DEV Community: Pavol Rajzak

Coding on iPad

Pavol Rajzak — Wed, 25 Nov 2020 20:03:41 +0000

Well, this is what I’ve been thinking about ever since I bought one. In general they are devices for consuming, not producing content. But since new Apple MacBooks are switching to ARM (same CPU architecture as iPads) we could see more development tools being also available for tablets.

I have seen some people using it for Python and also some applications for learning programming, but would like to know whether it could be used also for JavaScript or even JVM stuff :).

Does anyone have any experience? Would like to read about it in comments.

How to hack unsecure web application

Pavol Rajzak — Wed, 18 Nov 2020 20:43:38 +0000

In this article I would like to demonstrate how easy it is to get confidential information from a web application that... well, doesn't pay too much attention to security. What I will be working with is a sample Java application that I created in Spring Boot for demonstration purposes. But the attacks performed are valid for any other programming language or framework. Some vulnerabilities and security issues that will be demonstrated include:

The setup

We will be working with a fictional web application that allows you to login as user which is a part of some group. Based on user role, he can view either basic or confidential data. In this case, you will see a list of employees in a company, their status, etc.

You can find the sources to this application in my Github: https://github.com/rapasoft/hackme.

Attack #1: Man in the middle attack

Imagine you are sitting in a restaurant and would like to check something in the application above. You connect to restaurant's Wi-Fi, open the login page, enter credentials and obtain information you want (e.g. the list of specific employees). What you might not now, is that your credentials have been compromised. Let's examine the login page closely:

This application does not use SSL/TLS (e.g. no https:// connection). This means, that any information sent can be viewed as plain text by anyone with access to communication between the client and server.

This is exactly what is happening in so called Man in the middle attack. More specifically, in this case ARP spoofing has been used as a way to poison whole network so that attacker is aware of anything that goes on and can sniff on all packets. I am not going to go into details on how ARP spoofing works, but will demonstrate it on this video:

You might need to open this Youtube video in a new window and full-screen to see more details

What you can see above is that I have started Ettercap, which is a comprehensive suite for MITM attacks, and performed ARP spoofing in my local network. In the meantime, when user (me via iPad) enters the credentials, they are visible both in Ettercap and in Wireshark (tool for network traffic analysis).

Attack #2: SQL Injection

Continuing our role as attacker of this application, we now have the credentials for user hgraves with password P4SSW0RD. You can see that not only this application does not use TLS, it has a very weak password policy enabling users chose really awful passwords.

We log in using the credentials above and can see one input field with option to search for list of people. When pressing Search we will get the full list of people. If we put "Fra" for instance we will get filtered results based on search. What if we put there some illegal character? It is obvious, that there's some database behind this application, so let's try the ' character:

Not only did this fail, but we can see that POST request has failed with very specific error message that expose the structure of whole SQL statement. We can see that WHERE P.NAME LIKE '%'%' is used at the end.

Skilled hacker does not need more. Adjusting the search string can after few attempts yield these results:

The injection in this case created union to select statement that fetches usernames and passwords together with their role. Not only this was successful, we've managed to display it in the original client application.

We have now credentials of all users, and their roles (displayed by the integer in the "Age" column). If hframe has role 1, rgraves must therefore be more important user with role 3.

Attack #3: Attacking weakly hashed passwords

We have learned in the first attack, that there probably isn't any password policy set for this application. This would give us hope that rgraves does not pay too much attention on security either.

The easiest way to crack hash of password that uses insufficient hashing algorithm (like MD5 in this case) is to perform dictionary or rainbow table attack. There are many possibilities, but the easiest one is to use internet services that already have large database of password-to-hash combinations:

First one is hframe, second one is rgraves. smorgan seems to be using stronger passwords than others, since it is not in the dictionary.

You can see that password for rgraves is swordfish, which means that he doesn't now how important it is to choose non-dictionary password ;). Now, nothing stops us from logging in as this user and discovering the "admin" section and confidential information:

Do not read this if you're German :)

How to fix this?

You might say that all of this could be easily prevented. You might say that these were rookie mistakes. Well, this might be true, but what's also true is that The Open Web Application Security Project lists Injection as #1 vulnerability in web applications (and it has been like this for several years).

So, if you found yourself wondering how to prevent all of this, let's recap:

Always use SSL/TLS when sending something to server. It doesn't have to be credentials, it is currently considered as good practice in general. Even if you don't have any inputs on your page at all! The easiest way is to provide certificate via services like Let's Encrypt.
Remember that self-signed certificates might mitigate the issue of data exposure, but do not prevent from MITM attacker to fake the whole site with his own self-signed certificate altogether.
When dealing with SQL queries always escape parameters obtained from client. The easiest way to do that is use capabilities of your framework, e.g. in Spring you can use NamedParameterJdbcTemplate which is good for readability as well.
Be paranoid. Validate any user input. Again in Java/Spring world you can add validation rules using JSR-380 bean validation implementation like Hibernate validator and annotate parameters, e.g. @Pattern(regexp = "[a-z|A-Z]*") String name would prevent entering '.
Log any attempts to pass in invalid input in the application. Moreover, in case of error do not expose any implementation-specific information to the client.
Improve your authentication.
- If possible use at least 2-factor authentication.
- Do not implement custom password storage or encryption algorithms. It is extremely difficult to do on your own and you will definitely fail. There're proven solutions like BCrypt.
Read and bookmark OWASP TOP 10. Start with there and then go through their list of best practices.

I hope you found this article not only informative but entertaining as well. Looking forward to your comments!

Common Java myths and misconceptions

Pavol Rajzak — Thu, 30 Jul 2020 12:14:48 +0000

There're a lot of incorrect opinions among developers - some root in misunderstanding, lack of knowledge or bad experience from past. Java developers are usually up to date with the changes, but I often hear from non-Java developers and general IT world that:

Java is slow
Java is buggy/not secure
Java is not free, so you need to pay a lot to Oracle for licenses
Java is verbose, outdated language, with API that is awkward to use

I understand that without proper context, any information can be misinterpreted, so I will try to glue it together so that it makes sense :).

Is Java slow?

Short answer: No.

I remember back at my university days, I was trying to get into competetive programming. It is basically all about algorithms and data structures and you write code to solve some problem. The verification is done on a remote server which tests your solution against input dataset. Only language I knew back then was Java, and the server supported assesment of Java written solutions. The main source of loathing from the guys writing in C was that Java solutions took significantly more time to execute and that's why time limit had to be increased for Java.*

Fast-forward to 2020, Java is one of the most popular languages in the world and JVM-based solutions dominate the world of data-intensive computation. Apache Kafka, one of the leading platforms for high-speed stream processing is running on JVM. This fact itself, should disprove the statetment of Java being slow.

