How to Build Java Applications Today: July 5, 2021
Tags: java, bpf
Published: 2021-07-05 22:29:17

## TL;DR
Google’s Firebase gets new features, free Java production profiling to whither away, Sonatype Lift bundles static code analyzers, Quarkus 2.0.0, Apache Camel 3.11, and IntelliJ IDEA 2021.1.3.

***

## README
This is **issue 43** of my weekly newsletter, “How To Build Java Applications Today”. I read all the Java newsletters, so **you** don’t have to! And it’s “Java news with a smile”.

If you like my newsletter, then [subscribe to it on Substack](https://bpfnl.substack.com)! Or read it on [dev.to](https://dev.to/ksilz/series/11995),  the [Java Cafe](https://thejavacafe.com/ksilz/series/1), or [Medium](https://ksilz.medium.com). Even better: Share it with people who may be interested.

***

## Quote of the Week
*I used to think that the brain was the most wonderful organ in my body. Then I realized who was telling me this.‌*
[Emo Phillips](http://www.quotationspage.com/quote/39852.html), a US comedian [(born 1956)](https://en.wikipedia.org/wiki/Emo_Philips), reminds us not to blindly trust our inner voice. Or the voice of our partner when they tell us what a wonderful person they are!

***

## Stand-Up
I hope my readers in the US (or “the colonies”, as some still call them over here in merry ol’ England) had a good Independence Day! I had a busy weekend, too, with two InfoQ articles of mine [getting published](https://www.infoq.com/profile/Karsten-Silz/). Fortunately, there isn’t a lot of summer weather distracting me here. 🌧 You’ll read about one article in the main section below.

I also booked [another conference talk](https://betterprojectsfaster.com/learn/talks-jfs-2021-how-to-build-front-ends/). And yes, it’s “How should Java developers build front-ends today?” once more. It’s the one where I shot a [teaser video](https://youtu.be/3xNAt4Felt4) with - as a good friend told - terrible light. 😔 Anyhow, given that supposedly 90% of us Java developers work in the **back-end**, there’s an awful lot of interest in my **front-end** talk - [5 conferences this year](https://betterprojectsfaster.com/learn/#conference-talks) and counting!

***

## Code Review
### Issue 42 from June 28, 2021
#### Java Applications in Windows 11 App Store
[Last week](https://bpfnl.substack.com/p/how-to-build-java-applications-today-ff1) I wrote about how Java apps can appear in the Windows 11 app store. Now a Windows 11 preview is [available for download](https://www.theverge.com/2021/6/28/22553639/microsoft-windows-11-download-available-preview-features), but many questions remain: What are [the requirements](https://www.theverge.com/2021/6/29/22555371/microsoft-windows-11-cpu-support-hardware-requirements-tpm-response)? Will the blue screen of death [really turn black](https://www.theverge.com/2021/7/1/22559852/microsoft-windows-11-black-blue-screen-of-death-bsod-change)? And does Windows 11 still have UI layers, as [Windows 10 does](https://ntdotdev.wordpress.com/2021/02/06/state-of-the-windows-how-many-layers-of-ui-inconsistencies-are-in-windows-10/), that go back to Windows 8/7/Vista/XP/2000/95? Only time will tell.

But we **do** know that [Konstantin Terziev](https://www.linkedin.com/in/konstantindt/) is an avid & helpful reader of this little newsletter! He found typos in four issues already. Last week, for instance, I wrote “Visual J+++”. Arguably, [that tool](https://en.wikipedia.org/wiki/Visual_J%2B%2B) didn’t even deserve two “+”. But the third one was wrong for sure! So thank you, Konstantin, for being my editor!

