Find partners
Foojay.io | Friends of OpenJDK and Java Programming

Foojay.io | Friends of OpenJDK and Java Programming

Hosted by Foojay.io | Java and Programming Community

Episodes

101

Latest episode

Oct 2026

Language

EN

About the show

Foojay.io is your go-to programming community podcast, connecting developers with the latest in Java, OpenJDK, JVM, and open source tools. We bring together Java professionals worldwide to share insights, tools, and news in the vibrant Java programming ecosystem.

Listen to episodes

60 recent
October 17, 2026Episode 10344 min

Killing Reflection at Build Time: Avro, Codename One and Java Codegen (#103)

Runtime reflection is a quiet tax on the JVM. It is flexible, it is everywhere, and it is easy to stop noticing it until you go looking for where your CPU is actually going. Two teams did exactly that, in completely different corners of the ecosystem, and arrived at the same answer: move the work to build time. In this episode, Dmitry Moskalyuk explains the model layer behind his Foojay article on reflection-free serialization, where JSON, XML, YAML and TOML all end up as Avro. Shai Almog explains the build-time codegen pipeline of Codename One, which aims for no reflection, no service loader and no Class.forName. We compare the two and ask whether generated code is really something to avoid. Topics include: Where Jackson's reflection cost really lives, and what Blackbird does about it Jackson versus kotlinx.serialization, and why a missing feature sent the team back to Jackson Why a UI framework bans reflection, and how that differs from the backend Is generated code bad? Lombok, Manifold and jOOQ What Records and Project Leyden change for reflection Build time cost versus runtime cost, and a single source of truth for your data model Should you still use reflection in a new project? Guests: Dmitry Moskalyuk, Senior Backend Engineer Dmitry on LinkedIn Shai Almog, Author, DevRel and open source developer working on Codename One Shai on LinkedIn Links: Dmitry's article on Foojay Shai's article on Foojay Jackson Blackbird Apache Avro Project Leyden Full show notes with every link Timestamps: 00:00 Introduction of topic and guests 01:50 About the new Foojay, contributing with GitHub pull requests 03:17 What is Apache Avro 04:26 What is Codename One 06:31 What is Blackbird in Jackson and compared to kotlinx mechanisms for different content parsers 10:01 Why Codename One focuses on "no reflection, no service loader, no Class.forName" 14:23 Is automatically generated code bad (Lombok, Manifold, JOOQ)? 17:47 Java evolutions that bring improvements into the system (Records, Project Leyden) 21:31 Is reflection changing through Java versions? 24:29 Build time cost versus runtime, Project Leyden 28:41 Use of reflection in UI versus backend 32:16 Benefit of your data model in a (Java) object, having one source of truth, good debugging 35:35 Should you worry about serialization in a small project 37:38 Serialization and security 38:57 Should I still use reflection/serialization in a new project? 43:22 Conclusion

October 3, 2026Episode 10238 min

We Left WordPress: CMS vs Static Sites, Hugo vs Jekyll vs Roq (#102)

Foojay.io quietly moved off WordPress and onto Hugo. No more CMS login, no database, no admin panel — just Markdown and AsciiDoc files, built and deployed straight from GitHub. So is a traditional CMS still the right way to run a content site in 2026, or has static tooling caught up? In this episode, Andy Damevin and Holly Cummins from the Red Hat Quarkus team join to talk through it. Andy created code.quarkus.io and Roq, Quarkus's own Java-based static site framework; Holly led the migration of quarkus.io itself from Jekyll to Roq. We go through the real security numbers behind WordPress's plugin ecosystem, and put very different static site generators head to head: Hugo and Jekyll, the veterans, versus Roq, the newcomer. Topics include: Why WordPress core is usually fine, and the plugins are where the trouble is — over 10,000 plugin vulnerabilities found since 2025 What "recovery" means for a static site versus a CMS after a hack or defacement Jekyll, Hugo, Roq and JBake compared, and why staying in Java matters (or doesn't) How to extend Roq as a Java developer, from a small PR to writing your own plugin What an actual WordPress-to-Roq migration looks like in practice Where a CMS still earns its keep despite all of this Guests: Andy Damevin on LinkedIn - Principal Software Engineer at Red Hat, Quarkus core team, creator of code.quarkus.io and Roq Holly Cummins on LinkedIn - Senior Principal Software Engineer, Red Hat Quarkus team, led the quarkus.io migration from Jekyll to Roq Links: Migrate from WordPress to Roq Roq Hugo Full show notes Timestamps: 00:00 Introduction of topic and guests 03:29 Why WordPress is not the best choice for most sites 04:36 Difference between CMS-driven websites and static websites 07:02 Jekyll versus Roq and other systems 11:04 How to extend Roq 12:59 Moving from WordPress to Roq 14:43 Pulling data with JBang or Roq from external sources into your publication process 16:09 Why should I use Roq instead of Jekyll or Hugo? 24:33 Static websites can be created with a small team and are much cheaper (or even free) to host 26:52 How many WordPress websites have a backup to recover after getting hacked? And the advantage of having your content sources on Git. 33:04 Is there still a use case for WordPress-like systems? 37:09 Conclusions

