#220 - From Hibernate to Quarkus: Modernizing Java for Cloud-Native - Sanne Grinovero
“Hibernate is not something that should be used in every situation. If you are a smart developer and a tool is being imposed on you, you know you’re not going to have a good relationship with it.”
In this special in-person episode, Sanne Grinovero shares the story of Java’s evolution from his unique perspective as a long-time open-source contributor. He shares his 16-year career journey at Red Hat, highlighting his amazing work on key projects like Hibernate, Infinispan, and especially the creation of Quarkus. His career trajectory, from a student who initially considered Java too bloated to a leading figure in its modernization, shows the transformative power of open source.
A key part of the conversation focuses on how technical challenges spark innovation. Sanne explains how the task of making the popular Hibernate framework compatible with GraalVM’s limitations led directly to the birth of Quarkus. This journey tells the bigger story of how Java adapted for cloud-native development, ensuring it continues to be a top choice for developers seeking high performance and a great developer experience.
Timestamps:
- (00:02:16) Career Turning Points
- (00:04:52) Winning an Innovation Award
- (00:06:35) Java Heroes
- (00:08:04) Working as a Consultant
- (00:09:56) Taking a Massive Pay Cut to Work on Open Source
- (00:10:59) Contributing to Big Open Source as a Youngster
- (00:12:53) State of Hibernate Project
- (00:15:15) Spring Boot
- (00:16:54) Making Hibernate Work on GraalVM
- (00:21:05) GraalVM Limitations for Running Hibernate
- (00:26:09) Java for Cloud Native Application
- (00:28:04) Quarkus vs Spring Boot
- (00:33:21) JRebel & Quarkus
- (00:34:35) Java vs New Programming Languages
- (00:39:22) The ORM Dilemma
- (00:42:38) Some Hibernate Design Pattern Tips
- (00:46:40) Getting Paid Working on Open Source
- (00:48:41) Hibernate License Change
- (00:51:05) Intellectual Property & Meaningful Contributions
- (00:52:52) AI Usage & Copyright in Open Source
- (00:55:21) Biggest Challenge Working in a Big Open Source
- (00:56:08) Politics in Open Source
- (00:58:32) Security Risks in Open Source
- (01:02:25) Donating Hibernate to Commonhaus Foundation
- (01:04:49) The Future of Red Hat
- (01:06:39) 3 Tech Lead Wisdom
_____
Sanne Grinovero’s Bio
Sanne Grinovero has been a member of the Hibernate team for 16 years; he led the project as Sr. Principal Software Engineer at Red Hat and worked on Quarkus as a founding R&D engineer.
He is deeply interested in solving performance and concurrency challenges around data access, scalability and exploring integration with new storage technologies, distributed systems and search engines.
Working on Hibernate and Quarkus led him to contribute to several related open-source technologies, most notably to Infinispan and JGroups, WildFly, ANTLR, various JDBC drivers, the OpenJDK and GraalVM, Apache Lucene and Elasticsearch.
After being challenged to reduce memory consumption and improve Hibernate’s bootstrap times, Sanne worked as part of a small R&D team at Red Hat on some ideas that have evolved into what is known today as Quarkus. Today, he leads various initiatives and research projects in the JVM space at Red Hat and still contributes to all these projects.
Follow Sanne:
- LinkedIn – linkedin.com/in/sannegrinovero
- Twitter – twitter.com/SanneGrinovero
- GitHub – github.com/sanne
Mentions & Links:
- Extreme programming – https://en.wikipedia.org/wiki/Extreme_programming
- Object-relational mapping (ORM) – https://en.wikipedia.org/wiki/Object%E2%80%93relational_mapping
- REST API – https://www.redhat.com/en/topics/api/what-is-a-rest-api
- Function as a Service – https://en.wikipedia.org/wiki/Function_as_a_service
- Developer joy – https://www.figma.com/blog/the-atlassian-method-developer-joy/
- Serialization – https://en.wikipedia.org/wiki/Serialization
- equals and hashcode – https://www.geeksforgeeks.org/equals-hashcode-methods-java/
- Primary key - https://en.wikipedia.org/wiki/Primary_key
- Quarkus for Spring Developers – https://developers.redhat.com/devnation/tech-talks/quarkus-for-spring-developers
- Project Leyden – https://openjdk.org/projects/leyden/
- OpenJDK – https://openjdk.org/
- Project Liliput – https://openjdk.org/projects/lilliput/
- Hibernate – https://hibernate.org/
- Quarkus – https://quarkus.io/
- Infinispan – https://infinispan.org/
- Hibernate Search – https://hibernate.org/search/
- JGroups Project – http://www.jgroups.org/
- JDBC driver – https://en.wikipedia.org/wiki/JDBC_driver
- iBATIS – https://ibatis.apache.org/
- MyBatis – https://mybatis.org/mybatis-3/
- Spring Boot – https://spring.io/projects/spring-boot
- JPA – https://spring.io/projects/spring-data-jpa
- GraalVM – https://www.graalvm.org/
- Reflection API – https://docs.oracle.com/javase/tutorial/reflect/
- Servlets – https://en.wikipedia.org/wiki/Jakarta_Servlet
- Jackson REST – https://quarkus.io/extensions/io.quarkus/quarkus-rest-jackson/
- Kafka Connect – https://docs.confluent.io/platform/current/connect/index.html
- Elasticsearch – https://www.elastic.co/elasticsearch
- Testcontainers – https://testcontainers.com/
- Postgres – https://www.postgresql.org/
- JRebel – https://www.jrebel.com/
- Java collections – https://docs.oracle.com/javase/8/docs/api/java/util/Collections.html
- SQL – https://en.wikipedia.org/wiki/SQL
- Rust – https://www.rust-lang.org/
- Go – https://go.dev/
- TypeScript – https://www.typescriptlang.org/
- Python – https://www.python.org/
- Assembly – https://en.wikipedia.org/wiki/Assembly_language
- C – https://en.wikipedia.org/wiki/C_(programming_language)
- Kotlin – https://kotlinlang.org/
- Ceylon – https://en.wikipedia.org/wiki/Ceylon_(programming_language)
- Scala – https://www.scala-lang.org/
- ISBN – https://en.wikipedia.org/wiki/ISBN
- LGPL 21 – http://www.gnu.org/licenses/old-licenses/lgpl-2.1.en.html
- Apache License – https://en.wikipedia.org/wiki/Apache_License
- Apache License Version 2 – https://www.apache.org/licenses/LICENSE-2.0
- Emmanuel Bernard – https://emmanuelbernard.com/
- Bela Ban – https://www.cs.cornell.edu/info/people/bba/
- Andy Miller – https://www.linkedin.com/in/andy-miller-408636/
- Jason Greene – https://www.infoq.com/profile/Jason-Greene/
- Eric Deandrea – https://developers.redhat.com/author/eric-deandrea
- Yoann Rodière – https://github.com/yrodiere
- Red Hat – https://www.redhat.com/en
- JBoss – https://www.redhat.com/en/technologies/jboss-middleware/application-platform
- Sourcesense – https://www.sourcesense.net/
- Commonhaus Foundation – https://www.commonhaus.org/
- Eclipse Foundation – https://www.eclipse.org/org/
- Apache Foundation – https://www.apache.org/
Tech Lead Journal now offers you some swags that you can purchase online. These swags are printed on-demand based on your preference, and will be delivered safely to you all over the world where shipping is available.
Check out all the cool swags available by visiting techleadjournal.dev/shop. And don't forget to brag yourself once you receive any of those swags.
Taking a Massive Pay Cut to Work on Open Source
-
Since we’re talking about careers here, I made a big mistake there as well. I was so keen to join them that I actually took a massive pay cut. I thought, well, it doesn’t matter. I would work for free here. We’ll address that later.
-
It wasn’t addressed later. They put me very low in the ladder there, and then I realized I was a bit more senior than that. So it was fixed, but very slowly over the years. Once you are inside a big company, there are all kinds of rules. Like I can’t re-adjust or double your salary overnight. We need to do this 5% here and 5% over there. So it took some time.
-
Thinking in retrospect, they didn’t have the budget at that moment. I probably could have said, let’s talk in two months, and that would’ve been better for everybody. But I was so keen to join them and learn more and just work full-time on those projects.
State of Hibernate Project
-
We do have download statistics. It’s doing incredibly well. We’re in the dozens of millions of downloads per month. The problem is we don’t know what people do with it. For all I know, it might be one script somewhere that’s downloading it a million times per day.
-
In practice, we do know via Red Hat, we have customers using it because they open support tickets, ask questions, ask for clarifications, ask for roadmap plans. They suggest features. So we know there is a lot of activity there.
-
And then there are community report researchers that try to get a bit of a breakdown of what’s happening. From those, it seems that yes, Hibernate is very widely used and has an extremely large market share now. They’re always a bit biased—each of these vendors asks their own community. So it’s a bit difficult to have a full picture. But we’re very confident that pretty much every Java developer has heard of it or used it at least once in some project.
Spring Boot
-
The Spring group is a bit of a competition to JBoss and Red Hat, but they’re also big friends in the way that they understand Spring wouldn’t be as useful without Hibernate, and we totally understand that Hibernate wouldn’t be as popular without Spring. So there is a very respectful back channel communication between them.
-
One problem we have is that we’re allowed—it’s even in our employment contract—to contribute to any open source project whenever we want. We don’t have to ask for permission. It doesn’t matter which project it is—it can even be a competitor’s project. So there’s this sad thing that I know the Spring team sometimes would like us to make some changes, and it’s always a bit of a difficult conversation because they can’t send patches. It’s not allowed for them.
Making Hibernate Work on GraalVM
-
The idea was we wanted to support GraalVM properly. GraalVM at the time had a lot of limitations. Many of those have been softened or resolved nowadays. But at the time, the list of limitations was really daunting. And among them, Hibernate would do all of them.
-
I was tasked with, can you try to make Hibernate work on GraalVM? It’s really important for the entire Java world, the entire Java ecosystem. They were saying to me, okay, maybe some features of Hibernate cannot work in native. Remove them. They were suggesting, create something new, which would have the role of Hibernate in this new world, but maybe different. And we were like, what about the JPA spec and things?
-
The situation was a bit dire. We give a lot of importance to the spec. But at the same time, the way cloud native development was going, it was clear that the direction Java was taking was just not compatible with this new feature. There was a strong concern that Java would still be alive in 10 years. We were really thinking, okay, if the current Java Enterprise specs are not fit for the purpose, maybe we should propose a new set of specifications.
-
So my task initially was to write down what you would think should be something we called JPA lite. You have to identify which things Hibernate is doing today we can do in this JPA lite, and which things you need to leave behind in the interest of making things happen in the GraalVM world. So I started working on that, and this list is very long. The amount of complexities we have is very daunting.
-
At some point, I had this eureka moment, which was really brilliant. I just twisted the thing a little bit, and then I wrote this email to my colleagues saying, look, if we boot the entire framework in this particular way, I have no limitation whatsoever. We solve all the problems that GraalVM is offering. So there is no need for a new specification.
