Tomcat 11: Lenient vs Strict Defaults, Side by Side
A side-by-side comparison of legacy Tomcat defaults and the strict defaults in Tomcat 11, showing which behaviors change and what to verify before you upgrade a Java web tier.
Loading…
Topic
Java
32 posts about Java. Every summary links to the original.
- 32 posts
- 17 companies
- 1 explainer
See the idea
Java explainers
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
National Australia Bank accelerates legacy migrations with Cursor
NAB standardized 6,000 developers on Cursor after evaluating Amazon Q and GitHub Copilot, and is expanding access to more than 10,000 technology employees. The bank uses Cursor across legacy modernization and new development: BizCalc's Silverlight/.NET monolith is being refactored into Java microservices and React, while Assembly-based core-banking programs are being migrated using generated flowcharts and business summaries. Engineers use Ask Mode, Plan Mode, custom NAB CEL skills, Composer, and Opus coding models to document systems, produce requirements and API specifications, parallelize implementation, and test changes. NAB reports that both modernization efforts are progressing three times faster than expected, while a hardware-agnostic payment app was built in under three weeks rather than four months; one team reported a 5–8x velocity improvement.
Modernizing Core Insurance Systems: Breaking the Batch Bottleneck
Migrating core insurance platforms from legacy relational databases with PL/SQL to Java and MongoDB Atlas frequently degrades batch processing performance. Like-for-like migrations can cause batch jobs to run 25 to 30 times slower due to high network round-trips, inefficient per-record operations, and under-utilized bulk capabilities. To resolve these bottlenecks, an optimization framework was developed that leverages MongoDB native bulkWrite operations, intelligent reference data prefetching, and parallel execution. An architecture combining a Spring Boot controller and a dedicated executor framework partitions workloads across threads or event processors. This framework recovered lost performance, completing previously failing batch jobs within service-level agreements and achieving 10 to 15 times better execution speeds than legacy systems in certain workloads.
Simplifying JVM App Development with Heroku’s Buildpack Magic
Heroku’s Java buildpacks simplify JVM application deployment by detecting project languages and frameworks, fetching build tools, and configuring runtime settings automatically. They support Spring Boot, Quarkus, and Micronaut by inspecting Maven or Gradle build definitions, packaging applications, selecting framework-specific runner commands, and mapping service variables such as SPRING_DATASOURCE_URL, SPRING_REDIS_URL, DATABASE_URL, and JDBC_DATABASE_URL. In many cases, a Procfile is unnecessary because the buildpack can identify the executable JAR and provide a default web process, while Quarkus and Micronaut receive their respective runner JAR and port settings. Heroku also automatically attaches a lightweight JVM agent for runtime metrics, including memory usage and garbage collection, and offers similar buildpack support for Scala and Clojure through sbt and Leiningen.
Canva incident report: API Gateway outage
On November 12, 2024, canva.com suffered an outage lasting approximately one hour due to cascading API Gateway failures. The disruption began when a stale Cloudflare routing rule induced severe latency and packet loss between Ashburn and Singapore during an editor asset deployment. Cloudflare's concurrent streaming mechanism consolidated over 270,000 user requests for a single delayed JavaScript chunk; when the asset finally loaded, clients simultaneously generated a 1.5 million requests-per-second thundering herd to Canva's API Gateway. This surge collided with a telemetry performance regression involving lock contention on Netty event loop threads, exhausting off-heap memory and causing the Linux Out Of Memory Killer to terminate API Gateway containers. Canva mitigated the failure by temporarily blocking all traffic at the CDN level, stabilizing replacement Amazon ECS tasks, and gradually restoring traffic under strict rate limits.
How to Create an AI Agent With Heroku and Agentforce
The post shows how to extend Salesforce Agentforce with a Heroku-hosted custom action when customer information remains in older, unstructured cloud archives and requires scalable, real-time processing. It explains that Agentforce selects discrete actions, while Heroku exposes code through External Services using an OpenAPI description of the request and response. The sample uses Java and Spring Boot, an H2 in-memory database, springdoc.org for OpenAPI generation, and Spring AI to convert natural-language questions into SQL before returning results for an Agentforce response. The integration is identified as pilot-only and not intended for production, while the post also points to Heroku Postgres, Heroku Connect, Data Cloud, and pgvector as extensions for other agent use cases.
New zoom freezing feature for Geohash plugin
Grab introduced a zoom freeze capability to its Geohash plugin for the Java OpenStreetMap Editor (JOSM). Previously, zooming in or out forced the plugin to calculate and render new geohashes automatically, causing visual clutter when users needed to focus on a specific region. The updated interface introduces a toggle label allowing editors to switch between enabling and disabling zoom freezing. While frozen, the current geohash boundaries remain locked during map scaling, and options to show smaller or larger geohashes are disabled. Disabling the feature instantly updates the display with the appropriate geohash subdivisions for the current zoom level.
