A Java geek

Nobody runs a SecurityManager in production. The usual reason given is that it does not survive a load test, and every guarantee in this series was bought with a check: a constraint on each call, an audit before each load, a principal set on each thread, a digest on each grant. Part 1 declared constraints on a remote call. Part 2 vetted code before a client loaded it. Part 3 and Part 4 established who is calling and carried that chain across the wire.

If you have built an application with an interactive map, you know what you are in for. You pick a tile provider such as Google or Mapbox, or a self-hosted stack like GeoServer or Martin, and your frontend requests thousands of small image or vector tiles as the user interacts with the map. A server processes each request: it reads from a database, renders the tile, maybe caches it, and sends it back. That server is infrastructure: it needs to be deployed, monitored, and scaled.

While searching for my ancestors, I had to access data from many different websites. I noticed there were different levels of protection against automated access depending on the site. In this post, I’ll list them and mention countermeasures you can take to bypass them anyway. Disclaimer As a private person using the data for my own personal use, I have no qualms about bypassing the protection. It can be considered fair use.

A URL is a name, and names get reused. Replace the bytes behind https://repo.example.org/order-processor.jar and every permission granted to that URL still applies, now to code nobody audited. So far in this series, Part 1 declared constraints on a remote call, Part 2 vetted code before a client loaded it, Part 3 established who is calling, and Part 4 carried that chain of identities across the wire.

I started with a simple task: I needed an AI agent to help me compile decision records, structured documents that capture why a team chose option A over B, using the open-source MADR format. Fill in the sections, organize the rationale, done. It worked. And it was useless.

I got a lot of feedback on my post AI-assisted genealogy, some good, some not so good. In any case, I felt the subject was interesting to a lot of people. Meanwhile, I continue working on my tree, and I have deepened my understanding of the subject. In this post, I want to share again. Trust, but verify Let’s address the not-so-good feedback first. The gist of it was: AI can hallucinate. It’s true in theory: when you ask a question, it provides any answer.