I get involved into an open source project usually It’s relatively simple at least it should be relatively simply that’s what simple that’s what I strongly believe the best way usually is to reach out in an issue tracker or if if a project has one on a mating list and be a bit concrete I’d like to work on this particular issue that I found maybe you discovered it yourself maybe you just found it in the issue tracker how do I get started who can help me out I think that’s typically the best way many projects nowadays have up for grabs lists they tag issues that they believe are relatively simple don’t require in-depth knowledge of the

[10:40] Project to be present that you already have it but as we look at it in the app Maven project if you have Java coding skills and problem solving skills you should be able to do these and actually one of my colleagues worked on such an item during that two-day event and indeed without having that much knowledge of Maven itself or how it is built the code and the architecture of Maven he was able to resolve that issue and get it working in just two days well that’s indeed a nice challenge okay thanks a lot for this talk have fun here today at jall yeah and thank you for being part of the Foojay podcast thank you so much thank you for having me thank you an essential part of the maven system is the repository it’s manag by sonatype and my next guest knows everything about it I’m Jamie Coleman I’m a developer sonatype originally I started my career at IBM worked on jbms worked on web speres most people probably know here and today I’m here to talk about Maven Central so son type we’ run Maven Central for the community and we have done for the past 10 years so part of my

[11:50] Job is to go around to make people aware of what we’re doing to increase security and help developers make better choices when they are downloading open source dependencies so Security in Java libraries yes yes yes so I mean today we’re consuming open source on a huge scale if we go back say 20 30 years most of the applications we had we wrote ourselves whereas nowadays 90% of our applications are borrowed code from someone else we’re downloading that code which is amazing I mean it helps us focus on an innovation rather than you know having to rewrite things that already exist or people have wrote before but there comes problems with that because the bad people the Bad actors of the world they’re now targeting these open- Source projects to try and get vulnerabilities malware inside so what we’re trying to do at son type and we made them Central is give developers better Insight I would say into what they’re downloading to help them make better choices I know I just uploaded a new version of a library a few days ago yeah I got a report y immediately from Sona awesome that there was nothing found yeah okay what is it

[13:01] Checking so we do lots of different things so firstly everything that goes in to Maven Central is scanned by our Enterprise scanners so what happens first of all is it’ll get scanned and AI machine learning will do some scanning and then if we’re not sure it will go to our security research team so we have a very big security research team whose job essentially is every day to go through line by line of code to make sure there’s anything bad in there so what we’re trying to do is provide people with kind of if you’re uploading something kind of reports on the health of your project do we see any vulnerabilities any bad patterns there to try and make you or make your open source project more robust and generally score a little bit higher I mean op ssf created scorecards and things like that so we want to inform people that are use creating these open source projects and maintaining them how to better maintain them to get those better scores so developers can make better decisions and say yes I’m I trust this open source project and I believe it’ll be right for it’s not going to contain

[14:07] Lots of vulnerabilities and even if it does have a vulnerability I have trust that they’ll fix that projectability later it’s amazing that all this stuff is free yeah so I create a library whenever I want this is my pet project yeah I upload it so for the rest of the lifetime you are keeping a copy of it so you are storing it somewhere yeah AWS generally the company yeah who’s paying for this we do so it’s something we have run for the Run for the community from the beginning so my boss Brian Fox he was one of the original Maven contributors and he kind of one of the main people that set up Maven Central now at the beginning it was running in a computer underneath his desk which was fine as it’s grown and it’s grown it’s grown more obviously that’s no longer feasible so we run it on the cloud these days but open source consumption is growing exponentially to the point I think La this year alone or the first seven months of this year we had something like it was half a billion or half a trillion downloads from Maven Central whereas we only just hit a two trillion downloads in total I

[15:17] Think last year so as you can see we’ve already hit half of like a quarter of that this year alone so it’s growing and of course the cost is getting bigger but it’s just something we do for CA type just for the community basically but how do you make money out of this well we don’t so sonatype makes money again we’re in the security software supply chain business so we have a suite of products that will scan your dependencies to make sure they haven’t got vulnerabilities give you insight into what versions you should move to and of course sonot type started its life off as a repository we were the first ever artifact repository in the world so that was Nexus repo and so we make our money off our different other products but some of that money goes back into m Central you know like to help the community ENT but actually I think that’s a profit in both sides because you have all the dependencies you know what’s happening yes you know when security issues are happening there yes of course so you know log for Jay for example that we’re all aware of I mean we were the first

