Brian Vermeer with DevOpsSpeakeasy at DevoxxMA 2022

devops Speakeasy here at Dev Ox Morocco

with Brian Vermeer Brian would you like

to introduce yourself to our audience

um yeah sure hi I’m Brian I am a

developer advocate for sneak Java

Champion based in the Netherlands and

well I’m an engineer what what more to

say yeah yeah yep same I’m a developer

Advocate as well also a developer slash

engineer and we can argue about that

later but

um I’m so excited to see you here is

this your first time here at devops it’s

my first time in Morocco so yeah

definitely Devil’s Morocco is my first

time as well so

um I am pretty pleasantly I’m pleasantly

surprised about about the whole thing

over here the vibe the people the amount

of people the eager that they have and

the friendliness they’re so open like it

was a warm welcome and having this in a

venue like this this is amazing this is

just I want to I want to be back here

next year agreed agreed well you’re a

great company I think there’s a number

of us this is our first time here it’s

mine as well and I have the same feeling

really excited I know um even and to

comment on friendliness I I got to sit

next to a wonderful gentleman during the

opening ceremony here who is a professor

at an engineering school and brought

nine of his students here to this

conference and so the passion here

around getting kids and getting you know

the Next Generation involved is huge and

um I just that was just really inspiring

absolutely

well um for you you have a talk coming

up right I have a talk coming up and I

just did a talk and I had a deep dive on

the first day so you were busy this day

yeah I did I didn’t I don’t know how I’d

end up doing this so much but um um it

was I went great so far so I’m happy all

similar content or is there one in

particular that’s your favorite

um all similar content or basically like

uh three different topics but all

security related so one was a deep dive

on General Security basics for

developers uh like just setting the

stage but also going into what kind of

kind of like security is an umbrella

thing so what kind of things do we need

to think about as as a developer when

we’re creating stuff right that was the

first one I just did a security related

talk on creating Docker containers

specifically for Java applications and

what you should think of because just

copying things from stack Overflow is

not always the best thing to do and what

can go wrong just showing that and later

this afternoon I have a talk about uh

deserialization issues in Java so that’s

more a deeper technical talk nice oh man

okay so I want to talk to you about both

of these things sure first one um I love

talking about containers because that’s

something that’s near and dear to me too

as a developer I was exposed to

Containers just it wasn’t like a formal

introduction it was just here’s a

project we need you to maintain it now

it’s already set up here’s a Docker file

learn it and I think a lot of developers

have that experience and I learned

through a lot of trial and error

um what do you think in your opinion are

some of the most important things that a

Java developer specifically would need

to know

um let’s take it a bit broader let’s

let’s look at let’s look at in general

as developer or whatever language and

any language yeah

most people create their Docker files

let’s keep it to darker and base it on a

base image but nobody knows what that

bass image does what comes in what it’s

based on uh does it make sense to have

save for Java a maven 3 full jdk 17 in

your image that you’re pushing to

production do you need Maven do you need

to jdk exactly do you need your source

code

um and where is it based on is it a full

Debian operating system or is it a

smaller maybe Alpine based operating

system make what makes sense and I think

people are using Docker uh because it’s

easy but it’s also easy to just use it

it works uh ship it and never look at it

again and I think we should take

responsibility and I’m trying to show

folks like what can go wrong or what are

we actually doing giving an Insight so

they can make their informed decisions

themselves yes I think that is the thing

I’m not suggesting you should take this

or that but just look at it go a little

bit deeper and see what what we are

actually creating yeah I think that that

makes a lot of sense and this is a very

popular devops subject right because now

we have developers that are learning a

little bit more about the operation side

and when you start wrapping these

applications in containers now you have

to be concerned with how everything’s

actually being deployed like you just

said

um what what is the problem with that

what’s the problem with using a full-on

jdk base image

well basically it has everything so do

you need that maybe you just need a

runtime if that if that is what you need

why put more in say I have that Maven

open jdk version and I put my source

code in it and I spin it up using Maven

and that’s how I do it on my local

machine I do it at the same thing in a

darker file and I ship it to to to

production

first of all it’s big because it has a

lot of stuff I don’t need secondly if

people can get in they have all the

tools to actually do harm to you like

they have the jdk so they can recompile

yeah they have your code second they can

change it they can recompile it they

have a build system Maven that was

already there these are all the

ingredients I need if I can get in to

change your code that does something

well maybe a Bitcoin miner or something

that that runs on the side when you

start up your application while your

container is still running and can go in

change all these things recompile your

stuff execute it it’s the container is

still running and um then it does a

different thing and you’re like

choose all five it looks all fine to me

so you’re giving them so much

information that that does that’s not

needed but also from a devops not only a

security perspective from Devil’s

perspective if you want to be scalable

do you want that with a 200 megabyte

image or a gigabyte image

how do you want to be elastically