-
This was a good breakthrough because if we had solved these workarounds for Hibernate, which had all these limitations, then it was probably going to be easy to apply the same ideas to all the other frameworks, which had simpler use of the JVMs.
GraalVM Limitations for Running Hibernate
-
GraalVM, the entire code base needs to be known at build time. That means the byte code is not changing. So, no byte code manipulation, no generation of byte code at runtime. And also no reflective invocations. Hibernate needs to do reflective calls.
-
For many years now, we tried to not use reflection at runtime, because it used to be quite inefficient in the JVM. It’s better optimized nowadays, but still we try to avoid it. But at least, during bootstrap, we need to know your entity, which properties they have, what’s their name, what’s their type, and which classes actually have and the annotations.
-
And reflection does not work at all in native image unless you specifically tell the compiler. You can give a lot of inputs to the GraalVM compiler to tell it, at runtime this method might need reflective access. This type needs to have reflective construction. This other type might need to be serializable.
-
You need to be thorough in listing all the cases, otherwise it’s going to fail. Resource loading wouldn’t work unless you register it. Service loading doesn’t work unless you register the type that’s going to be loaded. We do all these things in Hibernate and in many other frameworks.
-
The key was that the GraalVM compiler is a Java process, and it is triggering initialization of the constants in your code. So what I did was, if I put my main class and I do public static final SessionFactory, and initialize Hibernate in a constant, the GraalVM compiler is going to initialize the entire Hibernate in this constant, and it did. So it booted the entire Hibernate in there.
-
And now there are some problems with that. First off, you don’t want it to actually connect to the database, because you’re building the application. Your database is maybe not even reachable from this environment. Or you certainly don’t want it to connect even if it’s reachable, because you’re building. The trick here is that all of this reflection and all of this work—annotation, scanning, configuration, parsing—all of it is happening when the compiler is running.
-
Now the compiler happens to be a valid JVM. GraalVM is written in Java. So this process in which it’s running and defining the constants, all these operations that are not valid after being compiled are valid during compilation. So all of these limitations suddenly were not applying. I just needed to make sure we would not use any of those things at runtime. Of course, we would still use some of those things at runtime, but this really reduced the set to something manageable in a short timeframe.
-
For example, Hibernate. If you use bytecode enhancement on entities, it would not need reflective calls on objects, except the constructor, I believe. That’s still the case. But if you don’t do bytecode enhancement, then a lot of reflections are happening.
-
So very quickly we decided, bytecode enhancement is mandatory. We don’t even ask people to use it. It’s just something that the framework does for you during the build. So it’s simpler. And it’s also simpler for us, because one problem Hibernate had over the years is lots of configuration properties, even in the engine possibilities. So for us, even reducing the things we actually need to support also helps us to increase the quality.
Java for Cloud Native Application
-
Yes, it’s absolutely in that category. We do have a Quarkus version for serverless. It starts in milliseconds. So people can really decide if they want to go in that direction.
-
Actually, the beauty of it is you don’t have to decide in which direction you’re going up front. You’re not going to choose a framework because you’re going serverless. You’re building your code, and then you can deploy the same application easily. You can change it in the build properties, saying, I want to build this as a serverless function. Then maybe you realize the load on this serverless thing is getting higher and higher, and it’s better if this was a regular Java application. It’s just a matter of changing configuration properties. Or maybe you are getting a very low load occasionally. But it’s more convenient for you to run it as a native image, and you can just compile the same application to native.
-
What I really like is this flexibility that you don’t have to decide upfront. You’re not going to use Quarkus because you need native. You’re going to use Quarkus because you want to write in Java. What’s coming after that depends on the needs of the day. Requirements change often and agility is quite important nowadays. It helps to keep the cost low, to adapt quickly.
Quarkus vs Spring Boot
-
Why would you use Quarkus? There are lots of very good reasons. First off, the developer joy is fantastic. Developer joy is our framework of reference, but it means several things. Pretty much, we make your productivity very high. The feedback loop is really short and that makes people happy.
-
Essentially, the main feature is the live reloading capability. We aim that any change you make in code when you are in dev mode is reflected in your running system under a hundred milliseconds. That means you change a method, refresh your browser, and immediately see if you’re on the right path. Get immediate feedback and it creates a much lower cognitive load. I’m not frustrated because an error happened—I’m still in the flow. I have not been distracted, and I just keep going with my things. So I’m happy because I’m very productive, I’m learning, and I’m constantly getting feedback that I’m on the right path.
-
Speaking of feedback, we have something called continuous testing. So while you’re working, you can have continuous testing running, which is pretty much running the unit tests in a loop really quickly. While you’re coding, you might see now this test is red. This is immediate, and there are some interesting techniques in there so that it actually knows how to prioritize which tests to run, which are related to the code you modify.
-
The other thing is dev services. So if you want to start developing, you start having many external components. Now as a developer, it quickly becomes, oh, okay, I’ll spend my morning installing all these systems. In Quarkus, you don’t have to install anything at all. When you’re starting, if it knows you have the Postgres extension and Hibernate, this implies you’re going to need Postgres.
-
Behind the scenes, it’ll use Testcontainers, fetch a Postgres instance, start a Postgres instance for you, and you don’t even have to provide the connection properties, because those are being provided and injected into the running dev mode. So you can quickly start working on your model. You just refresh the application and see the schema evolving as you are evolving the model. The flow goes really fast, and you’re not wasting time on boring things.
JRebel & Quarkus
- Quarkus really takes a very innovative idea there, which is since it’s so fast to boot, we just reboot our application over time. And it’s very reassuring. It means you really have a clean slate.
Java vs New Programming Languages
-
I honestly think Java is in a very good position. People maybe don’t realize it because it depends on whom you listen to and what you get excited about. But if you look at each of the languages you mentioned, they all have one strong suit and are very weak in other areas. While Java is maybe not top leader in all of those areas, it’s very close to leading in all of them. It has been innovating quite aggressively recently. The improvements are steady. The pace accelerated, and it’s very interesting where it’s headed.
-
Project Leyden is going to realize from pressure and GraalVM, the interesting thing that it boots faster that the OpenJDK had the problem of booting too slowly. And they’re addressing that. It’s improving very significantly with Leyden.
-
Project Liliput is making it consume less memory, because it had this reputation of being bloated and all that. Honestly, the fame of being bloated is very often coming from frameworks that were not designed to boot fast, because nobody cared—the application was going to be up for many months. And if it was taking some seconds more to boot, that was like a drop in the bucket. Completely meaningless.
-
These things are being addressed now, because people start to pay attention to them. Of course, these libraries are so widely used, and they’re so large and featureful that it takes some time to get there, but we are getting there really quickly if you look into the Quarkus space. A very big complex Quarkus application with a thousand Hibernate entities can boot in under one second. But we keep working on it. I have more ambitious targets. We want to go in the 200–300 milliseconds space.
-
We do believe that in terms of achieving maximum performance or maximum efficiency of the system, if you really want to handle a very high load, Java is the way to go. There are so many clever things happening in the JVM, in GraalVM. The combination of these things, the combination with Quarkus, things that we’re exploring, are really pushing the throughput to very high levels.
-
And we do compete, and we do benchmark ourselves with other languages. Because Quarkus is significantly faster than any other Java framework around. The challenge really is, is this design perfect? Can this go any faster? To verify that, I need to compare myself with other languages, and we’re getting really close to that level.
The ORM Dilemma
-
There are lots of Hibernate haters. There are two categories of Hibernate haters. There is a large group of people that sadly have been taught about Hibernate the wrong way. It’s difficult because knowledge propagates online, and I have no control over those things.
-
And then, of course, there is a category of people that have been told they had to use Hibernate for this project when it made no sense. Hibernate is not something that should be used in every situation. There are some situations in which it’s really not the right tool. But still, it gets imposed as a standard in some places. And of course, if you are a smart developer, and you understand that this is being imposed on you, and it is the wrong tool, you’re not going to have a good relation with the tool.
-
I would always start from an ORM, or at least, in most cases. Now, if you need to do a lot of operations inside the database, maybe stored procedures are frowned upon, but in some cases they are the right solution. I would always try to minimize the span of transactions. So if that implies that the transaction gets extremely chatty over the wire, that’s a problem, then it’s not a good solution. But in most cases, I would have Hibernate available in my system. There are many operations, many business operations, and some of them would use Hibernate. Some of them would not.
-
It’s important that people remember that Hibernate is an ORM, but it’s also facilitating access to native SQL queries in many ways, and mapping results of native SQL queries. A good user should understand when to use Hibernate with the stateful session, Hibernate with the stateless session, or when to just send native statements to the database.
Some Hibernate Design Pattern Tips
-
A lot of people still believe that a Hibernate entity needs to implement serializable. It’s just not true. It might need serializable because you’re using that same object with other frameworks which require it. But Hibernate doesn’t care at all if it’s serializable, we never need it.
-
And then there are discussions about getters and setters rather than a field, make it public. You can do whatever is good for designing your application. Hibernate doesn’t care. It can be a public field for all we want. It can be a private field. It doesn’t matter. It doesn’t really make any change in the semantics of what we do, it’s all the same.
-
People seem to think they have to implement equals and hash code on entities. In practice, they don’t. But if you implement it, there’s a very good chance you’re getting it wrong. So I would typically suggest don’t implement it, please.
-
And why do I say you’re getting it wrong? Because it’s an entity. The purpose of the entity is that you change its state to represent changes that you want to happen in the database. It means that you’re changing the state, so you’re going to change the hash code.
-
Now, the only reason for you to implement equals and hash code is because you want to store this, say, in a hash set somewhere. Again, Hibernate doesn’t care about this. You might want to implement something in your entity because you need it for some other reason. Like you want to store this in a hash set. But if you store things with multiple attributes in a hash set, you are calling for trouble, because that’s how Java collections work.
-
In my opinion, one correct way of implementing equals and hash code is to only include id, the primary key, in your implementation, but also to make sure that before you ever invoke those, the ID gets assigned, either by you or by the framework.
Getting Paid Working on Open Source
-
You need a network, you need to be somebody who’s actually an expert. To be an actual expert, you need to spend time contributing to those things.
-
A model that would work really well for an open source contractor is somebody that charges a premium to some important customer because he’s actively an expert, but also because he makes changes happen in the open source project. So the company might have a particular issue, you are able to fix it, and therefore you can charge a premium. But then you also actually do fix it and make sure that it gets merged.
-
Now that is a bit tricky, because other members of the team might not agree with that change, so there is that risk. It means you really need to work on being really good, because you need to be persuasive to the other people, and you need to really make sure that it’s a high standard, good quality work.
Hibernate License Change
-
We wanted to change to Apache License Version 2. This is actually one of the first things I asked my colleagues when I joined many years ago: oh, wouldn’t it be easier if we switched the license? I remember they laughed at me like, oh yeah, maybe, but it’s impossible. We can’t do it. And why? Why can’t you do it? Well, you need permission from all the contributors. We had to contact every single contributor ever that made some meaningful contribution for projects.
