The Curious Engineer

All blogs / Security

Bozho's tech blog

techblog.bozho.net

Tips and thoughts on developing software, by Bozhidar Bozhanov

SecurityJava / JVMSociety / politics / economy

’10’15’20’25
Posts
384 from 8 Jul 2008 to 16 Aug 2026
Posting
now and then (1 in the last year)
Kind
personal blog
Feed
https://techblog.bozho.net/feed/

2026 1

  1. Age Verification Is A Bad Way To Solve The Problem of Children on Social Networks. What’s The Alternative?

2025 3

  1. Position Regarding the “Chat Control” EU Regulation Proposal
  2. Assessment of DOGE and Musk’s Actions for Government Efficiency
  3. Wiretap Detector App For Catching IMSI Catchers

2024 5

  1. Is Ransomware Protection Working?
  2. The xz Backdoor Should Not Happen Again
  3. Why Facebook’s Lack of Customer Support Is a Problem
  4. Another Attack Vector For SMS Interception
  5. eIDAS 2.0, QWACs And The Security Of The Web

2023 7

  1. MERDA – A Framework For Countering Disinformation
  2. Anticorruption Principles For Public Sector Information Systems
  3. Methodology for Return on Security Investment
  4. Why I’m Not So Alarmed About AI And Jobs
  5. Nothing Is Secure [slides]
  6. Internally And Externally Facing Honeypots
  7. A Security Issue in Android That Remains Unfixed – Pull-down Menu On Lock Screen

2022 4

  1. The Lack Of Native MFA For Active Directory Is A Big Sin For Microsoft
  2. Open APIs – Public Infrastructure in the Digital Age
  3. On Disinformation and Large Online Platforms
  4. Don’t Reinvent Date Formats

2021 15

  1. I Have Been Appointed As E-Governance Minister of Bulgaria
  2. Simple Things That Are Actually Hard: User Authentication
  3. Integrity Guarantees of Blockchains In Case of Single Owner Or Colluding Owners
  4. Hypotheses About What Happened to Facebook
  5. Digital Transformation and Technological Utopianism
  6. Obtaining TLS Client Certificates In Spring Integration
  7. Every Serialization Framework Should Have Its Own Transient Annotation
  8. A Developer Running For Parliament
  9. The Syslog Hell
  10. Developers Are Obsessed With Their Text Editors
  11. List of Open Source Security Tools
  12. Always Name Your Thread Pools
  13. Connecting to Kibana Within an AWS VPC
  14. Elasticsearch – Scalability and Multitenancy [slides]
  15. Content-Security-Policy Nonce with Spring Security

2020 26

  1. Releasing Often Helps With Analyzing Performance Issues
  2. Syntactic Sugar Is Not Always Good
  3. Creating a CentOS Startup Screen
  4. Let’s Kill Security Questions
  5. My Advice To Developers About Working With Databases: Make It Secure
  6. Discovering an OSSEC/Wazuh Encryption Issue
  7. OpenSSL Key and IV Padding
  8. ElasticSearch Multitenancy With Routing
  9. Is It Really Two-Factor Authentication?
  10. Bulk vs Individual Compression
  11. Making Sense of the Information Security Landscape
  12. Encryption Overview [Webinar]
  13. Blockchainizing Existing Databases
  14. Seven Legacy Integration Patterns
  15. Using Multiple Dynamic Caches With Spring
  16. Low-Code, Rapid Application Development and Digital Transformation
  17. Six Things I Learned from Mr. Robot
  18. AWS Alarms for Application Errors
  19. Am I a Real Expert?
  20. Automating the Change of WordPress Permalinks
  21. An AWS Elasticsearch Post-Mortem
  22. Running a Safe Database Cluster in AWS With Auto-Scaling Groups
  23. Where Is This Coming From?
  24. One-Month of Microsoft DKIM Failure and Thoughts on Technical Excellence
  25. One-Time Passwords Do Not Provide Non-Repudiation
  26. Solving Problems Properly Is Often Not Viable