7 Tips For Optimizing Apache Flink Applications
Shopify presents lessons from operating large, stateful Apache Flink applications on Kubernetes with Google Kubernetes Engine, RocksDB, and checkpoints and savepoints stored in Google Cloud Storage. The guidance begins with profiling tools, including async-profiler, VisualVM, jemalloc with jeprof, and Eclipse Memory Analyzer, to investigate CPU, heap, native-memory, and leak-related problems. Disabling Kryo fallback exposed unsupported serializers such as Scala BigDecimal and Scala algebraic data types; replacing them with supported alternatives increased throughput by 20 percent. The post also recommends separate configuration profiles for high-throughput backfills and low-latency steady state, while describing a RocksDB native-memory failure in which disabling the block cache stopped repeated out-of-memory crashes without affecting application performance.
Understanding Programs Using Graphs
TruffleRuby uses a sea-of-nodes graph as an intermediate representation after parsing, allowing its just-in-time compiler to optimize Ruby programs and translate them to machine code. The explanation contrasts this graph with an abstract syntax tree, then shows how control flow, data flow, side effects, pure computations, loops, and phi nodes are represented through boxes and arrows. A three-way conditional demonstrates global value numbering: a repeated multiplication becomes one movable computation that can float across branches without changing program behavior. A loop example shows backward control flow and repeated functional computation, while the discussion weighs graph-based optimization against poor compactness and readability at larger scales. Shopify is building graph-drawing and Ruby decompilation tools to inspect optimization at codebase scale.
Ten Ways to Secure your Applications
The post, adapted from Joe Kutner’s Devoxx 2018 talk, presents ten ways to strengthen web application security, with examples focused on Java but applicable to modern languages. It recommends keeping dependencies current, validating explicit payloads with schemas, checking regular expressions for ReDoS, throttling abusive requests, and keeping credentials outside the codebase. It also advises secure-first coding, certificate validation for outgoing connections, logging security-relevant actions without recording secrets, and monitoring suspicious behavior with tools such as AppSensor. The examples include Maven Versions Plugin, Snyk, Bucket4j, saferegex, environment variables, and EnvKeyStore, with a token-bucket algorithm proposed for request throttling. The conclusion is that security requires anticipating unintended functionality across network, platform, and physical domains, while these practices provide a starting point.
Mohammed Ridwanul Islam: How Mentorship, the T Model and a Pen Are the Keys to His Success
Mohammed Ridwanul Islam's career story connects his upbringing in Noakhali, Bangladesh, varied work and music experience, and interest in engineering with his current role on Shopify's Eventscale team. He describes how trying to build a game led him to write C# and later study Electrical Engineering at the University of Waterloo, where an internship became a full-time position. Eventscale develops tools, libraries, and infrastructure for collecting event-oriented streaming data across web, backend, and mobile platforms, supporting analytics and operational needs. Mentorship during a difficult team project taught him project management concepts, while habits, VIM, Java, and writing designs on paper shape his working practices. His advice is to build broad competence alongside deep expertise, and to prioritize problem-solving, values, social impact, and continued growth.
Kafka Streams on Heroku
Kafka Streams on Heroku shows how to organize, deploy, and scale Java stream-processing services using Kafka Streams, Apache Kafka, and the Heroku Runtime. The example contains a Text Processor that splits input from a textlines topic into words, an Aggregator that counts words in 10-second windows before writing to Postgres, and an independent Anomaly Detector that routes 10-second login-failure counts to urgent alerts or non-urgent email based on thresholds. A Gradle multi-project setup packages each service as an executable and uses a Procfile to run them as separate Heroku workers, while managed Kafka supplies the event-streaming infrastructure. Scaling is explained through Kafka partitions and Kafka Streams Stream Tasks: Stream Threads provide vertical scaling, dyno counts provide independent horizontal scaling, and Kafka Streams redistributes tasks when workers change or fail.
In the Cloud, No One Can Hear Your OutOfMemoryError
Heroku introduces Heroku Exec and Language Runtime Metrics to improve production monitoring, inspection, and debugging for applications running on dynos. Heroku Exec creates secure TCP and SSH tunnels for SSH sessions, port forwarding, remote debugging, and diagnostic tools, while the Heroku Java CLI integrates jmap and VisualVM. A synthetic Java memory-leak example shows VisualVM tracking heap growth and jmap producing a downloadable HPROF heap dump that Eclipse Memory Analyzer identifies as Servlet-held FakeLeak objects. The metrics feature, enabled through the Heroku Metrics buildpack on paid Standard-or-above dynos, displays heap, non-heap, and garbage-collection activity in the dashboard through a Java agent using Prometheus; JVM-language support is generally available, while Go support is in beta.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.