-
The key is meaningful, right? Because otherwise we would never have finished. We had to go through more than 2000 contributors. So we started sending requests to the ones that contributed the most, and then there is this long tail of people that contributed maybe just one or two patches, and those we have been looking at one by one to see is this meaningful from a legal and copyright, intellectual property law point of view. Eventually, we got permission from everybody. So now it’s Apache License 2.
Intellectual Property & Meaningful Contributions
- The tricky part was to understand that it’s meaningful in the context of intellectual property and not from the point of view of software engineering.
AI Usage & Copyright in Open Source
-
If I need to create a batch script, which is copying some things from one to the other, I’ve seen that AI is very helpful with that, because I’m a little bit out of my territory. I know how to write batch scripts, but I don’t remember some of the details, so I need to google, like, how is the equality sign again, for variables, integers—I don’t remember those things. So I use an AI for that. It helps me.
-
But when it comes to Java code, it never did the right thing for me. Never. And I think it’s because the kind of work we do is always novel in a particular strange space.
Biggest Challenge Working in a Big Open Source
- There was a time in which I tried to follow all the discussions. I no longer do that. It’s important to have subgroups and a lot of trust in other people. I know there are areas that are being watched by colleagues, friends, external contributors that I trust. And I also know that if they needed me, they would come to me. So I don’t have to go and read. That has been overwhelming and yeah, that doesn’t work.
Politics in Open Source
-
I think there is. I wouldn’t say if it’s politics. But there certainly are strong opinions, very often they come from misunderstandings. Some discussions are happening in a chat maybe, and you are typing a response before having read the other one. People start to lean on things, if they go on a tangent, and then there is a significant misunderstanding sometimes.
-
These things happen. I’ve never seen people intentionally going in the wrong, or trying to mislead others. Everybody’s coming in very good faith, and so when there is some tension growing, it’s always a misunderstanding. But also, emotions, tone, they don’t come across really well in written form. Also, it’s all software engineers. They might have a bit of empathy problems and it’s extremely international. So culturally, the expressions might not translate really well or translate in the wrong way. And then, that amplifies some problems.
Security Risks in Open Source
-
That was certainly a wake-up call. We used to give, say, commit access, quite easily. If you had been around for, let’s say, six months and doing some good work, I would give you the commit access. Nowadays, I’m not saying I’m going to do a background check, but I want to know what kind of person I’m dealing with.
-
In some projects, we really restrict the permissions to the bare minimum. This might seem a bit unfair, and we’re trying to compensate the fairness now with a bit of an open governance that is writing down rules of how do you join the project and what are the expectations.
-
Even then, we always review each other’s code. So the way GitHub rules are set up, CI is set up, we really do expect that even if I want to make a change, like I said, a pull request and somebody else is going to review it, and then it gets merged. There is a lot of automation there. Some of my colleagues created a very nice framework to create a GitHub bot. Also with Git, when I start my work, I fetch changes and I will always look at them. I might miss something though, that’s the risk.
-
One thing we’re working on now is reproducible builds. We want to make sure that the builds are reproducible, that helps to certify the origin of things. It’s going to be mandatory for Red Hat products and projects; I believe it is already, maybe.
Donating Hibernate to Commonhaus Foundation
-
Some things that we would like to do are to improve the upstream project as well. It’s not just a responsibility of Red Hat, it’s a responsibility of how the open source project is set up.
-
One of the things we’re doing now is donating the entire Hibernate code base and intellectual property to an open source foundation. This is literally to signal that this is not just Red Hat’s responsibility. We have many contributors from other companies, especially database vendors. They really like that Hibernate supports all their exotic features, including features of database versions that have not been released yet.
-
These projects are now being donated to the Commonhaus Foundation, which is a very young, new foundation. For a mature framework or mature library like Hibernate, in which we already have our way of working, our CIs, our system, getting in Apache would’ve been problematic. You need to migrate our ticket system, our mailing list, and it’s a lot of work. They also have a lot of other rules that we don’t necessarily like. We have an established process, which we think works very well.
-
So Commonhaus gives us a bit more flexibility in that sense. We really hope that that triggers more companies to not only contribute, but also steer it and lead it.
The Future of Red Hat
-
Our entire group is being moved to IBM. So we will no longer be under Red Hat, but under IBM. The things they promised, the reasons they gave us, seem very positive. It seems like a really good idea.
-
IBM has always had a very large team working on lots of Java things, including a lot of open source Java projects. We’re not even joining the team, we’re going to be side by side with them. But I expect a lot more collaboration to happen with those guys.
3 Tech Lead Wisdom
-
It’s very important to make yourself replaceable, aggressively.
-
Many of us working in this space might suffer from imposter syndrome. “Oh, I got here out of luck, but I don’t really know as much as all these other smart people I’m working with.” So you tend to make yourself valuable so that you are reassured you’re not going to be removed next week.
-
I have been working on Hibernate for a very long time. And then we created Quarkus, and then I was involved in Quarkus and in Hibernate, and I was the architect for the Hibernate team, which means also interfacing with all the other data products that have to do something with Hibernate or integrate with it. Lots of discussions. And it was just way too much. I love these projects. So I could not just quit any of them, because I felt that some things were unfinished and were not clear, or some other people were not in the right position to replace me.
-
And that was actually a problem. I realized that it’s important to make sure that I’m not indispensable. I had to go on paternal leave. And so I was literally not having sleep for four months. It’s not good for the project if something like that happens and you are not easily replaceable. It also prevented me from expanding and diving deep into other important opportunities within these projects.
-
Also out of respect for the project, the other people were not getting the attention they needed toward the direction they needed. Now they have him and it’s us. Yeah, making yourself indispensable, a big mistake. But that’s what we tend to do.
-
-
Do some interviews, sometimes.
-
I’ve been at Red Hat for a very long time. Another funny thing is most of my colleagues have been the same for all those years, and I even had the same manager for like 14 years. He didn’t even quit. He retired at some point.
-
I realize, in the industry, this is really unusual. And for many years, I also did not interview anywhere else. Because you love the project. You have a fantastic team. So, going and answering to competitors or somebody feels a bit like a betrayal of your best friends or your life’s work.
-
I think that was a mistake as well. I did some more interviews in recent years. Doing them helps me better understand my own value, and therefore, you get those very interesting offers. It builds up my confidence. And that helps, again, to fight impostor syndrome. It helps to realize that the way you’re working is valuable, it’s valued by others, and it just helps make you a better leader where you are.
-
Maybe you get the offer. It’s reassuring to know that even if you left here, there are other opportunities. It’s something I even suggest to my colleagues: do some interviews sometimes.
-
-
To truly listen to others.
-
One thing as a leader, especially in these groups, always resonates with me. In the aerospace industry, they noted that most accidents happen when you have two pilots on an airplane. It’s much more likely that an accident happens when the senior pilot is piloting, because the junior one is less likely to speak up. Or if he does, he might not be respected with his opinion. That really struck me, and I think it applies a lot in other areas, especially the technical things we work on.
-
I’ve seen, in all these chats and misunderstandings that we have, it happens quite often that somebody that’s very junior or maybe has a very basic understanding of our frameworks—an external user comes to us in the chat and asks something, he clearly has many misunderstandings or hasn’t read something, etc. And then, his opinions get discouraged really quickly. Sometimes there is really important feedback in there.
-
Also between colleagues, there is a bit of a hierarchy, so if you are on the top, it’s very important to listen to what the other guys say.
-
And the opposite of listening truthfully is also expecting the others to be truthful in what they say, and this is especially important now that we all work remotely and are far away, and we don’t know each other. The trust that exists between people is so important.
-
When you didn’t do something that you had to do, I really value that people are very honest about what it is. It’s much better to hear that, oh, you didn’t do it, because yesterday you had other things on your mind, and you didn’t feel like working. That builds a much stronger relationship. And you might need some slack, or you might have a motivation issue, and then it’s better if you tell me, and we can work on that together. That really helps create a bond in the long term. We see in these teams that we actually stay together for a long time, and we may create good things together.
-
[00:01:25] Introduction
Henry Suryawirawan: Hello, guys. I think, uh, this is our first time having Tech Lead Journal recording in-person podcast recording. So, as the first honorary guest, we have Sanne in this studio today. Sanne uh, is a long time open source contributor with Hibernate, Quarkus, and then Infinispan, uh, so many projects. Uh, he has been a long timer in Red Hat as well, probably about 16 years. And he’s traveling to Singapore, so we had a good chance to actually speak to him and ask him about his journey. So welcome to this first in-person podcast recording.
[00:02:16] Career Turning Points
Henry Suryawirawan: Right, Sanne, in the beginning, I always love to invite my guests to maybe share a little bit about your career, especially turning points that you think we can learn from you.
Sanne Grinovero: Yeah. Yeah. Fantastic. So, um, when I was at university, I was in, uh, in Italy, finishing my studies. And, um, I went, you know, professors had, they would assign students, uh, to some practical jobs as well at the end of that. And so I got involved into a big, very large, Java project, which was using uh, Java enterprise at the time, deploying on JBoss. I completely hated these technologies initially. Like, it was like, oh, Java seems large and bloated. It takes ages to deploy something and get feedback, like, am I on the right path? Of course, everything was new to me. And so the fact that to know that some code that was actually going to work as expected needed to go through this entire cycle of deployment, that was, uh, painful.
So very quickly, I put down scripts to deploy this faster on the application server, and, you know, to do all these kind of things just, and you realize it’s open source and you can read it. So you start learning a lot about the platform and how to work better with it. And, uh, well that project, it went from being extremely large and slow and complicated to something that I really liked doing. And so very quickly I was, I became from being like the junior guy that barely knew some Java to actually lead the project.
And then, um, well there was, um, a bit of a competition, like Red Hat was looking for, uh, interesting use cases to share to their customers. And, uh, so I wrote down what we had done with the project. And we won an innovation award. So they sent me to Orlando to get this, uh, this award, it was a bit weird, because I was like very young, and, uh, suddenly I’m there between, um, all, you know, these guys that are my heroes. Like these are like the Java developers that actually created these technologies. But they were all like very like, um, uh, level, right? They, they would, they were interested to hear my, about my experience and then also about the problems that I had. And, then, you know, they immediately started brainstorming with me, oh, how can we fix these things, right?
Yeah, that, that was like an amazing, um, impression for me. So then I immediately knew like, oh, okay, these projects are really amazing. Like they’re being used in so many places, they’re solving so many problems. And they have ideas that are valued there. Like they want to, to hear about those and they also want me to fix them.
[00:04:52] Winning an Innovation Award
Henry Suryawirawan: So when you say innovation award, what kind of project that you actually built back then?
Sanne Grinovero: Yeah, that was a, library management system for the Italian government. It was a very complicated, big project. So it starts from like the basic things like people, um, need to loan a book and so, you know, you need to just record, uh, who was the person that took a certain book and brings it home. But it was also like the central catalog for the national system. So if somebody wrote a new book, it needs to be assigned a new ISBN code and there is a whole, uh, official process behind. And so yeah, the complexity of the thing was, um, you know, much higher than what you would expect if somebody is not working in that domain. So we had something like 1,200 different database tables. And I remember, you know, statistics that I had to write for this, uh, paper for the award. Like we had more than 2,000 different, uh, web pages and, you know, this was all running at the time on JBoss application server, Hibernate.
