Category Archives: Uncategorized

Why I don’t use var keyword in Java

Admittedly Java has had the var keyword for a few years now, since Java 10 (and C# obviously has had it for a lot longer), and while I was involved in a few “for or against” discussions at the time, I realize I never officially posted my position on the matter. So here goes.

I recommend not using the var keyword in Java

In my case, it is not simply personal taste or a matter of opinion – I actually believe it makes you less productive. I base this belief upon two facts.

1. Developers spend much more time reading code than writing code. For example, in Clean Code: A Handbook of Agile Software Craftsmanship Robert C. Martin claims “the ratio of time spent reading versus writing is well over 10 to 1”.

That is, developers spends more than 90% of their coding time reading existing code.

So while the var keyword may save you a little bit of time while writing code (I would say very little with a good IDE), if you only spend 10% of your time actually writing code – isn’t it more interresting how the var keyword affects your reading…?

2. Eye movement analysis of people reading code show that we are repeatedly revisiting the initial variable declarations (reference at the end). It seems that, even in cases with only a few local variables, the mind needs a constant refresher of what these variables mean, and – at least I’m assuming – their type. This happens so frequently that researches even gave the behaviour a name – “retrace declaration”.

Now, let’s assume a method with this piece of code.

var ratio = foo.calculateRatio();

When reading this line, what type is the variable? int? double? String??? A Map keyed by class X with the ratio double as value? Admittedly, upon first read it may not matter (which is kind of the idea with var, right?). But when your mind and eyes are repeatedly doing declaration retraces, do you think the process will be faster or slower compared to if explicit typing was used, such as

int ratio = foo.calculateRatio();

or

Map<Customer, double> ratio = foo.calculateRatio();

?

I know what I believe. And I believe the case is the same when initializing with non-return values, such as

var foo = 1;
var bar = new HashMap<String, Integer>();

vs

int foo = 1;
Map<String, Integer> bar = new HashMap<>();

In the var case you’d need to read more or less the whole line (well, you could skip var itself) to realize of what type the variable is. In the explicitly typed example however, I’m assuming it is enough for the brain to pick up the following, beforing allowing it to re-realize the type and hopefully resume analyzing the use of the variable:

int foo
Map<String, Integer> bar

Admittedly I have not seen any studies on this particular matter, but assuming I’m right, it would mean explicit typing lets you read less number of characters (or rather “words” since the brain normally doesn’t process character by character) than you would have needed to read with var, and thus using var would force you to spend more time reading code than explicit types.

And since reading makes up 90% percent of your coding, in total you would be less productive, even if you saved a second here or there of your typing.

If your experience is contrary to the above or, better yet, if you know of detailed studies explicitly focusing on eye movement / productivity effects of var, please let me know in the comments.

Reference for the eye movent study: Uwano, H., Nakamura, M., Monden, A. and Matsutomo, K. Proceedings of the 2006 Symposium on Eye Tracking Research & Applications as referenced with charts and all by Jason Cohen in Best Kept Secrets of Peer Code Review.

Fifty shades of Serverless

Today I gave a talk titled Fifty shades of Serverless at JavaForum Göteborg (Gothenburg), covering Serverless and the different options the market is offering us as developers in general and Java developers in particular. I also demoed a few examples and highlighted a few caveats to consider before going serverless.

Below you’ll find the slides and a recording of the talk. The code from the demo can be found at github.com/mjiderhamn/fifty-shades-of-serverless.

Release faster – announcing Maven Promote Plugin

Hopefully you have Continuous Integration set up for your Java project in a way that Jenkins/Teamcity/whatnot triggers a build as soon as you push to GitHub, or whatever VCS you may be committing to. As part of that build, or triggered by that build, you run a bunch of automated tests and then you or some other part of your team does manual testing of the produced artifacts (WAR/JAR) – right?

Then once everyone is happy with the results you want to perform a release. Assuming you’re using Maven, that means running a build in the CI system using the Maven Release Plugin. This will build the artifacts again and run the tests again. Twice even; prepare + perform. (Axel Fontaine has previously blogged about this nuisance and suggested a workaround that he calls Maven Releases on Steroids.)

In this era of agile and frequent releases, this seems like a waste of time, don’t you think? And when you have discovered that critical bug in production, having to wait another 20/40/120/whatever minutes for the release build after the fix has already been verified can be quite frustrating.

Don’t you wish there was a way to just promote the already verified artifacts, to say “These are the ones I want to release”, and have them deployed to your Maven release repository (such as Nexus)?

Well now there is!

Available in Maven Central is now the Maven Promote Plugin that allows you to “promote” your SNAPSHOT build into a release, and have it SCM tagged and deployed the regular Maven way.

For detailed instructions how to configure your Maven pom.xml and Jenkins, see the README for promote-maven-plugin on GitHub.

While the initial version of the plugin may not be as feature rich and/or intelligent as it could be, it gets the job done and on my day job we have been releasing to production with this plugin for months now, which is why I’ve decided to promote it to 1.0.0 GA.

Counterproductive security: disable password paste

I saw it again today – a site where they had made the effort to disable pasting your password into the login form. The motive surely must be to increase security, but this may be the stupidest, most counterproductive security measure I know of. Let me explain why.

Basic password principles

The two most basic principles when it comes to online passwords are:

  1. Use strong passwords
  2. Do not use the same password on multiple sites

One reason for using a strong password is obvious – it should not be easy to guess your password (i.e. pet’s name etc). The less obvious reason is that long and complex passwords are harder for hackers to reveal using simple techniques like dictionary attacks. If you want to know more about creating strong passwords, just google it. But I have another suggestion below.