When it comes to performance, however, rarely something beats a compiled code. But it is like comparing apples and oranges, since Java bytecode runs on JVM - which gives it one of its main advantages: portability. Once C code is compiled against specific platform, it can be run only on that platform. But Java compiled bytecode can be run on almost any platform.

Other thing is that since its inception, JVM has evolved and there are also multiple implementations which are focusing on increasing the throughput and reduce latency, like GraalVM.

The slowness usually comes from the experience with working with badly written, outdated applications (e.g. GUI based apps in Swing). Unfortunately, Java gives a lot of freedom to create applications and it might happen that while something works, it does not necessarily need to perform well. I think this StackOverflow answer summarizes it the best.

*By the way the slowness was caused by JVM being started so that code can run.

Is Java buggy or not secure?

Short answer: No.

Again, there are many proven examples of Java-based solutions, with high focus on security: payment processing, digital signature, embedded devices (ATMs) and so on. Java has wide support for cryptography, authentication and authorization, SSL etc., so it gives you the tools to build secure applications. However, with any codebase bugs can happen, and JDK is not free of those. Luckily, there're frequent updates which fix the critical issues.

The main source of "bugginess" as perceived by users, other than the application code itself, might come from the fact, that the Java runtime (JRE) is not up to date on the machine. If the issue happens with application running on server, it is the fault of infrastructure maintainer for not keeping the JRE updated. And the same is with users. Do you remember these annoying pop-ups telling you that there's new version of Java? Do you remember also closing and ignoring it? Well, you just made your computer vulnerable.

Maybe the issue is with additional component (JRE) that you need to maintain on your computer, but most of the Java applications nowadays are bundled with JRE and do not require users to have one installed. This reduces the issue one degree down.

Is Java free?

Short answer: Yes.

Where does the confusion come from? In 2019 Oracle announnced changes in licensing model, that require buying subscription if you are using Oracle Java in production. This means that either you have a server based apps that run Java or you have a desktop application that you sell with bundled JRE. Having Oracle Java SE subscription will give you access to extended support.

That being said, if you don't need to have this premium support, you can still opt out and switch to OpenJDK or any other providers. There are many stable and open-source implementations of JDK, that most of the time will give you the same experience as with Oracle JDK. So the long answer is also yes, since you have a choice to select different vendor.

Java is verbose, "write-only" and obsolete language

Short answer: No.

Java has a long history and it was missing some constructs in older versions, but as any language it keeps evolving and improving. Let's take this snippet of code written in Java 7:

    private static void java7() {
        List<Person> persons = new ArrayList<>();
        persons.add(new Person("Luke Warm", 10));
        persons.add(new Person("John New", 15));
        persons.add(new Person("Elsa Snow", 19));
        persons.add(new Person("Mary Rose", 25));

        Map<Maturity, List<Person>> adultAndChildrenMap = new HashMap<>();
        for (Person person : persons) {
            if (person.age >= 18) {
                if (adultAndChildrenMap.containsKey(Maturity.ADULT)) {
                    adultAndChildrenMap.get(Maturity.ADULT).add(person);
                } else {
                    List<Person> adults = new ArrayList<>();
                    adults.add(person);
                    adultAndChildrenMap.put(Maturity.ADULT, adults);
                }
            } else {
                if (adultAndChildrenMap.containsKey(Maturity.CHILD)) {
                    adultAndChildrenMap.get(Maturity.CHILD).add(person);
                } else {
                    List<Person> children = new ArrayList<>();
                    children.add(person);
                    adultAndChildrenMap.put(Maturity.CHILD, children);
                }
            }
        }
        System.out.println(adultAndChildrenMap);
    }

This is unnecessarily long and difficult to read. There've been many improvements since Java 7, so the code above can be now written as:

    private static void java11() {
        var persons = List.of(
                new Person("Luke Warm", 10),
                new Person("John New", 15),
                new Person("Elsa Snow", 19),
                new Person("Mary Rose", 25)
        );

        var adultAndChildrenMap = persons.stream()
                .collect(Collectors.groupingBy(
                        person -> person.age >= 18 ? Maturity.ADULT : Maturity.CHILD
                ));

        System.out.println(adultAndChildrenMap);
    }

Current Java release cycle is 6 months and while version 11 is the LTS (long term support), current version is 14, which brings even more improvements either as preview or stable features. The problem with Java is that it rolls a big "ball of legacy", which needs to support (e.g. the existence of default methods in interfaces introduced in Java 8).

Since Java 8, the most notable Java update which was released in 2013, there have been many updates which aim to reduce verbosity and increase readability, including:

Improved factory methods for Collection API (Map.of(), Set.of(), etc.)
Stream API improvements (takeWhile/dropWhile)
Local variable type inference (var list = new ArrayList<String>();)
Improved String utility functions (repeat(), isBlank(), indent(), etc.)

Multiline Strings:

String html = """
<html>
    <body>
        <p>Hello, world</p>
    </body>
</html>
""";

Switch expressions:

int numLetters = switch (day) {
    case MONDAY, FRIDAY, SUNDAY -> 6;
    case TUESDAY                -> 7;
    case THURSDAY, SATURDAY     -> 8;
    case WEDNESDAY              -> 9;
};

instanceof pattern matching:

if (obj instanceof String s) {
    // can use s here without explicit casting
} else {
    // can't use s here
}

Records:
```
record Point(int x, int y) { }
```

As with any language, in order to use it effectively you need to learn all the constructs. For some, the first code example written in Java 7 will be more readable than the second one, but that's just because they have not learned the new ways of writing the code.

Conclusion

There's a lot to add to each of these topics and it is worth mentioning that sometimes it's not black-and-white situation (especially with the performance). I also know, that similar false statements are out there for other languages (Python being slow, C#/.Net copying Java or JavaScript invented by aliens that are waiting for us to go mad while writing application using it and then taking over the planet).

I hope that you enjoyed this article and feel free to add your most beloved myths about Java or any other language in the comments!

Migrating from Oracle DB pipe messaging to Kafka

Pavol Rajzak — Wed, 22 Apr 2020 12:35:49 +0000

Introduction

First of all, I would like to state that I am not an Oracle DB expert. I am just a regular full-stack developer, that knows his way around in the DB world and can make things work. I've been involved in several projects that were using Oracle DB and I can honestly say that every one of them could've survive on any other open-source DB engine. Every time, it's usage was unjustified and statements like "it's been there forever" and "it is hard to move away from it" just underlined the impossibility of replacement.