Hibernate Search, that was, um, key project for my career. Because Hibernate Search had just been pretty much created as a prototype by Emmanuel Bernard, who’s a big friend of mine and became my mentor later. So it was like a prototype. It was doing some of the essential things, which were like absolutely key for my project. Like we would not have succeeded in doing anything if Hibernate Search had not existed there. But at the same time, it was missing some things which are absolutely critical for us. So really for my project to succeed, it was essential for us when we were working on this library system that we implemented these missing features. And then, um, of course, at some point, I promised them man, I would, um, open source that those components and push them to Hibernate Search.
[00:06:35] Java Heroes
Henry Suryawirawan: So you mentioned you met some of your Java heroes, right? So can you share who are some of your heroes?
Sanne Grinovero: Oh, back then? Yeah. I mean, I have lots of heroes today. So yeah, when, when I, when I arrived at Orlando, I was very keen to meet some of them. I remember, um, yeah, Emmanuel, of course was there. Bela Ban, he was, uh, I say he still is today the leader of the JGroups Project. I think I met him there. I might confuse some events now. There was, um, Andy Miller, he was the director for the performance team at JBoss. And one of the big problems we had with our system was, of course, making sure that the system would perform at the level that the customer was expecting. And initially, it did not at all. We had made lots of mistakes and I had to learn really quickly again as a, you know, complete junior person facing Java for the first time, uh, about profiling tools and all what’s behind that. So when I get there and I see presentations from this person, which is giving me a lot of clarifications, a lot of really good hints, pretty much for free. Like these conferences are amazing. They’re just there to just honest sharing of knowledge for… just like very valuable, right?
So yeah, after that I go back to Italy with a lot of new knowledge, a lot of new friends, and a lot of network. Promises of contributions back. But I wasn’t working for Red Hat, right? I was working for these other companies.
[00:08:04] Working as a Consultant
Sanne Grinovero: And while I realized that I actually know a lot of things about Hibernate itself and, you know, all these things I’m doing with Hibernate Search. They needed to dive really deep and understand things more as a framework implementer than as a, as a user. So I quickly started a bit of a career in, uh, consulting. That was a good career acceleration. I’ve been working in banks. I was like a lead architect for, um, like a technology choices in one of the major Italian banks. I worked for, uh, for Sourcesense, which was, a very cool, uh, very small, very selective company in Italy about… they wanted to have like the brightest minds in the open source ecosystem and, you know, sell, uh, premium expertise as consultants.
I did that just a year. Like I, I started like very, very loving this group. But then, um, I had to work often in a bank, which they really valued us. But at the same time, this bank had the firewall. And from within, we could not use internet. Completely not allowed. And, you know, their big, very legacy, big systems, complicated. They would come to me like I was a guru of these things and ask me questions that I needed to do more research. And so, you know, you would need to do that at home and then research and then go back. So I also like disappeared from this network, from the open source world, because I was always firewalled out of the rest of the world.
And the Hibernate team was missing me. Like, they were like, oh, Sanne, where, where are you? And um, so I explained the situation, and then they said, well, why don’t you come work for us full time? And so, um, you know, that was a very interesting offer for me. Like, oh, I could join these people and work with them. And so I accepted that immediately.
[00:09:56] Taking a Massive Pay Cut to Work on Open Source
Sanne Grinovero: Yeah. Since we’re talking about careers here, I did a big mistake there as well. I was so keen to join them that I actually took a massive pay cut.
Henry Suryawirawan: Oh, okay.
Sanne Grinovero: And I thought, well, you know, it doesn’t matter. I really want to, you know, I would work for free here. We’ll, uh, you know, we’ll address that later. And, um, it wasn’t addressed later. Like, clearly, I mean, they put me very low in the ladder there, and then I realized I was a bit more senior than that. So it was fixed, but it has been fixed very slowly over the years. Because, of course, once you are inside a big company, there are all kinds of rules. Like I can’t re-adjust or double your salary overnight today. Oh, we need to do this 5% here and 5% over there. So it took some time.
And yeah, thinking in retrospect, I probably, you know, they didn’t have the budget at that moment. I probably could have said, well, let’s talk in two months, you know? And that would’ve been better for everybody. But yeah, I was so keen to join them and learn more and just work full time on those projects, that I said, well, let’s do that. And maybe that was the good thing.
[00:10:59] Contributing to Big Open Source as a Youngster
Henry Suryawirawan: So I think one unique thing that you just shared with us, right, you contributed to open source since very early in your career, right? Since, you know, maybe you won the award and you got into Hibernate, Hibernate Search. Maybe you kind of detour a bit to like banks and all that. But you have always been contributing in the open source, which I find maybe for some people it’s rare because they think you might need experience, understand a little bit of fundamentals and technical details before you can contribute to open source. So maybe can you share a little bit back then, do you find it challenging as a youngster, you know, contributing to a big open source, you know, like the Hibernate and all that? Or do you actually find it’s actually useful for your career?
Sanne Grinovero: Oh, it definitely was useful for my career, and it was challenging, but it wasn’t that early in my career, to be honest. Like I had been studying a university degree, uh, which is, in Italy, it’s like, it’s called, uh, like the old system. So university degrees were far longer, so they would go much deeper. And I was busy with that. So it was a kind an advanced course, right? So many of the fundamentals were kind of known to me. Java, I was not a professional in the Java space, of course, because universities, they don’t really teach you the practical ways of things, right? So, for example, making a library, that’s something that I would had never seen, and Hibernate was a library. Like something that people put at the site. So that was new to me. Or like a build systems, right? You would not really use those in a university systems.
And… But I, since I was working also in Sourcesense and in these other contractor positions, I had been exposed also to, uh, Agile practitioners, extreme programming practitioners and participated in these communities. And, um, I had some really good mentors as well helped me. So I was, becoming really quickly familiar with these other projects. And then, and only then, this open source, uh, things happened.
[00:12:53] State of Hibernate Project
Henry Suryawirawan: Right. If I look back at my career back then, actually Hibernate was kind of like released early in my career. To me, back then it was like a revelation, you know? Usually we wrote like, I don’t know, like JDBC driver, plain SQL. Then come iBATIS, MyBatis, right? And then Hibernate came, became like the de facto ORM. So to me that was like magical, right? Oh, what do you mean? You can write just plain simple Java object and you can translate to SQL queries just by itself? To me, back then it was like magical, right? So having been in that project for that long, right? What is the state of this Hibernate project now? Is ORM widely adopted? Is it like the standard practice for Java developers these days? So tell us maybe a little bit insight.
Sanne Grinovero: So it’s a great question. We do have download statistics. And it’s doing incredibly well. Like we are in the dozens of millions of downloads per month, right? Problem is we don’t know what people do with it. So for all I know, it might be one script somewhere that’s downloading it a million times per day. In practice, we do know of course via Red Hat, we have customers that we know they’re using it, because they open support tickets, they ask questions, they ask clarifications, they ask for like roadmap plans. Uh, they suggest features. So we know there is a, a lot of activity there.
Uh, we are not the first line of support. There are like three lines. So there is, um, lots of people answering, you know, the most common questions. They don’t want to bother us. Then there is a second line of people, more expert for the more difficult questions. And only the maximum escalation level comes to our team directly, right? So even there, we struggle getting a bit of feedback from the front, let’s say. But, uh, just looking at the sizes and stats there, we do know it’s heavily used, right?
And then there are, um, community report researchers that try to get a bit of a breakdown of what community happening. From those it seems that yes, Hibernate is very widely used and it has a extremely large market share now. They’re always a bit biased, you know, each of these vendors, they ask their community their section. So it’s a bit difficult to have a full picture or even like, um, what’s the error range in these measurements? But we’re very confident that pretty much every Java developer has heard of it, you know, or used it at least once in some project.
[00:15:15] Spring Boot
Henry Suryawirawan: I guess that also depends, because back then, right, I must admit I have left Java world for, I don’t know, maybe 10 years or maybe around that time by now, right? So back then, like Spring Boot was the kind of like the main framework for us to build any kind of application. It could be REST API, microservice, whatever that is, right? And Spring Boot by default package Hibernate as their JPA of choice or something like that, right? Maybe that could also be the driver for, you know, the number of downloads, because every time you build Spring Boot apps, it downloads those kind of stuff.
Sanne Grinovero: Yeah, we like, um, Spring. The Spring group is a bit of a competition to JBoss and Red Hat, but they’re also like big friends in the way that, you know, the… They understand that Spring wouldn’t be as useful without Hibernate, and we totally understand that Hibernate wouldn’t be as popular without Spring. So there is a very respectful back channel communications between them. I am a little bit saddened sometimes by how they advertise some things.
And one problem that we have in the relation is that like we are allowed, it’s even in our employment contract, we are allowed to contribute to any open source project ever when we want to. We don’t have to ask for permission. It’s clarified like this in a contract. It doesn’t matter which project it is, it can even be a competitor’s project, other engineers are not that fortunate, and we, we understand that. So there there’s a bit of this sad thing that I know the Spring team sometimes would like us to make some changes, and it’s always a bit of a difficult conversation because they can’t send patches. It’s not allowed for them. And then, uh, you know, for us it’s a bit tricky to understand what exactly you mean.
[00:16:54] Making Hibernate Work on GraalVM
Sanne Grinovero: And some members of the Hibernate team, they really struggle with that kind of relation and therefore, you know, sometimes there is a bit of tension there. But yeah, overall I think there is a strong sense of mutual respect. And, uh, now, of course, there is Quarkus, uh, which is a challenger to Spring Boot that makes things, uh, even more interesting now. I was in the initial group that’s, uh, created Quarkus.
And so actually one of the things we were using as a, like a key thing, like can this whole technology work was like the proof was like, can you get Hibernate to work in this very special way that Quarkus does. The idea was like we wanted to have GraalVM, to support GraalVM properly. GraalVM at the time had a lot of limitations. Uh, many of those have been, you know, softened or resolved, uh, nowadays. But at the time, the list of limitations was really daunting. And among them, pretty much in this list of limitations, Hibernate would do all of them.
So I was tasked with, can you try to make Hibernate work on GraalVM? And, uh, my mentors, uh, Jason Green and Emmanuel, they were very keen about, you need to make it happen. It’s really important for the entire Java world, entire Java ecosystem. And I’ll get back to that, why we thought that was the case. So they were saying to me, okay, maybe some of the features of Hibernate cannot work in native. Remove them. Like they were thinking or suggesting to me, create something new, which would like, have the role of Hibernate in this new world, but maybe different. And we were like, what about like JPA spec, right, and things?
