Foojay.io, the Friends Of OpenJDK!

Your Java AI application is live in production. But have you tested whether it can be jailbroken, manipulated into revealing its system prompt, or tricked into printing content it should never output?In this episode, Iryna Dohndorf, Software Engineer at Karakun Group and creator of Tiberius, explains how to bring security testing to LLM-powered Java applications. We cover why traditional unit tests break down with non-deterministic systems, how the Scan-Fixture-Validate workflow works, what buff mutation testing is, and why even well-trained models can be cracked with something as simple as the grandmother attack.Topics include:Why LLM non-determinism breaks the classic input/output test modelThe Scan-Fixture-Validate principle and sharing test artifacts across teamsPrompt injection, jailbreaks, and emotional manipulation attacksBuff mutation: testing linguistic surface coverageProbabilistic security contracts and multi-trial scansFingerprinting and why your model choice should not be detectableLLM as a judge: using a second model as a guardrailGetting started with Tiberius in Spring Boot and LangChain4jGuestIryna Dohndorf - Software Engineer at Karakun GroupLinkedInLinksArticle on FoojayTiberius on GitHubSecurity Testing GuideTimestamps00:00 Introduction of topic and guest01:05 The problem Tiberius wants to solve06:39 How "traditional" unit tests don't work for LLM integrations10:23 Scan-Fixture-Validate principle and sharing artifacts15:15 Using different skills, for example, the grandmother skill17:33 Testing for required versus forbidden bias19:35 The probes across nine attack categories used by Tiberius20:44 Buff mutation testing26:55 Using Tiberius in your pipelines and when to fail29:35 Using multi-trial scans31:14 Fingerprinting: which model you use, should not be detectable32:55 Combining multiple models, model as a judge34:41 Sharing JSON models to improve tests36:05 How to get started with Tiberius in Spring and with LangChain4j36:41 Quarkus not supported yet, plans for the future39:07 Conclusions and a call out to everyone to become a Foojay author

Welcome to another episode of the Foojay Podcast! Just like in the previous episode, I bring you conversations from two of Europe's premier Java conferences - Devoxx in Belgium and JFall in the Netherlands.At these conferences, I had the opportunity to speak with members of the Java community about topics ranging from the evolution of Java itself to mobile development, performance optimization, and even automotive security.My first guest is Johan Vos, a Java Champion who takes us on a journey through Java's history - from porting Java to Linux in 1995 to his current work on bringing Java and JavaFX to mobile and embedded devices through the Java On Mobile project.Then we'll hear from Stephen Chin, author of "The Definitive Guide to Modern Java Clients with JavaFX," who shares insights on building cross-platform client applications and reflects on how his daughter has followed in his footsteps to become a published author and technology educator.From JFall, Joseph Phillips joins us to discuss Java's evolution, the differences between REST and gRPC, and whether virtual threads have replaced the need for async implementations in modern Java applications.Next, François Martin walks us through the world of Java performance benchmarking with JMH - the Java Microbenchmark Harness - and explains why it's so valuable for comparing different implementations and optimizing code.Wouter De Geus shares his inspiring journey from finance and mathematics into Java development, and how his employer, the Dutch Tax Authority, supports open-source contributions and the Java community.And finally, Roald Nefs demonstrates something truly unique - using Java and the Foreign Function & Memory API to hack into automotive systems, revealing important security considerations for both hardware and software.Content00:00 Introduction of topics and guests02:11 Johan Voshttps://www.linkedin.com/in/johanvos/History of Java on LinuxHow the Java language and runtime are stable and evolving at the same timeLooking at the future of Write-Once-Run-Everywhere with Java(FX) on Mobilehttps://openjdk-mobile.github.io/19:04 Stephen Chinhttps://www.linkedin.com/in/steveonjava/Author of "The Definitive Guide to Modern Java Clients with JavaFX"Cassandra Chin: https://www.linkedin.com/in/cassandra-chin-developer/ Her book: https://www.amazon.nl/Raising-Young-Coders-Teaching-Programming/dp/B0DVBQZ48323:22 Joseph Phillipshttps://foojay.social/deck/@infosec812Java evolutions, communityREST versus gRPCDo we still need async or are virtual threads a better solution?27:49 François Martinhttps://www.linkedin.com/in/fran%C3%A7oismartinJava performance micro benchmarks with jmhhttps://github.com/openjdk/jmh33:30 Wouter De Geushttps://www.linkedin.com/in/wadegeus/Moved from finance to software developmentContributing back to the open-source community39:33 Roald Nefshttps://www.linkedin.com/in/roaldnefs/Hacking cars with the FFM APIHardware and software security concernsWhat you can learn from the Java community46:29 Outro

