A Java geek
Nicolas Fränkel's blog
- Website
- blog.frankel.ch · all feeds from this site
- Feed URL
https://blog.frankel.ch/feed.xml
Read it in your FeedListing reader
Or add to: Feedly Inoreader Raw feed
Latest posts
-
From Google Drive to Syncthing over Tailscale
I used Dropbox for decades, then switched to Google Drive. Both worked for most of my files. One file never fit, though: my KeePass password database. It’s the file I need on every device and the file I want to keep private the most. After one annoyance too many, I moved it to…
-
Security Baked Into the JVM: DirtyChai scales vertically, JGDMS scales horizontally
Nobody runs a SecurityManager in production. The usual reason given is that it does not survive a load test, and every guarantee in this series was bought with a check: a constraint on each call, an audit before each load, a principal set on each thread, a digest on each grant.…
-
Maps without a tile server
If you have built an application with an interactive map, you know what you are in for. You pick a tile provider such as Google or Mapbox, or a self-hosted stack like GeoServer or Martin, and your frontend requests thousands of small image or vector tiles as the user interacts…
-
Scraping websites and bot-protection
While searching for my ancestors, I had to access data from many different websites. I noticed there were different levels of protection against automated access depending on the site. In this post, I’ll list them and mention countermeasures you can take to bypass them anyway.…
-
Security Baked Into the JVM: no single party controls the outcome
A URL is a name, and names get reused. Replace the bytes behind https://repo.example.org/order-processor.jar and every permission granted to that URL still applies, now to code nobody audited. So far in this series, Part 1 declared constraints on a remote call, Part 2 vetted…
-
From documenting decisions to questioning them
I started with a simple task: I needed an AI agent to help me compile decision records, structured documents that capture why a team chose option A over B, using the open-source MADR format. Fill in the sections, organize the rationale, done. It worked. And it was useless.
-
AI-assisted genealogy, a follow-up
I got a lot of feedback on my post AI-assisted genealogy, some good, some not so good. In any case, I felt the subject was interesting to a lot of people. Meanwhile, I continue working on my tree, and I have deepened my understanding of the subject. In this post, I want to share…
-
World geography gotchas
Years ago, a colleague of mine told me about two pockets of foreign land surrounded by Switzerland: Campione d’Italia and Büsingen am Hochrhein, respectively Italy and Germany. Both are enclaves of their respective country in Swiss territory: An enclave is a part of the…
-
Build an AI Agent (From Scratch)
Facts 10 chapters$29.29 (at the time of this writing)315 pages Chapters Building your first LLM agentWhat is an AI agent?
-
AI-assisted genealogy
My son recently came to me to brag about using AI to find our ancestors. While the results were correct, I didn’t learn anything new, as it stopped at my grandparents. I was never very interested in my genealogy, but I decided to see if AI would be a good tool for this. TL;DR:…
-
Security Baked Into the JVM: sixteen Subjects on the wire
Alice calls the order service. The order service calls the ledger on her behalf. At the second hop, the ledger has to decide whose authority the debit is being made under. Most stacks answer badly. Forward Alice’s bearer token verbatim, and the ledger cannot tell her from the…
-
Solving Gradle metadata and Renovate integration
My current company has settled on using Gradle. It doesn’t make me very happy, but you need to learn to work with constraints. Plus, I must admit that the developers who actually implemented the build files did a pretty good job overall: they used Kotlin instead of Groovy, they…
-
Security Baked Into the JVM: two Subjects, one call
The constraint system stops a bad call before it leaves the JVM. The Safe Codebase Audit Pipeline stops bad code before a client ever loads it. What remains is identity: who is calling, and can you verify it? Most frameworks answer with a token check at the door. A filter…
-
GitHub agentic workflows and Renovate
I’ve been a big fan of Renovate for a couple of years already. Renovate scans your repositories, detects outdated package versions, and opens pull requests to automatically bump them. It’s similar to Dependabot in that it keeps your dependencies up to date. If I had to compare…
-
RFC 9880 and the IoT Validation Problem
The IoT/IIoT world has a data model problem and the concept of Digital Twin has made this issue more important. Plenty of people have tried to fix it. RFC 9880 and its Semantic Definition Format (SDF) are a serious attempt: a JSON-based, ecosystem-neutral way to describe what a…
-
Security Baked Into the JVM: the Safe Codebase Audit Pipeline
In Part 1, the minimal deployment showed constraints traveling with the proxy: authentication, encryption, hardened deserialization, all declared in configuration and enforced at the call boundary. The proxy is a JAR. That JAR was downloaded and unmarshalled before any…
-
Making ServiceLoader usable: a provider factory
I keep coming back to java.util.ServiceLoader. I have used it to put a JSON layer behind a contract, so the core code carries no direct dependency on any particular JSON library, and I can swap the implementation without touching callers. The same shape works for JWT handling,…
-
Two nasty surprises in Home Assistant's config
Last year, I motorized the rolling shutters on the southern façade of my apartment. My idea was to manage them via Home Assistant. I had a couple of automations in mind: In the evening, roll down the shutters of my bedroomIn the morning:If it’s too hot outside, roll down all…
-
Security Baked Into the JVM: why fork Apache River and OpenJDK?
The more distributed a system, the harder it is to secure. Code crosses JVM boundaries. Objects are serialized across trust boundaries. Third-party proxies run inside your process. The usual answer is a network firewall. It helps, but it operates at the wrong level. Java 17…
-
On programming languages, targets, and platforms
I started as a Java developer, but for some time now, I have broadened my horizons. Recently, I thought about how early languages were dedicated to a single target and platform, and now they are broadening their focus. In this post, I want to write down my thoughts in the hope…