Steve Poole on JAVAPRO International

2: The Jakarta Cliff: Why Modern Java Leaves Struts 1 Behind

Thu, 18 Jun 2026 07:00:02 +0000

This is the second in a series of articles exploring the realities of modernisation. In this article, you’ll learn about:

The Modern Java Breakpoint: Why the shift from javax to jakarta creates an unfixable compatibility break for Struts 1 on modern containers like Tomcat 10 and Jetty 11.
The External Pressure Cooker: How platform baselines, security policies, and cloud migrations force the issue, even if the application code itself hasn’t changed.
Why “Shims” Fail: A look at why attempting to patch compatibility with shims is not a viable long-term solution for production environments.
Safe Operation Strategies: What it practically means to run Struts securely on older containers without exposing the rest of your infrastructure to risk.
The Path to Modernisation: How to use incremental migration patterns and extended support to modernise on your own terms, avoiding risky “big-bang” rewrites.

1: Why Struts 1.3 Still Matters in 2026

Tue, 16 Jun 2026 16:41:08 +0000

What You’ll Learn

This article is the first in a series that explores why Struts 1 still shows up (quietly but persistently) in enterprise systems in 2026, and what that means for teams trying to keep the lights on.

We look at:

The Discovery Effect: How stable, forgotten Struts apps resurface during audits, migrations, and security scans.
Where the Friction Really Is: The talent shortage, the tooling disconnect, and the Jakarta EE shift: all colliding to make legacy upkeep harder than it should be.
Modernisation Without the Fantasy: Why the rewrite-or-risk framing misleads teams, and how approaches like embedding Struts in Spring Boot create workable transition paths.
Buying Breathing Room: How extended support gives organisations time to avoid crisis-driven decision-making.

curl | bash | hacked: the unseen dangers in your dev lifecycle

Wed, 25 Mar 2026 07:00:02 +0000

There’s a line of shell that looks harmless, even helpful:

CODE

curl <XXX> | bash

It promises speed. Convenience. “Just install the thing and get on with your day.”

That promise is exactly why attackers love it.

That one-liner doesn’t merely install a tool. It hands execution control to whatever sits on the other end of a network request, runs with your permissions on your machine, and within your environment. There is no sandbox. No review step. No guardrails.

The Myth of Stability: Java's Software Supply Chain After Log4Shell

Thu, 08 Jan 2026 07:00:02 +0000

For as long as most Java developers can remember, we’ve lived inside a comforting story about our ecosystem. It’s the idea that Maven Central, the Jakarta stack, the Spring universe, the vast Apache landscape, and all the independent libraries quietly carrying enterprise workloads together form a coherent, self-maintaining, self-healing whole.

A world where problems are fixed upstream, where maintainers have time, where the dependencies we pull down are being actively watched by someone who knows exactly what they’re doing. It’s a lovely idea. It’s also never been completely real.

The Shai-Hulud NPM Worm: When Supply Chains Bite Back

Thu, 02 Oct 2025 07:00:01 +0000

Let’s be clear: Shai-Hulud wasn’t just another npm compromise. For the first time, a self-propagating worm ripped through the JavaScript supply chain. We’ve seen worms before, but this one changed the game. It hijacked developers’ credentials and CI/CD pipelines, transforming them into its attack vector.

At KCDC and JavaZone, I warned about the dangers of curl | bash | hacked. Unfortunately, what once looked like a theory (or an occasional exploit) has now evolved into something far more dangerous.

Where to Use AI FOR Development: A Practical Guide for Engineers and Managers

Fri, 26 Sep 2025 07:00:01 +0000

There’s a lot of noise out there about AI generating code for you, creating tests, filing bugs, and possibly even conducting your sprint planning meetings. It’s easy to get swept up in the hype. You’ve probably seen claims like “AI can build your app from a prompt” or “Ship twice as fast with half the team”. Sounds appealing doesn’t it? The reality, as always, is more nuanced.

In this article, I want to puncture some of the more inflated expectations and instead offer a grounded view of where AI can help in software development today. What works, what doesn’t, and what might be worth trying if you squint hard enough. The lens I want to use is risk. Because fundamentally, that’s what software development is: a careful game of managing risk against code.

A 10X Approach to Quality Assurance

Wed, 20 Aug 2025 07:00:02 +0000

It’s often true that what you measure will define you. Measurements become critical indicators, which eventually become goals. Measure the speed of something, and soon, almost inevitably, the goal will be to increase it.

In time, those goals and measurements will become the driving force behind behavior. The original objectives will be lost to history, and the new focus will be considered the norm.

This transformation occurs frequently and is often the downfall of organisations. They forget what they are in business to achieve, get lost in the process, and have these fabricated objectives.