September 12, 2026Episode 10157 min

Java 27 in Practice: Smaller Heaps, Smarter Defaults, and Valhalla on the Horizon (#101)

Episode 101 of the Foojay Podcast. JDK 27 arrives on 15 September 2026 without finalising a single new piece of language syntax. It is still worth the upgrade: object headers shrink from 64 bits to 32, which the JEP measures at 22% less heap and 8% less CPU on SPECjbb2015, and G1 becomes the default garbage collector on every machine. Both changes live inside the JVM, so an application you compiled years ago picks them up with no code change at all. Simon Ritter , Deputy CTO at Azul and Java Champion, takes us through all nine JEPs in the release, explains why a non-LTS version is still worth testing against, and makes the point that "long-term support" describes the binary you download rather than anything in OpenJDK itself. We also cover the move from quarterly to monthly security updates that started in August 2026, and then look ahead to March 2027, when Project Valhalla reaches its first preview after roughly twelve years of work. Topics include: Compact object headers by default, and what 22% less heap actually buys you in production Post-quantum key exchange in TLS 1.3, and the harvest-now-decrypt-later attack it defends against JFR redaction: keeping access tokens and passwords out of flight recordings you share Structured concurrency in its seventh preview, and why an evolving API stays in preview The Vector API's twelfth incubation, and what it is waiting for Value Objects in Java 28: a new value keyword, 179,000 lines, 1,800 files, and why it will not be final in JDK 29 Whether a Simple JSON API in the JDK will survive its previews, or go the way of string templates Guest: Simon Ritter Deputy CTO at Azul, Java Champion Simon on LinkedIn Simon on Foojay Links: Full show notes, with every JEP linked JDK 27 What CSPUs Mean for Your Release Pipeline What to Know About Garbage Collection as a Java Developer! Project Valhalla Timestamps: 00:00 Introduction of the topic and guest 01:27 How long Simon has been doing Java 01:54 Why release 27 is important, even when not being a Long Term Support release 04:55 Quarterly and monthly security updates between new version releases 08:07 Which JVM versions are most used in companies 09:23 JEP 534: Compact Object Headers by Default 14:51 JEP 523: Make G1 the Default Garbage Collector in All Environments 18:59 JEP 527: Post-Quantum Hybrid Key Exchange for TLS 1.3 22:55 JEP 538: PEM Encodings of Cryptographic Objects (Third Preview) 25:35 JEP 536: JFR In-Process Data Redaction 28:02 JEP 531: Lazy Constants (Third Preview) 29:55 JEP 532: Primitive Types in Patterns, instanceof, and switch (Fifth Preview) 33:13 JEP 533: Structured Concurrency (Seventh Preview) 38:21 JEP 537: Vector API (Twelfth Incubator) 40:28 Looking forward to Java 28 and Project Valhalla 42:31 JEP 401: Value Objects and JEP 539: Strict Field Initialization 47:36 Can we expect this to be finalized in Java 29? 48:26 LTS releases every 1, 2, or 3 years? 49:55 JEP 541: Deprecate macOS/x64 51:53 JEP 540: Simple JSON API (Incubator) 55:30 Conclusion, what to remember from this release

July 11, 2026Episode 10050 min

Foojay Podcast #100: Java Podcasters on Why They Started, What Broke, and What They Learned (#100)