2019 25

  1. Getting Email Sending Settings Right
  2. A Disk-Backed ArrayList
  3. Near Real-Time Indexing With ElasticSearch
  4. A Technical Guide to CCPA
  5. Restoring Cassandra Priam Backup With sstableloader
  6. Blockchain Overview – Types, Use-Cases, Security and Usability [slides]
  7. The Personal Data Store Pattern
  8. Remote Log Collection on Windows
  9. Cybersecurity Is Very Important
  10. Protecting JavaScript Files From Formjacking
  11. Let’s Annotate Our Methods With The Features They Implement
  12. Idea: A Generic P2P Network Client
  13. First Thoughts About Facebook’s Libra Cryptocurrency
  14. Reflection is The Most Important Java API
  15. JKS: Extending a Self-Signed Certificate
  16. Multiple Cache Configurations with Caffeine and Spring Boot
  17. The Positive Side-Effects of Blockchain
  18. Command-line SQL Client for IBM i 7.x (AS/400)
  19. Audit Trail in IT Context
  20. 7 Questions To Ask Yourself About Your Code
  21. Implicit _target=”blank”
  22. How to create secure software? Don’t blink! [talk]
  23. Avoid Lists in Cassandra
  24. Certificate Transparency Verification in Java
  25. Integrating Applications As Heroku Add-Ons

2018 29

  1. Types of Data Breaches and How To Prevent Them
  2. Blockchain – What Is It Good For? [slides]
  3. Technical Innovation vs. Process Innovation
  4. Resources on Distributed Hash Tables
  5. Algorithmic and Technological Transparency
  6. Automate Access Control for User-Specific Entities
  7. Random App Ideas
  8. Scaling Horizontally on AWS [talk]
  9. Models for Electronic Identification
  10. Typical Workarounds For Compliant Logs
  11. A Caveat With AWS Shared Resources
  12. Writing Big JSON Files With Jackson
  13. Proving Digital Events (Without Blockchain)
  14. Implementing White-Labelling
  15. 5 Features Eclipse Should Copy From IntelliJ IDEA
  16. Electronic Signatures Using The Browser
  17. Storing Encrypted Credentials In Git
  18. The Benefits of Side Projects
  19. Bad Software Is Our Fault
  20. Audit Trail Overview
  21. User Authentication Best Practices Checklist
  22. Tracking Cookies and GDPR
  23. Setting Up Cassandra With Priam
  24. Using JWT For Sessions
  25. Adding Visible Electronic Signatures To PDFs
  26. Integration With Zapier
  27. GDPR for Developers [presentation]
  28. When You Have A Blockchain, Everything Looks Like a Nail
  29. Fix Your Crawler

2017 31

  1. OWASP Dependency Check Maven Plugin – a Must-Have
  2. Using Trusted Timestamping With Java
  3. GDPR – A Practical Guide For Developers
  4. The Problem Solver
  5. I Still Prefer Eclipse Over IntelliJ IDEA
  6. Blockchain? It’s All Greek To Me…
  7. Enabling Two-Factor Authentication For Your Web Application
  8. Setting Up Cassandra Cluster in AWS
  9. SecureLogin For Java Web Applications
  10. Self-Driving Cars Should Be Open Source
  11. Five Must-Watch Software Engineering Talks
  12. Stubbing Key-Value Stores
  13. We Are Not Having a Productive Debate About Women in Tech
  14. How To Send Ethereum Transactions With Java
  15. Concerns About The Blockchain Technology
  16. Basic API Rate-Limiting
  17. Simple Spring Boot Admin Setup
  18. Developers and Ethics
  19. Electronic Signature Using The WebCrypto API
  20. “Architect” Should Be a Role, Not a Position
  21. Overview of Message Queues [slides]
  22. Event Logs
  23. Spring Boot, @EnableWebMvc And Common Use-Cases
  24. Distributed Cache – Overview
  25. Distributing Election Volunteers In Polling Stations
  26. “Infinity” is a Bad Default Timeout
  27. Protecting Sensitive Data
  28. A Case For Native Smart Card Support in Browsers
  29. Computer Science Concepts That Non-Technical People Should Know
  30. Why I Chose to Be a Government Advisor
  31. Forget ISO-8859-1

