Jonathan Lalou's Blog

Introduction

Julien Legras, expert en sécurité chez SFEIR, livre une présentation captivante à Devoxx France 2023, intitulée « Et si on parlait un peu de sécurité ? ». Dans cette conférence de 14 minutes, Legras démystifie la sécurité des applications pour les développeurs, mettant en avant des mesures pratiques pour protéger les logiciels sans devenir spécialiste en sécurité. S’appuyant sur son travail chez SFEIR, une société de conseil en transformation digitale, il propose une feuille de route pour développer des applications sécurisées dans des environnements rapides.

Points clés

Legras commence par remettre en question une idée répandue chez les développeurs : la sécurité est le travail de quelqu’un d’autre. Il soutient que les développeurs sont la première ligne de défense, car ils écrivent le code ciblé par les attaquants. Chez SFEIR, où les clients vont des startups aux grandes entreprises, Legras a vu comment de petites erreurs de sécurité mènent à des failles majeures.

Il décrit trois pratiques essentielles :

• Validation des entrées : Nettoyer toutes les entrées utilisateur pour prévenir les attaques par injection, comme SQL ou XSS.

• Sécurisation des API : Utiliser l’authentification (par exemple, OAuth) et limiter les taux pour protéger les points d’accès.

• Gestion des dépendances : Mettre à jour régulièrement les bibliothèques et analyser les vulnérabilités avec des outils comme Dependabot.

Legras partage une étude de cas sur une plateforme e-commerce d’un client, où l’implémentation de HTTPS et une gestion sécurisée des sessions ont empêché une fuite de données. Il insiste également sur l’importance des journaux et de la surveillance pour détecter tôt les anomalies. La conférence équilibre conseils techniques et astuces culturelles, comme promouvoir une mentalité « sécurité d’abord » via des formations d’équipe.

Leçons apprises

La présentation de Legras offre des enseignements pratiques :

• Assumer la sécurité : Les développeurs doivent intégrer la sécurité dans leur travail quotidien, sans la déléguer.

• Utiliser les outils intelligemment : Les scanners automatisés et linters détectent les problèmes tôt, mais le jugement humain reste clé.

• Former les équipes : Des ateliers réguliers sur la sécurité renforcent la sensibilisation et réduisent les risques.

Ces idées sont cruciales pour les développeurs travaillant sur des applications publiques ou dans des secteurs réglementés. Le style accessible de Legras rend la sécurité réalisable, pas intimidante.

Conclusion

La conférence de Julien Legras donne aux développeurs les moyens de prendre en charge la sécurité des applications avec des mesures pratiques et actionnables. Son expérience chez SFEIR souligne l’importance de mesures proactives pour protéger les logiciels. Cette présentation est essentielle pour les développeurs cherchant à construire des applications sécurisées et résilientes sans ralentir la livraison.

Introduction

Dans sa présentation à Devoxx France 2023, « Ce que l’open source peut apprendre des startups », Adrien Pessu, évangéliste technique chez MongoDB, explore comment les principes des startups peuvent revitaliser les communautés open source. Cette conférence de 14 minutes s’appuie sur son expérience à l’intersection des startups et des logiciels open source. En appliquant des stratégies entrepreneuriales, soutient-il, les projets open source peuvent devenir plus durables et percutants, offrant des leçons précieuses aux développeurs et mainteneurs.

Points clés

Pessu commence par souligner les défis de l’open source : l’épuisement des mainteneurs, les contributions fragmentées et le manque de financement. Il oppose cela aux startups, qui prospèrent grâce à l’agilité, l’orientation utilisateur et la croissance itérative. Chez MongoDB, où des outils open source comme MongoDB Atlas sont centraux, Pessu a observé comment des pratiques inspirées des startups renforçaient l’engagement communautaire.

Il propose trois stratégies inspirées des startups :

• Conception centrée utilisateur : Impliquer les utilisateurs tôt pour façonner les fonctionnalités, comme les startups valident l’adéquation produit-marché.

• Itération légère : Publier des fonctionnalités minimales viables et itérer selon les retours, évitant le perfectionnisme.