Nevertheless, I had to use it, and most of the time it was more of a fight. Things that were essential in every other engine were a nightmare to configure (the simplest ones). If something usable was included, you had to pay extra for it (like the absence of partitioning in the standard edition). Anyway, Oracle DB is still the synonym for "enterprise-ready database solution" so Oracle marketing team is doing their job well!

Database-centric messaging model

The (simplified version of) application that underwent transformation to Kafka can be described with producer/consumer model.

Simply put: There are 1 .. n producers and 1 consumer. The producers are writing data in the database tables, which have ON UPDATE triggers to send information to Oracle Pipe (DBMS_PIPE package). The client then reads information from the pipe and processes it.

Oracle Pipes are low-level mechanism to communicate between two (or more) sessions in similar scenarios as above. They work similarly as UNIX pipes, with all of their limitations, and are actually quite fast. This solution has one very important problem - it does not scale. Imagine that there will be 1 .. gazillion producers, you can probably add some extra power and RAM, but you still have a single bottleneck to maintain - database.

Enter Kafka

Apache Kafka needs no introduction, since it already has a steady place in a world of high-load/high-availability solutions. It is a streaming platform that enables you to build scalable distributed applications with not much effort. If you don't have experience with Kafka, this post is everything you need to know to understand it.

Kafka somehow fits naturally into our use-case. There already are producers and consumers, so we could just take them, wire it all together using Kafka and skip the DB part! In simple world, yes, that would be the case. But our application has important business logic related to calculation and messaging melted in the database, remember?

Until we are in an ideal world, where database is purely a storage facility, Kafka has a tool that could help us to transition to pure producer-consumer Kafka solution.

Kafka JDBC Source Connector

Using kafka-connect API, we can create a (source) connector for the database, that would read the changes in tables that were previously processed in database triggers and PL/SQL procedures. These changes would then be sent to intermediate component, that would do the computation itself.

You can use either JDBC-based or log-based solution, but since the latter one would cost more money (licenses for tools like Oracle GoldenGate or XStream), we will use JDBC-based one. Setting up JDBC source connector is relatively easy, here's a good article that describes it in a succint way. If you don't want to read the article, here's what it does:

Polls specific table (either based on query or just the table name)
When change is made, it's JSON representation is sent to Kafka

There are certain caveats and limitations which I will list for future reference:

you can specific the mode in which the updates will be checked. I've used timestamp, which is using comparison of timestamp column values. In order to set this up, timestamp column must be:
- present in the table (duh)
- not null (nullability can be enabled, but what's the point of having that?)
- updated on each change either in the application or in the database trigger (since Oracle does not natively support ON UPDATE TIMESTAMP)
- using correct timezone (which can be configured in the connector settings)
JDBC connector will use polling, so polling timeout must be fine-tuned in a way that it does not swamp the database. Also, the query used to fetch data must be executed fast.
Database triggers have the ability to compare old and new date (e.g. before and after update). This would not be possible with JDBC connector, so you need to keep this in mind.
You would probably also need to format the result in the query, for instance number(*) (unbounded numeric type) will be transformed to a byte array. It can be easily solved by casting it specific value, e.g. number(12).

What's really great about this solution is how easily it scales up. The processing logic module can be spun up several times within the same Kafka group, which means the load will be distributed amongst consumers "the Kafka way". This would practically off-load the pressure on the database and enable us to scale up the processing part.

The implementation of processing logic can be done using kafka-streams or Kafka's Producer/Consumer API, depending on the nature of transformations. I haven't exposed too many details, which was on purpose, so if you have more questions feel free to leave a comment and contact me!

Using RxJava for creating reactive JavaFx UI

Pavol Rajzak — Fri, 17 Jan 2020 07:01:33 +0000

In this article, I would like to show you the benefits of RxJava in practical example - desktop JavaFx GUI application. If you are developing Android or any other apps that "compute and render content" at the same time read on!

An intro you can skip if you know JavaFx

If you never heard of JavaFx before don't feel bad. On the other hand, if you thought JavaFx project is long dead, well... I don't blame you. But believe it or not it's alive and kickin'. Since it was open-sourced and separated from JDK it has become the only reasonable choice for building desktop apps in Java.

Why on Earth am I writing about technology for creating desktop applications in Java in 2020?

I was firstly introduced to JavaFx in 2013, when it was still part of JDK and it was a proper replacement for Swing, the former UI library, that was... let just say unpopular. But JavaFx was like a fresh breeze and version 2.0 introduced concept of FXML files, which allowed you to define the looks and style of your components in similar fashion as HTML and CSS.

Why on Earth would anyone want to build desktop applications in 2020 anyway?

There are several reasons. First of all some users still prefer it to web-based services. If you don't have internet connection, you cannot access the site (if it is not offline-enabled). Also, these kind of applications are perfect for communicating with filesystem or underlying OS (e.g. we had an utility that connected through ssh and executed a script, whose results were displayed in the UI). I think there are a lot of benefits there, but this is not the topic for today.

Do you want to develop an app?

Let's say you're writing simple UI in JavaFx. You define your layout, create first components, start adding behavior to them and you expect results. Everything works, technically, but sometimes it does not feel right. The UI is lagging when operations are performed and you get the impression you are doing something wrong.

To illustrate this I created a simple application with just two components:

Combobox (a.k.a. SelectBox), which would perform some background tasks whenever user selects different value
List view of results from these long running tasks. This list will show the name of the task and time taken to execute it (up to 1s) in order of execution. And if time is higher than 500 ms it will mark it as slow.

The code to execute this task is fairly simple (ignore the Result class for now, it's just a simple POJO):

private Result runTask(Integer i) {
    long currentTime = System.currentTimeMillis();

    String name = "Task" + i;
    long sleepDuration = (long) (Math.random() * 1000);

    try {
        Thread.sleep(sleepDuration);
        return new Result(name, sleepDuration);
    } catch (Exception e) {
        return new Result("-", 0);
    } finally {
        System.out.println(name + " took " + (System.currentTimeMillis() - currentTime) + " ms");
    }
}

The long running task will be fairly simple. We define the NUMBER_OF_TASKS that should be executed and collect results in an ObservableList that will be used as backing collection for the ListView.

For those not familiar with JavaFx, the ListView works with a special collection wrapper (ObservableList) that is bound with the component. So whenever its content is changed, it is also changed in the UI. Simple as that.

And hey! Since it is 2020 we're going to use Streams, which highly increase readability of what's happening:

private void runTasksJavaFx(ObservableList<String> observableList) {
    IntStream.range(1, NUMBER_OF_TASKS) // Stream API way of iterating
            .mapToObj(this::runTask) // Execute and map the results of our long-running task
            .map(result -> result.time > 500 ? new Result(result.name + " (slow)", result.time) : result) // "Annotate" those that took too long
            .forEach(result -> observableList.add(result.toString())); // And push them to result list so that they are displayed in UI
}

This looks nice, but you can probably feel that it's not right. When you try it this is what you'll get:

As you can see when item is selected the whole GUI freezes until computation is finished (you can see that in the console output on the right).