scalable

um if I need to spin up another

pod that’s easier with a smaller image

so like all these kind of things are are

intertwined with each other yeah so I

think it’s good to actually look at what

are we doing instead of blindly using

them and yes if it works on my machine

is not a thing anymore because Docker

images kubernetes files all these things

are now part of our our repository so we

are responsible for that yes and that

yes or at least at least partially yeah

agreed agreed and there is this constant

Push Pull between Simplicity ease of use

you know pulling a framework just

because it’s easy to learn uh you know

to get ahead but then there is this cost

that you pay sometimes with bloat and

security issues like you said

um yeah this is where devops for

developers is so important we make

different decisions as developers right

based on how things are going to be

deployed yep um it’s not only it works

on my machine here the operations folks

will take care of it no we’re doing all

of it now like as a team it’s the one

team thought

um right so we should take

responsibility as well for everything

and not just make it work and that’s the

mindset it’s not just just using tools

it’s a mindset of actually want to do

that doing that right what are things we

need to think about how can we combine

certain skill sets in a team so our team

is fully operational yeah yeah it’s all

about communication making sure we all

understand what each other is doing now

does this mean that a developer is now

doing an operations job

um maybe partially I would say you need

to know about one to do the other it’s

not it’s not there’s no hard border

anymore and that’s for a good thing

because you need your environment to

make sure that your application is

running correctly right maybe your use

stuff in your environment to to make

your application work so you need to

know what’s in there

um the other way around how to operate

things and how to put things in

production how to maintain them you need

to know what the application is actually

doing so I think

the old-fashioned let’s say the

old-fashioned siled way we had before

that developers were just doing it on

their machine and then throw it over and

operations folks to care if that that

has that had a lot of problems a lot of

uh well scalability was not a thing at

that point it was you couldn’t scale

like deploy three times a day and if we

want to go badder faster and stronger we

need to know about both sides so if if

you have a core operations person they

need to know a bit about development and

the developer needs to know a bit about

the environment about that well like say

how the

how the environment Works what you know

how the vinement is set up because that

can be beneficial or hopefully

beneficial for your application so as

it’s blending in yeah I think that is

that is the key thing it’s blending in

taking down these walls and operating as

as a

well-oiled machine yes

was the first time I needed to set up a

development environment for myself plus

a testing environment plus a staging

environment for a brand new team and I

realized there was a lot I didn’t know

it was kind of overwhelming this was my

introduction to build servers for

example as a developer I just wasn’t

ever exposed to that process that was

another team that was working on that so

moving to a devops team where you have

this better communication with each

other was really powerful you learn a

lot you add a lot to your toolbox yep

it’s pretty pretty important I think I

think it’s key to have a

to go to production in a good fashion

and to make sure that things are your

clients or your customers

are actually having the best uh best

experience of of whatever you create

so yeah

well a lot of your talks and I’ve seen

some of your talks in the past I really

enjoy them you do an awesome

presentation thank you um so Brian

Vermeer check him out he’s done other

talks at other conferences I really

admire him you do talk a lot about

security yes and I know that one thing

as a developer we’re being taught more

and more to pay attention to our

dependencies that we’re pulling in right

make sure that

um you know that they we’re not pulling

in something vulnerable well where we

know there’s this pipeline right you

start with development you might go

through continuous integration you might

prepare a release where do you think

it’s important to look for

vulnerabilities the simple answer is it

all faces

because

um think about it from different fashion

if you use unit you probably have unit

tests hopefully you have unit tests test

your stuff anyway the the the the thing

is um if you want to create something

new you hope a test is breaking or you

need to add a test or you do I need to

do something with it goes hand in hand

right

the same handles with you have to handle

it the same way with pulling in

dependencies like make sure they are not

vulnerable uh but if it’s not vulnerable

at this time it can be vulnerable in the

future because it was it simply wasn’t

found yet right like the same question

is there live on Mars we didn’t found it

yet doesn’t mean that it’s not there

right

um so in the next stage it’s my might

live in your git repository for a while

um you have a CI system that builds it

like why not do it on all stages and

find it as fast as possible so you have

the information and you can act

accordingly sometimes you just

it’s an easy fix sometimes it’s not and

then you can make an informative

decision like do we need to prioritize

this over something else or not and if

you only do it in a pipeline which can

be okay but you might already have been

able to catch it earlier if you did that

in your ID or be able to do it on your

local machine next to running your unit

tests on your local machine

so and after you go to production you

also need to maintain that because if

it’s in production it’s still alive it

lives there

May might be the team might be just

looking at new features and what’s the

next best thing that we’re going that

next new thing that we’re going to build

