[2022 javaone] sequenced collections

Speaker: Stuart Marks

For more see the table of contents

General

  • New JEP; candidate state
  • JEP-431
  • Targeting Java 20

Encounter order

  • HashSet does not have. Order depends on hashcode
  • Encounter order is insertion order ArrayList, ArrayDeque, LinkedHashSet
  • Encounter order is sort order – TreeSet

First and last elements

  • get(0), getFirst(), first()
  • list.get(list.size()-1), getLast(), last()

Iterating and streaming, forward and reverse

  • Iterating – forEach loop – code same for all types to iterate forward
  • Iterable tied to forward iteration
  • Reverse varies – listIterator(), descendingIterator(), Collections.reverse(), descendingSet()
  • Streams use forward iteration as well
  • Streaming in reverse order needs spliterator as adapter to order

Sequenced Collection

  • Proposed
  • SequencedCollection – new subinterface of Collection.
  • Includes reversed(), addFirst(), addLast(), getFirst(), getLast(), removeFirst(), removeLast()
  • Also SequencedSet, SequencedCollections and SequencedSet
  • Includes default methods so doesn’t break existing code
  • New methods for sequenced map views

Covariant overrides of reversed()

  • Reverses
  • View of reversed list, but same list
  • Updating reversed view/original updates the other
  • Returns same interface you pass in

LinkedHashMap

  • Will be able to get reversed views, remove entry from end, etc
  • sequencedKeySet(), sequencedValues()
  • putFirst(), putLast() – unconditionally put mapping at end regardless of whether addition or replacement

My take

The talk started 15 minutes late due to AV issues. And people waited. That says a lot about people looking forward to this talk! The content was quick but understandable. I like that there was a lot of code shown and run in an IDE without spending time typing. Also, NetBeans which doesn’t show up in as many demos. Despite the late start, it didn’t feel rushed. Ended a few minutes late, but not as late as it started so seems like a win!

[2022 javaone] halloween tv – or why it might really be watching you back

Speaker: Steve Poole

For more see the table of contents

  • Doing Java 27 years
  • True story. Happened to multiple people
  • Company in the middle of nowhere
  • Smart tv with an ethernet port
  • Discover new wifi SSID
  • Look everywhere for the router, use scanners and eventually learn it is the TV
  • Asked supplier for instructions. Suppliers didn’t know had wifi either.
  • Asked manufacturers how to configure wikif. Manfufacturer says no wifi in tv
  • Take apart TV and discover ”system on a chip” with the wifi (had everything a computer needs like a raspberry pi)
  • However, wasn’t the system on a chip (SOC) that the manufacturer shipped. Manufacturer may not know because SOC has extra capabilities they turn off. In this case, manufacturer says isn’t theirs
  • Problem: open wiki, unsecured gateway
  • This SOC phones home. Every time turn on TV, get new wifi and sends geolocation info to an IP.
  • Anyone could ”drive by” and access the network. Can compromise other things on intranet

Implications

  • Lots of thigs plugged into typical network – ex: printer/scanner. Could send your data
  • We all know not to plug USB into computer. However, tiny charger can be compromised and send data
  • A lot are espionage tools. More prevalent now.
  • Software applications can be compromised too.
  • Poor supply chain management
  • If buy charging cable (vs data cable), know what it can do. Can’t tell by looking at it.

log4shell

  • Worst vulnerability ever
  • 33% log4j downloads from Maven Central
  • Look at scanning tools and see if can find all instances
  • 742% increase in vulnerabilities since last JavaOne. Actively trying to create log4j situation in open source

My take

Steve is a great speaker so I’m glad I got to see this. It was poorly attended. Possibly becuse of the location (on the exhibit floor) or possibly becuase people though the stage was all vendors. Granted this is a vendor talk too. But it took more than half of the talk to even allude to something that relates to Sonatype and that’s if you know what they do. Only the last two minutes was a direct tie (and even then didn’t mention their products by name)

[2022 javaone] log4shell where were your bug detection tools

Speaker: Munawar Hafitz

For more see the table of contents

  • we remember log4shell
  • Path analysis
  • Deep calls
  • polymorphism
  • Didn’t blog on this but Open Refactory presented about Log4j. (felt very commercially). Presented Apache Commons vulnerability as ”next Log4jShell” (it doesn’t look anywhere near as bad. per this article, it afects a specific API)

My take

This was mostly a commercial for OpenRefactory. I didn’t blog about the commercially parts