Now the situation was a bit dire. Like, so we do have, we get a lot of importance to the spec. But at the same time, the way cloud native development was going, it was clear that the way the direction Java was taking was just not compatible with this new feature. And so there was a bit of a strong concern that Java would still be alive in 10 years. And then we were really thinking that, okay, if the current Java Enterprise specs are not fit for the purpose, maybe we should propose a new set of specifications. So my task initially was actually like write down what you would think should be something that we were calling like JPA lite. That was the idea. And you have to identify which things that Hibernate is doing today, we can do in this JPA lite, and which things you need to leave behind in interest of making things happen, um, in the, the GraalVM world.
So I start working on that, and this list is very long. And the amount of complexities we have is very daunting. You know, I’m thinking I’m showering a lot and going back and, at some point, I have this eureka moment, which was really like a brilliant. Like I just twisted around the thing a little bit and then I wrote this email to my colleagues saying, look, if we boot the entire framework in this particular way, I have no limitation whatsoever. Like, we solve all the problems that GraalVM is offering. And so there is no need for a new specification, right?
So that was a very nice, uh, breakthrough. Of course, this was a theory. And then, you know, we start prototyping those things and, well, these prototypes are all in GitHub so people can have a look now. It’s um, pretty much if you check out the work with source code, and you sort them by date, and you go in the very early things, you’ll see some scripts and scribbles and really terrible code that I wrote at a time, which have nothing to do with what Quarkus is today. Well, there are other colleagues working on other aspects to make a new generation framework working. But I was focusing on this thing of like, do we need a new spec? Is JPA fit for the future in the GraalVM space, right? And that was resolved in this way, but the way I was resolving this was extremely specific for Hibernate. I mean this was a good breakthrough because if we had solved it, these workarounds for Hibernate, which had all of these limitations, then it was probably going to be easy to apply the same ideas to all the other frameworks, which had simpler use of the JVMs.
[00:21:05] GraalVM Limitations for Running Hibernate
Henry Suryawirawan: Maybe for the benefit of some of us which don’t know the details, like what are some of the biggest limitations that you see GraalVM is not able to run Hibernate or maybe most of the Java frameworks back then, right? What are some of the biggest hurdles for you and how did you actually solve that by inventing Quarkus?
Sanne Grinovero: Okay. Well, I wasn’t alone in inventing Quarkus, right? I was focusing from this aspect. For example, GraalVM, the entire code base needs to be known at build time. That means also like that the byte code is not changing. So, no byte code manipulation, no generation of byte code at runtime. And also like, uh, no reflective invocations. Hibernate needs to do reflective calls. Now, since many years already, we tried to not use reflection at runtime, because it used to be quite inefficient in the JVM. It’s better optimized nowadays in the JVM, but still we try to avoid it. I mean, we already implemented all the schemes to avoid it, so it’s better that way. But at least, during the bootstrap, we need to know your entity, which properties they have, what’s their name, what’s their type, and which classes actually have and the annotations, right?
So all of that goes pretty much via the JDK standard Reflection API, at least it used to. And the reflection does not work at all in native image unless you specifically tell the compiler, hey, uh, sorry there is like a, an additional resource file that you can type in in, I believe it’s JSON now, I forgot. I haven’t written one of these resource files in years. But you can give a lot of input toward the GraalVM compiler to tell it, oh, at runtime this method might need to have like a reflective access. This type needs to have reflective construction. This other type might need to be serializable. You need to be thorough in listing all the cases, otherwise it’s going to fail. Resource loading wouldn’t work unless you register it. Service loading doesn’t work unless you register the type that’s going to be loaded. And well, we do all of these things in Hibernate and in many other frameworks, right?
Now, the key was really like the GraalVM compiler is a Java process and it is triggering initialization of the constants in your code. So what I did was really like, oh, it means that if I put my main class and I do like public static final SessionFactory, and initialize Hibernate in a constant, the GraalVM compiler is going to initialize the entire Hibernate in this constant, and it did. So it’s booted the entire Hibernate in there. And now there are some problems with that. First off, you don’t want it to actually connect to the database, because you’re building application. Your database is maybe not even reachable from this environment. Or well, you certainly don’t want it to connect even if it’s reachable, right? Because you’re building, right?
So I started patching Hibernate in a bit of a private branch. You know, you want to go quick, like, what happens if I delete this stuff? And, you know, nobody cares. There’s lots of patches in there. So I just make sure that the life cycle of the booting phase is pretty much split between two phases. Building the entire model, discovering, doing the reflection work and all that. And then, actually, you know, connecting to the database and doing the things. This was complicated because the bootstrap is very cyclic, very unstructured. It’s, well, it is structured, but it’s designed in an era in which this separation was not an objective at all.
Now the trick here is that all of this reflection and all of this work and annotation, scanning and configuration, parsing all of it, it’s happening when the compiler is running. Now the compiler happens to be a valid JVM. GraalVM is written in Java. So this process in which it’s running and defining the constants, all these operations that are not valid after being compiled are valid during the compilation. So all of these limitations suddenly were not applying. I just needed to make sure that we would not use any of those things at runtime. Of course, we would still use some of those things at runtime, but this really reduced the set to something that was manageable in a short timeframe.
For example, Hibernate. If you use bytecode enhancement on entities, it would not need reflective call on objects, except the constructor, I believe. That’s still a case. But if you do the bytecode, you know, if you don’t do bytecode enhancement, then a lot of reflection is happening. So, you know, very quickly we decided, well, bytecode enhancement is mandatory. We don’t even ask people to use it. It’s just something that the framework does for you during the build. So it’s, uh, it’s simpler. And it’s also simpler for us, because one problem Hibernate had over years is lots of configuration properties, lots of, even in the engine possibilities. Like, uh, do we need to handle the entity as a manager? Do we need to end it? Has it been enhanced with, uh, which capabilities? And so for us, even like reducing the things that we actually need to support also helps us to, uh, increase the quality.
[00:26:09] Java for Cloud Native Application
Henry Suryawirawan: Right. I think one aspect about Java back then, right, it used to be very, people associated it as a heavyweight. You know, whenever you run Java applications first, yeah, when you boot, it takes a while, maybe seconds. And it depends on your project. If it gets bigger, then it might take even up to a minute, I would say. Now with all these inventions like Quarkus and maybe GraalVM itself and maybe other projects that I’m not aware of, has Java become a valid choice for like cloud native application? Think of it like a function-as-a-service, you know, where you need to boot up really fast and react to certain events. Has it reached that stage yet?
Sanne Grinovero: I think it did. Yes, it’s absolutely in that category. Like we do have a Quarkus version for serverless. It starts in milliseconds. So people can really decide, uh, if they want to go into that direction. Actually, the beauty of it is that you don’t have to decide in which direction you’re going upfront, right? You’re not going to choose a framework because you’re going serverless. You’re building your code, and then you can deploy the same application easily. You can change it to, you know, during the, in the build properties saying, well, I want to build this as a serverless function, right? And then maybe you realize, you know, with the, the load on this serverless thing is getting higher and higher, and better off, if this was like a regular Java application, it’s just a matter of changing configuration properties of the system.
Or maybe you want, you know, you are getting like very low load occasionally. But it’s more convenient for you to run it as a native image, and you just can compile the same application to native. What I really like is this flexibility that you don’t have to decide upfront. Like you’re not going to use Quarkus, because you need native. You’re going to use Quarkus because you want to write in Java. And what’s coming after that, well, depends on the needs of the day. And, you know, requirements change often and agility is quite important nowadays. It helps to keep the cost low, uh, to adapt very quickly.
[00:28:04] Quarkus vs Spring Boot
Henry Suryawirawan: Right. I mean Quarkus itself solves almost kind like similar problem to Spring Boot, right? Like it helps people to bootstrap, like create new applications faster and there are a lot of, you know, niceties, you know, auto generation and things like that, I guess. So tell us why we should use probably Quarkus versus Spring Boot? I know that for some people, this is probably a common question.
Sanne Grinovero: So I think we are at a stage in which the majority of Java developers have experience with Spring Boot, right? So one thing that we really took a lot of care of is to make it really easy for somebody that has experience with Spring Boot to move to Quarkus. There is a book by Eric Deandrea about, it’s called, I believe, Quarkus for Spring Developers. And the book is free. You can just Google it. You can download a PDF for free, like, or you can also buy a paper copy if you want it sent, but essentially can get the PDF for free. It is really easy because you know they’re built on very similar technologies. Like if you have say a very large, complex Hibernate model, I mean, they’re running the same Hibernate. They’re probably even running the same version of Hibernate, right? So that’s a piece of cake, right? Now there are some APIs in Spring, say you’re using, uh, Spring Data JPA right now. I don’t like it, but that’s personal, right? It might totally be fitting for your project.
Now we do have a Spring Data JPA in Quarkus. It’s probably not perfect, because when you’re replacing implementation from A to B, there might be some imperfection, but it will definitely help people to migrate from one to the other. And basically they’re built on the same similar standards. Like, uh, so if you’re using like the JPA spec, or even if you’re just using JDBC, servlets, uh, Jackson REST, uh, you’re using Jackson, you want to, you know, use Kafka Connect to Elasticsearch. It’ll be all be pretty, very, very, very similar. Much, pretty much the same, in many cases, the same code, right? So that’s very easy.
Now why would you use Quarkus? There are lots of very good reasons. First off is, well, the developer joy is fantastic. Developer joy is our framework of reference, but it means several things like that pretty much we make your productivity very high. The feedback loop is really short and that makes people happy. Essentially, the main feature is, uh, the live reloading capability. We do aim that any change you make in the code when you are in dev mode is reflected in your running system under a hundred milliseconds. That means that you are, you change a method, you refresh your browser, and you immediately see if you’re on the right path.
You make a mistake, like I did a demo this morning and I forgot to change some path in the, uh, REST endpoint and, you know, then I had the duplicated path, because I made my change by copying a block and then making a change. And then, you know, I refresh the browser, I get an error in the browser saying me what I had done wrong. Okay. So I flip back the focus, change the thing, refresh, and now I’m fine, right? This kind of errors since I get immediate feedback and I’m still focused on, I just created a method, it creates a much lower cognitive load, right? So I’m not frustrated because an error happened ‘cause I’m still in the flow. I have not been distracted, and then I know I just keep going with my things. So I’m happy because I’m very productive and I’m learning and I’m constantly getting feedback that I’m on the right path.
Speaking of feedback on the right path, we have something called, um, continuous testing. So while you’re working, you can have continuous testing running, which is pretty much like it’s running the unit tests in a loop really quickly. And while you’re coding, you might see now this test is red. This is immediate, right? And there are some interesting techniques in there so that it actually knows how to prioritize which tests to run, which are related to the code you modify, right?
The other thing is, uh, dev services. So if you want to start developing, say a new application which is like Hibernate connected to Postgres and maybe Elasticsearch using Hibernate Search. And maybe Infinispan as an external cache. Now you start having many external components. Now as a developer, it quickly, you know, becomes, oh, okay, I’ll spend my morning installing all these systems. In Quarkus, you don’t have to install anything at all. You’re starting, it knows, okay, you have the Postgres extension, you have Hibernate. This implies you’re going to need Postgres.