• Communauté comme clients : Traiter les contributeurs comme des clients précieux, avec une documentation claire et un support réactif.

Pessu partage l’exemple des pilotes open source de MongoDB, où un processus de contribution simplifié, inspiré de l’onboarding des startups, a boosté la participation communautaire. Il aborde également le financement, suggérant des modèles comme le développement sponsorisé ou les fondations, similaires aux levées de fonds des startups. La conférence met l’accent sur des objectifs mesurables, comme le suivi de la rétention des contributeurs, pour évaluer la santé du projet.

Leçons apprises

Les idées de Pessu sont actionnables pour les mainteneurs open source :

• Prioriser les utilisateurs : Développer des fonctionnalités répondant à des problèmes réels, validées par les retours communautaires.

• Simplifier les contributions : Des directives claires et des victoires rapides encouragent une participation soutenue.

• Assurer la durabilité : Explorer des modèles de financement pour soutenir les mainteneurs sans compromettre les valeurs open source.

Ces leçons résonnent avec les développeurs impliqués dans l’open source ou cherchant à rendre leurs projets plus inclusifs. La perspective startup de Pessu offre un cadre novateur pour relever des défis de longue date.

Conclusion

La présentation d’Adrien Pessu comble le fossé entre startups et open source, montrant comment des tactiques entrepreneuriales peuvent renforcer les communautés. Son expérience chez MongoDB illustre le pouvoir de l’orientation utilisateur et de l’itération pour pérenniser les projets. Cette conférence est incontournable pour les développeurs et mainteneurs visant à rendre l’open source plus vibrant et résilient.

Orateur : Adrien Pessu

Introduction

In “Les tests, un investissement pour l’avenir,” presented at Devoxx France 2023, Julien Deniau, a developer at Amadeus, champions software testing as a cornerstone of sustainable development. This 14-minute quickie draws from his work on airline reservation systems, where reliability is non-negotiable. Deniau’s passionate case for testing offers developers practical strategies to ensure code quality while accelerating delivery.

Key Insights

Deniau frames testing as an investment, not a cost, emphasizing its role in preventing regressions and enabling fearless refactoring. At Amadeus, where systems handle billions of transactions annually, comprehensive tests are critical. He outlines a testing pyramid:

• Unit Tests: Fast, isolated tests for individual components, forming the pyramid’s base.

• Integration Tests: Validate interactions between modules, such as APIs and databases.

• End-to-End Tests: Simulate user journeys, used sparingly due to complexity.

Deniau shares a case study of refactoring a booking system, where a robust test suite allowed the team to rewrite critical components without introducing bugs. He advocates for Test-Driven Development (TDD) to clarify requirements before coding and recommends tools like JUnit and Cucumber for Java-based projects. The talk also addresses cultural barriers, such as convincing stakeholders to allocate time for testing, achieved by demonstrating reduced maintenance costs.

Lessons Learned

Deniau’s talk provides key takeaways:

• Test Early, Test Often: Writing tests upfront saves time during debugging and refactoring.

• Balance the Pyramid: Prioritize unit tests for speed, but don’t neglect integration tests.

• Sell Testing: Highlight business benefits, like faster delivery and fewer outages, to gain buy-in.

These insights are crucial for teams in high-stakes industries or those struggling with legacy code. Deniau’s enthusiasm makes testing feel like an empowering tool rather than a chore.

Conclusion

Julien Deniau’s quickie reframes testing as a strategic asset for building reliable, maintainable software. His Amadeus experience underscores the long-term value of a disciplined testing approach. This talk is a must-watch for developers seeking to future-proof their codebases.

Introduction

Julien Topçu, a tech lead at LesFurets, delivers a concise yet powerful Devoxx France 2023 quickie titled “L’architecture hexagonale en 15 minutes.” In this 17-minute talk, Topçu introduces hexagonal architecture (also known as ports and adapters) as a solution for building maintainable, testable systems. Drawing from his experience at LesFurets, a French insurance comparison platform, he provides a practical guide for developers navigating complex codebases.

