Foojay Podcast #50: JCON Report, Part 2 - Maven, Software Security, Code Quality

Transcript

Automatically generated from the audio, so it can contain errors in names and technical terms. Suggest a correction.

[0:00] Welcome to the f j podcast all your news about OpenJDK this is part two of the interviews I recorded at the jcon conference in Germany earlier this month in this episode we have two main topics Maven and code quality let’s start with Carl hin marbe and Steve po to learn more about the maven project the repository son type and the security impact of dependencies my name is Kahan I’m attending this jcon conference because also I’m a speaker here for I’m talking about AET Maven because I’m the AET Maven chairman at the moment so that’s one of the reasons and also of course I wanted to meet people and talk about things like that and discuss with other people and things like that so General discussion about and calling it networking for example yeah and meeting everyone yes of course very important thing yeah apachi Maven can we say that Maven is one of the foundations of the Java Community I would say yes because based on the knowledge I have at the moment more or less 60 70% of the Java developers are using that there are other tools like Rad or something like that yes but I made the experience that

[1:16] Many people prefer Maven for some experiences for some reasons and others do prefer some other tools yes of course and I think that the distribution of Maven is very large in the meantime because over the time it had has been coming very popular over the time some people blaming about that because complaining about things yes of course there are problems in there no doubt about that but in the meantime it showed that the Simplicity in some ways and the descriptive way to Define what you’re doing is a more or less easier way to do that then instead of making program programmatic setup and you have to program your build us something like that I think that’s the most important thing it makes it easy to use it yes of course there are some complaints about that which are completely fine and okay but we are working on that to get a new version out that there and we are working at the moment on pet Maven 4 at the moment yeah so you have Maven the Bild tool you have Maven the repository what I found out when I try to submit a library into Maven it’s not an very easy step but maybe that’s a

[2:25] Good thing to avoid too much clutter yeah that’s that’s a point where very often people complain about that it’s too complex to put something into Maven Central it’s called usually or the central repository in the meantime it had been changed a little bit the most important thing because you have to sign your artifact with your GG gpg Keys key and that’s very important to do that and upload them and make that reproducible process and that makes it safe for other users to consume them because you are not able to Simply say I don’t want it to be that anymore in the central repository just delete that because the consequences of that is that if you do that and just delete an artifact from your from the central repository maybe other builds can fail simply and we have some examples of these problems like an npm and other things like that are Python and other things like that and I think this kind of Step of security and things like that the steps you have to go through it’s a little bit complicated yes that’s that’s a point which is not good I know yes but there are a good documentation you

[3:39] Should do that once and if you have to get used to it that is fine yes but it gives you on the other side a very good security and a reliability which is very important for your builds and I think that is most important based for a build tool at all yeah and there is a process ongoing I think to have a new setup so for firsttime contributions there’s a new login Pro procedure being developed I think I’ve seen yes in the meantime there are other setups doing at the moment that is supported by the sonot type Corporation yeah they’re doing that all all the time and they are trying to in a way to simplify that process yeah that’s a good thing and that takes time of course because we have millions of artifacts in central repositories about four five million artifacts in the meantime that size is about 15 20 terabytes in the meantime and very large to be honest but it has grown over 15 20 years in the meantime and that takes some time of course to make the migration from the old process to the new one what I heard is that the very first server of that repository was under the desk of the sonot type manager

[4:50] I think I am not sure about that story but I can really imagine that it could be true yeah that’s I don’t know if it’s a legend or if it’s true but it’s I can’t I confirm that but it could be true yes maybe maybe it’s true yeah yeah now if you go to Maven the bill tool so you’re saying version four yeah what will be new or what will we see as as Evolutions the most important thing is because many people are complaining out the flexibility part and also about the XML configuration it’s bloated and things like that you can do that but there are some some things we had to do ground work we have to do some foundational work at first and we needed to start to make a separation between the real use pom file which in Maven 3 is always the same you use for building and also you will publish that and you will use that for consumption and there are two things combined here which is usually not a good idea to make a separation of concern here that’s much more better then we have to make a separation here we call it a build pom that’s one thing what you use and describe how you build