So it’ll, behind the scenes, it’ll use Testcontainers, fetch a Postgres instance, start a Postgres instance behind the scenes for you, and you don’t even have to provide the connection properties, because those are being provided and injected into the running dev mode. So you can quickly start working on your model and immediately get refresh. You know, you just refresh application and see the schema evolving as you are evolving the model or, you know, in the other direction depending what’s your cup of tea? But the flow goes really fast and you, you’re not wasting time on boring things, right?
Henry Suryawirawan: Right. I really believe that the feedback loop, right, the shorter you can make it, right, and the developer joy, right? I still remember back then when I did Java, right? Whenever there’s a class signature that I need to change, it was like, oh man, I have to restart my applications, wait for the bootstrap.
[00:33:21] JRebel & Quarkus
Henry Suryawirawan: And back then when there was a JRebel, maybe you have heard about it. That was also quite revolutionary, although it was quite pricey back then for some of us, right? But yeah, this thing that you mentioned, even though I haven’t used Quarkus, I really believe that it can make life really simpler and more productive-for developers.
Sanne Grinovero: Yeah. Yeah. We, I remember at the time, yeah, JRebel was very interesting. But I think they had a big maintenance problem, because they had to know how each framework is going to react. They needed to know how to… I remember the conversation with them. I was already, uh, known in the Hibernate community. They wanted us to have some kind of stable API that we would promise to never change over time so that they would know where to hook. It was very useful, but it was also extremely costly, you know.
Now Quarkus really takes a very innovative idea there, which is like since it’s so fast to boot, we just rebooted our application over time. And it’s very reassuring. It means you really have a clean slate, and this is really the output. It’s not, you know, something fancy, because maybe some of your tools is something strange.
Henry Suryawirawan: The state might be gone, right?
Sanne Grinovero: The state is gone. But that encourages you to also work on your import scripts and your setup scripts in the, in the right way, right? So you are constantly also checking that those things are in sync. It actually leads you into the right direction.
[00:34:35] Java vs New Programming Languages
Henry Suryawirawan: Right. So all along in your so-called career, right? Maybe you dealt mainly with Java technologies. I know like for some, I dunno, youngsters, right? People who just came into software engineering maybe in the last 10 years or so, Java is associated with like oh, legacy heavyweight. And now also like the version changes so fast. So how do you compare, maybe from your point of view, maybe a little bit biased, but how do you compare Java now with like modern technology, like programming languages, like maybe Rust, Go, and even TypeScript, right, or Python? What are still some of the strengths that Java has that people should consider, even though they’re like youngsters, they want modern technologies? Yeah.
Sanne Grinovero: I honestly think Java is in a very, very good position. People maybe don’t realize it, right? Because, you know, it depends who you listen and what you get excited about. But if you look at, you know, each of the languages you mentioned, they all have like one strong suit and very weak in other areas. While Java is maybe not top leader in all of those areas, but it’s very close to be leading in all of those areas. It has been innovating quite aggressively recently. Like I think the Oracle stewards and including like the Red Hat engineers also contributed some. The improvements there are, um, are steadying up. The pace accelerated and it’s very interesting where it’s headed.
Like now we’re working on a Project Leyden, there are lots of interesting things happening in the OpenJDK. But personally, very interested in Project Leyden, because of the things that we do with Quarkus and how we also integrate with it, right? So Project Leyden is going to, you know, they kinda realize from, you know, pressure and GraalVM the interesting people that it boots faster, that the OpenJDK had the problem in booting too slowly. And they’re addressing that. It’s improving very significantly with Leyden. And so that’s very interesting.
Project Liliput is making it consume less memory, because it had this frame of being bloated and all that. Honestly, the fame of being bloated is very often coming from the frameworks that were pretty much not designed to do things, to boot fast, because nobody cared, right? The application was going to be up for many, many months. And if it was taking some seconds more when it would booting, that was like a drop in the bucket. Completely meaningless.
So these things are being addressed now, because people start to pay attention to them. Now, of course, these, these libraries, they’re so widely used and they’re so large and, uh, featureful that it takes some time to get there, right? But we are getting there really quickly if you look into the Quarkus space. Like a very big complex Quarkus application with thousand Hibernate entities can boot in under one second. That’s, um, that’s, yeah, that’s, I’m very, very happy with that. But we keep working on it. I have more ambitious targets. Like we want to go in the, like 200-300 milliseconds space.
And yeah, about other, the other languages, well, uh, Rust is really very interesting, but more for the properties that it has, right? We do believe that in terms of like achieving maximum performance or maximum efficiency of the system, like if you really want to handle a very, very high load, Java is the way to go. It’s getting really, well, there are so many clever things happening in the JVM, in GraalVM. The combination of these things, the combination with Quarkus, things that we’re exploring, are really pushing the throughputs to very, very high levels. And we do compete and we do benchmark ourselves also with benchmarks in other languages. Because Quarkus is significantly faster than any other Java framework around there. So it’s not fun. The challenge really is like, is this design perfect? Like can this go any faster, right? Today, to verify that, I need to compare myself with other languages, including like Rust, Assembly, uh, C and uh, we’re getting really close to that level.
Henry Suryawirawan: Nice. How about Kotlin? I mean, is it like the default language used or people still write in Java?
Sanne Grinovero: I see a lot of interest in Kotlin, but again, it depends in which area you’re looking. I have not intentionally avoid Kotlin. I try to learn it, but I never had any actual need. I’m not a Kotlin professional at all. Like everything I do is in Java and I don’t feel the need for Kotlin. I dunno, time might tell, but the impression really is that Kotlin and Ceylon, they have been pushing the JVM to innovate. But many of the most important things, they are now available in the JVM or they’re coming very soon in the JVM, right? So this is kind of removing the need for people to go and learn uh, Scala, Kotlin, other things.
[00:39:22] The ORM Dilemma
Henry Suryawirawan: So let’s maybe go back to the Hibernate side, right? So ORM technologies, I mean, many programming languages now support some kind of ORM libraries. Some people like it because maybe they can write some, you know, database related applications fast. Some people really hate it. So from someone who is like a co-maintainer of Hibernate, what is your opinion?
Sanne Grinovero: Yeah, we, we had to have a thick skin, because yeah, there there are lots of Hibernate haters, right? And, um, there are two categories, I think of Hibernate haters, generally. There is, uh, a large group of people that sadly have been taught Hibernate the wrong way. And I am trying to address that. It’s difficult because knowledge propagates online without getting, you know, I’d have no control over those things, right? We might have some authority saying, hey, I work on Hibernate. But still, if somebody publishes a book, and it’s completely wrong, I can’t go to the editor and say, you have to withdraw this from the market, right? And if somebody publish your blog, I can’t go to Google and say, you need to delist this, because I don’t agree with its content, right? That’s not how it works.
And then of course, there is a category of people that, they have been imposed that you use, you have to use Hibernate for this project when it made no sense, right? This is something that we also fight for. Hibernate is not something that should be used in every situation. There are some situations in which is really not under the right tool. But still it gets imposed as a standard by, in this case, some places, right? And of course, if you are a smart developer and you understand that this is being imposed on you and it is the wrong tool, you know you’re not going to have a good relation with the tool, right?
Henry Suryawirawan: When do you think it’s not the right time to use like ORM or Hibernate?
Sanne Grinovero: Well, I might be biased. I would always start from an ORM, or at least, in most cases. Now, of course, if you need to do a lot of operations inside the database, maybe stored procedures are frowned upon, but in some cases they are the right solution. I would always try to minimize the, the span of transactions. So if that implies that the transaction gets extremely chatty over the wire, that’s a problem, right? Then it’s not a good solution. But in most cases, I would have in my system, I would have Hibernate available. And then, you know, there are many operations, many business operations, and some of them would use Hibernate. Some of them would not use Hibernate, right? It’s important that people remember that Hibernate is an ORM, but it’s also facilitating access to native SQL queries in many ways, and mapping results of native SQL queries.
One thing that was done recently, Hibernate had since a very long time, they had the stateless session, which is important for some of these access patterns. And well, uh, recently the stateless session got some more love, like some, some more improvements in that area. And the documentation was improved a lot as well. So, uh, a good user should understand when to use Hibernate with the stateful session, Hibernate with the stateless session, or when to just send native statements to the database.
[00:42:38] Some Hibernate Design Pattern Tips
Henry Suryawirawan: Yeah, I guess this also comes back to the design, right? The design of your application, because it can be misused in a way such that your entity class is used all over the places, right? Maybe from the entrypoints of the APIs, you deal with the entity class, straight away, right? You propagate all this, you know, so-called object chain all over the places and somehow magically the transaction works. I guess that’s when people actually kind of like hate this ORM. And especially if you have like the N+1 problem, those kind of stuff, right? It tends to be very slow.
I guess the design is important, right? So you encapsulate the entity for the right reason and don’t propagate it all over the places. Don’t expose attributes that you’re not supposed to, to other parts of the, you know, other modules, I guess. So maybe in your point of view, what kind of design pattern maybe that people should think about? Is it like domain driven design or is it like something like the hexagonal pattern? Is there anything that you think, from your experience as well?
Sanne Grinovero: Those patterns, they’re all fine. Like it’s more like how people think that the operation will work in a database that is important. And then there are lots of like lore that people give each other, which are actually unfounded. Just a very simple one. A lot of people still believe that a Hibernate entity needs to implement serializable. It’s just not true. You know, it might need serializable, because you’re using that same object with other frameworks which require it, right? But Hibernate doesn’t care at all if it’s serializable, we never need it. And then, you know, they are serializable and then they add the serial UID and you know, they’re adding lots of things in there, which I’m thinking, well, fine, you can add it, but you’re just, you know, making your code less readable.
And then, you know, there are discussions getters and setters rather than a field, make it public. You can do whatever is good for designing your application. Hibernate doesn’t care. It can be a public field for all we want. It can be a private field. It doesn’t matter. We will, we’ll get access to it in some way, right? And it doesn’t really make any change in the semantics of what we do, right? It’s all the same.
The equals and hash code is a very tricky one. Because people seem to think they have to implement equals and hash code on the entities. In practice, they don’t. But if you implement it, there is a very good chance you’re getting it wrong. So I would typically suggest don’t implement it, please. And why do I say you are getting it wrong? Because it’s an entity. The purpose of the entity is that you change its state to represent changes that you want to happen in the database.
Henry Suryawirawan: Yeah.
Sanne Grinovero: Now it means that you’re changing the state, like you’re going to change the hash code. Now the only reason for you to implement equals and hash code is because you want to store this, say in a hash set somewhere. Again, Hibernate doesn’t care about this, right? If you implement it or not, it’s totally fine. But you might want to implement something in your entity, because you need it for some other reason. Like you want to store this in a hash set. But if you store things with multiple attributes in a hash set, you are calling for trouble, because that’s how Java collections work. So it’s a bad idea for Java collections.
The only thing that’s typically stable in an entity is the primary key. And I’m saying typically, because if you just created the object and didn’t store it yet, the primary key is not assigned, right? Unless you assign them yourself. So one correct way, in my opinion, because of course might vary, but in my opinion, one correct way of implementing equals and hash code is to only include id, the primary key in your implementation, but also to make sure that before you ever invoke those, the ID gets assigned, right? Either by you or by the framework. And then you start having these kind of responsibilities and if you just leave the default, it’s going to work.