Use the threads Luke

This is not an issue limited to JavaFx and it surely was a nightmare in Swing as well. The problem here is that the application code is running on the same thread as UI code, which means whenever there's some long running task it will block updates of UI until it is finished. And that's exactly what's happening above.

There're, of course, ways to fix this. One of them is to use JavaFx's Platform.runLater() method that takes standard Runnable as a single parameter. It will schedule updates to "some time in the future". Second is to use JavaFx's Task and together with ExecutorsService (and related). To keep it simple, we'll use first one:

private void runTasksLaterJavaFx(ObservableList<String> observableList) {
    IntStream.range(1, NUMBER_OF_TASKS) // Still Java 8, yaaay!
            .forEach(i -> Platform.runLater(() -> { // We're using lambda for Runnable, so we cannot map the result
                Result result = runTask(i); // So we go one Java version down with the code style
                if (result.time > 500) {
                    result = new Result(result.name + " (slow)", result.time);
                }
                observableList.add(result.toString());
            }));
}

Ok, there're few things here and the most important one is that since Runnable returns void, we need to process results "the old fashioned way". My personal opinion: it's ugly. And it will get uglier if the logic is more complex.

And then there's this nice note in the Platform.runLater method's documentation:

NOTE: applications should avoid flooding JavaFX with too many pending Runnables. Otherwise, the application may become unresponsive. Applications are encouraged to batch up multiple operations into fewer runLater calls. Additionally, long-running operations should be done on a background thread where possible, freeing up the JavaFX Application Thread for GUI operations.

That's not very encouraging, isn't it? So when it gets complex, you need to introduce logic for batching the updates. You could use the Task/Executors solution, but that's even more code and if there's one thing that developers hate is reading huge amounts of code to understand what's happening.

But okay, let's see what it does when we execute this method:

The improvement here is that we don't block the UI, but as you can see, the updates are periodically displayed to the console output, but they are rendered once everything is finished. This can be of course improved, but at what cost?

You know what Luke? Let's revisit this threads idea again

There are, of course, better options than fighting threads. Since we want to push our code to the third decade of 21st century, we will use Reactive Extensions (RX)!

With RX it is as with anything that's currently trending like Cloud computing or Blockchain. The concept is not new, it's just a matter of putting everything together to solve a specific problem. The main marketing pitch for RX is The Observer pattern done right. I won't go into too much details about RX so I suggest you to read a thing or two on reactivex.io website.

The Observer pattern in a nutshell is about creating an object that would emit changes (Observable) and registering some handler that would execute action whenever needed (Observer). RX goes further with that since it is a combination of the best ideas from the Observer pattern, the Iterator pattern, and functional programming. There are multiple implementations of RX in various languages, so we're going to use RxJava.

I'll go ahead and post a code example, which I will explain in detail line by line:

private void runTasksRxJavaFx(ObservableList<String> observableList) {
    Observable.range(1, NUMBER_OF_TASKS) // 1
            .subscribeOn(Schedulers.computation()) // 2
            .map(this::runTask) // 3
            .map(result -> result.time > 500 ? new Result(result.name + " (slow)", result.time) : result) // 3
            .observeOn(JavaFxScheduler.platform()) // 4
            .forEach(result -> observableList.add(result.toString())); // 5
}

Line // 1 looks very similar to what we have in first example (the blocking one). But instead of using regular IntStream we are using one of RxJava's utility classes to generate an observable collection. In this case it will emit each iterated element, so that observers are notified.
Line // 2 is probably the most difficult concept to understand here. This is because RxJava is not multi-threaded by default. To enable multi-threading, you need to use Schedulers, to off-load the execution. subscribeOn method is used to describe how you want to schedule your background processing. There are multiple schedulers you can use based on the type of work. Specifically Schedulers.computation() will use bounded thread-pool with the size of up to number of available cores.
Lines marked with // 3 are the same as in first example, see?
Line // 4 is similar to subscribeOn, but observeOn instead declares where you want to schedule your updates. If you look at the flow of the code, at this point, we would like to emit changes back to the UI thread. In this case, we will use special type of scheduler which is part of (additional) RxJavaFx library and it uses - guess what - the Java FX GUI thread.
Line // 5 is also same as in the first example, but in this step we are actually instructing what should be done after observeOn was called.

And it finally looks like an application users want to use:

There's of course more to it. RxJavaFx project has nice API for creating RX-ready components. Truth to be told the learning curve might be "gentle", especially when it comes to RxJava itself. But when it is used right, you can tune it to handle large amounts of changes without sacrificing UX or performance of your application.

This was just a fly-by of what you can do with RxJava and I omitted a lot of details (including the setup of JavaFx project), so for those of you that read it until here I have prepared a Git repository with template project that you can use for developing JavaFx applications and a branch with fully working example of what I just described here.

Kotlin

Pavol Rajzak — Fri, 05 Oct 2018 11:02:31 +0000

In this year's KotlinConf keynote Andrey Breslav mentioned how pleasantly surprised he was by the results of Google search for "Kotlin love" keywords. Developers love working with it, that's why it ranked 2nd in "Most loved language" category of StackOverflow Developer survey.

The question is: why is that? What makes the language lovable?

It's really hard to pick up the best features of Kotlin, since one can easily end up writing about everything. But it would just mean rewriting their awesome documentation :). The most important is what can actually be used in solving real world issues™.

I was working on a internal time-tracking application. Backend is written in Java and it has a fairly complex logic when it comes to operations with time. For instance, the working day is defined as 8 hours, and anything that's above it is considered an overtime.

Note: This is actually a simplification of this problem, but let's go with it for the sake of this example

Data classes

In Java, it is implemented using various libraries and utility functions on top of complex structures. What I really like about Kotlin, is that it's very expressive, while it stays readable. For instance, if we would like to define the structure for Time, we could write a simple data class

data class Time(val hours: Int, val minutes: Int)

This will give you an immutable data structure, with equals/hashCode/toString/getters and setters (and other) functions implemented out of the box. It's something Java people would call a POJO, but defined in one line.

