Development

Product security starts with the first click, not the server settings

If you ask a frontend developer how they handle security, they’ll usually mention the basics: checking password length or hiding admin buttons for regular users.

And that’s usually it. We’ve all gotten used to the idea that frontend is just the “pretty” part: elegant UI, speed, performance, and smooth animations. There’s a long-standing myth in the industry that the client side is safe territory and that security is strictly a “backend problem.”

Continue reading

Angular, React, or Next.js? How the Frontend Stack is Actually Chosen

Recently, I was asked one of those “eternal” questions that drives the IT community crazy, second only to the meaning of life: “How do you actually choose a frontend stack?”

Developers can discuss for hours about syntax, performance, or what’s trendy. But when it comes to real production, choosing a technology is always about risk assessment, budget, and business goals.

Continue reading

The CAP Theorem and Its Implications for Postgres, MongoDB, Kafka, Cassandra

The CAP theorem is a fundamental principle in the realm of distributed systems, stating that a distributed database system can guarantee only two out of the following three properties at the same time: Consistency (C), Availability (A), and Partition Tolerance (P). This theorem has profound implications for the architecture and selection of database systems in software development. This article focuses on Postgres, MongoDB, Kafka, and Cassandra, and how each of these systems addresses the challenges posed by the CAP theorem.

Continue reading

Replace Docker for Windows with Podman?

In the recent months - or years - an alternative implementation of the Open Container Inititive (OCI) - Podman - has gained traction, especially as large Linux distributors (RedHat, Suse) decided to drop Docker in favor of Podman. Not to mention, that podman is one of the container engines used by Kubernetes. But how is the situation on Windows?

In this article I want to shed some light on how to set-up Podman on Windows and discuss whether it’s ready to drop Docker on Windows as well.

Continue reading

Jenkins: How to use shared libraries for configuration

This article discusses how Jenkins pipelines that use shared libraries can be be updated structurally upon changes on the shared library without running a full build.

Continue reading

Coverage with Jacoco and Sonarqube

In most projects I have worked in, Jacoco was used as tool to determine code coverage. The configuration is fairly easy as it plugs into the JVM that runs the tests using an agent that tracks the invocations. In maven, this JVM is forked by the surefire plugin and the parameters are auto generated. The setup is well documented so in this blog post I want to shed some lights on the internals of Jacoco and Sonarqube and how both calculate their coverage metrics. I did some code digging, and I’d like to share my insights. The following information is a compilation of what I found out.

This article is inspired by this question on StackOverflow, which is basically about how Sonarqube and Jacoco calculate coverage.

Continue reading

Mutation-Analysis-Plugin 1.2 released

We’re happy to announce the release 1.2 of the Mutation-Analysis Plugin for Sonarqube.

Continue reading

How to write good code

A couple of days ago I stumbled over a tweet on Twitter. It contained a list of catchy phrases what makes good writing. Developers also write, but more code than prose texts, so I wondered how applicable this list is to coding as well. So I came up with my own list, which might be a bit less catchy but is hopefully a usefully assembly of good coding practices or guiding principles.

Continue reading

Light Bulb Methods

While writing the article on “How to write good code”, I used the term “light bulb methods” and I want to explain bit more in detail, what I meant with this style of method structuring.

Continue reading

Cognito based authentication for CloudFront protected resources

Cognito is a relatively new offering proving Identity Management for Apps and Services, including profile management and multi-factor authentication. CloudFront is the Content Delivery Network service provided by Amazon Web Services. CloudFront offers publicly accessible content as well as private content. Private content can be access using either signed URLs or Signed Cookies. Cognito however generates OAuth access tokens. This article describes how to build a service for creating Signed Cookies for Cloudfroint using access control provided by Cognito.

Continue reading