[6:02] Your artifact and on the other hand you have to publish something like that which is consumed by other by the consumer and there is a separation ongoing which we have implemented over the time in the meantime that takes a long time because have to clean up all the co old code because this code phase is about 20 years old in the meantime to be updated and clean up and things like that and that was the most important foundational work we had to do in the meantime that worked with 4.0 we are at the moment in these days I read the mailing list yesterday last time we had a all started a voting for beta one at the moment but it’s closed because of a problem so in the next days there will be coming up another world for that and that is the most important thing we had improvements for the reactor and many other things to improve that handling version handling I do a lecture on when wday about that and others already did so for example on j conf conference and others already talked about the details but that is the most important thing to do that and to get the door open to make it possible to do changes

[7:14] For example change the form if we would like to or make it more easier to use something like that I like the XML structure yeah to be honest I like the XML as well because many interestingly many people are complaining about that because they say why we don’t we use jaml or Jason or whatever but the most important thing about XML is it works with all idees code completion works it is machinable readable and the problem is what many people don’t realize in the background is this is not describing only for the human being sitting in front of that but it’s also consumed by a lot of tools like the Ed Ides for example many other tools are working on that structure analyzing tool things like that and that is the most important thing and that’s a huge amount of things and you can’t simply change that very simple or all the files which are in Central repository for example they are XML and they are in this old format 4.0 for example and if you would like to change that you had to migrate the whole Central repository should who whoever will do that work there is no possibility to be honest in

[8:29] The history of Maven there had been something like that already we had the migration from Maven 1 to Maven 2 where already the format has changed and based on the history I read it was not a good idea in the end one thing you should learn do a mistake only once for example learn learn from your mistakes learn from your mistakes in the end yes that’s a very good thing yeah so may before when will we be able to use it fully you can already use it and test it it’s completely released availability of course but in beta phase we are I think we should have something end of this year maybe beginning of next the final release I say would say but it would be a great thing if you already downloaded and tested so we can see okay there is a problem with a particular build or a particular Maven Plugin or whatever but it’s very important to just try it out and see if it works I would say it should work already many many things of course there are issues in there but it’s very important to report these issues and that is the most important which we wish from the community that they are doing that and

[9:41] Report the problems say okay there is we have one bill that doesn’t work with Maven 4 this and that and Report the details that would be a very good thing for us of course and also for Community yeah was back okay that’s a nice message to share yep my name is Steve Paul I work for cot type for a couple of years I used to work for red hat for a bit and then I was at IBM for 28 years scary number I’m a JVM engineer I’m a devops guy I care about security and right now I’m the director of developer relations at cotype so my passion because it’s very much what cotype cares about is security but software supply chain security so not like API stuff but getting Developers to be more security conscious in how they create software and how they choose dependencies and all that sort of stuff so we’re trying to get people to do a better job because of all the bad things that are happening we just had Carl Hines here yeah we talked about Maven of course yeah but I don’t know I don’t think that most people are aware that sonot type is behind the maven repository absolutely the history is

[10:55] Really strange because two guys Jason vanil and Brian Fox created Maven the tool Way Way Back in the early days of java and it was there as a you know make make it easier to create builds it was just there as a developer to but once you start talking about having an easy way of managing dependencies you need to have somewhere to put the dependencies so Brian and Jason started I think it was actually Brian who had maven Central under his desk so it’s true we were just wondering is that he says it that he did but I don’t think it was for very long it didn’t I mean because Apache were the you know hosted it fuzzy on the details I know that for most of its life it was funded by public subscription and then it just got too big so now it’s you know I know this year we had a trillion downloads and it just continues to grow so yeah so I know long time I know couple of decades cotype has been quietly running it and that’s Brian’s passion because he’s you know an open source guy and so that ethos is always around and mayen Central yeah it’s a great tool for us because we can say all the security