Key Insights

Topçu explains hexagonal architecture as a way to decouple business logic from external systems, like databases or APIs. At LesFurets, where rapid feature delivery is critical, this approach reduced technical debt and improved testing. The architecture organizes code into:

• Core Business Logic: Pure functions or classes that handle the application’s rules.

• Ports: Interfaces defining interactions with the outside world.

• Adapters: Implementations of ports, such as database connectors or HTTP clients.

Topçu shares a refactoring example, where a tightly coupled insurance quote system was restructured. By isolating business rules in a core module, the team simplified unit testing and swapped out a legacy database without changing the core logic. He highlights tools like Java’s interfaces and Spring’s dependency injection to implement ports and adapters efficiently. The talk also addresses trade-offs, such as the initial overhead of defining ports, balanced by long-term flexibility.

Lessons Learned

Topçu’s insights are actionable:

• Decouple Early: Separating business logic prevents future refactoring pain.

• Testability First: Hexagonal architecture enables comprehensive unit tests without mocks.

• Start Small: Apply the pattern incrementally to avoid overwhelming teams.

These lessons resonate with developers maintaining evolving systems or adopting Domain-Driven Design. Topçu’s clear explanations make hexagonal architecture accessible even to newcomers.

Conclusion

Julien Topçu’s quickie offers a masterclass in hexagonal architecture, proving its value in real-world applications. His LesFurets example shows how to build systems that are robust yet adaptable. This talk is essential for developers aiming to create clean, maintainable codebases.

Introduction

In his Devoxx France 2023 quickie, “Et si on faisait du Event Sourcing sans framework ?”, Jonathan Lermitage, a developer at Worldline, challenges the reliance on complex frameworks for event sourcing. This 17-minute talk explores how his team implemented event sourcing from scratch to meet the needs of a payment processing system. Lermitage’s practical approach, grounded in Worldline’s high-stakes environment, offers developers a clear path to adopting event sourcing without overwhelming dependencies.

Key Insights

Lermitage begins by explaining event sourcing, where application state is derived from a sequence of events rather than a static database. At Worldline, which processes millions of transactions daily, event sourcing ensures auditability and resilience. However, frameworks like Axon or EventStore introduced complexity that clashed with the team’s need for simplicity and control.

Instead, Lermitage’s team built a custom solution using:

• PostgreSQL for Event Storage: Storing events as JSON objects in a single table, with indexes for performance.

• Kafka for Event Streaming: Ensuring scalability and real-time processing.

• Java for Business Logic: Simple classes to handle event creation, storage, and replay.

He shares a case study of tracking payment statuses, where events like PaymentInitiated or PaymentConfirmed formed an auditable trail. Lermitage emphasizes minimalism, avoiding over-engineered patterns and focusing on readable code. The talk also covers challenges, such as managing event schema evolution and ensuring idempotency during replays, solved with versioned events and unique identifiers.

Lessons Learned

Lermitage’s experience offers key takeaways:

• Keep It Simple: Avoid frameworks if your use case demands lightweight solutions.

• Prioritize Auditability: Event sourcing shines in systems requiring traceability, like payments.

• Plan for Evolution: Design events with versioning in mind to handle future changes.

These insights are valuable for developers in regulated industries or those wary of framework lock-in. Lermitage’s focus on practicality makes event sourcing approachable for teams of varying expertise.

Conclusion

Jonathan Lermitage’s talk demystifies event sourcing by showing how to implement it without heavy frameworks. His Worldline case study proves that simplicity and control can coexist in complex systems. This quickie is a must-watch for developers seeking flexible, auditable architectures.

Introduction

In “Un monolithe sinon rien,” presented at Devoxx France 2023, Nicolas Demengel, a tech lead at Ornikar, makes a bold case for sticking with a monolithic architecture. In this 14-minute quickie, Demengel challenges the microservices trend, arguing that a well-structured monolith can be a powerful choice for startups like Ornikar, a French online driving school platform. His talk offers a refreshing perspective for developers weighing architectural trade-offs.