***

## Bookmarks
### Frameworks & Libraries
#### Google’s Backend-as-a-Service Firebase Gets New Features
*[Firebase](https://firebase.google.com) offers many free services for Java, web & mobile apps: Authentication, configuration, push notifications, analytics, performance monitoring, mobile app distribution, and more. We pay for storing data in databases & files. But you have to like both the cloud & Google!* 

My current project uses the [Backend-as-a-Service](https://en.wikipedia.org/wiki/Mobile_backend_as_a_service) Firebase. Firebase is part new service, part thin layer over existing Google Cloud services. If your organization permits cloud-based services and lets you use Google services, then I can recommend Firebase. Here are the products I use or plan to use in my project:
- Firebase handles [authentication](https://firebase.google.com/products/auth), so my Spring Boot application doesn’t store passwords, just tokens. I only use email & password for now but plan on enabling social logins (Facebook, Google, Microsoft, …) down the line.
- [Cloud Storage](https://firebase.google.com/products/storage) stores files. I  can define Access Control Lists (ACL) that reference authentication properties. This is the only service I pay when the file volume exceeds my free [Google Cloud tier](https://cloud.google.com/free/docs/gcp-free-tier#free-tier).
- I distribute my  native iOS and Android app tests versions with [App Distribution](https://firebase.google.com/products/app-distribution). The recipients of my test versions need a Google account.
- I analyze iOS and Android app crashes with [Crashlytics](https://firebase.google.com/products/crashlytics).
- I plan to send push notifications with [Firebase Cloud Messaging](https://firebase.google.com/products/cloud-messaging) later this year. From [what I can see](https://firebase.google.com/pricing), that’s free, no matter how many notifications I send.
- I hope to use [Remote Config](https://firebase.google.com/products/cloud-messaging) for feature flags.

A big downside for Firebase is the cost model of its NoSQL database [Firestore](https://firebase.google.com/products/firestore). Not only do we pay for storing data (1 GB/month is free), but also for [reads, writes, and data transfers](https://firebase.google.com/pricing). Worst case: A US$30k bill [in 3 days](https://www.dottedsquirrel.com/30k-firebase/)!

At Google I/O in mid-May, Firebase got a new product ([App Check](https://firebase.google.com/docs/app-check)) and some enhancements. App Check verifies both the app and the device with tokens, whereas authentication verifies the user’s right to access specific resources. You can read more in [my InfoQ article](https://www.infoq.com/news/2021/07/new-firebase-features-google-io/).

Firebase certainly seems to have momentum on its side: Google claims that  [three million apps](https://firebase.googleblog.com/2021/05/whats-new-from-firebase-at-google-io.html) per month actively use Firebase. That’s more than the [2.2 million apps](https://www.statista.com/statistics/276623/number-of-apps-available-in-leading-app-stores) in Apple’s App Store! And while it took 13 months (from [September 2019](https://firebase.googleblog.com/2019/09/Whats-new-at-Firebase-Summit-2019.html) to [October 2020](https://firebase.googleblog.com/2020/10/whats-new-at-Firebase-Summit-2020.html)) to go from 2 million apps to 2.5 million apps, it took just 7 months to add another 500k.

[My InfoQ Article](https://www.infoq.com/news/2021/07/new-firebase-features-google-io/)

***

### Tools
#### Free Java Production Profiling To Whither Away?
*Java Flight Recorder (JFR) is an imperfect but free tool for profiling Java applications in production. The upcoming Project Loom will amplify its deficiencies. Who’ll step in to fix them?*

In [issue #25](https://bpfnl.substack.com/p/how-to-build-java-applications-today-b38), I wrote about “Profiling in Production” with the [JDK Flight Recorder](https://en.wikipedia.org/wiki/JDK_Flight_Recorder). Oracle claims that JFR just adds 1% overhead to the monitored Java application. And in Java 16, it could record memory allocation more efficiently. So all’s well, right?