[12:22] Software that scanning software is used when you post to Maven Central but that was never the intention the intent was to give the community something so yeah which is as you say people got surprised when we reskinned it last year or the year before and people saying when you cype by Maven Central it’s like no no we’ve been running it forever yeah indeed yeah so you your focus is bit on security so there are some horror stories we can say about from the Java Script Community where libraries got uploaded containing security issues back doors and are you sure that will not happen with Java libraries it’s not impossible but it’s much harder there are some really basic stuff so for instance when you publish to Maven Central you have to own the Internet domain that matches the package that you’re putting up so that sorry that requires proof of identity and it requires you to spend some money to own a domain and so that’s one barrier the second barrier is be is because you have to own the domain you can’t do what’s called dependency confusion so dependency confusion is where I publish

[13:46] Something under one version and you publish the same package with say version 9999 and then when somebody comes the latest version they go latest they don’t get my latest they get yours you can’t do that with Maven Central because you have to ear domain now if somebody managed to take over domain ownership theoretically as possible so you get that problem which we don’t have in general the other one is typo squatting where people the name of the package they misspell again if it’s I know com. aache Fu and you spell it com. aache Doo you’re you couldn’t register that because it’s when there as high demain so it’s not it’s slightly harder slightly easier to do that but again you have to buy a domain to do that so we’re pretty from a Java point of view we’re pretty secure because of those things and of course also anything that gets pushed up to B goes through all the scanning tools that we produce and I joined cite because when I was looking at this I think again these guys know what they’re doing so it’s not a soub to say I think that they have one of the best set of solutions going so

[14:57] That means maven’s very safe but if you look at the other communities you look at JavaScript and Python and stuff like all these things are possible because they don’t really have the ownership mechanisms so therefore if you know I can register something and you can register something with the name slightly misspell somebody finds yours other than mine maw oh and the other thing that makes this even worse is some of these packaging tools have exit to run install so they can run Scripts so there’s another way for malware to get in so with Java you download something nothing happens you’ve just downloaded it so there’s a whole complete difference between the way the ecosystems work and Java is by design by default safer so you know keep using Java of course we the Java Community oh I say Java I mean cotan and all those things yes it’s all all these amazing Technologies running on the gvm yeah yeah and it’s more than just Java there well the last time there was a Wikipedia page that was kept update for a bit and I think the top it got to was about 850 programming languages ported to Java

[16:05] What yeah yeah you go there are that many program languages but I I’m it was a very high number yes yeah and there are a lot of Engineers developing a language yeah just to find out how the gvm works yeah you can do that I everybody should try and write their own language it’s not hard you can get into the weeds you know if you start going down Lexus and those things you know you can get very hard gets very hard the hard bit is always with Java with any program language is the conversion from source code the binary you know to machine code with Java you don’t have that problem as long as you spit it out you got learn B code and stuff like that but as long as you that’s not hard once you learn that stuff you can create a language yeah just had otavio here he’s written a book he has written a book about the bite code so if you want to understand how that works there are great books about the topic and a lot of info Java developers modern Java developers current Java developers have lost track of how Java works now jvms work and they might talk about GC and stuff like that but the detail I think

[17:11] Isn’t particularly common knowledge I’m doing a talk tomorrow about hidden security features of jvms a lot of stuff there that it’s mainstream but not many people know about yeah it’s not only security is also like garbage collection yeah you don’t need to know it as a Java developer because JVM takes care of it yeah but it’s good if you know how it works and what you can achieve with it and because it works so well you don’t notice those of us that have been brought up with Java know that there were the early days of GC getting in the way and people being you know it becoming a mean the things stopped because GC was kicking it and that’s all gone and that’s thanks to hundreds of millions of dollars of investment from over the years from all loads of people it’s been people don’t realize just how much money has been put pushed into the jvms that they used today if you go back to security yeah there’s a whole discussion Trend going on about es bombs yes is that part of that security process being aware of what is in your project yes yes in a nutshell we’re seeing more and more

[18:20] Legislation that is requiring you to provide proof of what you’re shipping so an sbom the idea is that when I give you a product even if it’s a black box you can’t PE inside I tell you what’s inside it and that eson that bill of materials is what can then be used to check against have you got any vulnerabilities so you would no longer rely on me to tell you could check it yourself and you know that’s the first step the requirement on producing one and then the understanding that it becomes a legal document that you have to give to somebody so they can keep themselves safe and that’s what the industry is trying to do the what you the way to look at it is to look at the way that a lot of the governments think about these things so most governments don’t understand software so you often get like a car manufacturing analogy so the analogy is if you shipped a car and you knowingly knew the air brakes didn’t work then you would be liable right you would be criminally liable but you’d also be required to do a recall so you know he’s he’s got that version that’s slightly harder for us