[16:16] Companies to pick that up because we know and the great thing is because we run Maven Central we have all this data in these insights so we can see exactly what countries are downloading what versions I think to when I checked this morning and the problem is with us as developers we’re quite slow to react so I think even this morning I looked at in the last 24 hours 22% of Log4j downloads was still that vulnerable version as of this morning yeah I think in total it’s getting to something like five 250 million now downloads of that vulnerable version and that’s because we humans we tend to react to things rather than be proactive so I think yeah it’s just one of those things that you know we we’re in the business of trying to help people make the right decisions but we’re also not in the business of taking down dependencies and things like that I once uploaded a wrong dependency I did something wrong yeah you don’t remove it no it’s there forever yes yes well the thing is a lot of people rely on Maven Central in their build Automation and things like that and the problem is a lot of the things

[17:19] The vulnerabilities in Java are mistakes they’re not malicious things that go in whereas if you look at node and python they don’t have the same kind of domain space protection you don’t have to ear the domains put stuff up there so they’re full of malware full of bad things that have gone up there whereas we have that first check a decision that was made at the beginning to basically limit who can you have to own the domain so that first amount of protection is there essentially and that’s kind of what’s helped us yeah there are a lot of articles about how easy it is to slip something into a JavaScript yeah dependency they are true yeah of course and like you know if you ever run mpm in store or something like that you’re essentially running that malware straight away whereas at least with Java we have to hit that line of code before that malware or that vulnerability is activated so we have a little bit a few more protections but cotype don’t just do Java they monitor all the different ecosystems we’re just quite lucky in Java that we’ve been protected for quite a long time because

[18:16] The decisions that were made at the beginning so and then removing that vulnerable lock for J you said it yeah again like you would break everything from companies that still rely on it 22% apparently from as of this morning yeah that’s the thing so again even though there’s a vulnerability in that version of log for Jay you might not be using that functionality that calls that vulnerability so we don’t make our decision to say what is and what should go up there the only thing we will always remove is malware we will never let well first of all malware doesn’t get up there but if it ever did that’s the only thing we’ll ever remove because that is maliciously put there to do bad home so if I want you to remove my wrong Library I have to tell you there’s malware in there yes and then we’ll scan it realize there’s no Mal in there unfortunately it will stay there anyway okay thanks that’s great information about how this whole system works because it is there for everyone yeah but maybe we just don’t realize that there’s a company behind it managing it and paying for it and thanks for doing

[19:15] That for the community no no problem and thanks for sharing that message no problem and yeah we we’re very good we like putting articles on Foojay as well we do have a series of articles about software build materials and some of the things that are happening in industry around open source software so yeah I’d advise anyone to go check them out onj okay thanks a lot brilliant no problem thank you now that we know more about libraries and how they are managed in the maven repository we can look closer at the security with my colleague Garrett and in this case I got a surprising answer to the same first question I ask everyone who are you and what are you doing here I’m the biggest fan of jall and I’m speaking here and I’m so happy to be here again my name is gett gal I’m your colleague by the way indeed I know you but yeah yeah I ask the same question to everyone here I know you’re talking here yes have a session here and it’s about it’s about security U and in the Java environment which is not known to everyone but it’s good to know about it yeah and be aware yeah you’re a big fan why of J I can’t say it

[20:21] Often enough it’s the best one day conference it’s packed it’s fully packed yeah it’s if you compare it to the at the moment the biggest conference in the US I think has 1,400 attendees and this one is close to 2,000 as far as I know it’s about 18800 and it’s one day just think about it yeah there are a lot of people we are here in the entrance hall people are just streaming arriving yeah it’s it’s it’s amazing yeah you have your camera with you always what is the goal of the camera it’s it’s to take good shots of whatever I have no idea I always have it with me because you never know you are an unofficial conference photographer well sometimes yeah yeah I just like it it’s it’s a good chance to take pictures of friends and then I send it to them and everybody’s happy you’re for me known a lot for the Java vix work you’ve done in the past is that still a thing nowadays well that’s a good question I was at w Jackson Munich yesterday and we had the same discussion it is still to my knowledge used a lot internally in big companies and there is a place in the Java environment for Java effects

[21:38] Unfortunately nobody knows about it in the public and then everybody says Ah it’s dead it’s not it’s not dead and it will live for quite some time but I don’t push it anymore I did it for more than 10 years I but if I create something desktop stuff I usually use Java effects because I know how to do it and it’s a really nice API still yeah people who check your Twitter profile will see a lot of screenshots and releases continuously do you ever sleep sometimes sometimes because this night you arrive from another conference yeah it was a little bit tricky so I arrived on 1:00 a.m. I was at home from unich and then at 4:30 I oh no yeah 4:30 I woke up and left home at 5: so I just arrived at age you’re one of those people for whom sleep is overrated yeah I can sleep when I’m dead wait with that a bit longer I would and while we are at the subject of desktop applications with Java evx let’s take a look at swing one of the other UI Frameworks within the Java system hello everybody my name is anony gubar I have been Java developer for more than 25 years so that’s why I’m coming here to I