Key Insights

Demengel begins by acknowledging the allure of microservices: scalability, independence, and modern appeal. However, he argues that for Ornikar, a monolith provided simplicity and speed during rapid growth. The talk details Ornikar’s architecture, where a single Ruby on Rails application handles everything from user onboarding to payment processing. This centralized approach reduced complexity for a small team, enabling faster feature delivery.

Demengel shares how Ornikar maintains its monolith’s health through rigorous testing and modular design. He highlights practices like domain-driven boundaries within the codebase to prevent spaghetti code. The talk also addresses scaling challenges, such as handling increased traffic during peak enrollment periods, which Ornikar solved with database optimizations rather than a microservices overhaul.

Lessons Learned

Demengel’s talk offers practical takeaways:

• Simplicity First: A monolith can accelerate development for startups with limited resources.

• Discipline Matters: Modular design and testing keep a monolith maintainable.

• Context is Key: Architectural choices should align with team size, expertise, and business goals.

These insights are valuable for startups and small teams evaluating whether to follow industry trends or stick with simpler solutions. Demengel’s pragmatic approach encourages developers to prioritize outcomes over dogma.

Conclusion

Nicolas Demengel’s “Un monolithe sinon rien” is a thought-provoking defense of the monolith in an era dominated by microservices hype. By sharing Ornikar’s success story, Demengel inspires developers to make context-driven architectural decisions. This talk is a must-watch for teams navigating the monolith vs. microservices debate.

Introduction

In her Devoxx France 2023 quickie, “Votre pire cauchemar : être responsable du legacy,” Camille Pillot, a consultant at Takima, tackles the daunting reality of managing legacy code. With humor and pragmatism, Pillot shares strategies for transforming legacy systems from a developer’s nightmare into an opportunity for growth. This 14-minute talk, rooted in her experience at Takima, a consultancy specializing in software modernization, offers actionable advice for developers tasked with maintaining aging codebases.

Key Insights

Pillot opens by defining legacy code as software that’s critical yet outdated, often poorly documented and resistant to change. She draws from her work at Takima, where teams frequently inherit complex systems. The talk outlines a three-step approach to managing legacy:

1. Assessment: Understand the system’s architecture and dependencies, using tools like code audits and dependency graphs.

2. Stabilization: Implement tests and monitoring to prevent regressions, even if the code remains brittle.

3. Modernization: Gradually refactor or rewrite components, prioritizing high-impact areas.

Pillot shares a case study from a Takima project, where a legacy e-commerce platform was stabilized by introducing unit tests, then partially refactored to improve performance. She emphasizes the importance of stakeholder buy-in, as modernization efforts often require time and budget. The talk also addresses the emotional toll of legacy work, encouraging developers to find value in incremental improvements.

Lessons Learned

Pillot’s insights are a lifeline for developers facing legacy challenges:

• Start Small: Small, targeted improvements build momentum and trust.

• Communicate Value: Articulate the business benefits of modernization to secure resources.

• Embrace Patience: Legacy work is a marathon, not a sprint, requiring resilience.

These strategies are particularly relevant for consultancy roles, where developers must balance technical debt with client expectations. Pillot’s empathetic approach makes the talk relatable and inspiring.

Conclusion

Camille Pillot’s talk transforms the fear of legacy code into a call to action. By offering a clear framework and real-world examples, she empowers developers to tackle legacy systems with confidence. This quickie is essential viewing for anyone navigating the complexities of maintaining critical but outdated software.

Introduction

In the Devoxx France 2023 quickie “Tous architectes !”, Simon Maurin, Lead Architect at Leboncoin, delivers a compelling case for democratizing software architecture. Drawing from his decade-long experience at France’s leading classified ads platform, Maurin argues that architecture isn’t the sole domain of designated architects but a shared responsibility across development teams. This 15-minute talk explores how Leboncoin evolved its architectural practices to scale with growth, offering practical insights for developers and tech leads navigating large organizations.

Key Insights

Maurin begins by reflecting on Leboncoin’s early days, where small teams naturally collaborated on architecture through organic discussions. As the company grew to serve 30 million monthly users, this informal approach became unsustainable. The introduction of formal architects risked creating bottlenecks and disconnects. Maurin highlights the pivotal shift to empowering all developers as architects, fostering a culture where everyone contributes to design decisions. This approach aligns with Domain-Driven Design principles, which Maurin champions as a tool for maintaining clarity in complex systems.