Operators overloading

The next thing, useful in our scenario would be comparing one Time to other. For instance 1:30 is more than 0:45 and so on. In Java, you can implement Comparable and override compareTo function. The same works in Kotlin, but with one big difference - you are able to compare instances by using equality operators.

data class Time(val hours: Int, val minutes: Int) : Comparable<Time> {
    override fun compareTo(other: Time): Int {
        return when {
            this.hours == other.hours -> this.minutes - other.minutes
            else -> this.hours - other.hours
        }
    }
}

println(Time(1,30) > Time(0,45)) // true

You can also override other operators. For instance we would need the minus operator. You can just add this to Time class:

operator fun minus(other: Time): Time {
    return convertToTime(convertToDouble(this) - convertToDouble(other))
}

and then

println(Time(1,30) - Time(0,45)) // Time(hours=0, minutes=45)

Companion objects

You can see that I've used some utility functions convertToTime and convertToDouble. If you are working with Java, you are used to create your own XYZUtil classes, so instead of creating TimeUtil class, we can use the companion object.

data class Time(val hours: Int, val minutes: Int) : Comparable<Time> {

    companion object {
        @JvmStatic
        fun convertToTime(time: Number): Time {
            // implementation
        }
        @JvmStatic
        fun convertToDouble(time: Time): Double {
            // implementation
        }
    }
}

Java interoperability

As you can see, I've annotated the methods with @JvmStatic annotation. Kotlin does not have a static methods, but to provide perfect interoperability with Java, it can make them visible by using this annotation. Thus, you can call this in Java:

public class JavaClass {
    public static void main(String[] args) {
        System.out.println(Time.convertToTime(2.75));
    }
}

You can expose also constants and other fields, that would be visible in Java.

Null safety

Kotlin does not allow you to use null values by default. However, if you for some reason (e.g. Java inter-op) want to allow them, you can define the parameter types with ?. Let's define another constructor in Time that accepts only hours:

data class Time(val hours: Int, val minutes: Int) {
    constructor(hours: Int?) : this(hours ?: 0, 0)
}

We define it using constructor keyword and specifying parameter as Int?. But if this value is null, we would like to provide zero as a default. You can use so called elvis operator ?: which will evaluate the expression and if it is null, it will use the right hand value as a fallback.

Smart casting

In Java, it is very annoying to do the "check-than-cast" routine, where you first check whether object instance is instanceof some class and then manually cast it. Let's look at the Kotlin implementation of convertToTime function defined above:

fun convertToTime(time: Number): Time {
    return when (time) {
        is Double -> {
            val fullHours = Math.floor(time).toInt()
            Time(fullHours, ((time - fullHours) * 60).toInt())
        }
        is Float -> convertToTime(time.toDouble())
        is Int -> Time(time)
        else -> Time(time.toInt())
    }
}

You might not know this, but function Math.floor is expecting Double as a parameter. We are not casting it explicitly, but since we're doing it in on of the branches of when (i.e. switch in Java), it is automatically smart casted to Double. And IDE will highlight this for you, so that you are aware of it! The same goes to call is Int -> Time(time) which is smart casted to Int and uses the constructor defined in the previous section.

Extension functions

We've talked about writing utility functions on top of our newly created classes by using companion objects. But what if we would like to add functionality to existing classes?

For instance, we would like to provide a toString implementation for our Time class, that would print 00:45 instead of the data class default Time(hours=0, minutes=45):

override fun toString() = "${hours.padZeros(2)}:${minutes.padZeros(2)}"

hours and minutes are Int properties of Time class, but function padZeros does not exist in Int class. If you really want to use this across the whole project, you can define an application-wide extension function:

fun Int.padZeros(length: Int) = "${if (this.sign < 0) "-" else ""}${this.absoluteValue.toString().padStart(length, '0')}"

The this in the function above refers to instance on which the function is invoked, so you can use it however you like.

Note: As you see, Kotlin allows powerful String templating using syntax known from other languages: "${someVar}" :)

Ranges

Let's put it all together in a next example. We would like to have a class for Workday, which can tell us when the person started and concluded his day at work. One of the specialties of this class, would be determining, whether person was at work at specific time.

We can achieve this by using a ClosedRange interface, which allows us to use this syntax:

println(Time(10, 30) in Workday(Time(8), Time(16)))

The implementation is pretty straight-forward thanks to conventions used for ClosedRange. It expects that the implementation provides the start and endInclusive properties of specified type (which in our case is Time)

class Workday(override val start: Time, override val endInclusive: Time) : ClosedRange<Time>

One important note is that this works because ClosedRange expects that the type is implementing Comparable interface, which our Time class does.

Higher order functions

Kotlin supports some idioms of functional programming by treating functions as a first-class citizens in language. This means, that you can use them as either parameters, return types or declare them as variables.

For instance, we would like to add functionality which will check the constructor parameters once the class is initialized:

class Workday(override val start: Time, override val endInclusive: Time) : ClosedRange<Time> {

    init {
        // higher order function
        require(isValid()) { "Range `${this.start} to ${this.endInclusive}` does not define a valid workday." }
    }

    fun isValid() = start >= Time(0, 0) && endInclusive <= Time(23, 59)
}

There are several things going on here at once. First, we define a function isValid which validates that start and end times are within a day range. Then, in init block (which is called after constructing instance) a require function is called, which is defined in Kotlin stdlib as this:

public inline fun require(
    value: Boolean,
    lazyMessage: () -> Any
): Unit

In other words, it will evaluate a first parameter, and if it is false it will invoke a second parameter which is a function (declared using lambda expression syntax) that defines the message used in IllegalArgumentException. So this call

Workday(Time(-1), Time(12))

will end up like this:

Exception in thread "main" java.lang.IllegalArgumentException: Range `-01:00 to 12:00` does not define a valid workday.
    at Workday.<init>(WorkingTime.kt:62)
    at WorkingTimeKt.main(WorkingTime.kt:83)

Note: In Kotlin, if the last parameter is a lambda expression, you can write it after the function call (as in our example). But it is the same as require(isValid(), { "Range ${this.start} to ${this.endInclusive} does not define a valid workday." })

Wrapping it up

There are many hidden gems, that you will discover when working with Kotlin. It enables you to write concise and readable code while working with known technologies (e.g. Java, JVM and it's frameworks). If you would like to discover them, you can start by going through Kotlin koans, a set of exercises that go through most of the language features - and you can do it in browser!

Edit: Here's a Gist to a full source code used in this article. ;)

Pains of Java generics solved in Kotlin

Pavol Rajzak — Thu, 06 Sep 2018 05:54:41 +0000

The problem

Why does this not compile in Java?

Optional<Integer> optionalInteger = Optional.of(1);
Optional<Number> optionalNumber = optionalInteger;

int i = optionalNumber.get().intValue();

I am usually very conservative when using generics in Java. When I try to "be smart" I usually over-complicate things and end up with @Suppress("Unchecked") annotations all over the code. Programming language should always be both easy to write and read. So why is it not possible to do the cast in the example above?