2016 30

  1. Anemic Objects Are OK
  2. Amend Your Contract To Allow For Side Projects
  3. Progress in Electronic Governance [talk]
  4. Domain Fallback Mechanism In Apps
  5. Using Named Database Locks
  6. Short DNS Record TTL And Centralization Are Serious Risks For The Internet
  7. The Broken Scientific Publishing Model and My Attempt to Improve It
  8. I Stopped Contributing To Stackoverflow, But It’s Not Declining
  9. Traditional Web Apps And RESTful APIs
  10. The Right To Be Forgotten In Your Application
  11. Why I Introduced Scala In Our Project
  12. Biometric Identification [presentation]
  13. Writing Laws Is Quite Like Programming
  14. Custom Audit Log With Spring And Hibernate
  15. Spring-Managed Hibernate Event Listeners
  16. Installing Java Application As a Windows Service
  17. Why I Prefer Merge Over Rebase
  18. E-Government Architecture [presentation]
  19. Identity in the Digital World
  20. Cleanup Temp Files
  21. Dirty Hacks Are OK
  22. A Beginner’s Guide to Addressing Concurrency Issues
  23. How To Read Your Passport With Android
  24. Software Can’t Live On Its Own
  25. Take a Step Back
  26. Pretty Print JSON Per Request With Spring MVC
  27. Setting Up Distributed Infinispan Cache with Hibernate and Spring
  28. Issues With Electronic Machine Readable Travel Documents
  29. Microservices Use Cases
  30. Testing: Appetite Comes With Eating

2015 36

  1. General Performance Tips
  2. TLS Client Authentication
  3. Electronic Identification
  4. A Problem With Convention-Over-Configuration
  5. E-voting [presentation]
  6. Setting Up CloudFront With S3
  7. In Defence of Monoliths
  8. Retryable operations
  9. Why All The Fear of Electronic Voting?
  10. Common Sense Driven Development [talk]
  11. “Forget me” and Tests
  12. The “Software Engineer” Mindset
  13. Comments on The Twelve-Factor App
  14. A Software Engineer As a High-Level Government Adviser
  15. Events Don’t Eliminate Dependencies
  16. Government Abandonware
  17. Tomcat’s Default Connector(s)
  18. Blue-Green Deployment With a Single Database
  19. Optional Dependencies
  20. AWS “Noisiness”
  21. Log Collection With Graylog on AWS
  22. Should We Look For a PRISM Alternative?
  23. The Precious Feature Design Meetings
  24. KISS With Essential Complexity
  25. Getting Notified About RabbitMQ Cluster Partitioning
  26. A Non-Blocking Benchmark
  27. How to Land a Software Engineering Job?
  28. Why Non-Blocking?
  29. My Development Setup
  30. Do It Either Way, We’ll Refactor It Later
  31. Time Zone Use Cases
  32. I Am Not Allowed to Post My Content on Reddit
  33. The Internet Is Pseudo-Decentralized
  34. My Most Frequent Code Review Comment
  35. The Hash Challenge
  36. Proposal for an E-Government Architecture