Henry Suryawirawan: Now that you mentioned it, I could still remember back then, right? Equals, hash code we use IDE auto generation most of the time and choose the important properties or attributes, everything. It would be, uh, you know, important for the entity class.
[00:46:40] Getting Paid Working on Open Source
Henry Suryawirawan: So going back to the open source world, right? You mentioned you work in open source, but also get contracts like employed as in like you contribute to open source. For some people, like for me, I haven’t done it before. How does it like to work in an open source? But it’s kind of like paid to do that.
Sanne Grinovero: So at, at the time, you mean like the time before I was employed by Red Hat?
Henry Suryawirawan: Yeah.
Sanne Grinovero: Um, yeah, that was, uh, that was very interesting. Of course, uh, good money, but also you spend some time in the commercial aspect things, which I hated. Like I would forget to send invoices and then just don’t care about it, and then I would have no money. But, you know, if you do it properly and you are disciplined with the commercial part, I think that would be a very good career, right? But you need a network, right? You need to be somebody that’s actually an expert, right? So to be an actual expert, you need to spend time contributing those things.
So I think a model that would work really well for an open source contractor is somebody that charges a premium, because, so to some important customer, because he’s actively an expert. But also because he makes changes happen in the open source project, right? So the company might have a particular issue. You are able to fix it and therefore you can charge a premium, but then you also actually do fix it and make sure that it gets merged. Now that is a bit tricky, because, you know, you might think, well, this is a solution, I’m going to push it through the project and I’m done. And you charge, right? But there are the other members of the team might not agree with that change, right? So there is that risk. It means you really need to work on being really good, right? Because you need to be persuasive to the other people and you need to really make sure that it’s a high standard, good quality work, right? So yeah, you might charge a premium, but maybe you have been at that company just days, but you’re going to spend 20 days making sure that that update gets merged, right? So it’s that balance.
[00:48:41] Hibernate License Change
Henry Suryawirawan: So at the moment, I mean, if you’re still active in the Hibernate, because you are a technical lead, right, I assume. How many contributors are there in this project?
Sanne Grinovero: I actually do know now, because we just changed the license of Hibernate ORM. It has been since forever LGPL 2.1 with what we call classpath clarification. Now in Java, LGPL uh, spare you the details, but we decided at some point that it was, you know, rather than having to have clarifications about what was interpretation of the license, to reassure people that it’s fine, it’s open source, but it does not affect your code. That was the concern for some companies, right? Of course, not many companies, because a lot of people use it. But we did have some cases in which people had this rule, you can’t use Hibernate or you need to use, you can use it, but the code needs to be compiled, purely against the JPA APIs that you can’t evoke Hibernate code.
To clarify that it’s easier to be Apache license, by Apache License Version 2. So we wanted to change to Apache License Version 2. This is actually one of the first things I asked my colleagues when I joined many, many years ago, is, oh, wouldn’t it be easier if we switched the license? I remember they laughed at me like, oh yeah, maybe, but it’s impossible. We can’t do it. And why? Why can’t you do it? Well, you need permission from all the contributors. So now I really want to change the license, because of other reasons. We can get to them later. But we had to contact every single contributor ever that made some meaningful contribution for projects.
The key is meaningful, right? Because otherwise we would never have finished. But yeah, we had to go through, it’s like more than 2000 contributors. So we start sending requests to the ones that contributed the most so that they, we didn’t have to review as much code. And then there is this long tail of people that contributed maybe just one or two patches, and those who have been looking at one by one to see is this meaningful from a legal and copyright, intellectual property law point of view, right? So you discard some of them and then you start sending more emails and more emails and more emails. And yeah, eventually, we got permission from everybody. So now it’s Apache license too, but that was, that was big. It’s a very large community.
[00:51:05] Intellectual Property & Meaningful Contributions
Henry Suryawirawan: That’s pretty a lot, right? 2000 plus contributors. And when you say meaningful, what do you mean? Like how do you define meaningful, right?
Sanne Grinovero: Yeah, the tricky part was to understand that it’s meaningful in the context of intellectual property and not from the point of view of software engineering, right? So if you had, the, for example, in the grammar, there is a piece of code. It’s just like a string. It looks like a bit like a regular expression. So imagine you have a regular expression that’s like a page long. Somebody added question mark in one very specific point to fix an issue, you as a software engineer, you look at that and well, you know, it’s a one character change. At the same time, you know, it probably hasn’t been easy, you know, to figure out that from the problem you had, distill it to a test and then eventually figure out that that one character was missing precisely at that point. So a lot of work behind that patch. But from an intellectual property point of view, it’s just one character. It doesn’t matter.
On the other hand, if somebody would fix something trivial, just a one liner in implementation. But now a rule we have is every contribution needs to be covered by a test that covers for that, for future regressions, right? So that you can say, it’s fixed, then it’ll never happen again. So even if somebody would contribute a fix, which is online would ask, well, can you add a test for it? And now the test would have an entity. The entity needs to have a name. So somebody would just have a person, somebody would say animal, or you know, somebody would come up with something new. There’s creativity in that. That is meaningful. Even if it’s a very trivial test, which is probably copied like the same template and the same pattern from many, many other things. So you need to understand this difference.
[00:52:52] AI Usage & Copyright in Open Source
Henry Suryawirawan: When you mentioned about that, I mean, it reminded me with all this AI now, right? Because somebody could generate tests very easily with AI, and now this becomes blurry, right? Is it meaningful because, you know, a machine actually generated that? Like in your maybe open source experience, have you seen a lot of increased contributors that actually leverage AI? And what are the reactions of the core open source community towards, you know, AI? Because on one hand, sometimes it works, right? But most of the time, most of the design might not be optimal and maybe it hallucinates a little bit, or it infringes some copyright from some other libraries that it copies? Like you don’t know from where, so how do you, what’s your take about all this?
Sanne Grinovero: It’s very difficult to say if somebody use the AI, right? Yes. So we do see an increase in contributions. But I mean, Quarkus didn’t exist six years ago, and we have a thousand contributors in Quarkus nowadays. So it, it’s really skyrocketing the interest, but also the amount of contributions in there. It’s growing significantly. I wouldn’t know if it’s AI, right? I would guess there is very, very little AI in there. There might be some, but I, I suspect actually none. That’s my suspicion, right?
But if I need to create a batch script, which is say, copying some things from one to the other, I’ve seen that AI is very helpful with that, because I’m a little bit out of my territory. I know how to write batch scripts, but I don’t remember some of the details, so I need to google, like, how is the equality sign again, for variables, integers well I don’t remember those things. So I use an AI for that. It helps me. I can check, oh yeah, that’s what I needed, you know, surfaces some memories and you try it out, it works.
But when it comes to Java code, it never did the right thing for me. Never. And I think it’s because the kind of work we do is always kind of novel in a particular strange space, right? I’m not using Hibernate or creating a new entity, which would potentially be a very repetitive thing, but requires maybe domain knowledge, right? Maybe you are in a medical field, you know exactly what kind of proteins you need to do here. And therefore you map that and putting the annotation on there and the properties is a boring thing that AI can help you with. The kind of puzzles we solve are bit in a different league.
[00:55:21] Biggest Challenge Working in a Big Open Source
Henry Suryawirawan: So you have worked with so many contributors. Maybe tell us what are your biggest challenges working in such a big, you know, open source project?
Sanne Grinovero: There was a time in which I tried to follow all the discussions. I no longer do that. Um, it’s important to have subgroups and a lot of trust in other people. So I know there are areas that are being watched by colleagues, friends, external contributors that I trust. And I really, really trust them. And I also know that if they needed me, they would come to me. And so I don’t have to go and read. That has been overwhelming and yeah, that doesn’t work.
[00:56:08] Politics in Open Source
Henry Suryawirawan: I’m quite curious, is there such thing as politics in open source project? Because as you have numbers of people, right? Maybe some people have a strong opinions, they gather influence. Is there such a thing? Because I’ve never been involved in such a big source project, I’m just wondering. Because this tends to happen in any kind of big organizations.
Sanne Grinovero: I think there is. I wouldn’t say if it’s politics. But there certainly are strong opinions, right? Very often they come from misunderstandings. But also, you know, some discussions are happening in a chat maybe, and you are typing a response before having read the other one. People starting to lean on things, if they go on a tangent, right? And then there is a significant misunderstanding sometimes. And now if I, if he didn’t understand the problem, and then i’m really sure that this is the solution. And the other person is like, you’re an idiot. That doesn’t solve my problem at all, right?
So yeah, these things, these things happen. I’ve never seen people being intentionally going in the wrong, you know, or trying to mislead others. Like everybody’s coming in very good faith, right? And so when there is something, some tension growing, it’s always a misunderstanding. But also, you know, emotions, tone, they don’t come across really well in written form. Also, it’s all software engineers. They might have a bit of empathy problems and it’s extremely international. So culturally, the expressions might not translate really well or translate in the wrong way. And then, you know, that amplifies some problems.
Henry Suryawirawan: Right. So, yeah, I think I’m always amazed, you know, like in open source project, especially with this many contributors, people may not meet each other, right? They may not know each other. But they can build like such a good software, you know, like that works and serves more people than just the contributors themselves, right? It’s always amazing for me and kind of like the pickup rate of open source maybe in the past 20 years has been a lot, right? Like so many companies these days will just adopt open source. Before when I started my career, it’s always a problem. Okay. You cannot use this open source. You have to go through, I dunno, an enterprise architect board to approve a certain version of an open source. But these days, I’m sure, like, I think almost all software engineers would just use open source, because it’s so ubiquitous and so made life so much easier, right?
[00:58:32] Security Risks in Open Source
Henry Suryawirawan: So one aspect of open source that is becoming a challenge these days about security. We have seen many threat actor trying to be a contributor, make some changes that actually is, you know, security threat. How do you actually identify this? Detect and maybe protect your open source from such, you know, threat actors?
Sanne Grinovero: Yeah. That was certainly a wake up call. We used to give, say, commit access, quite easily. Yeah. I wouldn’t say too easily, but if you had been around for, let’s say, six months and doing some good work, I would give you commit access. Nowadays, I am, I’m not saying I’m going to do a background check, but kind of like, I want to know what kind of person I’m dealing with. And, um, the whole, uh, the whole life cycle and management of projects changed a bit. Like, um, in some projects, we really just, really restrict the permissions to the bare minimum. This might seem a bit unfair, and we’re trying to compensate the fairness now with, you know, a bit of an open governance that is writing down rules of like, how do you join the project and what are the expectations. It’s not clearly written down, right? So that there is a level of fairness. It’s difficult to write down those rules because you need to think about them and how does this work, right? And it’s kind of a novel territory there.