and integrate in that system but what’s

in production is actually what’s facing

your your customers or what’s facing

your clients or

um and that is actually the vulnerable

part if that’s if there’s a

vulnerability there so we need to

monitor that as well so in all phases of

that and it’s a continual cycle like we

know software is not a project anymore

like it’s a start and an end and then

we’re done oh it like we need to

maintain it so that’s why I would

advocate for the fact like do it in

every stage of that that life cycle

right agreed yeah

um sometimes I hear struggles with

developers

um not specifying actual versions in in

certain you know packages or libraries

that they’re using and I’ve heard the

argument that you know some reason to do

that would be to always keep it updated

always keep it at the latest and I hear

this with images too I always keep it at

the latest and then you know you rebuild

and you can you can deliver the latest

and greatest every single time do you

have any advice for that mentality

um my advice would be don’t do it and

there’s a reason for that because if you

pin the versions like from your your

dependencies please pin them

um also the the your Docker images

please pin them because you have

deterministic builds at that point you

know every time you build it you have

the same result so if something goes

wrong it’s easier to find out what went

wrong because if you do always the

latest and that might be like if I do it

now and I do it two minutes from now

chances are that something changed

because just one Library might be

updated right

um for libraries it can be that some

version do not work with each other well

you get into a dependency

problem basically dependency hell

because some version doesn’t work with

the other one transitive dependencies

that Collide you don’t want that and if

a certain version works fine that’s

finite pin that one and then if you

change something else make sure that you

have a good test Suite make sure that it

works and then you’ll release it again

so if you do if you pick the latest

um

and luckily within the Java ecosystem we

don’t do much of version ranges and I’m

so happy about that yes because I’ve

worked with node applications that oh

yeah it used to work if you just do an

install and then it didn’t because then

we had a different version of a simple

package and done then it break it wasn’t

compatible with some of the other stuff

and then it’s finding out what version

we need to have and so if you pin it you

have deterministic builds and it’s much

easier to

um to think about it to look at it to

determine what is the actual problem and

then update it to the newer versions

I would say yes I I get it where for for

images you say the latest but I would

still say don’t do it I’d love to have

the deterministic builds and I update it

every say every week or every two weeks

depending on how critical the system is

right and that’s up to you that I cannot

look into what the contact text is of if

you’re building an application if how

important that is but if you say it’s a

high value a well-valued application a

lot of users you might want to do that

daily you might want to do that Weekly

but then we’re going to in a whole

nother face as in what’s threat

management and and that kind of stuff so

that makes a lot of sense so basically

whenever you you pin your versions

whenever you want to do updates it needs

to be intentional not not just exactly

it happens randomly if it happens

randomly you don’t actually know you

just you have to only pray that it works

correctly and praying that it works

correctly I don’t think it’s a good

practice for for an engineer right I

think I think we learned this early in

our careers right yeah that

for everyone yeah we all go through that

experience

okay so um a little more specific you

were you have a session on serialization

you said yeah

um well I was intrigued by serialization

because it looked so easy in the in the

Java ecosystem to do that the custom

serialization and it was also

um called by different people as the

gift that keeps on giving and not in a

good way so I was looking into that like

what is the problem with that because a

lot of people know how to use

serialization what serialization is in

general but how it actually works and

what a serialization gadget chain is and

how that is the root of a lot of

security vulnerabilities in Java uh that

explains a lot and if you understand

that why you should or shouldn’t do that

and what you should do that to prevent

it it makes a lot of sense why certain

things happen for instance the whole log

for J thing we were we were dealing with

deep down it’s a serialization problem

because we’re loading up classes that

when we instantiate them they execute

code they execute a side effect which is

in this case executing a command

how is that possible why is that

possible how can we prevent such things

um and that’s partially how the Java

system ecosystem works but also you can

do something about it if you know how

these things work so that’s why I deep

delve into that like how does this

actually work and turns out that I

didn’t know everything I probably still

don’t know everything but I know enough

to explain to people what they should do

and what they should uh why they should

care about that yeah

there’s a theme here isn’t there exactly

there is a theme there great to have

your tools but it’s very important to

understand how it should work tools are

are

tools are a choice uh you can use tools

you don’t necessarily have to I would

say use tools that that fit your your

your your process uh not just use a tool

because your boss says so

but it starts with culture it starts

with a cultural mindset it starts with

um being aware that these things happen

and that we can do something about it

yep well you’re doing a great job here

at devox Morocco informing and sharing

the knowledge that you have I was so

happy to see you here thank you and

thank you so much for this interview I

appreciate it and looking forward to

Future talks from you thank you so much

and uh oppa you enjoyed it cheers