[19:36] But if I told you that you’ve got a car and one of the parts is a malfunctioning airbag you could do something about it you’re not waiting for me to tell you right you’re it’s so it’s better joined up but a lot of this the esom is the first artifact the requirement from all the governments is a lot more about much more rigor and control over the process because security issues mistakes and things happen from the moment you write software so what they’re trying to do they will force us to do is to move away from a lot of the handcrafted Bill systems to more rigorous controls yeah and as bomb contains more than so if I create a Java application and I have in my Maven pump file five dependencies and a version yeah there’s actually probably more dependencies in there yeah well so in theory the esom I give you will contain all of the code that I’ve shipped you in a way that you could scan for as in you could go look up for vulnerabilities so it would be initial initial dependencies transitive dependencies in theory and this is has been discussed is that it would also tell you what

[20:47] Compiler you used and what plugins you used and what operating system you used down to something that was trackable because in theory with a compiler I mean compiler vulnerabilities are pretty rare but they do happen if somebody spotted that there’s a compiler vulnerability and you knew that the product you’ve got was built with that compiler you might want to do something about it so the s bomb bu materials is similar to what you get on the side of a jar in a supermarket but with more information because it isn’t just ingredients it’s also where the ingredients come from what’s their Providence so the pressure is to create an accountancy chain unforgeable unbreakable accountancy chains everything involved in mutating the software from source code to delivery packaging it combining it whatever is in there so that you can see that if it affected your if it was gets affected you know big ask we’re a long way away from satisfying that but governments like all these people start with something and the first thing is the yeah okay so security it’s a hard topic yes but actually pretty

[21:59] Fascinating that’s fabulous and a lot that you can learn from yeah not only security but also how Maven Works how yeah applications get packaged and buildt and stuff yeah oh I mean I know a lot of this stuff over the years anyway because you know you use these things and you get curious the thing for me was that a few years ago when I was IBM I sort of got bored doing jbms right I just doing it too long and I want to do something else so I took over running IBM’s European devops team and I went into there with a developer hat on and I came out with a devops hat and the difference for me was that I went in as a developer going I’m if I’m going to run a devops team one of the things we’re going to do is we’re going to fix all these nonsense about updates and patches and stuff because it gets in the way let’s not do that what I came out with was I now understood exactly why these things were important and why we have to get developers to do that which is sort of started why I’m here because developers are not security conscious they’re not security aware and when they do get told to do things they see it as this chore

[23:07] That they try to work around yet what we’re all we’re trying to do is keep everybody safe you know we just we haven’t got through we’re getting there but developers because they’re so often pushed about productivity that the security becomes a second thing but hopefully especially with a lot of this legislation there may be a little bit of kicking as screaming into the 21st century and it’s it’s so hard but so important because there are so many people on the wrong side let’s say oh yeah who are trying whatever they can yeah to get into applications get into databases so yeah yes if you come to my workshop yesterday you would we would have talked about that the scary fact is that the estimate of the amount of money that it cost the world this year which is a factor of how much the money do they steal from you and the consequences of whatever they do to trash systems you know for you to recover the current estimate is about $9 trillion and when you get $9 trillion and it’s like it’s such a big amount so one of the analogies we’ve got is that if that was a GDP number cyber crime would be the third largest country in

[24:21] The world and the way things are going by 2025 2026 it could be by GDP the number one country in the world and you get and it still doesn’t compute so the one I use in the UK we just started using is in 2016 when cyber crime was about the same as the drug trading value you could buy two million houses in the UK for the money that they was okay now you can buy 85% of all the houses in the UK you know there are millions of them so the amount of money is ridiculous and because it’s it’s so easy to do it’s just growing and growing which is why developers are key to this because they’re the ones that make the first choices about what software comes in they’re the ones that worry about up should worry about upgrades and if we could get them to realize how much control they have in keeping us safe because it starts with them we don’t want to be in this position where of having people with big sticks every time going you’re using a vulnerable thing updated it we want Java developers should be making better choices so that happens less often so yeah so they have to do that