Episode 100 of the Foojay Podcast. No grand plan. It just happened. To mark the milestone, Frank turned the microphone around and invited other podcasters: Adam Bien (airhacks.fm), Jennifer Reif (Breaktime Tech Talks), Kadi McKean and Steve Pool (10xInsights), and Oumaima Zerouali (JCast). Same questions for each: why did you start, what broke, and what did you learn? Along the way: why a no-prep podcast works when you have 20 years of experience, the difference between writing a blog and recording a podcast, burnout from editing, AI tools that changed someone's voice into Batman, and why a Dutch Java podcast about the human side of development got its first episode from a calendar invite that became a recording. Guests: Adam Bien — airhacks.fm Jennifer Reif — Breaktime Tech Talks Kadi McKean and Steve Pool — 10xInsights Oumaima Zerouali — JCast Links: airhacks.fm on Spotify Breaktime Tech Talks on Spotify 10xInsights | 10xInsights on Spotify JCast Foojay Podcast #67: Writing a book. Does it make you rich and famous? Foojay Podcast #71: 30 Years of Java with James Gosling Foojay Podcast #99: Testing the Untestable: LLM Security for Java Developers with Tiberius Frank on JCast Other podcasts mentioned: Spring Documentary Content: 00:00 Introduction 01:00 Adam Bien (airhacks.fm) 12:52 Jennifer Reif (Breaktime Tech Talks) 26:25 Kadi McKean and Steve Pool (10xInsights) 38:43 Quote by James Gosling 39:46 Oumaima Zerouali (JCast) 48:01 Conclusion Hosted by Frank Delporte | foojay.io

June 20, 2026Episode 9941 min

Testing the Untestable: LLM Security for Java Developers with Tiberius (#99)

Your Java AI application is live in production. But have you tested whether it can be jailbroken, manipulated into revealing its system prompt, or tricked into printing content it should never output? In this episode, Iryna Dohndorf , Software Engineer at Karakun Group and creator of Tiberius, explains how to bring security testing to LLM-powered Java applications. We cover why traditional unit tests break down with non-deterministic systems, how the Scan-Fixture-Validate workflow works, what buff mutation testing is, and why even well-trained models can be cracked with something as simple as the grandmother attack. Topics include: Why LLM non-determinism breaks the classic input/output test model The Scan-Fixture-Validate principle and sharing test artifacts across teams Prompt injection, jailbreaks, and emotional manipulation attacks Buff mutation: testing linguistic surface coverage Probabilistic security contracts and multi-trial scans Fingerprinting and why your model choice should not be detectable LLM as a judge: using a second model as a guardrail Getting started with Tiberius in Spring Boot and LangChain4j Guest Iryna Dohndorf - Software Engineer at Karakun Group LinkedIn Links Article on Foojay Tiberius on GitHub Security Testing Guide Timestamps 00:00 Introduction of topic and guest 01:05 The problem Tiberius wants to solve 06:39 How "traditional" unit tests don't work for LLM integrations 10:23 Scan-Fixture-Validate principle and sharing artifacts 15:15 Using different skills, for example, the grandmother skill 17:33 Testing for required versus forbidden bias 19:35 The probes across nine attack categories used by Tiberius 20:44 Buff mutation testing 26:55 Using Tiberius in your pipelines and when to fail 29:35 Using multi-trial scans 31:14 Fingerprinting: which model you use, should not be detectable 32:55 Combining multiple models, model as a judge 34:41 Sharing JSON models to improve tests 36:05 How to get started with Tiberius in Spring and with LangChain4j 36:41 Quarkus not supported yet, plans for the future 39:07 Conclusions and a call out to everyone to become a Foojay author

June 13, 2026Episode 9844 min

The End of JNI Pain: How WebAssembly Is Quietly Replacing Native Libraries in Java (#98)