But yeah, there was a time in which it would’ve been fairly easy to get commit access. But even then we always review each other’s code. So the way, you know, GitHub rules are set up, CI is set up, you know, we really do expect that even if I may want to make a change, like I said, a pull request and somebody else is going to review it, and then it gets merged. And there is a lot of automation there. Some of my colleagues, they created a very nice framework to create a GitHub bot. So anytime there is a need of making changes there, there is some new script thingy starting and helping. So it’s kind of easy to also enforce rules like this. Also with Git, when I start my work, I fetch changes and I will always look at them. I might miss something though, right? Yeah. That’s, that’s the risk.
Henry Suryawirawan: So yeah, again, like these security issues really is very hard. And especially, we have heard so many, especially maybe in the JavaScript world, right? Because when you pull one package, you pull maybe ten or more dependencies. Sometimes it’s just a small library that you think it’s insignificant, but it could be, you know, changed by some hackers or whatever that is such that you’re using vulnerable libraries, right? So I think again, open source can be a threat sometimes, especially these days.
And I was uh, having chat in some other episodes as well like when you create an application, 90% of what you’re running is actually open source software. So yeah, like you really don’t know how come the code gets generated that way, right? What kind of things that it does on the background. So I think, yeah, maybe one challenge there for people to actually also identify vulnerabilities as you pull new versions or new changes in the…
Sanne Grinovero: Yeah, well, we’re certainly looking at it much more carefully. Like one thing we’re working on now is like reproducible builds, right? We want to make sure that the builds are reproducible, that helps to, you know, certify origin of things. It’s going to be mandatory for Red Hat products and projects, I believe it is already, maybe. Um, sorry. I’m not very involved in those areas, but there are certainly a lot of attention, right? For example, anything like, you know, Red Hat supports product versions of our projects, and that’s why they employ us. They sponsor the project pretty much, right? But what they do is like, they do rebuild the entire thing in a closed air gap environment before it’s being sent to customers, right? And they have a lot of additional checks and controls at that level.
[01:02:25] Donating Hibernate to Commonhaus Foundation
Sanne Grinovero: Of course, that happens after our upstream work. So some things that we would like to do really is to improve the upstream project as well. It’s not just a responsibility of Red Hat, it’s a responsibility of how the open source project is set up. And well, one of the things we’re doing now is we are actually donating the entire Hibernate code base and intellectual property to an open source foundation. This is literally to signal that this is not just Red Hat’s responsibility, right? We do have many contributors, from other companies, especially like database vendors. They really like that Hibernate supports all their exotic features, including features of database versions that have not been released yet.
And, you know, initially, those conversations were a bit funny. Like they wanted to pay us to implement things that we were not allowed to know about unless we signed an NDA. But we’re not going to sign an NDA with like Oracle or things like that when we’re employed for Red Hat. It gets all very tricky and things. So, um, they, all these other companies, they do stuff, people that work with us on the Hibernate code base. And we really want to make sure that that happens more frequently. And it’s really nice for us and for the project to have more companies involved in project.
So for that, these projects are being now donated to a Commonhaus Foundation, which is a, a very young, new foundation. We did explore like, uh, the Eclipse Foundation, the Apache Foundation. They’re all fine and great for some projects, particular projects, but for a mature framework or mature library like Hibernate, in which we already have our way of working, our CIs, our system being. Like getting in Apache would’ve been problematic. You need to migrate our ticket system, our mailing list, and it’s a lot of work. They also have a lot of other rules that we don’t necessarily like. We have an established process, which we think works very well. Like we have experience as well. So Commonhaus gives us a bit more, um, flexibility in that sense.
So yeah, it’s going to Commonhaus. And yeah, we really hope that that triggers then more companies to not only contribute, but also steer it and lead it. Like this is all entirely in the hands of Red Hat engineers nowadays, which is totally fine, but, you know, more diversity there would be really nice.
[01:04:49] The Future of Red Hat
Henry Suryawirawan: So if you are allowed, right, to talk about. So you’ve been in Red Hat for like 16 years, and throughout this time, there’s so many changes, a series of acquisition, a series of license probably changes for some of those. So tell us how Red Hat, you know, is going to advance in the next few years, right? Where do you see the next big thing that will come from Red Hat?
Sanne Grinovero: We just had very big news. It’s very big for us. Probably, I hope, meaningless for everybody else. But our entire group is being moved to IBM. So we will no longer be under Red Hat, but under IBM. The things they promised was, the reasons they gave us, seem very positive. Like it seems like a really good idea. IBM has always had a very large team working on a lots of Java things, including a lot of open source Java projects. And so we are even not even joining the team, we’re going to be side to side with them. But I expect a lot more collaboration to happen with those guys, right? So that, that’s great.
We do have concerns about the open source commitment, because like in Red Hat, it’s very easy. Like we, as I said before in our employment contracts, we have this thing that you’re allowed to contribute to anything. IBM has been very reassuring about us. Like they clearly don’t want to lose us and they want us to keep working the way we are, we are used to work. So probably, nothing is going to change, but for us, this is, uh, a bit surprising. And yeah. I can’t answer your question about where Red Hat is going because uh, we won’t even be there, right?
Henry Suryawirawan: For such a big name, you know, Red Hat. It has been in the open source from the Linux and many, many many other projects like Hibernate. I think that’s really a big contribution. And hopefully, you guys can continue all this great work and, you know, support the community.
[01:06:39] 3 Tech Lead Wisdom
Henry Suryawirawan: So Sanne, as we reach the end of our conversation, I have one last question before I let you go. I call this the three technical leadership wisdom, but you can think of it simply just like advice that you want to give to the listeners. Maybe you can share some of your advice for us.
Sanne Grinovero: Yeah, this is the tricky question. I thought about like, the most important one. I realized this was actually advice given to me some years ago. It took me a while to implement or realize how important it is. But I think it’s very important to make yourself replaceable, aggressively, right? So I think many of us working in this space that we might suffer from, um, you know, uh, imposter syndrome, right? Oh, I got here out of luck, but I don’t really know as much as all these other smart people I’m working with, right? So you kind of, tend to make yourself valuable so that you are kind of reassured that you’re not going to be removed, uh, next week, right?
Now I have been working on Hibernate for a very long time, and then, you know, we created Quarkus, and then I was involved in Quarkus and in Hibernate, and I was the architect for the Hibernate team, which means also like interfacing with all the other data products that have to do something with Hibernate or integrate with it or, and know about, you know, lifecycle versions. How long are you gonna continue, you know, supporting this other branch? Lots of discussions. And it was just way too much. I love these projects. So I could not just quit any of them, because I felt that some things were unfinished and were not clear, or like some other people were not, you know, the right position to replace me. And that was actually a problem.
So I’ve been mentoring, uh, Yoann Rodière now. He’s a extremely brilliant engineer in France. And he’s, he took over already, uh, since last October, I believe. The role of Hibernate architect, right? So I’m no longer officially in, but I’m mentoring him. So I’m still kind of in the picture and I’m still working on Hibernate, right? But I really realized that it’s important to make sure that I’m not indispensable. I had to go on paternal leave. Uh, and so I was literally no, not having sleep for four months. It’s not good for the project if something like that happens and you are not easily replaceable, right? So it also prevented me from expanding and like diving deep into other important opportunities within these projects, right?
Yeah, this is done now. I think we’re all in a better position, because also out of respect for the project, the other people, they were not getting the attention they needed toward the direction they needed. Now they have him and it’s us, right? So, um, yeah, making yourself indispensable, a big mistake. But that’s what we tend to do.
And in the same space, I’m thinking of, um, interviews. Like so I’ve been at Red Hat for a very long time. And another funny thing is most of my colleagues have been the same for all those years, and I even had like the same manager for, I think, like 14 years. And he didn’t even quit. He retired at some point, because, you know, all these long steps. Now I realize in the industry this is really, really unusual. And for many, many years I also did not interview anywhere else. Because, you know, you love the project. You have a fantastic team. And so, you know, going and answer to a competitor or somebody feels a bit like a betrayal of your best friends or your life’s, uh, baby, right?
I think that was a mistake as well. I did some more interviews in recent years. And doing them, it helps well better understand my own value and then therefore, you know, you get those very interesting offers. It builds up my confidence. And that helps again to fight impostor syndrome. And that helps to realize that, you know, the way you’re working is valuable, it’s valued by the others, and it just helps make you a better leader where you are. I never left because, you know, yeah. You get maybe the offer. It’s reassuring to know that even if you left here, there are other opportunities. But then you know, you still reflect like, well, I, but I like this one. But, but, it’s still something that I even suggest to my colleagues, you know, do some interviews sometimes. It’s good. And then, you know, we talk about it. You know, worst case, you, you are going to need a raise to stay. It’s also not bad.
Uh. To truly listen to the others. Like one thing as a leader, especially in these groups, it always resonates to me. These six… in the aerospace industry, they noted that most accidents happen when, you know, you have two pilots on an airplane. It’s much more likely that an accident happens when the senior pilot is piloting, because the other guy that’s, you know, they monitor each other, the junior one is less likely to speak up. Or if he does, he might not be respected in his opinion. That really struck with me, and I think it applies also a lot in other areas, right? Especially the technical things we work on.
I’ve seen, you know, in all these chats and all these misunderstandings that we have, it happens quite often that somebody that’s very junior or maybe has a very basic understanding of our frameworks. You know, an external user comes to us in the chat and asks something, he clearly has many misunderstandings or not read something, etc. And then, you know, his opinions get really discouraged really quickly. And sometimes, you know, many times, it doesn’t add value, right? But sometimes there are really important feedbacks in there. Also between colleagues, you know, there is a bit of a hierarchy, so if you are on the top, it’s very important to listen what the other guys say.
And, well, the opposite of listening truthfully is also like I expect the others to also be truthful in what, what they say, right? And this is especially important now that we all work remotely and that we are far away and we don’t know each other. The trust that there is between the people is so important.
I had been blindsided once. Like there was one person that lied to me. And I realized later that I was like, I was very naive. I realized it had been many, many, many years that I’ve been working with lots of smart people and it had never happened to me, right? So I completely am in, working in a world in which the technical excellence is really reached by the fact that these people are very honest about what they see, what they’re perceiving and all that.
So I feel like it’s, when something doesn’t, you know, you didn’t do something that you had to do, I really value that people are very honest about what it is. Like it’s much better to hear that, oh, you didn’t do it, because yesterday you had other things on your mind and you didn’t feel like working. And that builds a much stronger relation. And, you know, you might need some slack or you might have a motivation issue, and then it’s better if you tell me and we can work on that together. And that really helps creating a bonding in the long term. But then we see in these teams that, you know, they actually, we stay together for a long time and we may create good things together, right?
Henry Suryawirawan: Well, I really love that, you know, listening and be open, say truthful thing, right? The psychological safety. And, you know, some people say that.
Sanne Grinovero: That’s so important.
Henry Suryawirawan: That’s really super important. Sanne, thank you so much for coming here.
Sanne Grinovero: Thank you.
Henry Suryawirawan: Again, this our first time doing the in-person podcast. I hope you enjoyed the experience.
Sanne Grinovero: It was fun.
Henry Suryawirawan: Yeah, good with all the open source project out there. So again, thank for your time.
Sanne Grinovero: Yeah, Thank you.
– End –