[25:35] Because if you get hacked I don’t see if you’re a small company 50% chance of going after business bigger companies less but it’s still a horrific attack and of course we’re moving now also from it being attacks of money we’re seeing much more cyber Warf for type attacks which is much more nation states using the same tools and they have different agendas and you know you’re you’re looking at people not just say stealing data you’re also seeing people adding data you know if you’re a credit card company or even if you’re just a Amazon somebody somebody can compromise you and insert new accounts that you know any and get bypassed any validation process that you’ve got that’s really valuable they can then start sending all your goods to somebody you know or whatever so it’s and the thing is that the bad guys are much more incented to do all this they’re much more thoughtful and if I have one take away from all this is that don’t think this is some 15y old guy in his bedroom these are professional groups of developers well paid very motivated just you know with Criminal

[26:47] Intent yeah there are businesses but Absolut somewhere hidden yeah yeah with stuff and big big groups of developers really working on these hacks yeah yeah I mean there’s not as many you think but there are enough of them to want to do this enough of them for all the governments to realize that they have to do something about you and it’s the money is a big thing for them but the realization these weapons are also weapons of war yeah and can be used against you now you can see everybody you can see what’s happening Al you’ve got nation states going we have to prevent this they can’t attack us but also they’re going how do we use this stuff to attack so yes new world it’s a scary message but it’s one we have to bring yes absolutely thank you next to security we as developers are responsible for the creation of readable and maintainable code I talked about this subject with the following guests Meo Wagner marit F and hin hey my name is Miro wenner and I am here for conference the first to kind of Meet the friends which I don’t have a time normally because my busy schedule and also to get to know what is

[27:59] Happening in a Java World MH yeah to keep updated and are you speaker yourself yes I’m speaking I have a talk here and I forgot the name what is the topic how to boost the delivery stream with the discipline engineering because I think based on the project I’m involved in and I’m trying to help the customers to I figured out that the struggles are in the communication mainly it kind of also involves the level of empathy mhm yeah the people are not able at certain point to communicate and it’s not only about the developers it’s also everyone knows the convey law right so the product actually the application we produce is kind of reflection how the company communicates but it’s a just a partially true yeah I mean if the if you don’t have the language how you can share your ideas or just how you can object against the decision so it’s very hard it may turn into the Direction you don’t want to and yes but I once heard about someone who decided to become a programmer is he did that because he didn’t want to speak to people he wanted to be behind the computer but actually I

[29:19] Think that’s the biggest mistake as a developer is that you don’t want to speak to people that’s yeah probably the biggest part of your job is find out what people really want what is the problem they want you to solve I mean yes I agree I mean it could be valid in the past right so this is also about my the talk I will be touching this topic yeah in the past there was simply the system were not that complex and it allowed us as a developers to provide really isolated Solutions yeah but these times are gone so they will never come back so right now we are running the Clusters we are running VMS so everything is basically spread around in the clouds yeah sometimes raining yeah so but in that case what does it mean is you have to actually communicate your result you need to find a language that you can share with your PE your achievements or your struggles yeah so it’s communicate with the people who are using your application but also within your team yes with your testers with the people who want who need to deploy it yes so I indeed we are in a completely different software world than some years

[30:43] Ago yes of course completely and also there a very nice also the Java is a completely different level I right now recently when I just being sitting in the train I read some article like or just maybe it was a tweet that with the new release 20 Java 23 it becames eight L closer to Scala yeah the J Java but I think it is a partial true yeah so I mean the Java is a it will be still the first one JV land language Scala it brought some very nice features that been required by the community at that time but I mean if you take a look on the trends how the company been able to evolve if the Java would be at the level like a Scala at that time just it will be too too early because the company and project will be not able to kind of use and utilize all these features yeah that’s a bit what we heard already in the previous podcast is yava evolved slowly so it became a stable system where a big a lot of companies depend on yes and now with the new age we have a fast revolving Java so we’re entering a new era where people people can take take take pride in the new type of java that we have now