Maven 4 is approaching its release, bringing many improvements to the build tool powering millions of Java projects.In this Foojay Podcast episode, we talk about Apache Maven 4, a significant milestone that has been years in the making. Maven has been the backbone of Java dependency management and build automation since the early 2000s; however, the road to version 4 has been a long and deliberate one. With significant performance improvements, a modernized API for plugin developers, and changes that affect how we think about project structure, Maven 4 represents both an evolution and a revolution. What does this mean for the millions of developers who depend on Maven daily? How should teams prepare for the transition? And what's the story behind the Maven Central Repository changes that have been making headlines? To answer these questions and more, we're joined by a few of the many contributors who are actually building Maven 4 and stewarding its ecosystem.Guests Hervé Boutemy https://www.linkedin.com/in/hboutemy/ Guillaume Nodet https://www.linkedin.com/in/guillaumenodet/ Maarten Mulders https://www.linkedin.com/in/mthmulders/ Content00:00 Introduction of the topic and guests04:23 Status of Maven 4 release https://maven.apache.org/whatsnewinmaven4.html https://maven.apache.org/guides/mini/guide-migration-to-mvn4.html 07:57 Why we needed a new Maven version https://maarten.mulders.it/2020/11/whats-new-in-maven-4/ https://maarten.mulders.it/2021/03/introduction-to-maven-toolchains/ https://www.javaadvent.com/2021/12/from-maven-3-to-maven-5.html 12:37 You can already start using Maven 414:35 Some benefits of switching to Maven 418:52 Changes in the pom file, and yes, still XML20:30 Changes for Maven plugin developers and integrators22:24 Changes for Maven users, for instance, the need for Java 1728:34 Maven The Tool versus Maven The Repository34:51 Reasons for the change in authentication for uploads to Maven Central36:01 The one and only Maven Central URL to use https://central.sonatype.com/ 38:04 About the very first "server" hosting the Maven repository40:32 The importance of setting up your own caching repository https://www.sonatype.com/blog/maven-central-and-the-tragedy-of-the-commons https://openssf.org/blog/2025/09/23/open-infrastructure-is-not-free-a-joint-statement-on-sustainable-stewardship/ https://www.youtube.com/watch?v=t74ClffSUW0 44:04 The relationship between POM, BOM, BOM-POM , and SBOM49:43 Gradle versus Maven57:54 How to contribute to Maven or any other open-source project, and how to get the support of your company to do so01:05:23 How to upgrade your projects from Maven 3 to 4 https://maven.apache.org/tools/mvnup.html

On September 19th, 2025, the first AI4Devs conference (https://amsterdam.ai4devs.io/) took place in Amsterdam. I grabbed my camera and microphone to talk with speakers and attendees about the revolution in AI-powered coding and application development. In this first part, we'll explore Spring libraries, security, infrastructure and scaling, real-world use cases, event streaming, JetBrains tools, and more...I asked all my guests the same opening question: 'What's your name, and what brings you to this conference?' Let's get started!00:00 Introduction00:44 Christian Tzolov and Josh Long Spring AI, Spring MCP, Spring Security https://www.linkedin.com/in/joshlong/ https://www.linkedin.com/in/tzolov/ 17:07 Brian Vermeer AI and security and the responsibility of the developer https://www.linkedin.com/in/brianvermeer/ 27:57 Camille Nigon and Maarten Vandeperre Quarkus, Scaling AI applications, the cost of using LLMs https://www.linkedin.com/in/camille-nigon/ https://www.linkedin.com/in/maarten-vandeperre/ 36:15 Luca Berton Infrastructure for AI applications https://www.linkedin.com/in/lucaberton/ https://www.youtube.com/@BertonLuca 41:15 Soham Dasgupta Real life AI use cases https://www.linkedin.com/in/dasguptasoham/ https://github.com/marketplace?type=models 48:03 Mary Grygleski Event driven agents to handle complex flows https://www.linkedin.com/in/mary-grygleski/ 55:04 Anton Arhipov Java and Kotlin at JetBrains, Junie AI https://www.linkedin.com/in/antonarhipov/ 01:06:07 Outro