From Breaches to Blackouts: The Human Consequences of Software Supply Chain Attacks

Wed, 23 Jul 2025 07:00:01 +0000

Have you ever considered the impact of Cybercrime? How do your choices in terms of applying good security practices matter? Given that the current estimate for the annual bill worldwide is 9 Trillion US Dollars, there is obviously a significant financial reward for the bad guys, but have you ever wondered how that breaks down or if there’s more to their motivations and actions than just money?

This article will explore the financial element and broader human implications.

Policy and Process: Thinking differently about Modern Java API design

Wed, 30 Apr 2025 07:00:01 +0000

There are many guides on achieving the right architectural balance and multiple thoughts about the ‘right’ way. In this article, I want to distil some of this thinking, apply it to Java API design, and use modern Java features. Historical patterns like AWT or RMI often influence older Java API design thinking, and it’s time to remind readers that modern Java features offer new, more powerful, and frequently safer ways to design APIs.

Move Fast, Break Laws: AI, Open Source and Devs (Part 4)

Thu, 10 Apr 2025 07:00:02 +0000

The software development landscape is rapidly changing, with legislation emerging as a key driver of industry trends. As our reliance on software and AI grows, so does our vulnerability to cybercrime, which is now a multi-trillion-dollar problem. This has caught the attention of regulators worldwide.

This article explains the various regulatory efforts in play and summarises actions that developers and executives should consider as they get to grips with 2025 - the year of software legislation

Move Fast, Break Laws: AI, Open Source and Devs (Part 3)

Tue, 08 Apr 2025 07:00:01 +0000

Background

Part 1 covered the background, what a software supply chain is and thoughts on AI and open source.

Part 2 explored how governments are working to create legislation and what the current status is.

Move Fast, Break Laws: AI, Open Source and Devs (Part 2)

Thu, 03 Apr 2025 09:56:07 +0000

This article explains the various regulatory efforts in play and summarises actions that developers and executives should consider as they get to grips with 2025 - the year of software legislation

Move Fast, Break Laws: AI, Open Source and Devs (Part 1)

Tue, 01 Apr 2025 11:34:21 +0000

This article series explains the various regulatory efforts in play and summarises actions that developers and executives should consider as they prepare for 2025, the year of software legislation.

Thinking differently about testing

Mon, 27 Jan 2025 16:35:56 +0000

10x Insights to help take a different view of quality assurance

I’ve given a few talks about 10x developers, or rather 10x professionals and been involved in process (re)engineering for many teams and projects. However much you learn about people and their roles - there’s always something new to discover. In fact, it’s amazing how often your worldview is blinkered, how often there’s a different way to do or think about some aspect of your life or career.

1BRC with AI - curious and curiouser said the LLM

Wed, 15 Jan 2025 11:48:56 +0000

Did you try turning it off and on first?

(I promise this is the last 1BRC-related post). Read on to discover how large language models (LLMs) performed in generating Java code, their strengths in context-aware development, and challenges such as hallucinations and nuanced errors. Learn what makes a good AI dev tool and what makes a great IDE integration.

A definition of insanity is repeating an action and expecting a different outcome. As developers, we’re used to doing that :-) It’s part of our operating manual.

My Top 10 Principles for getting the best from AI (for developers)

Mon, 02 Dec 2024 11:56:54 +0000

AI tools for developers: principles, insights, and the importance of clean code.

Every day, I encounter a new AI tool, whether a new capability is added to an existing tool or an entirely new offering. I actively use several AI tools, including ChatGPT, Grammarly, and Amazon Q Developer, each serving different purposes. I pay for pro access to ChatGPT and Grammarly, though I sometimes consider switching to Claude.ai, which occasionally proves invaluable. s a view of AI tools for developers: my principles, insights and ultimately the realisation that development practises such as clean code is more essential than ever

The AI Mona Lisa Challenge: Precision and Security Adjustments for Your CI/CD Pipeline

Thu, 21 Nov 2024 12:22:47 +0000

“Mona Lisa, Mona Lisa, men have named you; you’re so like the lady with the mystic smile.”

Last time, I finished a set of articles about using AI coding tools. In the end, my conclusion was that the tools can help greatly but that right now, using them to generate whole programs was pushing the envelope. As helpers, as pseudo-pair-programmers, the tools can offer great value and make you more productive. However, it’s essential to understand that this process works because of the interaction between humans and AI. Without the steering and a continuous mix of rejection and acceptance, the AI can’t learn how to respond correctly.

UnConferences - the antidote to conferences?

Wed, 13 Nov 2024 11:35:30 +0000

unConferences: Experience community-driven learning and networking - where attendees set the agenda and drive the conversation.

In a few days, I’ll be kicking off the second London Java Community Conference this year. We (the LJC) usually run an unConference once a year. Traditionally the last Saturday in November., but since the end of the Covid lockdown, it’s been a Monday near that date. I’ll explain why that’s important later

In this post, I want to explain why we are running an unConference and have two this year. I aim to inspire you to follow suit and run your version—wherever you are and whatever you do. It might just change your life.