[32:03] And so people who are cutland fans actually they’re also running on the gvm so it’s it’s all the same base yeah I think well I have experience I have been also having the project with the cotlin is a nice language yeah I have no doubt I have no here I everything it is running on jbm I love Yeah groovy so yeah it has all everything has a plus minus yeah some there has been taken some compromises and the coton is the same yeah the Java part of it it’s precisely designed to a achieve the type safety all the way around so no shortcuts yeah and this is very hard to make like my respect to the language designers yeah and those languages like Scala or cutl and so they just took a shortcut they took the glowes rying on the floor M yeah and jav was not able yeah but it was able to evolve and the designers were well able to think through things how it will be works and therefore I mean Java has done the dramatic like improvements over the past year and this six months cency is really helpful yeah and it’s one be Scala I think I just to be honest yeah I’m I’m running right now scalar project

[33:30] Very big one and it’s going a lot of mathematics here so and I think we are right now entering the phase like in the next man where maybe it would be possible with the new features even to switch to without the significant contrib like refactoring and sign to Java yeah because Ed end we my project is based really on mathematics and prob isic yeah and as I see the transformation we need to apply on the code so I have like SC Scala has this features but the Java is not so far yeah and never been so that’s it so but it’s all in the gvm world so we’re all happy with it no my point was that just complain the sometime people complains that Java doesn’t have these features yeah but the question is do you really need these features yeah because actually if you are the seller or you owner of the product you need to maintain it any part of the code you need to maintain and it becomes very significant difficult if you have just the collection of new features or cool feature usage which you don’t understand MH after the week yeah so that’s my point okay I’m Mar sik I’m a

[34:54] Developer Advocate at jet brains and I’m speaking here today or rather I spoke this morning and my talk was called reading code and it’s about reading code and the importance of reading code and also why we should practice reading code because as developers we spend more time reading and trying to understand existing code than we do writing code but we hardly ever practice reading code as a skill we spend a lot of time practicing writing code but not reading code and then you know sometimes we need that skill more to understand existing code that we’re working with so my talk is about how can we practice reading code and using structured exercises and code reading club which was created by Felina hermans a professor of Computer Science Education in the Netherlands and a few other people and they started doing exercises and practicing reading code and they’ve shared some of the their resources with people so that people can either join their online events or start their own clubs and of course I’m talking about how our IDE can help us when we are reading code in our

[36:10] IDE from familiarizing oursel with a project or looking at a particular section of the code and searching and navigating our code base to getting hints from the ID and finding out what a particular piece of code does so is it the bad joke that you should write code for the for a psychopath who will take over your code later and will murder you if he doesn’t understand it I really really dislike that joke it’s a really because I would prefer to not have any Psychopaths that work in your code my team in my code near my code or near me so I would prefer to think of it as writing code as if it will be maintained by someone that you like including your future self future assuming that you like yourself but you know hopefully we do so assume that it will be maintained by people that you actually like and make it easier for them to maintain your code and especially yourself and I mean we all know what it’s like reading code that was written by someone else including your past self because you won’t exactly remember what you were thinking so and is it only

[37:29] About having a good method name or is it making your code not complex it’s multiple things so I’m actually not my talk is not about writing readable code but it’s explicitly about reading code that is and I think you know as we have a lot of opinions on what makes good code there are people who’ve written books on what makes good good code and yes there is re but there’s also there’s research on what makes good variable names or what makes good code and again Felina Hermon has written a book called The programmer’s Brain where she’s also talking about you know what makes good naming or good variable names but based on Research so not opinions on it should be this but research has shown that this works better so I really like her book in that sense but it’s also more about you know you encounter code the code is what it is you might write it differently now because you know more than I’ve literally Rewritten code that I wrote myself six months ago because I learned more about the language that we were working with which was cotlin we used cotlin at my previous