Nope: Marcus Hirt, one of the founders of the [JRockit JVM](https://en.wikipedia.org/wiki/JRockit) that eventually merged with the Sun JVM, sounds the alarm. JRockit is where JFR was born (as the “JRockit Flight Recorder”). Marcus, now at [Datadog](https://www.datadoghq.com), identifies four weaknesses of JFR:
- The first is the recording context - associating the data recorded by JFR with the “thread of execution”. With reactive programming today, many connections share a Java thread, so that link is already broken. And the Virtual Threads of Project Loom (see [issue #39](https://bpfnl.substack.com/p/how-to-build-java-applications-today-068)) won’t connect with JFR out of the box, either.
- Marcus also thinks JFR needs wall-clock profiling. That is a low-overhead way to dump thread stacks. Once more, the Virtual Threads of Project Loom make that harder still.
- The current CPU profiling in JFR doesn’t include native libraries or native JVM threads. It should, according to Marcus.
- JFR can produce “millions of events per minute” on a 96 core machine, “resulting in recording sizes of hundreds of megabytes per minute”. Now that certainly doesn’t sound like the 1% overhead that Oracle promises! Datadog fixed this already for memory allocation with a rate-limited profiler in Java 16. But Marcus thinks it’s also needed in other areas.

This article is a cry for help because Marcus & his employer Datadog can’t do all this work by themselves. But his [calls to action](https://en.wikipedia.org/wiki/Call_to_action_(marketing)) are rather vague (highlights are mine): “For JFR to remain the premium, best in class, production profiling platform, **some investment will be needed.** […] **The OpenJDK community will need to be involved**.” So who does what by when here?! I don’t know. But I **do** hope that the proper actions will be taken!

[Blog post](https://foojay.io/today/openjdk-and-the-future-of-production-profiling/)

***

#### Sonatype Lift Bundles Static Code Analyzers for Java & Other Languages
*Static Code Analyzers find bugs that tests often don’t. Sonatype Lift bundles many open-source analyzers for Java and other languages. Lift is free for public Git repositories but not for private ones.*

I use static Java code analyzers because they show me errors in my code. And yes, I don’t write enough unit tests - none these days, really. I know I should, but I don’t. 😔  I do floss each night and eat my vegetables if that is any consolation.

Anyhow, I use two common static analyzers: [PMD](https://pmd.github.io/) and the [FindBugs](http://findbugs.sourceforge.net) successor [SpotBugs](https://spotbugs.github.io). They both are separate Gradle targets that I run when putting together a release at the latest. In contrast to these two, [Google’s Error Prone](https://errorprone.info) always runs during Java compilation, so it gives me much more immediate feedback.

Sonatype bundles 25 static analyzers for Java, JavaScript, C++, and other programming languages in a product called [Lift](https://www.sonatype.com/products/sonatype-lift). Lift works on Git repositories in GitHub, [GitLab](https://about.gitlab.com), and Atlassian’s [BitBucket](https://bitbucket.org/product) and creates pull requests with fixes. You know, like [Snyk does](https://snyk.io/product/open-source-security-management/) for vulnerabilities in dependencies.

Sounds good, so how much does it cost? It’s “[free forever on public repositories](https://github.com/marketplace/muse-dev)” and costs $25/month/developer for private repositories.

The beauty of bundling open-source static analyzers is that we can integrate these analyzers ourselves! Here are the ones Lift [currently uses](https://help.sonatype.com/lift/included-analyzers) for Java: [Facebook’s Infer](https://fbinfer.com/), Error Prone, the SpotBugs plugin “[Find Security Bugs](https://find-sec-bugs.github.io)”, [Quandary](https://fbinfer.com/docs/checker-quandary/), [Semgrep](https://github.com/returntocorp/semgrep), and PMD (disabled by default). So if I’m bored over the next couple of months, I could now add more static analyzers to my project! 👍🏻

If Lift is not for you, I’d say: Start with Error Prone and SpotBugs. Between these two, you’ll find a lot of bugs!