WebAssembly is already running inside Java applications, but most developers just don't know it yet. In this episode, Andrea Peruffo walks us through how WebAssembly is becoming the modern, safe alternative to JNI. Run Rust, C, and other native libraries directly on the JVM, without the crash risks, per-platform packaging headaches, or the observability blackhole that JNI creates. From JRuby's Prism parser to SQLite and full Postgres running as pure Java bytecode, the use cases are real. And the project making it possible, Endive, under the Bytecode Alliance, is open and ready to explore. Guest Andrea Peruffo GitHub: https://github.com/andreaTP/ LinkedIn: https://www.linkedin.com/in/andrea-peruffo-32269178/ Bluesky: https://bsky.app/profile/andreatp.bsky.social Links A New Generation of Java Libraries: Wasm Becomes the Implementation Detail Chicory on GitHub Endive on GitHub Endive documentation Bytecode Alliance OpenJDK Project Detroit Timestamps 00:00 Introduction of topic and guests 00:56 What is WebAssembly? 03:35 Comparing the performance with JavaScript 05:45 JRuby already uses WebAssembly 09:04 JNI versus FFM API versus WebAssembly 13:58 Other Java-related tools that use WebAssembly 17:56 History of the Chicory and Endive projects to bring WebAssembly to Java 21:03 Projects of the Bytecode Alliance 22:02 The Endive project as the glue to bring WebAssembly tools to Java 23:30 Integration of the Redline compiler 28:59 Why this is the perfect solution to modernize existing Java applications 31:18 Is this approach performant? 32:24 What future changes in Java and the JVM will make this even better 35:04 How Endive can be used in AI development 37:28 What to expect in Endive 41:29 Conclusions

May 30, 2026Episode 9749 min

From Scripting Language to AI Powerhouse: How BoxLang Is Redefining JVM Development (#97)

BoxLang is a modern dynamic JVM language built for rapid application development. It's 100% Java-interoperable, compiles to JVM bytecode, and deployable anywhere from OS to AWS Lambda to Spring Boot. In this episode, we sit down with Luis Majano (CEO of Ortus Solutions and creator of BoxLang) and Cristobal Escobar (BoxLang community manager) to dig into the wave of innovation that has hit the platform over the past few months. We cover the BoxLang AI v3 release, a major overhaul that ships multi-agent orchestration with parent-child hierarchies, an AI Skills system based on Anthropic's open standard, MCP server integration (both consuming and serving), a composable middleware layer with six built-in classes including a FlightRecorder for deterministic CI testing, and a unified API spanning 17 AI providers. Luis and Cristobal walk us through the highlights of a 7-part BoxLang AI deep dive series, covering tools, memory systems & RAG, streaming, middleware, and MCP. We also touch on the BoxLang Spring Boot Starter, BoxLings (an interactive TDD/BDD learning platform), and TestBox 7's real-time streaming test runner. Whether you're a Java developer curious about dynamic JVM languages, an AI engineer looking for a productive alternative to Python-based agent frameworks, or just want to see what the JVM ecosystem can do in 2026, this episode is for you. Guests Luis Majano Foojay author page LinkedIn Cristobal Escobar Foojay author page LinkedIn Links On the BoxLang website : BoxLang docs BoxLang AI docs BoxLang Academy BoxLang for desktop applications BoxLang Spring Boot Starter BoxLings Announcing MatchBox Open Beta: BoxLang, Now Running in New Places Try BoxLang On Foojay: Overview of all recent BoxLang AI articles: Complete Guide to Building AI Agents BoxLang AI v3 Has Landed BoxLang AI Deep Dive series, Parts 1–7 How to Develop AI Agents Using BoxLang AI: A Practical Guide Introducing the BoxLang Spring Boot Starter Introducing BoxLings! Introducing skills.boxlang.io — The Open Agent Skills Ecosystem for BoxLang & the Ortus World Content 00:00 Introduction of topic and guests 01:17 What is BoxLang and how to use it 05:25 Multi-runtime (WASM) with MatchBox, based on Rust 07:00 Combining BoxLang with Spring Boot 10:40 The abstraction approach in BoxLang AI, compared with LangChain4j and others 14:18 Markdown skill files similar to Claude are also used in BoxLang AI 15:21 About the 7-part Foojay BoxLang Deep Dive posts series, agents, event-driven,... 19:28 BoxLang can be used for MCP server and client 23:01 Premium features in BoxLang and building a company on an open-source project 27:52 BoxLings, an interactive learning tool for BoxLang that teaches TDD and BDD 30:25 TestBox 7, real-time streaming test execution and a browser-based IDE 32:58 How to get started with BoxLang? 34:14 How the evolutions in the JVM and Java language influence BoxLang development 39:33 Which article to read first on Foojay about BoxLang? 43:27 More learning resources and ideas for the future and desktop development 48:05 Conclusions