2014 42

  1. Handling Edge Cases
  2. In Favour of Self-Signed Certificates?
  3. Algorithmic Music Composition [paper]
  4. Open Source for the Government [presentation]
  5. Static Typing Is Not for Type Checking
  6. Getting Started with Machine Learning
  7. Making Side Projects With New Technologies
  8. Interrupting Executor Tasks
  9. Development Overhead
  10. On Java Generics and Erasure
  11. The DSL Jungle
  12. Validate Configuration on Startup
  13. Scala – the Good, the Bad and the Very Ugly [presentation]
  14. Load-Testing Guidelines
  15. EasyCamera Now in Maven Central
  16. Musical Scale Generator
  17. Caveats of HttpURLConnection
  18. Open-Sourcing My Music Composition Algorithm
  19. Get Rid of the URL Pollution
  20. Generating equals(..), hashCode() and toString()
  21. Suggestion for Spam Filters
  22. RabbitMQ in Multiple AWS Availability Zones
  23. The Cloud Beyond the Buzzword [presentation]
  24. You Probably Don’t Need a Message Queue
  25. How to Handle Incompetence?
  26. Make Tests Fail
  27. An Architecture for E-Voting
  28. Integration Tests for External Services
  29. Algorithmic Music Influenced by Tweets
  30. The Low Quality of Scientific Code
  31. Development “Methodologies”
  32. Scheduling Repeated Tasks in Android
  33. Common Misconceptions About Java
  34. Fixing The Android Camera API
  35. The Optional Type API
  36. IDE vs. Editor
  37. Verifying Secure Password Storage Externally
  38. Coping with Methods with Many Parameters
  39. Ideas Aren’t Worthless
  40. Digital Signatures With Javascript
  41. I Don’t Like Scala
  42. Why The Web Isn’t Semantic Yet

2013 21

  1. WebSocket and Java
  2. I Use the main() Method
  3. Save-and-Refresh With Java Web Projects
  4. Embedding Maven
  5. UTF-8 By Default
  6. The Lazy Expert
  7. A Scraping Library
  8. A Serious Flaw of PaaS
  9. KISS My YAGNI
  10. A Simple Plugin System for Web Applications
  11. Two Types of Deployment for Subsystems
  12. We Don’t Need That Documentation
  13. Not an Expert in All Levels of Abstraction
  14. The Point of Knowledge
  15. Templating For Java Web Applications
  16. Login Tokens In Email Links
  17. Augmenting 3rd-Party Libraries
  18. How To Accept Bitcoin Payments
  19. Database Migrations And Java
  20. Caveats With MySQL Pagination
  21. Be Careful With Cache Managers

2012 36

  1. Why Not Emacs?
  2. What Is Challenging For Developers?
  3. A Guide To Authenticating Users With Mozilla Persona
  4. Not All Optimization Is Premature
  5. Generating Music
  6. Tip Of The Day: Make Your Email Column Unique
  7. How To Provide Default Serialization Format With Spring MVC RESTful Services
  8. Don’t Use JSON And XML As Internal Transfer Formats
  9. A Tip For Properly Utilizing Hibernate 2nd Level Cache
  10. Do Web 2.0 Companies Really Have The Best Technical Talent?
  11. Do Programmers Get Bored?
  12. Bcrypt. It’s The Bare Minimum.
  13. HTML5/Javascript Desktop Software
  14. All That Cloud: Amazon, Google App Engine, Windows Azure, Heroku, Jelastic
  15. How To Generate A Schema Creation Script With Hibernate 4, JPA And Maven
  16. Proof of Concept: Play! Framework
  17. Links To Your Static Resources Are Forever
  18. Managing CSS And Javascript In Production Is Hard
  19. ORM Haters Don’t Get It
  20. Javascript-off Unfriendly, And Proud About It
  21. Runtime Classpath vs Compile-Time Classpath
  22. Keep As Much Stuff As Possible In The Application Itself
  23. Replacing a JSON Message Converter With MessagePack
  24. Programming Puns
  25. Code Reviews Do Not Guarantee A Good Product
  26. My Problem With Your Interviews
  27. Is Moving All Jars To a Shared lib Folder Beneficial?
  28. Is Reddit Handling Trailing Slashes Incorrectly?
  29. State Does Not Belong In The Code
  30. Spring MVC Basics – Presentation
  31. Customizing Parameter Names When Binding Spring MVC Command Objects
  32. Send A Relevant Dilbert Strip To Your Boss
  33. A Hibernate Session May Get Flushed When Executing Queries
  34. The “Clean Software” Approach To Life
  35. Mind The “actions” Param For Facebook Graph API Posts
  36. Why I Like The Verbosity of Java