[38:48] Company so you know my first cotlin was writing Java in cotlin and then as we learned more cotlin and more idiomatic cotlin going back to that code and then making it more idiomatic it wasn’t because I was aiming to write bad code originally but I had learned new things so I could apply the things that I learned to that code and the same might be true for the domain that you’re working with as you get better understanding of the business domain you are able to use better naming for things or apply better logic to it and clean out some of the bugs that might have been in your thinking and therefore might also end up in your code so it it’s all of those things it’s evolving you as a person evolve your knowledge evolves and also the ecosystem evolves so new libraries might pop up that give you functionality that you need or you know the style might might change the Java language evolves continuously and there are new patterns that we can use to make our code you know less verbose less ceremonial easier to read as well so yeah keeping up with everything that

[40:04] Involves including ourselves and if we talk about Evolutions we have chat GPT which is now there as the AI assistant for instance in intelligy will that help us to read code or understand code yes so I also showed some jet brains AI assistant features that can help you to understand code one of the things is we there’s a there’s obviously an option to chat with AI assistant so you can ask questions and they can be generic like how do I do a quick sort or they can be specific like how do I add a controller and if you’re in a spring project it will suggest a spring controller to you or you can even ask it questions about your project because it’s connected with the IDE and it can do callbacks to the IDE and get that information for you it doesn’t automatically load the ENT ire project as context but it can it does have some information on the abstract syntax tree of the project or the program structure interface so what type of dependencies you’re using Etc and it uses that in the context but it can also call back to the IDE to get more information so that is one way that

[41:13] You can interact with your project with through AI assistant we also have some AI actions that you can use in the editor including explain code where it will open the chat and explain the selected piece of code you can right documentation sometimes that’s a good way to get a quick summary of what a method does you can use it to find problems or suggest refactoring which can also help you that’s going more towards judging and improving the code but it can help you understand like how does it work are there any problems in this code that I want to be aware of before I touch this code and now it’s mine yeah so it’s an extra tool we already discussed sonar Lin before which is also it’s not AI but it also says this is wrong with your code or you should make this differently so that’s this is a potential bug pattern or yeah so I mean obviously intellig idea has inspections that we’ve had for years and years which will suggest things that you could change about your code to make it more robust or performant or change the style to new Java versions we also have a scanning tool called

[42:25] Kodana where you can run those same inspections but in your cic CD or in your CI server so if not everybody on the team is using intellig but you want to make sure that you run the inspections you can use kodana and then AI assistant is an additional tool on top of all of that you can use to interact with your code and there are apart from the chat and the AI actions in the editor there are additional AI actions throughout the IDE obviously being tooling company we’re working very hard on integrating it into the IDE so another feature that I really really like is to explain this commit to me because if you go to the commit history sometimes you’re working on a piece of code and you’re like why is it like this or hey I thought it was different when was it changed so you can go to your commit history and find that commit to see you know at least the commit message which will hopefully not only tell you what because you can see that in the code but also why because you can’t see that in the code and you can ask you can look at the diff obviously to see what exactly was

[43:31] Changed in the code but you can now also ask AI assistant explain this commit to me and it will give you a summary of what was changed in that commit or if you select multiple commits what was changed in a few commits yes was that also in your talk yes I did show that in my talk so if the recording is available yes please watch that and let us know what you think my name is hin and I’m here at jcom initially to give a talk but I’m also enjoying the other talks I can watch and meet people is it’s always great you just left the blackbox room I guess no I didn’t no I thought you were part of those people so what was the talk you just visited it was about ethics being ethical as a developer so thinking about how do you say it difference between privacy and security they’re like in the same area but different yeah but different indeed so there was good refresher I’d say I we are working with Foojay on a book about being a sustainable developer okay I think that’s a bit the same topic you can be sustainable in good to people but also good to the economy ecology so having a

[44:46] Service which doesn’t consume too much energy was that also part of the talk no no was more about people ethics people yeah yeah gdpr that was not mentioned no it was more about i’ say think about ethics and not really about following the law that also follows of course if you try to do that yeah but be a good developer by just thinking about things before implementing them H so you’re also a speaker what’s the talk you will give or already gave I don’t know I already did my talk it was this morning it was about code reviews so some best practices what you should and what should what you shouldn’t do with a codee review okay which is a Hot Topic and a difficult topic I guess for a lot of companies what is a good merge request a small one with unit test or a big one refactoring the whole codes yeah I should of course say it depends right yes so I think there are a couple of key points I think for doing good code reviews I think the first one is to agree with the team why you do code reviews because I see a lot of teams that some people so say no I only go for the buck and other people