May 23, 2026Episode 9636 min

Run 35 AWS Services Locally FREE: Floci, Quarkus and GraalVM-Powered, LocalStack Alternative (#96)

What if you could run 35 AWS services locally in under 25 milliseconds, using just 13 megabytes of memory, with a single Docker command and no cloud bill? That's exactly what Floci does. In this episode, Frank Delporte talks with Hector Ventura, the creator of Floci, a free and open-source cloud emulator built with Quarkus and GraalVM native compilation. Hector walks us through why he built it when LocalStack dropped its open-source community edition, how AI tooling helped him accelerate development of new service integrations, the challenges of keeping GraalVM happy with third-party libraries, and the road ahead for Azure and GCP support. If you're a developer who wants fast local testing, a DevOps engineer writing Terraform, or a student learning cloud without the cost, Floci is worth a look! Guest: Hector Ventura Foojay Author page LinkedIn Links On Foojay: Introducing Floci: A High-Performance, GraalVM-Powered AWS Emulator Floci project site Floci on GitHub Migrate from LocalStack Content 00:00 Introduction of topic and guest 01:48 What is Floci? 02:15 How Floci compares to LocalStack 03:01 Why Hector started Floci 04:02 Floci emulates the cloud APIs 05:02 How additional services got integrated with AI assistance 06:31 Meaning of the name Floci 07:07 Why Quarkus and GraalVM as the starting point for Floci 09:35 How Floci starts up very fast and only uses a low amount of memory 12:18 GraalVM can be hard with some libraries or frameworks 14:02 What is needed to use Floci 14:56 The challenges to support AWS, Azure, GCP and finding contributors 20:24 Funding Floci 21:04 How data is persisted in Floci 22:37 Verifying Floci versus the "real" APIs with compatibility tests 23:56 In the future: UI for Floci 25:04 Biggest challenges while creating Floci 25:32 Functionality compared between Floci and LocalStack and migrating 28:15 Feedback from the Floci users 28:58 Long-term plans for Floci 29:59 Biggest surprises during the development of Floci 31:00 Best use-cases for Floci 32:12 In the next releases... 33:31 How to get started with Floci 35:00 Conclusion

May 9, 2026Episode 951 hr 5 min

Is Your Java App Actually Secure, Or Does It Just Look That Way? (#95)

Is your Java application actually secure, or does it just look that way? In this episode of the Foojay Podcast, Frank is joined by Steve Poole and David Welch, both from HeroDevs , to dig deep into the state of Java security in 2025 and beyond. Steve introduces the concept of zombie dependencies: end-of-life libraries that appear safely dormant but are quietly accumulating vulnerabilities waiting to bite you. David, a co-chair of the CVE Automation Working Group, explains what a CVE actually is, how the identification and disclosure process works in practice, and why AI tools like Mythos are dramatically accelerating the pace at which new vulnerabilities are found — on both sides of the wall. Together they cover how CVEs in the Java runtime are handled through coordinated disclosure, why Maven Central is safer than most ecosystems but not a silver bullet, and what insurance companies are starting to demand from organizations that haven't cleaned up their dependency trees. They also discuss practical steps any Java developer can take today, from generating an SBOM and running Snyk or Trivy , to adopting OpenRewrite and Renovate in your pipelines, and why vibe coding with AI tools may be quietly making your security posture worse if you are not reviewing the dependency choices being made for you. A candid, occasionally alarming, and ultimately optimistic conversation about a problem the Java community is well-positioned to lead on. Steve Poole LinkedIn Foojay Author profile Crossing the River Styx: Spring Boot 3.5 and the Zombie Dependency Problem Why Java Developers Over-Trust AI Suggestions David Welch LinkedIn Content 00:00 Introduction of topics and guests 04:00 What are Zombie dependencies? 05:36 What are CVEs? 11:39 How Mythos and other AI tools are influencing the CVE reporting process 16:53 How CVEs in the Java runtime are handled 21:30 How the industry is looking at the increased security threats 30:17 Developers need to make better decisions "the first time" and use the right tools 31:42 Keep your OS, JVM, and dependencies up-to-date! Insurance companies will force you... 44:48 How "safe" is Maven Central compared to other repository systems 50:48 What you can do as a Java developer to make your apps safer 59:01 Should we be scared for the following years and be careful with vibe coding? 01:04:27 Conclusion