The reason not to use the same password on multiple sites, is that in the unfortunate – although not that uncommon – event that a site gets hacked, and that they stored the passwords in clear text or weakly hashed without salt (don’t be that guy), so hackers get hold of your login info, they should not be able log into all your other accounts. Just imagine some low profile (low security?) forum you may have posted in once or twice gets hacked, and suddenly someone can control both your Google/Apple, Facebook and LinkedIn account. Not a pleasant thought, huh? (Tip: Enable two-factor authentication!)

Password managers to the rescue

The easiest way to use strong, unique passwords for all your online accounts is to use a password manager and have it generate different, strong, random password for each site. Thanks to the password manager, you can have good passwords like ltAaxjykylfcq3yU1K9M for Site A and 8KtVtz2iKa0kEhJ6honf to Site B, without having to remember any of them. (But you will of course need to remember the – preferably – strong password to your password manager. This is where the tips for manually creating strong passwords come in handy!)

I personally use and highly recommend KeePass which is free and available on multiple platforms (so you can access your passwords on both your PC and your smartphone). In my KeePass file I have 400+ passwords, most of them with a complexity like the examples above. Even though my memory often serves me well, there is just no way I could ever remember 400+ passwords as strong as ltAaxjykylfcq3yU1K9M.

Counter productive paste disablement

Back to the problem with disabling pasting of passwords into the login form. The most straighforward way to use KeePass, is to open your safe file and then just copy/paste your password into the login form. You won’t even see the password, as KeePass will by default mask it. The problem with sites that have disabled pasting into the password field, is that they discourage the use of password managers. Admittedly there are other ways to use password managers, such as browser integration and drag-and-drop, but the average user probably won’t bother to set that up. So, if I can’t copy/paste ltAaxjykylfcq3yU1K9M from KeePass (and don’t know there are other options), which do you think is the most likely scenario: that I unmask the password in KeePass (which by the way could allow someone reading it over your shoulder) and type it in manually – or that I choose a password that is easier to remember and type, say maybe one of the most popular passwords in the world…? And do you think that it is more or less likely that the user will reuse the same password on multiple “paste disabled sites”, than “paste enable sites”? So by discouraging the use of password managers, do you agree these sites implicitly discourage the two basic principles for online passwords – strength and uniqueness?

If you are a developer, please don’t disable paste in your login form.

By all means, read Troy Hunt on the same subject.

ClassLoader Leak Prevention library version 1.13.0 released

Version 1.13.0 of ClassLoader Leak Prevention library has just been released, and should propagate to Maven Central shortly.

This version changes the treatment of threads that uses the web apps ClassLoader as its contextClassLoader, while neither the Thread nor its Runnable are loaded by that ClassLoader. Previously the library would kill such Threads, assuming the ClassLoaderLeakPreventor.stopThreads setting was not explicitly disabled, which caused issues with Tomcat 7 executors.

Grab the new version via Maven central or download the jar manually.

<dependency>
  <groupId>se.jiderhamn</groupId>
  <artifactId>classloader-leak-prevention</artifactId>
  <version>1.13.0</version>
</dependency>

ClassLoader leaks at JavaForum Stockholm

Tonight I did a presentation on ClassLoader leaks at JavaForum Stockholm.

Video

Unfortunately there were some issues with the video feed, so I turned off the recording to rule out that interfering with things. Apparently the organizers recorded the event, so watch this space for updates when it has been made available online. Until then you may check out the recording of the same presentation from an earlier event:

Slides


References:
Slide 26: Heinz Kabutz Java Specialists’ Newsletter The Law Of The Blind Spot
Slide 41: Tomcat Bugzilla entries #48895 and #49159.

ClassLoader Leak Prevention library version 1.12.0 released

Version 1.12.0 of my ClassLoader Leak Prevention library has been released.

Apart from internal improvements (thanks to Jeremy Landis) it contains the following features:

  • Invoke org.springframework.web.util.IntrospectorCleanupListener in case it exists on the classpath. (Thanks to Craig Andrews)
  • Unregister ImageIO Service Provider loaded by the web application class loader. (Thanks to Thomas Scheffler)
  • Improve prevention of leaks caused by sun.awt.AppContext

Grab the new version via Maven central or download the jar here.

<dependency>
  <groupId>se.jiderhamn</groupId>
  <artifactId>classloader-leak-prevention</artifactId>
  <version>1.12.0</version>
</dependency>

ClassLoader Leak Prevention library version 1.11.0 released

Version 1.11.0 of my ClassLoader Leak Prevention library has been released.

Apart from minor tweaks it contains the following features:

Grab the new version via Maven central or download the jar here.

<dependency>
  <groupId>se.jiderhamn</groupId>
  <artifactId>classloader-leak-prevention</artifactId>
  <version>1.11.0</version>
</dependency>

ClassLoader Leak Prevention library version 1.10.0 released

Version 1.10.0 of my ClassLoader Leak Prevention library has been released.

Apart from minor improvements it contains protection against a leak caused by Caucho Resin version < 4.0.40. It is however recommended that you upgrade to Resin 4.0.40+.

Grab it via Maven central or download the jar here.

<dependency>
  <groupId>se.jiderhamn</groupId>
  <artifactId>classloader-leak-prevention</artifactId>
  <version>1.10.0</version>
</dependency>