I would expect the above to work because:

Number is parent to Integer class in Java
optionalNumber is a producing Number

The Java "solution"

It can be solved by using the extends/super keywords to specify the upper bound.

Optional<? super Integer> optionalInteger = Optional.of(1);
Optional<Number> optionalNumber = (Optional<Number>) optionalInteger;

int i = optionalNumber.get().intValue();

This will work, but we will get Unchecked cast warning on the second line, which does make sense in the world of Java generics, but it's still ugly. Also, what does it say to reader when <? super Integer> is used?

The Kotlin solution

Kotlin has solved this with declaration-site variance using keywords in/out. We will simulate the Optional class (since there isn't one in Kotlin) with get() function for this example:

class Optional<out T>(val t: T) {
    fun get(): T = t
}

val optionalInteger = Optional(1)
val optionalNumber: Optional<Number> = optionalInteger

val i = optionalNumber.get().toInt()

By annotating the T parameter with out keyword we will specify that T will always be used as output value (e.g. produced), thus it is safe to perform above cast (since the produced value is safe to cast). Also, if you try adding member function fun set(t: T) you will get a compiler warning, that T is out parameter but occurs in in position. It is easy to write, read and understand.

As I mentioned, Kotlin does not have separate Optional class. Instead it has some cool language features for null checking that you can find in any other modern language:

haveReadArticle?.giveItA❤️()

😎

On immutability in Kotlin

Pavol Rajzak — Thu, 21 Jun 2018 13:27:27 +0000

Kotlin has direct support for immutable data structures. They are called data classes and they have some really nice features.

First of all, the data class creation is really simple. For instance, this User data class will create class with one full-args constructor, hashCode, equals and toString methods generated:

data class User(
        val firstName: String,
        val lastName: String,
        val age: Int
)

There's additional advantage here, that by using val the references to primitive properties are final - thus, cannot be changed. You also need to define all constructor parameters when creating new instance, e.g. User("John", "Doe", 50). That's a good start for building immutable data structures on your own!

The most basic operation you'll want to do with immutable data structure is creating new instance out of existing one and changing (some of) its parameters. This is nicely supported in Kotlin by copy() function.

Let's start by simply copying the instance:

val user1 = User("John", "Doe", 50)
val user2 = user1.copy()

user1 === user2 // referential equality = false
user1 == user2  // structural equality = true

You can see that it works as expected - objects are equal, but instances are not the same. What if we want to change one property?

val user1 = User("John", "Doe", 50)
val user2 = user1.copy(age = 20)

This will copy the instance and change age parameter to 20. Compared to Java (in which cloning/copying without 3rd party library is nearly impossible) this is really awesome!

Let's look at a bit more complex example where we don't use only primitive types but reference to a object instance:

data class System(
        val name: String,
        val user: User
)

val user = User("Jane", "Doe", 50)
val system1 = System("Blog", user)

val system2 = system1.copy()

system1 === system2             // false
system1.user === system2.user   // true

So as you can see copy() is not deep, which means that parameters that are referring to instances will only copy their references. So basically, it's a syntactic sugar over creating new instance via it's constructor and passing the parameters of original instnace.

But that's okay, since user is an immutable data class and it's properties cannot be changed. It would only be problematic if User would have properties defined as var. Then you would be able to do something like this:

...
val system2 = system1.copy()
system1.user.age = 13     // not possible if user is defined as `val`

println(system2.user.age) // prints "13"

The bottom line is, if you keep using val definitions consistently you should be safe with immutability!

Frontend development stack: Introducing complexity to reduce complexity

Pavol Rajzak — Mon, 14 May 2018 12:12:28 +0000

As a Java developer, I am not a big fan of JavaScript as a language. In it's essence it is really primitive and simplistic. While this is fine for simpler scripting (the original intention of JavaScript) it is not usable for developing a large application. It has a lot of inconsistencies, tricky parts and in general it will make you pull your hair sometimes.

But, as in every language there are tools, libraries and frameworks that will ease your pain. I am really surprised how mature is the ecosystem around JavaScript and that you don't have to understand most of it. There's a handlebar for almost everything and - if we take it to the extreme - you might not know you are developing a JavaScript application at all. You can build a full-blown single page application, without even writing a single line of JavaScript - using TypeScript, for instance.

"How's that?" you might ask, and the answer is in the hidden complexity those "handlebars" bring in. There are plenty of tasks that are done in the background, from writing source code up to creating a "production bundle" that you can deploy.

In this article you'll find answers to these questions:

I just want to build web! Should I look into some more complex technologies other than HTML, CSS and plain JavaScript?
There are so many tools and libraries, which ones should I pick?
Does it have to be so hard to set everything up?

...and some other, hopefully.

Project

Let's work with some specific, running example so that the concepts are more clear. We will develop a frontend application for a blogging platform. Simple UI that will display posts from various authors and categories.

The Naive approach

You all remember the good old days, when you wrote HTML, some CSS and then to add some spice into it you've added some JavaScript effects? Well, this is where we are going to start. But the world has changed a bit since then, and now everything is written in JavaScript. It's mostly because you can define reusable parts of code and then just re-use them. For instance, this will be a title (title.js):

const title = `<h1>👨‍👨‍👦‍👦 Friends blog 🌟</h1>`;

and this is how we are going to use it (main.js):

const main = `
    <div class="main container">
        <div class="title">${title}</div>
    </div>
`;

Now in order to use this, we need to put it in some main file, for instance index.js:

document.getElementById("app").innerHTML = main;

And use it in index.html:

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">

    <title>Blogging platform!</title>

    <script type="text/javascript" src="components/title.js"></script>
    <script type="text/javascript" src="components/main.js"></script>
</head>
<body>
<div id="app">
</div>
<script type="text/javascript" src="index.js"></script>
</body>
</html>

We have three .js files, that need to be imported in specific order, because the constants are defined in global scope. Well this is a problem when we'll have additional components defined in other .js files. First, you need to manually add them into index.html and then you need to maintain specific order. What if you define variable with same name? It will overwrite the previous one. Also, we have jumped in it too quickly and are using features from ES6 ("version" of JavaScript) like string templates which isn't supported by older browsers. So, no IE9 support :(.

And we have nothing but title, yet. In a normal world, you want to add more components, styles, some layouting framework (for instance Bootstrap), add specific logic, helper classes and... bundle it all together.

Bundling it all together

Why is this needed? If you have significant amount of .js files, you will need to send a HTTP request for each of them (like in our example title.js, main.js and index.js) which is by nature always slower as if you would put it into one file (bundle.js). The orchestration around one HTTP request/response roundtrip is just too expensive.

