Bram's Blog

View on GitHub

JFall

Last October, I visited JFall Netherlands. JFall is the biggest Dutch free Java conference, held every year for members of the Duthc Java user group NL-JUG. If you are a member (which costs about Euro 50,-), you can visit JFall for free, provided you are able to catch a ticket.

Below are summaries of the talks I visited. There is also a playlist of all talks on Youtube for:

Master your tools - Jan-Hendrik Kuperus

Jan-Hendrik gave an early-bird talk in which he talked about lots of productivity-tools he uses on his MacBook. Some tools also had Windows and / or Linux alternatives. Most of the tools either help you automate things or access existing workflows or functions using much easier and faster key-bindings.

His alibi for this talk was based on the psychology of our limited ability to spend conscious effort. He advocates simplifying things to free up conscious effort that can be spent on actual creative work instead of losing it to mundane, repetitive and automatable tasks.

Given that having to remind lots of terminal commands, requires more conscious effort, we would like to automate and simplify things alot. He also showed us an XKCD chart to quickly figure out if the time to automate is worth the effort, although he did confess he was in the grey zone (not worth it) quite a number of times.

Given the time you can shave of by automating something and the number of times you perform this task, how much time could you save over a five year span. If you can automate it within that time, you have a net gain.

IntelliJ Idea:

Jan-Hendrik uses IntelliJ, because of these reasons:

Browser extensions

Jan-Hendrik showed a number of handy Browser extensions, mainly on Chrome. It is unclear how these extensions store your data (in local storage?) and whether they expose your browser-history to the extension’s developers.

Alfred peaked my interest

This is a replacement for Spotlight, which can:

Shell magic

Hammerspoon was incredibly powerful

Other

Keynote Rabobank on fast deployment to Pivotal Cloud Foundry

The first Keynote was a very nice talk by Vincent Oostindië and Wouter Oet

The main focus for them is to abstract away all container-hassle and stuff like configuration, log aggregation, cloud-challenges like scaling and routing etc.

Wouter was visibly nervous as he live-deployed an app (a Flappy-Duke game) to production on Pivotal Cloud Foundry. He first let us check the URL to see nothing was there. Then he pushed his code to GIT, which built and deployed it to the first server instance, which gave many of the audience access to the app. But after pushing to the second server, everyone had access. This all took just minutes from his local machine to live on PCF in production.

Yes this was in minutes, maybe even within a minute. Okay, it was “just” some static resources and they skipped all the normal pipeline stuff to do like complex build, testing, quality gates and pull-requests. But still, deploying made so easy and fast is what the end-game of DevOps should be.

As for technology they use at Rabobank, they already use Java 11 and are pushing towards 12.

Cryptography 101 by Michel Schudel

Michel had worked at Rabobank as well, where he created a Rabobank Crypto toolbox. In his talk, he explained the basics of Cryptography, which included:

He explained how cryptography can be used for:

Note that in the normal CIA triade the A stands for Availability, which should make sure data and systems are available when they should be available, so things like DDoS and Ransomware prevention should handle that.

All classes you need to do all the cryptography stuff in Java isn’t even that complex, but you do have to do it correctly and be aware of some small, but important details. Cryptography is included in:

These are some options to use as implementations for Cryptography:

The examples are all available in his Github repo here and the presentation slide are here

As for where the java security stuff is stored in different Java versions, that changed since Java 9:

Hashing

Good hashing algorithms have these properties:

Symmetric encryption

Symmetric encryption works on same-size blocks of the original input, which could mess when encrypting repeated data. Basically if the repeated data is the same size as the block size of the encryption, you will see repeated data in the encrypted output as well.

But with symmetric key encryption comes a challenge: How do you agree upon a shared, but secret key? That’s where the Diffie-Hellman key-exchange helps out:

Unfortunately Michel forgot to mention Ralph Merkle who conceptualized the exchange method.

Asymmetric

Asymmetric encryption is much slower and requires longer keys as the data to encrypt gets longer. So it is mostly used for:

In asymmetric (or private-public) key encryption, communicating partners use a key-pair which is mathematically bound to encrypt and decrypt messages or data.