2011 38

  1. Fix That Code Immediately!
  2. The Default Use Case
  3. Change Without Redeploying With Eclipse And Tomcat
  4. A Bit Of Linux Hate
  5. Two Years On Stack Overflow
  6. Avoid Lazy JPA Collections
  7. To Employers That Don’t Respond In Time
  8. Getters and Setters Are Not Evil
  9. Java Client for the Google+ API
  10. Spring-managed Hibernate Listeners with JPA
  11. Error pages and chunked encoding – it’s harder than you think
  12. First Experience with the Google+ API
  13. The Logging Mess
  14. How to Map Dates with Hibernate – Use joda-time
  15. Google App Engine and Maven
  16. How to Handle Project Configuration
  17. What to Do With IDE Project Files
  18. Describe Concepts in Comments
  19. Making Spring and Quartz Work Together Smoothly
  20. What Questions an Interviewer Should Ask
  21. On DTOs
  22. The Most Common Mistake When Using Dependency Injection Frameworks
  23. Spring and PersistenceContextType.EXTENDED
  24. The Declining Quality of Low and Middle Class Laptops
  25. Slippers
  26. Pretty URLs and the Trailing Slash
  27. Why is the Facebook API So Crappy?
  28. An Idea for JPA Regarding Domain-Driven Design
  29. Careful with Storing Base64 in MySQL
  30. Those Evil Frameworks and Their Complexity
  31. Some Technical Details About My Startup
  32. Securely Storing Facebook / OAuth Access Tokens
  33. Where Is That Class / Resource Located?
  34. Facebook Graph API – What Does Each Field Mean in Different Contexts
  35. ThreadLocal Variables and Thread Pools – It Can Go Wrong
  36. Checked and Unchecked Exceptions in Java
  37. How Programming Becomes a Hobby Rather Than a Mere Profession
  38. RSS Is Not Dead. You Are Using It in a Wrong Way.

2010 17

  1. Why Startups Should Not Choose NoSQL
  2. Contexts and Dependency Injection Presentation
  3. We Don’t Need No Password Strength Checker
  4. How Does Merge Work in JPA (and Hibernate)
  5. Views on CDI and What’s New in JavaEE6
  6. Why I Decided Not to Use Cassandra
  7. Abstracting the DAO Layer with Hibernate/JPA
  8. Is JaveEE Really Portable? And Is It Really Useful?
  9. JMS, MessageDriven EJB (MDB), Timers, Maven, JPA (Hibernate) JBoss Example
  10. Time Zones and Java Web Applications
  11. On Domain-Driven Design, Anemic Domain Model, Code Generation, Dependency Injection and More…
  12. UI for Managing PKI, Instead of keytool or openssl
  13. The Psychology of Voting and Choice (on Stackoverflow and in General)
  14. Appeal to API Designers
  15. Using Multiple ELResolvers with CompositeELResolver in JSF
  16. Tips for Identifying and Debugging Problems
  17. Spring Annotation-Based vs XML-Based Transaction Definition Precedence

2009 12

  1. Are Tests of Service Methods That Rely on Database Access Unit Tests?
  2. JAXB: javax.xml.bind.UnmarshalException: unexpected element
  3. Hibernate: could not locate named parameter
  4. Custom Exceptions Thrown From Service Layer with Spring Transaction Support
  5. A Month on Stackoverflow
  6. Database Integration Testing / Unit-Testing with Spring, JPA, JUnit and Maven
  7. Deep @Embedded Hibernate Entity Hierarchy with Oracle
  8. How to Obtain Signer’s Details From JavaScript Signed Data
  9. A Really Useful Eclipse Shortcut to Configure
  10. NoScript and AdBlock plus – Two Sides to Every Story
  11. How to Create a Digital Signing Solution with Only JavaScript
  12. How to Iterate Over java.util.Set in JSF

2008 6

  1. Why I Might Not Want to Use Flex
  2. Content Management Systems – a Bad Idea?
  3. NetBeans 6.1 – Not Quite Useful IDE
  4. Why Windows Live Hotmail Is Not Competitive?
  5. First Look at Google Android – a Bit of Disappointment?
  6. Feed Readers’ View-Styles