We can automate this task by delegating it to a tool! Not too much time ago, there were 2 main competitors and that's Grunt and Gulp. You can define a specific list of tasks that should be executed in specific sequence in order to build a project, for instance:

clean build directory from previous runs
iterate over list of source .js files
- and copy them into one bundle.js
- and compress it's contents
iterate over list of source .css files
- and copy them into one bundle.css
- and compress it's contents
generate and copy index.html that will include link to built bundle.js and bundle.css files

Gulp and Grunt are somewhat similar in what they do, but they use different approach. While with Grunt it's more declarative, in Gulp you are defining procedures that are piped together. Take this config (called gulpfile.js) for instance:

... (gulp plugin definition) ...

gulp.task('buildJs', function () {
    gulp.src([
        './src/components/title.js',
        './src/components/main.js',
        './src/index.js'
    ])
        .pipe(concat('build.js'))
        .pipe(uglify())
        .pipe(gulp.dest('target'))
});

gulp.task('buildCss', function () {
    gulp.src('./src/styles/*.css') // path to your file
        .pipe(minifyCss())
        .pipe(concat('build.css'))
        .pipe(gulp.dest('target'));
});

gulp.task('cleanTarget', function () {
    return gulp.src('target')
        .pipe(clean({force: true}))
});

gulp.task('copyIndexHtml', function () {
    return gulp.src('src/index.html')
        .pipe(gulp.dest('target'));
});

gulp.task('default', gulpSequence('cleanTarget', 'buildJs', 'buildCss', 'copyIndexHtml'));

It is pretty much clear what it does, running gulp in command line will run the default task which combines everything together.

How Gulp works? It's a node.js application, so in order to use it properly you have to have node.js installed. You need to transform your project to node.js project as well (via package.json configuration) and install all the plugins which gulp will used (via npm - node package manager). So we need to install not one, but two tools to automate tasks.

Of course, both gulp and grunt have many plugins that will help you achieve almost everything there's needed. But they are mostly 3rd party plugins that are of various quality and difficulty in terms of setup.

In our setup, we haven't yet tackled the problem with order of .js files (which still needs to be explicit) and also haven't mentioned another problem which is a dependency management.

Some kind of dependency management

There's Bootstrap, jQuery, moment.js, lodash and more cool libraries and frameworks you would like to use in your project. In ideal world what you would do is to download or point to a bootstrap.css and link it in index.html like this:

<head>
    ...
    <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css" />
    ...
</head>

And you're done! But nothing is ideal in frontend world nowadays and the problems will appear as soon as you start adding files. You will need to solve problems like:

Is library A compatible with specific version of library B?
Why adding jQuery into project disabled all my fancy pop-up menus?
Why do we have 4 libraries for creating fancy pop-up menus anyway?
I have linked an external library that is not available at this link anymore :(

You will soon realize, you need at least some kind of dependency management. Something that will find the correct version of library you need and link it into project. Not so long time ago these problems were solved by using Bower. Bower is a package manager, which will use it's configuration file (bower.json) to define, download and later install dependencies for your use.

{
  "name": "blogging-platform-frontend",
  "description": "The blog!",
  "main": "index.js",
  "authors": ["Pavol Rajzak"],
  "license": "ISC",
  "keywords": ["javascript", "gulp"],
  "homepage": "",
  "ignore": [
    "**/.*",
    "node_modules",
    "bower_components"
  ],
  "dependencies": {
    "bootstrap": "^4.0.0"
  }
}

As for Gulp/Grunt you need to install it via npm, then you can run bower command which will create a bower_components directory with specific libraries. You can then use gulp/grunt plugins to wire the dependencies into your project. Sweet! It seems so, but not everything is ideal. Bower is now a de-facto discontinued project, because of several design problems it contained. You should not use it for new development.

Another point of view could be like this: for building the project and maintaining dependencies we need these tools:

node.js - runner of .js scripts
npm - package manager
grunt/gulp - task runner
bower - package manager

Well, I tried to make it obvious, that there's some duplication we could avoid. Why do we need 2 task runners and 2 separate dependency management tools? The answer is - we don't.

Introducing webpack

So, we have got rid of gulp/grunt and bower and replaced it with pure npm/node.js solution for frontend part. What can we do with it? Well, not much. The main task - bundling it all together - still needs to be replaced by some more advanced, dedicated tool. An application bundler.

Here's where we introduce Webpack into our story. It's a bundler capable of crawling through your application, finding sources and creating application bundle based on defined dependencies. The main and biggest difference here is that it takes advantage of modular approach, which can be implemented in several ways. The ES6 way is using import/export statements.

Let's look at our changed example from naive approach:

... (title.js) ...
export const title = `<h1>👨‍👨‍👦‍👦 Friends blog 🌟</h1>`;

... (main.js) ...
import {title} from "./title";

export const main = `
    <div class="main container">
        <div class="title">${title}</div>
    </div>
`;

... (index.js) ...
import {main} from "./src/components/main";

document.getElementById("app").innerHTML = main;

Now this is a huge improvement and it solves the problem of having all component definition in global namespace. Now that you can define your dependencies explicitly, you don't have to worry about any namespace clashes, since webpack will bundle it all in safe way.

Webpack can be configured (webpack.config.js) like this:

module.exports = {
    module: {
        rules: [
            {
                test: /\.js$/,
                exclude: /(node_modules)/,
                use: {
                    loader: 'babel-loader',
                    options: {
                        presets: ['babel-preset-env', 'react'],
                        plugins: [
                            require('babel-plugin-transform-object-rest-spread')
                        ]
                    }
                }
            },
            {
                test: /\.css$/,
                use: ['style-loader', 'css-loader']
            },
        ]
    },
    plugins: [
        new WebpackCleanupPlugin('target', {verbose: true}),
        new CopyWebpackPlugin([{from: 'index.html', to: 'index.html'}])
    ]
};

This is doing very similar thing as gulp/grunt was doing, but instead of tasks/plugins there are loaders used for processing files and plugins for additional tasks.

