A Java Geek weekly 157

Security Baked Into the JVM. Anthropic Studied How People Actually Use Claude. The Findings Were Surprising. Thirteen years of blogging. The wonderfully lazy way to SSH into your computers. 10 Popular Security Practices That Do More Harm Than Good. Half the AI agents in production are if-statements with a GPU bill. 10 Modern CLI Tools You Should Try in 2026. Where Sensitive Data Hides in OpenTelemetry® Pipelines, and How to Find It. Why I recommend Renovate over any other dependency update tools.

• 2 min read
Security Baked Into the JVM

The more distributed a system, the harder it is to secure. Code crosses JVM boundaries. Objects are serialized across trust boundaries. Third-party proxies run inside your process. The usual answer is a network firewall. It helps, but it operates at the wrong level.

Java 17 deprecated the SecurityManager, Java 24 put the final nail in its coffin. Most developers didn’t notice. Applications that load and execute remote code did: the JVM no longer has a built-in mechanism to restrict what that code can do.

In this series, I want to explore how the two projects push security into every layer of the platform. Each post covers one layer: from codebase auditing to identity to authorization to performance.

Anthropic Studied How People Actually Use Claude. The Findings Were Surprising
  • Claude usage mirrors the workweek, and the weekend looks nothing like it
  • The most common output is an explanation, not code
  • The product you use changes your behavior more than the model does
  • The heaviest delegators are the most optimistic, which is the opposite of the usual story
  • Claude replies above the reading level it was asked at

    The most surprising thing in a report about an AI company’s traffic is how little of it is about AI. It is about tax deadlines, 5 a.m. insomnia, Saturday business ideas and people asking a machine to explain something so they can decide for themselves.

Thirteen years of blogging

If you are a Java developer, you need to follow Vlad.

The wonderfully lazy way to SSH into your computers

I’m only a recent Tailscale user, but I love it a lot. I didn’t know the web trick, and I don’t have that many devices, but it’s good to know. I wonder what are the security implications, though.

10 Popular Security Practices That Do More Harm Than Good
  • Expiring Passwords Every 90 Days
  • Blocking Paste in the Password Field
  • Storing Security Questions in Your Recovery Table
  • Locking the Account After Five Failed Attempts
  • Shipping SMS Codes and Calling It MFA
  • Sanitizing Input Instead of Encoding Output
  • Arguing About Token Storage While Shipping Tokens You Cannot Cancel
  • Checking Permissions in Middleware and Nowhere Else
  • Catching Broad Exceptions So the Request Fails Safe
  • Reflecting the Origin Header to Make CORS Stop Complaining

    Just know the rule protects compliance, not the account.

Half the AI agents in production are if-statements with a GPU bill
  • a model call where a regex would do
  • vector search where SQL would do
  • an autonomous agent where a decision tree would do

    Does it remind you blockchains?

10 Modern CLI Tools You Should Try in 2026
  • Dnsglobe
  • Gitlogue
  • Visidata
  • Oxker
  • LLMfit
  • Croc
  • Grex
  • Kondo
  • Worktrunk
  • Yq

    The only tool I worked with was yq and I confirm it’s good. I installed LLMfit, and I like what I see too.

Where Sensitive Data Hides in OpenTelemetry® Pipelines, and How to Find It

What leaked

Where it showed up

What caused it

Java trust store passwords

process.command_line resource attribute on every span

Password passed as a -D flag, captured by the Java agent’s process resource detector

OAuth authorization codes, access tokens, and JSON Web Tokens (JWTs)

url.query and url.full span attributes, sometimes URL-encoded twice

HTTP auto-instrumentation records the query string by default

Authorization headers with bearer tokens

Log records and span attributes

HTTP header capture enabled for all headers

Brazilian tax IDs: individual (CPF) and company (CNPJ) numbers

Log messages, url.full, and metric attributes

Developer log statements and identifiers in REST paths

Email addresses

Metric attributes, span attributes, and logs

Identifiers chosen as dimensions, logged objects

Names, emails, phone numbers, and street addresses of clinicians

Log records

An object-relational mapper (ORM) configured to log every SQL statement with its bound values

Date of birth

A span attribute

Request object recorded as attributes

Customer phone numbers

Prometheus metric labels

The phone number doubled as a money-transfer key

Wi-Fi passwords

Span attributes

A decorator that recorded every method parameter

Database connection strings with embedded credentials

A span attribute on hundreds of thousands of spans

Client library instrumentation recording the connection string

Signed storage URLs

Span attributes

The signature in the URL granted 15 minutes of access to signed contracts

Japanese tax numbers

Logs

Regional identifiers no existing redaction rule covered
Why I recommend Renovate over any other dependency update tools

I agree and I learned about grouping PRs. I’ll update my configuration files shortly.

Skip Lists Data Structure

I never used skip lists, so I always need to regularly read about them to remember their pros and cons.

Follow the Law of Demeter: Reduce the Dependency Surface

Lots of people can talk about the Law of Demeter. I like the post, because it shows how you actually apply it.

Open Source as We Know It Is Dead

Unfortunately, it’s hard to argue with the facts stated in the post. I’ll wear my Apache committer badge with honor.