1 Billion RECORD CHallenge - AI Style

Thu, 07 Nov 2024 10:05:34 +0000

Previously …

I recently wrote about my experiences with getting AI coding tools to find bugs and write tests. I picked five different tools. The selection criteria were simple - free or trial with no credit card needed. I chose three tools designed to help developers and two general-purpose LLMs.

I gave them a 1000-line Java program and asked them to do three things.

Add Javadoc to explain what the code did
Analyse the code for bugs and design weaknesses
Create Junit testcases that would provide reasonable code coverage.

The results were disappointing but, in hindsight, predictable. Overall, the tools were better at creating documentation than finding bugs and, apart from one, were pretty poor at writing test cases.

Are AI Coding tools worth it - RESULTS

Wed, 30 Oct 2024 12:32:45 +0000

Background

In Part 1 , I examined the value of AI tools for developers, especially those that help them create or understand code. The tools selected are all free to use and a mix of general-purpose ones and those that declare they are specifically for coding purposes.

In Part 2, I examined these tools’ ability to find bugs and weaknesses. The results were spotty and not particularly useful or time-saving.

In this part, we’ll look at the results from asking these tools to create JUnit tests for the code and decide who wins (and why).

Are AI Coding tools worth it - Part 2

Wed, 23 Oct 2024 16:04:46 +0000

In Part 1 , I started to examine the value of AI tools for developers, especially those that help them create or understand code. The tools selected are all free to use and are a mix of general-purpose ones and those that declare they are specifically for coding purposes

Tools being evaluated

1: ChatGPT https://chatgpt.com/

2: Claude https://claude.ai/

3: Amazon Q Developer https://aws.amazon.com/q/developer/

4: Codeium https://codeium.com/

5: JetBrains AI Assistant https://www.jetbrains.com/ai/

I asked each tool three questions

“Generate the main Javadoc to describe this class.”
“Assess the class for bugs and coding weaknesses and provide corrections or guidance.”
” Generate Junit test cases to provide around 90% code coverage -especially for edge conditions etc.”

Results so FAR

In Part 1, we saw that they could all generate Javadoc, but none could do it particularly well. ChatGPT came off best as providing the most comprehensive response, but all the tools were prone to hallucinations that made the result misleading.

Are AI coding tools worth it? - part 1

Thu, 17 Oct 2024 10:00:00 +0000

This is the start of a few posts about AI coding tools. This one sets the scene and gives a taste of what I found. In later posts I’ll show more of what I got from using them as is. , explore what the sweet spots might be and end with a harder look at getting value out of them. If you want to skip to the end go here

A long time ago, in a company far, far away…

In the very early 90’s I had the, well, honour is not quite the word I want, the experience may be, to use a prototype of one of the first viable commercial speech-to-text and speech-to-control tools. I used it at work; I used it at home. It was a disaster in all ways. In the first go-around, the training for learning your voice was arduous, literally painful, and demanding. In the second prototype, it would often pick up the sound of the hard disk on the computer and interpret it as text, to much hilarity for all.

Building a better Mouse Trap - web crawling with Temporal

Thu, 03 Oct 2024 14:26:30 +0000

For various reasons, I’ve been looking at Temporal lately. It’s one of those open-source projects with some great users - think Netflix, Uber, etc.- yet has less visibility in the Java community than expected.

I hope to raise its profile here.

Before I talk about Temporal, I’ll cover my particular use case. Stay with me; this needs to be detailed.

Background

A side project I have is to create a Java API comparison tool that can be used to check if moving from version A to version B of a dependency will have issues. I’m looking beyond the simple class-to-class comparison, I intend to check for a more holistic view to find runtime and compile time problems that might occur within the dependency tree if you upgrade something.

Developer Relations as Terraforming: Cultivating Ecosystems for Success

Thu, 26 Sep 2024 11:55:28 +0000

As a “DevRel” person, I’m disappointed in how often our efforts are misunderstood and marginalised. In this article, I want to take another slant on the what and why of “DevRel.”

Developer Relations (DevRel) holds the same transformative potential as terraforming in science fiction. It’s cheesy, but it’s pretty accurate. Much like engineers striving to turn a hostile, barren planet into one that can sustain life, DevRel teams are tasked with creating an atmosphere where developers can thrive. Success in both cases isn’t immediate; it requires patience, deliberate planning, and constant care to cultivate a living ecosystem.

the Wild Frontier of Technology adoption

Tue, 13 Aug 2024 09:55:32 +0000

Being out of work and looking for new opportunities means interviews. A common thread that comes up is arm waving. “There are 25 million developers out there, we want you to make them use our product/api/service”. Coupled with this idea is the expectation that if only they could get the offering in front of a developer if only that developer would try it, then all would be well and money would pour in.