[22:54] Live also not that far from here so that’s why for me it’s a confence of the year to go to is this you’re a regular visitor of j4 yeah probably come to almost all of them all 20 I guess almost all 20 yeah there are a lot of sessions which ones did you pick which ones do you want to join today yeah I think the one that was most interesting for me so far are the one about the software engineering and more about the concept of developing software and so on MH you’re a Java developer what is your main task what’s your main stuff that you’re building yeah so at the moment I’m a bit special Java developer I’m on the desktop side so not on the server side I’ve switched to the desktop part so mostly writing swing applications H you know I have a big love for Java vix let’s have a competition no no why swing why Java vix what’s your view on this yeah so I starting writing swing application in I guess 1998 before it was even included in Java so it’s a long history in this case and yeah so swing is included in Java you have look and Fields that make it also very

[24:16] Easy to switch and you can also just at ja IP you can also extend components you also have a lot of history on the internet when you need help to search for something so that’s why stay with swing because yeah there’s nothing wrong with swing I think there’s nothing wrong also with Sava effect but there’s no competition there people have the choice and they can choose whatever much is their requirements Java for most people is something which runs on the back end server side so not a people not a lot of people use it for desktop applications how do you see this evolvement going on like this electron apps with JavaScript versus something which is built with Java yeah that’s a bit strange because indeed we’re moving from desktop to SAS and a lot of web server web application but when you look on the mobile P when you have Android or iOS you could have website but everybody is doing basically desktop application for mobile so you have a mobile app for Twitter you have a mobile app for all kind of software could be just on the server so you see that having what we call Fat

[25:32] Client against a website it’s sometimes depends sometime on the platform so I hope it will come back also to desktop to realize you have more control about the window about the clipboard about a lot of and at the end just have more productivity I think one of the main advantages is also that you have Java running in your application so that means you can do a lot of threading like stuff if you have complex applications is that something that you use as a benefit yeah think so for example I have an application which is the file manager something that every developer use I could not write this application as a web server part because your file are local your browser don’t have access that much to the files and so on so yeah yeah so there you taking advantage of the things which are in Java already and you can bring them to desktop client exctly yeah Java very nice library for managing files and so on so let’s using okay thanks a lot for this talk enjoy the day here at jall yeah enjoy also Foojay very nice website so look to the Articles especially today because then one of my article is in there today is

[26:46] There okay yeah I didn’t see what published today see one of my article today okay thank you for contributing to Foojay yeah you’re welcome Java vix and swing are tools to make desktop to user interfaces but Java also allows you to create web user interfaces he shared some information about a few of those HDMX and time Leaf hi good morning my name is k loing I’m just an atton at J fall and I come to see new people people that I already know and hopefully to get some new things from the sessions that I attend are there any sessions particularly that you’re looking forward to yes I saw from Martin dasor that he’s going to speak about HDMX and I use it for a hobby project I’m looking into it together with thy leaf and Micronaut to get a very small piece of software that I could throw away if I wanted to okay but I want to keep it simple like s Mark said in his talk this morning yeah keep it simple so is that a pet project are you one of those developers who just keeps on coding day and night no I’m not I’m a bit since I am an independent software developer I like to educate

[28:16] Myself in my spare time as well because obviously I don’t have a company that provides me these these things and I found some nice things and some people that want my software as well okay in this case it’s for a hobby project that will that is modernizing an a dialect dictionary and it has to go online within some months okay so you have some work to do yeah okay HDMX time leavea how do they compare or you’re using boats well first I was I am using Micronaut to provide me a backend and to parse the data source let’s put it and I saw that Micronaut has Micronaut views which are backend rendered views and th leave is one of the possibilities to do that in and online I saw a speaker that already did something with spring Boot and th leaf and HDMX so I’m trying to combine that with Micron not could that be whim the blower H could that be whim the blower I think so yeah yeah yeah he’s Belgian yeah I saw him yeah yeah he’s also a creator of some components that yes he has some libraries he has a book about time Leaf he’s a really an

[29:42] Expert on this to I don’t think he’s here today A bit unfortunate yes are you a regular visitor of the jall conference because this is a 20th Edition have you been here 20 times no not 20 times like the one person in the room in the at the KE note now I think that do I try to do it every year but the past 12 years I attended I think 80 or 90% okay that’s a lot yeah that’s quite nice and the attractive thing of J fall is to meet the people that you already know in this industry I worked for some contractors already and all the people that you meet there your colleague in assignments you meet them here again as well okay another yava web framework is vadin Simon Martinelli is an expert on this topic but at jall he came to talk about another one hibernate versus Juke I’m s Martinelli I’m from Switzerland and I will have a talk it’s called do you really need hibernate and I will answer the question if you really need hibernate or if there are some Alternatives that may be a better fit for your application and can you maybe already SP spoil a bit of the answer