Most importantly, you define and trigger the build using npm / node.js , so we have now only three very specific tools that will do the job. Here's for instance the package.json configuration:

{
  "name": "blogging-platform-frontend",
  "version": "1.0.0",
  "description": "The simplest UI you can imagine",
  "main": "index.js",
  "scripts": {
    "start": "webpack --watch index.js target/build.js",
    "build": "webpack index.js target/build.js",
  },
  "keywords": [
    "javascript"
  ],
  "author": "Pavol Rajzak",
  "license": "ISC",
  "devDependencies": {
    "babel-core": "^6.26.0",
    "babel-jest": "^22.2.0",
    "babel-loader": "^7.1.2",
    "babel-plugin-add-react-displayname": "0.0.5",
    "babel-plugin-transform-object-rest-spread": "^6.26.0",
    "babel-preset-env": "^1.6.1",
    "babel-preset-react": "^6.24.1",
    "copy-webpack-plugin": "^4.5.1",
    "css-loader": "^0.28.9",
    "style-loader": "^0.20.1",
    "url-loader": "^0.6.2",
    "webpack": "^3.10.0",
    "webpack-cleanup-plugin": "^0.5.1"
  }
}

You might've spotted one addition in the configuration - we are using babel. It is a transpiler (language-to-language compiler) which will compile our ES6 code to a more supported ES5 version of JavaScript. We can now support our application also on IE9, woohoo! <IronyOff />

Also, webpack is able to natively work in watch mode, which will automatically pick-up changes and re-build the bundle. It also supports multiple configurations (development / production), it has numerous plugins and it get's better each version! As opposed to gulp/grunt the configuration process is definitely more deterministic.

It's all Greek to me!

The lifespan of these tools is very short, I am not talking about decades of evolution, but a few years at most. How to track what's going on? If you are not directly employed/involved in frontend development it is very hard. If now webpack is the cool thing to use, in some months it can be prepack. Or npm is now being deprecated in favor of yarn.

Luckily, there are tools/libraries/frameworks even for this! If you want to build React applications, you can start with create-react-app, for Angular you have angular-cli. Everything you might need is already pre-configured for you. You still need to understand the notion of build and dependency management, but at least the burden is a lighter this way.

The bottom line

I personally think, that being a frontend developer means you need to keep track of changes in JS ecosystem even more frequently. While on backend, you can basically jump back in even after few years without studying new trends (which you shouldn't), it is nearly impossible in frontend. If you do, however, lose track of what is the "standard" frontend stack, you can just use boilerplate or generators directly targeting specific frameworks.

Preparing a course for junior developers

Pavol Rajzak — Tue, 03 Apr 2018 07:07:40 +0000

So, we have decided to create a course for junior developers that would go on for several weeks. The point is to introduce them to newest technologies that are used on real projects and show them the best practices in software engineering. While previously I had several presentations and short-term workshops, I am still a bit struggling about how to conduct it so that it will bring value to the participants.

I have identified several things like:

prepare all prerequisites (environment, materials, Git repository)
work with smaller groups (or have additional help with overcoming impediments)
don't over-flood people with information
if possible select participants (so that everyone starts on the same level)
be friendly, try to motivate instead of just stating facts

Anyhow, I would like to start a discussion on what you think are the key points for successful course. If you have any tips to share, please don't hesitate ;).

Just do it! With AWS Lambda

Pavol Rajzak — Sun, 25 Mar 2018 17:31:59 +0000

The prequel

Last year I had a presentation about AWS Lambda. It's not something I am using in my daily work, but I wanted to explore this technology further and present it to public. When I was preparing code examples for this talk, I was having a problem of coming up with some real-world usage that would go beyond standard "Hello World" or some other peoples' examples. The talk was okay, but it was missing that "Wow!" moment when audience realize that this is the game changer.

Fast forward to present: Our company is finally adopting Slack as our primary communication tool. It's a huge improvement over traditional Skype for Business, mostly because we can create specialized channels. And with that, the most frequently used channel is... the discussion about where to go for a lunch!

The struggle

You see, this is quite a thing, here in Slovakia, since restaurants offer daily lunch menus for a reduced price. Each day different menu for several restaurants around our office. There are many options, so you see why the lunch discussion is an ongoing one.

The first idea (before Slack era) was to create a web application that would scrape information about menus from nearby restaurants. Either from their webpages or from similar services that provide this information. Thus, Luncher was born!

And so, with Slack our lunch-flow is:

Create a screenshot from Luncher
Post it to Slack #lunch channel
Create /poll where to go for lunch.

And that's not very Slack-ish (if that's a word).

The idea

Luckily, I designed Luncher to expose a REST API which provides a list of daily menus in JSON format. My first idea was to create a slack command and use this API. Without any prior knowledge, I started to explore how things work.

In Slack, it is fairly easy to create a command. You just create new app within your organization, and then provide a functionality to it. In my case, the intention was to create so called slash command, which starts with forward slash followed by command name and parameters. I called this command /obed (meaning lunch in Slovak).

The twist

The rules to create slash commands are pretty simple: you use /obed command, it will call REST API to fetch the data and list the results in Slack. Well that's easy, but the problem (here comes the twist) is that the resulting JSON that is going to be read by Slack needs to be in specific format, like this:

{
    "text": "Here's the main text!",
    "attachments": [
        {
            "text":"Here be some additional text!"
        }
    ]
}

And Luncher sends responses in a very different format.

The easiest thing would be just to add additional endpoint that would send responses in Slack-friendly way, but here's the real problem. Luncher is deployed to Azure as a WAR file (it's Kotlin + Spring Boot) and it's a bit painful to change anything there, since I am not responsible for the deployments.

The solution

I didn't think long when I decided to try implementing a AWS Lambda function that would call Luncher API and transform the output to Slack format. The whole implementation was really easy, since I created and deployed the Lambda function using awesome Serverless framework.

Basically, when /obed is executed it will call an endpoint defined in AWS API Gateway which will point to Lambda function. This function will call the Luncher REST API, retrieve data, transform them in Slack JSON response and return it back. As a result you get this:

Final words

The most awesome thing about this is that it was super easy. I managed to do this within one hour or so. For now it is simple, but it can be enhanced so that it accepts parameters and formats output in a more fancy way. Also, now I have a real-world example for my next FaaS related topics.

Gerrit notifications: How to tame them?

Pavol Rajzak — Mon, 22 Jan 2018 13:24:11 +0000

We are currently required to use Gerrit for our code reviews. While in general I am okay with the "one-review-per-commit" mechanism and I actually like how the review is done.

On the other hand, the user experience provided by Gerrit web UI is just terrible. For example you cannot even sort the changes by specific columns in table, which does not have even/odd lines in different colors (yes, I need to use my pen to track the information on one line on my 24" screen).

But the main productivity killer for us is the notification system. Only push-like notifications are sent via email, and they cannot be fine tuned (well, you can switch between plain-text and HTML or "all comments" and "comments left by others"). Therefore, you get a lot of SPAM which you need to manually go through. And it is not even aggregated like in other tools (e.g. BitBucket). While you can write scripts'n'filters in your favorite e-mail client, Outlook, for instance, is not my favorite client to tweak.

Therefore, I would really like to know, are there any alternatives to get meaningful push-like notifications?