25
How to Build Java Applications Today: July 5, 2021
Google’s Firebase gets new features, free Java production profiling to whither away, Sonatype Lift bundles static code analyzers, Quarkus 2.0.0, Apache Camel 3.11, and IntelliJ IDEA 2021.1.3.
This is issue 43 of my weekly newsletter, “How To Build Java Applications Today”. I read all the Java newsletters, so you don’t have to! And it’s “Java news with a smile”.
If you like my newsletter, then subscribe to it on Substack! Or read it on dev.to, the Java Cafe, or Medium. Even better: Share it with people who may be interested.
I used to think that the brain was the most wonderful organ in my body. Then I realized who was telling me this.
Emo Phillips, a US comedian (born 1956), reminds us not to blindly trust our inner voice. Or the voice of our partner when they tell us what a wonderful person they are!
Emo Phillips, a US comedian (born 1956), reminds us not to blindly trust our inner voice. Or the voice of our partner when they tell us what a wonderful person they are!
I hope my readers in the US (or “the colonies”, as some still call them over here in merry ol’ England) had a good Independence Day! I had a busy weekend, too, with two InfoQ articles of mine getting published. Fortunately, there isn’t a lot of summer weather distracting me here. 🌧 You’ll read about one article in the main section below.
I also booked another conference talk. And yes, it’s “How should Java developers build front-ends today?” once more. It’s the one where I shot a teaser video with - as a good friend told - terrible light. 😔 Anyhow, given that supposedly 90% of us Java developers work in the back-end, there’s an awful lot of interest in my front-end talk - 5 conferences this year and counting!
But we do know that Konstantin Terziev is an avid & helpful reader of this little newsletter! He found typos in four issues already. Last week, for instance, I wrote “Visual J+++”. Arguably, that tool didn’t even deserve two “+”. But the third one was wrong for sure! So thank you, Konstantin, for being my editor!
Firebase offers many free services for Java, web & mobile apps: Authentication, configuration, push notifications, analytics, performance monitoring, mobile app distribution, and more. We pay for storing data in databases & files. But you have to like both the cloud & Google!
My current project uses the Backend-as-a-Service Firebase. Firebase is part new service, part thin layer over existing Google Cloud services. If your organization permits cloud-based services and lets you use Google services, then I can recommend Firebase. Here are the products I use or plan to use in my project:
A big downside for Firebase is the cost model of its NoSQL database Firestore. Not only do we pay for storing data (1 GB/month is free), but also for reads, writes, and data transfers. Worst case: A US$30k bill in 3 days!
At Google I/O in mid-May, Firebase got a new product (App Check) and some enhancements. App Check verifies both the app and the device with tokens, whereas authentication verifies the user’s right to access specific resources. You can read more in my InfoQ article.
Firebase certainly seems to have momentum on its side: Google claims that three million apps per month actively use Firebase. That’s more than the 2.2 million apps in Apple’s App Store! And while it took 13 months (from September 2019 to October 2020) to go from 2 million apps to 2.5 million apps, it took just 7 months to add another 500k.
Java Flight Recorder (JFR) is an imperfect but free tool for profiling Java applications in production. The upcoming Project Loom will amplify its deficiencies. Who’ll step in to fix them?
In issue #25, I wrote about “Profiling in Production” with the JDK Flight Recorder. Oracle claims that JFR just adds 1% overhead to the monitored Java application. And in Java 16, it could record memory allocation more efficiently. So all’s well, right?
Nope: Marcus Hirt, one of the founders of the JRockit JVM that eventually merged with the Sun JVM, sounds the alarm. JRockit is where JFR was born (as the “JRockit Flight Recorder”). Marcus, now at Datadog, identifies four weaknesses of JFR:
This article is a cry for help because Marcus & his employer Datadog can’t do all this work by themselves. But his calls to action are rather vague (highlights are mine): “For JFR to remain the premium, best in class, production profiling platform, some investment will be needed. […] The OpenJDK community will need to be involved.” So who does what by when here?! I don’t know. But I do hope that the proper actions will be taken!
Static Code Analyzers find bugs that tests often don’t. Sonatype Lift bundles many open-source analyzers for Java and other languages. Lift is free for public Git repositories but not for private ones.
I use static Java code analyzers because they show me errors in my code. And yes, I don’t write enough unit tests - none these days, really. I know I should, but I don’t. 😔 I do floss each night and eat my vegetables if that is any consolation.
Anyhow, I use two common static analyzers: PMD and the FindBugs successor SpotBugs. They both are separate Gradle targets that I run when putting together a release at the latest. In contrast to these two, Google’s Error Prone always runs during Java compilation, so it gives me much more immediate feedback.
Sounds good, so how much does it cost? It’s “free forever on public repositories” and costs $25/month/developer for private repositories.
The beauty of bundling open-source static analyzers is that we can integrate these analyzers ourselves! Here are the ones Lift currently uses for Java: Facebook’s Infer, Error Prone, the SpotBugs plugin “Find Security Bugs”, Quandary, Semgrep, and PMD (disabled by default). So if I’m bored over the next couple of months, I could now add more static analyzers to my project! 👍🏻
If Lift is not for you, I’d say: Start with Error Prone and SpotBugs. Between these two, you’ll find a lot of bugs!
Spring Boot’s most humble competitor adds continuous testing, a CLI, and a GraphQL client in version 2.0. JDK 11 is now the minimal version, and dependencies got upgraded.
“Quarkus makes Java supersonic, subatomic”, to quote the Quarkus 2.0 website. In other words: It’s a modern microservice framework that creates small & fast native images with GraalVM. How popular is Quarkus?
Now back to version 2.0. Despite the big jump from 1.x, the summary above already told you nearly all you need to know: Three new features, JDK 11, and dependency upgrades. These upgrades are GraalVM 21.1, Eclipse Vert.x 4, Eclipse MicroProfile 4, and Hibernate ORM 5.5.
Part of that release is Camel Quarkus 2.0.0 that - you probably guessed it already - integrates Camel with Quarkus 2.0.0.
If you’ve used IntelliJ IDEA, then it probably already nagged you to upgrade to this new version.
When I read that it fixed “UI freezes”, I thought for a moment it fixed the ones that I occasionally experience. But sadly, it’s other freezes. 😒
Karsten Silz is the author of this newsletter. He is a full-stack web & mobile developer with 22 years of Java experience, author, speaker, and marathon runner. Karsten got a Master's degree in Computer Science at the Dresden University of Technology (Germany) in 1996.
Karsten has worked in Europe and the US. He co-founded a software start-up in the US in 2004. Karsten led product development for 13 years and left after the company was sold successfully. He co-founded the UK SaaS start-up "Your Home in Good Hands" as CTO in 2020. Since 2019, Karsten also works as a contractor in the UK.
Karsten has this newsletter, a developer website, and a contractor site. He's on LinkedIn, Twitter, and GitHub. Karsten is also an author at InfoQ.
25