A key mechanism introduced at Leboncoin was Architecture Decision Records (ADRs). These lightweight documents capture the rationale behind architectural choices, ensuring transparency and continuity. Maurin shares a case study where ADRs helped Leboncoin transition from a monolith to microservices, reducing coupling and enabling faster iterations. The talk also touches on data engineering challenges, such as scaling to handle 10 million daily events, underscoring the need for shared ownership in high-traffic environments.

Lessons Learned

Maurin’s talk offers several takeaways for developers:

• Shared Responsibility: Architecture thrives when all team members, not just architects, engage in decision-making.

• ADRs as a Tool: Documenting decisions prevents knowledge silos and aids onboarding.

• Cultural Shift: Scaling architecture requires fostering a mindset where developers feel empowered to challenge and contribute.

These lessons are particularly relevant for growing tech organizations facing the tension between agility and structure. Maurin’s emphasis on collaboration over hierarchy resonates with modern software engineering trends.

Conclusion

Simon Maurin’s “Tous architectes !” is a rallying cry for developers to embrace their role in shaping software architecture. By sharing Leboncoin’s journey, Maurin provides a roadmap for balancing freedom and formality in large teams. This talk is a must-watch for developers and architects seeking to foster inclusive, scalable practices in their organizations.

At PyCon US 2023, Guillaume Dequenne from Sonar presented a compelling workshop on modernizing legacy codebases through incremental improvements. Sponsored by Sonar, this session focused on integrating code quality tools into development workflows to enhance maintainability and sustainability, using a Flask application as a practical example. Guillaume’s approach, dubbed “Clean as You Code,” offers a scalable strategy for tackling technical debt without overwhelming developers.

The Legacy Code Conundrum

Legacy codebases often pose significant challenges, accumulating technical debt that hinders development efficiency and developer morale. Guillaume illustrated this with a vivid metaphor: analyzing a legacy project for the first time can feel like drowning in a sea of issues. Traditional approaches to fixing all issues at once are unscalable, risking functional regressions and requiring substantial resources. Instead, Sonar advocates for a pragmatic methodology that focuses on ensuring new code adheres to high-quality standards, gradually reducing technical debt over time.

Clean as You Code Methodology

The “Clean as You Code” approach hinges on two principles: ownership of new code and incremental improvement. Guillaume explained that developers naturally understand and take responsibility for code they write today, making it easier to enforce quality standards. By ensuring that each pull request introduces clean code, teams can progressively refurbish their codebase. Over time, as new code replaces outdated sections, the overall quality improves without requiring a massive upfront investment. This method aligns with continuous integration and delivery (CI/CD) practices, allowing teams to maintain high standards while delivering features systematically.

Leveraging SonarCloud for Quality Assurance

Guillaume demonstrated the practical application of this methodology using SonarCloud, a cloud-based static analysis tool. By integrating SonarCloud into a Flask application’s CI/CD pipeline, developers can automatically analyze pull requests for issues like bugs, security vulnerabilities, and code smells. He showcased how SonarCloud’s quality gates enforce standards on new code, ensuring that only clean contributions are merged. For instance, Guillaume highlighted a detected SQL injection vulnerability due to unsanitized user input, emphasizing the tool’s ability to provide contextual data flow analysis to pinpoint and resolve issues efficiently.

Enhancing Developer Workflow with SonarLint

To catch issues early, Guillaume introduced SonarLint, an IDE extension for PyCharm and VSCode that performs real-time static analysis. This tool allows developers to address issues before committing code, streamlining the review process. He demonstrated how SonarLint highlights issues like unraised exceptions and offers quick fixes, enhancing productivity. Additionally, the connected mode between SonarLint and SonarCloud synchronizes issue statuses, ensuring consistency across development and review stages. This integration empowers developers to maintain high-quality code from the outset, reducing the burden of post-commit fixes.