[46:04] Yeah nitpick on every I don’t know style change and refactoring so in general I think that’s the most important part that you know why you do the code reviews another one is try to do one thing at a time so you can still do one refactor which touches a lot of code just because it’s used a lot of time then maybe the request is big but it’s conceptually one change so if you try to stick to conceptually one change that will really help also like code formatting is also a I would say a famous thing for touching a lot of lines so if you change one code style Rule and you reformat the code then it’s like I don’t know whole code base has been changed while essentially it’s only like change the Braes from End of Line to new line so then for review I would say review the code Style and then approve so and I think if your company is big enough or at least you should try to automate this kind of stuff I guess formatting yes yeah so one of the how we say it the one of the points I had in my presentation was I don’t want to see any style comments if there’s a style command you should

[47:21] Automate it like if it’s not an automatable style check then it’s like matter of taste cannot really like block a pool request on it that would not be nice and of course automate the boring Parts as much as possible so that you can use human power to do the real valuable reviews same with like Security checks there are automated Security checks you can run yeah try to use them yeah if you say do one change at a time is it also important to have a discussion about trunk based versus branches is can that be an issue in a good code review process I think you should decide on a branching strategy apart from the code reviews and then the code reviews should follow that guideline that you have in the team so I would say it’s like a team decision or maybe a company decision on a branching strategy that some can have some advantage over others and I suggest for sometimes use feature branches if you have a really big thing which requires both refactoring and a lot of code to be added and maybe some other things then you could opt for a feature Branch to prevent one big merge

[48:38] Request so you can do small pull request to that feature branch and then at the end you don’t have to do the whole feature brand review that because every part is already reviewed oh that’s the idea so you stay stay within your feature Branch but you still do pool requests true to have to review step by step correct yeah yeah but it’s kind of like a workaround but because I would prefer to main to the merge to the let’s say main branch so that everybody can profit from a reflection for example so if you change the design and you integrate early but sometimes that’s that’s too difficult or not viable and then a feature Branch could could help but again yeah software it depends yeah of course I think it’s also depends on the size of your team and the size of your application if you can have multiple Fe feature branches true yeah and also the experience of the team so to be able to handle that kind of big changes we are here with a lot of java Community people do you mingle do you see a lot of people you know or only know from Twitter and other things and get in contact maybe not a

[49:49] Lot because typically I don’t make contact quite easily or it’s improving but still working on that skill but the more people you know the easier it gets to get to know new people because other people know other people and then it spreads yeah you’re from the Netherlands right there are a lot of JS in the Netherlands do you participate in those depends on how you go participate I attend to I try to attend the UT J meetings like every other time so it’s like once every two months or so something like that and occasionally I go to other meetups in the Netherlands if they’re close by you spoke here how is that Journey as a speaker did you start that J or did you just submit to a conference and got accepted I started out on a speaker mentoring program from the UT jug by was back then it was Brian verir who was the mentor for the speaker program and then I got a talk on UTF Jer and then I sent in a proposal for the jall conference in the Netherlands that one got accepted but since then I didn’t do that much conference was Java land last year and now is that a good approach you

[51:10] Think to grow through a jug and do a try out let’s call it like that a try out at a smaller event like a jug yeah I don’t know I’m not that experienced as in I didn’t try the other options so but yeah for me this speaker mentoring program helped both in let’s say technique writing for call for papers but also getting to know other people and then starting with presenting in a joke that made the bar a bit lower to start yeah that’s it for this episode of the Foojay podcast and my overview of the Jon interviews in the next one you’ll hear otavio Santana Aran tames Andre miali bhaki Cindy and Patrick bone Gardner about persistence Jakarta e a pet project with telegram and much more see you next week give me a give me a j give me the friends of OpenJDK