[30:59] Yeah the point is there is a law it’s called bedri law I think it’s from a journalist from England and he says if the title is a question then the answer is always no so you don’t need hibernate you don’t need hibernate what’s a better option yeah it depends on the application type but it depends it depends so now the option is learn SQL properly and then you can do a lot of that in the database already so you don’t need to load data and transform it first because the database already can do that that’s one thing and the other thing the database has a lot of features to offer that are hidden behind the nor mapper for example and I know it often people try to abstract the database layer because they want to change database later but no one does more or less are we a bit spoiled as developer with a framework like hibernates that we don’t need to learn SQL yeah probably the point is also how young developers learn it you know they for example I’m also teaching at University in Switzerland and we’re teaching spring boot so what do we start with Services then later on we use

[32:13] Repositories and we don’t see even the database if we don’t turn on the SQL logging we don’t even see that seq is executed by the code and that’s maybe the problem we think and when I learn Java like 25 years ago people also tend to oh we want to stay in objects we don’t care about persistent layer it’s just an implementation detail but for most applications I’m involved this is not an implementation detail because that’s the purpose of the application to store data in the database right so we should learn SQL a bit more yeah and I mean for Java developers it became easier with the invention of java streams API in Java 8 because before we tend to do like imperative style of programming like for loops and while loops and now we also have to do it declaratively so it’s a relatively easy step from something like stream filter map collect to something like select from into whatever yeah okay I know that hibernate and database is only one of your big interests Vaden is another one is there some vadin content today I don’t think so no no I’m just I a sh an application because I’m in a sports

[33:37] Club in Switzerland and we are organizing competitions for kids already for I would say 45 years or so and in the beginning we did that by hand or they did that by hand so there are like tables where you can look oh he did like three meters long jump and you can get the points and you have to calculate the points and when I started as a software engineer I thought oh that’s not a good idea you should do that with some software yeah automated make it easier and I did that in 1997 and now I migrated the application like four years ago to wadin and this is my showcase project because there I can use a the superpower of chuk for example it’s called multiset I can fet nasted structures with one single prery and they use that because in a competition management software you need ranking lists and ranking lists are a three so you need to read lik data and that’s perfect so you see somebody but I will not talk about what yeah okay you’ve that’s a bit the same thing that happened to me I was working on a pet project beside my job and that became my job and I was writing about open source

[34:56] Library so I’m now doing that even more is that about the same thing that happened with you were interested in these Technologies yeah and now you’re doing consultancy on these topics that’s that’s exactly the point so as I said I started with that small pet project 1997 and it currently it has it’s the fourth generation so I constantly change it and very often if I’m in a more or less boring project I need to do something new yeah and so I can take this project and transform it to some new technology that’s exactly what I did with so I learned some more what in with this small pet project because there I can do whatever I want and how I want to do it and this works very well yeah and how do you pick up these new technologies is that at a conference like this one today it’s very often at conferences yes but I also read magazines like most of them are German Java Spectrum or Java magazine you also an author there I write for Java Spectrum sometimes I’m organizing Java User Group in burn in Switzerland and so there we have speakers from all over some of them we prefer to have also speakers from our

[36:11] Local community but as you may know that’s very hard to get them out of their comfort zone to talk about what they’re doing in the daily job but this gives a lot of inspiration here indeed that’s a nice topic how do you inspire people to become a speaker being at a conference like this is really great but it’s a growing part people can speak at JS but how do you convince them to try it to do it for the first time I was working for Swiss Railways for 13 years and there we have had an internal software conference for Java we still have that it will take place in two weeks and I’m all every year invited as a honorary speakers because I founded that conference also and I always try to pick talks from there and bring it to the Java USIC group and some really like that because they didn’t even knew that they have the opportunity because sometimes I think Swiss jav USIC group is very professional and we have great speakers so with a lot of experience and if you’re sitting in the audience and watching such a talk it May Scare You a bit right because he does everything perfect and using oh but my talk is not

[37:30] Relevant but that’s not the case yeah yeah and so I always try even if I work for customers because I’m a consultant in Switzerland I try to convince software developers that I should come to chv group and have a talk about something that they’re working on yeah if people are interested to becoming a speaker they should really just try and contact the ju I think that nlj is even organizing some some boot camps to become a speaker so we always welcome new speakers that’s the main message yeah okay do the same that’s it for part three of my jall review some keywords for the final part next week collections Jakarta profiling and testing keep an eye on Foojay for future articles and podcasts about development and everything related to the Java World thanks for listening give me a give me a j give me the friends of OpenJDK