May 2, 2026Episode 9459 min

More Than a Blog: How Foojay Connects, Sustains, and Evolves the Java Community (#94)

Foojay.io, the website for the Friends of OpenJDK, is turning six years old. To celebrate, Frank Delporte headed to JCON in Cologne, Germany, and sat down with twelve members of the Java community to talk about what Foojay means to them, what they learn from each other, and how the community is evolving. Foojay is more than a blog. It is a Mastodon server, a Slack community, the Disco API, a book on sustainability, a podcast, and now an education catalog. Six years in, it is still growing, still community-driven, and still very much a place where anyone who works with Java is welcome. 00:00 Introduction 02:16 Sharat Chandar https://www.linkedin.com/in/sharatchander/ Java community and history What you can learn from conferences and articles 05:37 Markus Westergren https://www.linkedin.com/in/markuswestergren/ https://foojay.io/sustainability-for-java-developers/ https://foojay.io/today/join-slack-com-t-foojay-signup/ Book "Sustainability for Java Developers" How to "sustain yourself" in this strange-AI-changing-world 09:46 Iryna Dohndorf https://www.linkedin.com/in/iryna-dohndorf/ https://foojay.io/today/author/iryna-dohndorf/ Mentoring about sustainability as a developer + groundness + robustness skills High performance without crushing your soul 13:59 René Schwietzke https://www.linkedin.com/in/reneschwietzke/ https://foojay.io/today/the-curious-case-of-different-runtimes-with-different-training-data-jit/ Diving deep into the runtime, JITWatch About the broad mix of topics handled on Foojay 18:28 Gerrit Grunwald https://www.linkedin.com/in/gerritgrunwald/ https://foojay.io/today/author/gerrit-grunwald/ https://foojay.io/today/disco-api-helping-you-to-find-any-openjdk-distribution/ https://sdkman.io/ The Disco API, the source with all the available OpenJDK distributions, is used by SDKMAN, Gradle, and many other tools About the many distributions that are available, even ones that are mainly (and only) used in Asia 27:45 Catherine Edelveis https://foojay.io/today/author/catherine-edelveis/ https://www.youtube.com/watch?v=Ytdo8OGEYFI https://foojay.io/today/which-java-runtime-should-you-use-in-production-comparing-openjdk-distributions/ Reducing Docker sizes improves security and performance Many distributors provide builds of OpenJDK 31:16 Jago de Vreede https://foojay.io/today/author/jago-de-vreede/ About the Java community and the place of Foojay in it. What is good, what are we missing? SDKMAN, creating an UI for it, and using the many OpenJDK distributions 35:05 Annelore Egger https://www.linkedin.com/in/anneloredev/ https://foojay.io/?s=egger Java community, conference volunteering, mentoring How to become a conference speaker Learn by teaching 38:03 Buhake Sindi https://www.linkedin.com/in/buhake-sindi/ https://foojay.io/today/author/buhake-sindi/ https://github.com/langchain4j/langchain4j-cdi Jakarta EE, LangChain4J CDI, Agent to Agent Impact of AI on developer life and sustainability 44:03 François Martin https://www.linkedin.com/in/fran%C3%A7oismartin/ https://foojay.io/today/author/francois-martin/ https://foojay.io/today/eliminating-flaky-tests-to-end-world-hunger/ https://foojay.io/today/five-ways-to-use-gradle-enterprise-to-identify-and-manage-flaky-tests/ Learn from mentoring, for example, how to earn from opensource Foojay author, just published an article about Flaky tests 48:18 Dominika Tasarz-Sochacka https://www.linkedin.com/in/dominikatasarz/ https://foojay.io/today/author/dominika-tasarz/ https://foojay.io/today/join-slack-com-t-foojay-signup/ https://foojay.io/today/how-to-submit-your-next-article-on-foojay-io/ The future of Foojay, how can we get the community even more involved What you can learn from the community 51:18 Geertjan Wielenga https://www.linkedin.com/in/geertjanwielenga/ https://education.foojay.social/ Java communities are everywhere How Foojay started and grew How can contributing to the community influence your career 58:15 Conclusion

Is this your show?

Claim this listing to keep it up to date, reach guests who want to pitch you, and manage bookings with Guestify.

Claim this listing

More Technology podcasts