One key is always private (the secret) and in possession of a single person or entity. The other is public and can be used by anyone.

In the example, Bob wants to send a secret message to Alice.

Signatures

Signatures are used to authenticate data coming from a specific source. For this, we use HMAC: Keyed-hash Message Authentication Code.

By combining hashing with asymmetric encryption, a sender can create a hash of a message, then encrypt this hash using his own private key, which only the sender can do. This is exactly the other way around as the previous example, where the sender encrypted the message itself with the receiver’s (public) key. Often a combination of encrypting the message (again: with the receiver’s public key) and a signature (with the sender’s private key) is used to get both confidentiality and integrity.

Certificates

These handle authenticity.

Again, everything needed to use (store, validate etc.) certificates uses a small number of classes. Also, these can (and often will) be implemented by a Hardware Security Module, which when done properly, strengthens security of your setup.

Highly Secured API’s: Insight into OAuth 2.0 by Simone Stapels

Simone talked about the different choices you can make when implementing OAuth 2.0. She explained the good, the better and the not-so-good options.

Some important facts she discussed:

IT Leadership summit

In this panel discussion, four IT C-level managers discussed a number of JFall-relevant topics, mostly on cloud, microservices and DevOps. Let’s just say that not all C-levels can be short and clear in their answers, let alone keep my attention. Where three panel-members could keep themselves from “selling” and stay on-topic in the discussion, the fourth member was both very wordy and constantly selling his fantastic company for all the wrong reasons. If I ever would consider that company in the future as an employer, this panel-discussion cured me from that urge.

Community keynote: A brief history of Computer music by Anders Norås

Anders took us from the very early days of computer music all the way through to current days where popular dance and pop-music is often composed mostly or even solely using computer-music. A lot of classic home-computers and consoles passed his presentation and a stream of retro-games and their sound-tracks were played.

I did miss some topics that I think were relevant in this context:

Notwithstanding, this was an incredibly fun presentation to (mainly) listen to and the audience was clearly very drawn into the retro vibe.

Secure Development Pipelines by Marten Deinum

Marten talked about lots of stuff developers can already do on making the software they develop more secure, before pentesters go in.

In his intro he discussed how Security:

There are several free and/or opensource Static analysis (or SAST) tools:

Also Maven has several relevant plugins:

Marten also referenced a talk on Spring vs. OWASP Top 10. I couldn’t write down the name, but I did find this excellent talk by Roberto Velasco @ Spring I/O 2019 on just about everything OWASP provides that can help you better secure the software you develop, beyond the well-known Top 10

The final tool Marten mentioned can scan your TLS/SSL configuration, which is TLS Observatory by Mozilla.

Some other “tools” that could have been mentioned are:

Using bleeding edge software in Lifecycle management without bleeding out by Martin Visser and Erwin Cavas

Final presentation I watched was about a Rabobank DevOps team of developers Martin and Erwin who discussed the strategy they used to break up a large monolythic application into smaller microservices.

They used the following technologies:

The challenges they faced:

Migration strategy

As a migration strategy, these were the steps they planned:

Performance

A thorough performance test was done using:

This concluded that:

This was unfortunate as they wanted to migrate away from Zuul, because this was declared End of Life by Netflix. Doubling the number of schedulers from 4 to 8 and again to 16 took performance to about 1 - 1.5x Zuul’s performance, but still fluctuating too much.

Pivotal Consultancy

They then asked Pivotal for consultation, which resulted in:

Spring Boot 2.1 General Availability release

They tried all Spring Boot 2.1 milestones and release candidates:

After these troubling results with pre-release versions, they landed on the general availability release, which to their surprise:

Blue/green deployment

To tackle the no downtime transition they used a blue/green deployment:

External configuration:

I’m not sure if these were final improvements they already did or which were planned, but for external configuration, they used:

All in all, this was a very nice insight into some challenging topics.

Overall JFall

With every 20 meter of exhibition floor, I bumped into an old colleague, project member or someone else from my network. Although this prevented me from spending proper time with everyone, I had an incredible time at JFall. I haven’t been able to go for several years now, mainly focusing on Security conferences (which I will keep doing), but as I’m trying to combine AppSec with Java again, this was an incredibly valuable experience.