Sustaining Codebase Health

The workshop underscored the long-term benefits of the “Clean as You Code” approach, illustrated by a real-world project where issue counts decreased over time as new rules were introduced. By focusing on new code and leveraging tools like SonarCloud and SonarLint, teams can achieve sustainable codebases that are maintainable, reliable, and secure. Guillaume’s presentation offered a roadmap for developers to modernize legacy systems incrementally, fostering a culture of continuous improvement.

Links:

• Sonar company website
• SonarCloud website
• SonarLint website

Hashtags: #LegacyCode #CleanCode #StaticAnalysis #SonarCloud #SonarLint #Python #Flask #GuillaumeDequenne #PyConUS2023

Simon Martinelli’s thought-provoking session at Spring I/O 2023 challenges the default adoption of Hibernate in Java applications. With decades of experience, Simon advocates for jOOQ as a performant, SQL-centric alternative for database-centric projects. Using a track-and-field event management system as a case study, he illustrates how jOOQ simplifies data access, avoids common ORM pitfalls, and complements Hibernate when needed. This presentation is a masterclass in rethinking persistence strategies for modern Java development.

Questioning the ORM Paradigm

Simon begins by questioning the reflexive use of Hibernate and JPA in Java projects. While powerful for complex domain models, ORMs introduce overhead—such as dirty checking or persistence by reachability—that may not suit all applications. For CRUD-heavy systems, like his 25-year-old event management application, a simpler approach is often sufficient. By focusing on database tables rather than object graphs, developers can streamline data operations, avoiding the complexity of managing entity state transitions.

jOOQ: A Database-First Approach

jOOQ’s database-first philosophy is central to Simon’s argument. By generating type-safe Java code from database schemas, jOOQ enables developers to write SQL-like queries using a fluent DSL. This approach, as Simon demonstrates, ensures compile-time safety and eliminates runtime errors from mismatched SQL strings. The tool supports a wide range of databases, including legacy systems with stored procedures, making it versatile for both modern and enterprise environments. Integration with Flyway and Testcontainers further simplifies schema migrations and code generation.

Efficient Data Retrieval with Nested Structures

A highlight of Simon’s talk is jOOQ’s ability to handle nested data structures efficiently. Using the event management system’s ranking list—a tree of competitions, categories, athletes, and results—he showcases jOOQ’s MULTISET feature. This leverages JSON functionality in modern databases to fetch hierarchical data in a single SQL statement, avoiding the redundancy of JPA’s join fetches. This capability is particularly valuable for REST APIs and reporting, where nested data is common, eliminating the need for DTO mapping.

Combining jOOQ and Hibernate for Flexibility

Rather than advocating for jOOQ as a complete replacement, Simon proposes a hybrid approach. jOOQ excels in querying, bulk operations, and legacy database integration, while Hibernate shines in entity state management and cascading operations. By combining both in a single application, developers can leverage their respective strengths. Simon warns against using JPA for raw SQL, as it lacks jOOQ’s type safety, reinforcing the value of choosing the right tool for each task.

Practical Insights and Tooling

Simon’s demo, backed by a GitHub repository, illustrates jOOQ’s integration with Maven, Testcontainers, and a new Testcontainers Flyway plugin. He highlights practical considerations, such as whether to version generated code and jOOQ’s licensing model for commercial databases. The talk also addresses limitations, like MULTISET’s incompatibility with MariaDB, offering candid advice for database selection. These insights ground the presentation in real-world applicability, making it accessible to developers of varying experience levels.

A Call to Rethink Persistence

Simon’s presentation is a compelling call to reassess persistence strategies. By showcasing jOOQ’s performance and flexibility, he encourages developers to align their tools with application needs. His track-and-field application, evolved over decades, serves as a testament to the enduring value of SQL-driven development. For Java developers seeking to optimize data access, this talk offers a clear, actionable path forward, blending modern tooling with pragmatic wisdom.

Links:

• Simon Martinelli on LinkedIn
• GitHub repository for jOOQ examples
• JadeOff project website

Hashtags: #SpringIO2023 #jOOQ #Hibernate #Java #SQL #Database #SimonMartinelli #Testcontainers #Flyway