DaShaun

Husband, father, volunteer, athlete, continuous learner. Tweets are mine. Spring Developer Advocate @VMwareTanzu #JUICE #LiftAsWeClimb @Testcontainers Champion

[DaShaun @dashaun]

Each new CVE is the dinner bell for bad actors all over the world. If they don't act on it immediately, they might not get dinner.

[Derek Devicemanager @IT_unhinged]

Security called me at 6:12 AM today.

"Patch every PHP server immediately."

I asked what happened.

"Two critical vulnerabilities. Remote code execution. No authentication required."

Cool.

How many PHP servers do we have?

According to inventory: 12

According to reality:

Nobody knows.

We found one running WordPress.

Three running old internal tools.

One under someone's desk.

Two inside vendor appliances.

A forgotten employee directory from 2016.

And a server named:

PHP-OLD-DO-NOT-TOUCH

Naturally, that one runs payroll exports.

Then we found a PHP 5.6 box.

I asked who owned it.

The documentation said:

BRIAN.

Brian left in 2019.

We called Brian.

He said:

"Oh wow, that's still running?"

Excellent.

By 8 AM, leadership joined the incident call.

CEO:

"Can hackers actually get in?"

Security:

"Potentially yes."

CEO:

"Without a password?"

Security:

"Yes."

CEO:

"Then why do WE need passwords?"

Not the lesson.

Finance asked if we could wait until the weekend to patch because downtime affects revenue.

Security explained that the alternative was letting strangers execute code on our servers.

Finance asked for a cost comparison.

At 9:17, someone suggested temporarily taking the vulnerable websites offline.

Marketing refused.

"Our campaign is live."

So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.

We finally patched everything we could find.

Then our scanner discovered another PHP server.

Hostname:

TEMP-PHP-2014

Uptime:

4,512 days.

Nobody knows what it does.

Nobody owns it.

Nobody can shut it down.

But every time we block network access, the warehouse stops printing shipping labels.

Security has classified it as critical infrastructure.

It is running PHP 5.4.

The vulnerability has existed longer than half our employees.

The emergency patch took four hours.

Finding out what PHP actually runs took eleven.

The internet isn't held together with code.

It's held together with servers everyone is afraid to turn off.

[DaShaun @dashaun]

@therealdanvega @jitterted You didn’t mention the CA certs. I think there were 4.

[DaShaun @dashaun]

@posono_123 Sorry it took so long to respond to this one. In that context, can you give me an example?

[DaShaun @dashaun]

Every agentic app hands the LLM the raw tool response, even when it only needs a fraction. The fix: filter tool output before it hits the model. #SpringAI #AIAgents #Tokens

[DaShaun @dashaun]

If you need help patching ANYTHING today, if you need to vent, or you want to be distracted for a minute, you can reach out to me! My DMs are open!

[DaShaun @dashaun]

@gagu_sh I agree! There are very few things that make me feel better than someone building along with my presentation and showing it to me after the session!

[DaShaun @dashaun]

St Louis JUG celebrating 30-years next May!!!!

Today, “Agentic AI Workflows with #Embabel 1.5 and #Jev”

PS: Dan Idoux showed me his new working Embabel Agent that he made during the presentation!

[DaShaun @dashaun]

@gtrakGT @AlBaker_Dev I can say with confidence, based on my evidence working with customers, that @graalvm usage trending higher. The JVM amazing. There are also lots of use cases where the native image is a better choice.

[DaShaun @dashaun]

The JVM is blowing the doors off Rust on two cores. Taking the lead, not even subtle. Josh Long and Andrew Lombardi on Coffee+Software. Full episode: https://t.co/OJbrEpB9be #Java #Kotlin #Rust

[DaShaun @dashaun]

@gagu_sh Thanks for the feedback!

[DaShaun @dashaun]

@AlBaker_Dev Thank you for sharing! Still looking forward to connecting further!

[DaShaun @dashaun]

@gtrakGT @AlBaker_Dev Watch the entire episode: https://t.co/iX0vOwZke2

[DaShaun @dashaun]

@your_javaguy @starbuxman I think so too!

[DaShaun @dashaun]

When you ask ChatGPT for an image, behind the scenes that entire process runs on Temporal. About a billion images a week. Full episode @starbuxman with Cornelia Davis on Coffee+Software. #Temporal #AI #Workflow https://t.co/7ppityPxLa

[DaShaun @dashaun]

@michelinux @graalvm It does, he gave ranges too. 40:20 (double) vs 45:30 (not double). The container reservation for each pod will probably be the same for both, that's why I think they are "comparable" and even if they aren't the same reservation, its not double.

[DaShaun @dashaun]

Java eats RAM? The GraalVM native image ran the same app at 40-45MB vs Rust's 20-30MB. Comparable. Full episode: https://t.co/OJbrEpB9be #Java #GraalVM

[DaShaun @dashaun]

@PaulReeseHopper @spencerbgibb @sjohnr @xyloman2 @rob_winch @BillyKorando @PaulReeseHopper When are you going to come visit the KCJUG?

[DaShaun @dashaun]

I'm so excited to see Steve Riesenberg at KCJUG tonight! My former teammate on the Spring team, now doing amazing things at Netflix. Steve is also an incredible presenter! Don't meet me there, beat me there!

https://t.co/4h8QVdXuos

[DaShaun @dashaun]

@Madeactual @starbuxman Thanks for the tip!

[DaShaun @dashaun]

jOOQ founder Lukas Eder and @starbuxman on the part nobody notices: you're not really writing SQL, you're building the expression tree that generates it. Every SQL query is dynamic, even when it doesn't look like it. #jOOQ #Java #SQL

[DaShaun @dashaun]

@gagu_sh @starbuxman Well said!

[DaShaun @dashaun]

@billiximarket @starbuxman Scope matters! You don't need to give all of the agents all of the MCP tools! Spring AI gives you lots of help around tool permissions, tool selection, and you get security all the way down!

[DaShaun @dashaun]

Agents do manual find-and-replace. IntelliJ's MCP server gives them real tools: 63 to 97 and growing. @starbuxman and Anton Arhipov on Coffee+Software. #MCP #IntelliJ #AI

[DaShaun @dashaun]

@robertsirc Now that I think about it, the timing seems a little suspect... Before the Surface Laptop Ultra announcement, the Nvidia DGX Spark was $4995. After the announcement, same Nvidia DGX Spark is $6995.

[DaShaun @dashaun]

@robertsirc Ive got Nvidia DGX Spark, but right now 128gb of unified memory is cheaper on the Surface Laptop Ultra.

[DaShaun @dashaun]

@robertsirc Would you ever consider one of the new Surface laptops? 128gb of unified memory? For local inference and more?

[DaShaun @dashaun]

I’ve literally deployed thousands of Wordpress websites, but around 2016/2017 I started exporting them as static sites whenever/wherever possible because keeping up with the updates was so time consuming. #HugOps to all those patching Php today!

[Jeff Geerling @geerlingguy]

This might be the most watched GitHub Actions build in the history of the platform: https://t.co/JXEdjPGHxY