This is the first Foojay podcast in Spanish. It's also the shortest one and the final of season 4 ;-) Jonathan Vila "highjacked" the microphone from Geertjan Wielenga (See episode 76, https://foojay.io/today/foojay-podcast-76-devbcn-report-part-1-learn-from-the-community/) during the DevBcn conference in Barcelona and interviewed a few of the participants for this first Spanish-only edition of the podcast.Stay tuned and subscribe to the podcast in your favorite app or on YouTube. We're taking a short break and will be back in September with the launch of Java 25!00:00 Introduction00:39 Marlene Maldonado, DevBcn Organization https://www.linkedin.com/in/marlene-maldonado-de-s%C3%A1 02:10 Barbara Teruggi, Speaker, Threat Modelling https://www.linkedin.com/in/barbara-teruggi/ 05:04 Santiago Rincon, CFP Member and Attendee https://www.linkedin.com/in/santiago-rincon-martinez 07:56 Marlene Maldonado, Vicente Soriano, Volunteers https://www.linkedin.com/in/visomar https://www.linkedin.com/in/marlene-maldonado-de-s%C3%A1 10:25 Alvaro Navarro, Speaker, API Design https://www.linkedin.com/in/anavarro 12:37 Vicente Cabanes, Sponsor, Grupo Castilla https://www.linkedin.com/in/vicente-cabanes/

This is the final part of the JCON 2025 interviews with a lot of tips and tricks!In the three previous podcasts, we featured interviews from the JCON conference on "Being a better Java developer," "Evolutions in Java," and "How to use AI with Java." However, we talked to many more people during the conference, so this podcast focuses on tips and tricks. Let's learn from the many other experienced visitors of JCON.00:00 Introduction00:34 Merlin Bögershausen - OpenRewrite and Azul Intelligence Cloud https://www.linkedin.com/in/merlin-boegershausen 07:08 Eberhard Wolff - Measure developer productivity https://www.linkedin.com/in/eberhardwolff 12:28 Annelore Egger - Dealing with bad code, it's not your fault https://www.linkedin.com/in/anneloredev 15:21 Michael Vitz - Unexpected things you can do with Java https://www.linkedin.com/in/michaelvitz 18:40 Michael Simons - Neo4J database models https://www.linkedin.com/in/michael-simons-196712139 https://motherduck.com/duckdb-book-brief 23:13 Stefan Böhringer - Building a project for education from scratch with Quarkus https://www.linkedin.com/in/datenschauer 28:14 Johannes Rabauer - Learned from earlier projects https://www.linkedin.com/in/johannes-rabauer 30:33 Roland Weisleder - ArchUnit, testing architecture with unit tests https://www.linkedin.com/in/roland-weisleder 34:26 Simon Martinelli - htmx, full stack, Vaadin, JOOQ https://www.linkedin.com/in/simonmartinelli 37:02 Loïc Magnette - Web development, Angular, React, Java community versus others https://www.linkedin.com/in/lomagnette 40:41 Tanja Obradovic - Eclipse Foundation, JakartaEE https://www.linkedin.com/in/tanja-obradovic-095604 49:19 Syed Usman Ahmad - Grafana, Prometheus, monitoring tools, OpenTelemetry https://www.linkedin.com/in/usmanlinux 55:38 François Martin - Tools, chaos testing, Toxyproxy https://www.linkedin.com/in/fran%C3%A7oismartin 01:01:31 Conclusion