[InfoQ article](https://www.infoq.com/news/2021/06/Sonatype-lift-code-analysis/)

***

### Releases
#### Quarkus 2.0.0
*Spring Boot’s most humble competitor adds continuous testing, a CLI, and a GraphQL client in version 2.0. JDK 11 is now the minimal version, and dependencies got upgraded.*

“Quarkus makes Java supersonic, subatomic”, to quote the [Quarkus 2.0 website](https://quarkus.io/quarkus2/). In other words: It’s a modern microservice framework that creates small & fast native images with GraalVM. How popular is Quarkus?

Snyk “JVM Ecosystems Report 2021” makes Quarkus the leader of the “Hip Framework Pack Chasing Spring Boot” with 11% (see [issue #41](https://bpfnl.substack.com/p/how-to-build-java-applications-today-5ca)). The “JRebel 2021 Java Technology Report” (see [issue #27](https://bpfnl.substack.com/p/how-to-build-java-applications-today-4b3)) gives that honor to DropWizard (9%), with Quarkus following (6%).

Now back to version 2.0. Despite the big jump from 1.x, the summary above already told you nearly all you need to know: Three new features, JDK 11, and dependency upgrades. These upgrades are GraalVM 21.1, [Eclipse Vert.x 4](https://vertx.io/blog/eclipse-vert-x-4-released/), [Eclipse MicroProfile 4](https://betterprojectsfaster.com/blog/weekly-links-2021-01-04#whats-new-in-microprofile-40httpswwwinfoqcomnews202012whats-new-in-microprofile-4), and Hibernate ORM 5.5.

[Release Notes](https://quarkus.io/blog/quarkus-2-0-0-final-released/)

***

#### Apache Camel 3.11
[Apache Camel](https://camel.apache.org) is an integration framework that implements the “[Enterprise Integration Patterns](https://camel.apache.org/components/latest/eips/enterprise-integration-patterns.html)” from the [book of the same name](https://en.wikipedia.org/wiki/Enterprise_Integration_Patterns). This version is an LTS release with [101 new features, improvements, and fixes](https://camel.apache.org/releases/release-3.11.0/).

Part of that release is [Camel Quarkus 2.0.0](https://camel.apache.org/blog/2021/06/camel-quarkus-release-2.0.0/) that - you probably guessed it already - integrates Camel with Quarkus 2.0.0.

[Announcement](https://camel.apache.org/blog/2021/06/RELEASE-3.11.0/)

***

#### IntelliJ IDEA 2021.1.3
If you’ve used IntelliJ IDEA, then it probably already nagged you to upgrade to this new version. 

When I read that it fixed “UI freezes”, I thought for a moment it fixed the ones that [I occasionally experience](https://youtrack.jetbrains.com/issue/IDEA-258631). But sadly, it’s [other freezes](https://youtrack.jetbrains.com/issue/JBR-2755). 😒

[Announcement](https://blog.jetbrains.com/idea/2021/06/intellij-idea-2021-1-3/)

***

## About
Karsten Silz is the author of this newsletter. He is a full-stack web & mobile developer with 22 years of Java experience, author, speaker, and [marathon runner](https://resultsbase.net/event/5809/results/3294285). Karsten got a Master's degree in Computer Science at the Dresden University of Technology (Germany) in 1996.

Karsten has worked in Europe and the US. He co-founded a software start-up in the US in 2004. Karsten led product development for 13 years and left after the company was sold successfully. He co-founded the UK SaaS start-up "[Your Home in Good Hands](https://yourhomeingoodhands.co.uk/)" as CTO in 2020. Since 2019, Karsten also works as a contractor in the UK.

Karsten has [this newsletter](https://bpfnl.substack.com/), a [developer website](https://betterprojectsfaster.com/), and a [contractor site](https://ksilz.com/). He's on [LinkedIn](https://www.linkedin.com/in/ksilz/), [Twitter](https://twitter.com/karsilz), and [GitHub](https://github.com/ksilz). Karsten is also an [author at InfoQ](https://www.infoq.com/profile/Karsten-Silz).