I just learned that some private keys leaked for a widely-trusted certificate authority. This is bad: it makes it possible for attackers to impersonate HTTPS services. If you’re shipping a mobile app or service that uses OkHttp, you’re exposed to this problem until the host platform’s trusted…
You are a restaurant owner-operator. You’ve been running your restaurant, Sam’s Pub, for almost ten years now, and you’re so proud of what you’ve built. You’ve hired a great staff, and you pay them fairly. You’ve developed a menu with items that use local…
Working with threads always feels hazardous to me. Non-determinism limits how much we can exercise with simple tests. Stress tests can shake out some bugs, but they’re slow and potentially flaky. I don’t like flaky tests. So I have a few concurrency patterns that I trust, and I…
I presented this at KotlinConf on May 22, 2026. Also available on slides, YouTube, and Speaker Deck. OkHttp is a popular library for making network calls. You might use it directly, or with Ktor, Retrofit, Coil, or gRPC. But this is not a talk on how to use OkHttp. Instead,…
An engineer I admire was lamenting about AI. He said that his new programming agent is excellent at fixing bugs! And all that it costs is a bunch of energy and many litres of water. He said that he could also have fixed those same bugs, and that he also…
Google is building a digital lock into Android. It's a very bad idea and I hate it. The excellent organizers at keepandroidopen.org encouraged me to complain to the Competition Bureau of Canada. What I sent wasn't well edited but it captures my anger. Please send your own! I found…
Rounds has a Kotlin server that integrates a few things: PostgreSQL persistence via SQLDelight (hosted on PlanetScale!)WebAuthn4J for Passkeyskotlinx.html for dynamic web pagesKtor for HTTP bindingThe service uses six database tables. The business domain tables are Game and GameEvent. Support for auth, sessions, and collaborative editing adds Account,…
I’ve been trying to build a remarkable UI for Rounds.app. One feature that turned out quite well is tinting the game name & menu bar icons when the winner changes. In this recording you can see colors change when I toggle the win condition: The title color changes…
Here’s a program that launches 3 jobs. The first runs forever and the other two exchange a value. @Test fun test() = runTest { val channel = Channel<String>() val deferredA = async { while (isActive) { delay(1_000) } } val deferredB = async { channel.send("hello") } val deferredC = async { channel.receive() } deferredB.await(…
In 2012, I published an Android score pad app named Rounds to the Play Store. I was quite proud of it! It used an iPod click wheel-style score entry UI and balanced capability with simplicity. Rounds’ animated action bar in 2012I joined Square, did a bunch of open source, had…
I recently posted on the Cash Code Blog announcing Burst’s new test interceptors feature. They are similar to JUnit rules in API and capability. A Small APIA typical use case is connecting some lifecycle to a test’s execution. Perhaps we want a chess engine to be available while…
I presented this at Droidcon NYC on June 25, 2025. Available as code, video, slides, Droidtube, & Speaker Deck. Coroutines are an important tool in the Android developer’s toolbox. We use 'em to background our tasks, to parallelize our work, and to gracefully cancel operations. This is not a…
I was using the old UIView APIs when I found some code that broke my brain. Here’s Swift code to animates a UIButton from opaque to transparent over one second. let button = ... let animateOut = UIViewPropertyAnimator(duration: 1.0, curve: .easeInOut) { print("2 alpha=\(button.alpha)") button.alpha = 0.0…
The late Joe Armstrong had a great rule for error handling that stuck with me. ‘If you can’t do what you want to do try to do something simpler’I was thinking about this recently. I was writing code to embed resource files in an iOS application binary. Here’…
I’m adding edge-to-edge UI support in Redwood. My code asks the host platform how much of the screen is consumed by system bars and notches and things, and it returns us a measurement like ‘40 pixels at the top + 10 pixels at the bottom’. The iOS code to handle…
My son’s swim meet is coming up. If he’s healthy, he’ll compete. My daughter’s hockey team has a game coming up. League rules say they must forfeit if they have fewer than 10 players. There’s only 10 girls on the roster so they need everyone…
I’ve been posting on this website throughout my career. Many posts are motivated by my own suffering! These go like this: I learned a thing.The hard way.It sucked.Please avoid making the same mistake.In other posts, there’s a discussion on something and I feel compelled…
I’ve seen bug reports and Slack conversations that start like this: @blacktshirt1981: ‘I tried to use your library to decode the integer 1 to a boolean and it crashed. Please document that your library doesn’t decode integers to booleans.’I probe a bit in my response: @jessewilson: ‘Oh…
A couple of us are grumpy that putting robots in charge of code formatting is too slow & too clumsy. Jake Wharton reminded us that ranting isn’t as useful as participating, and challenged us to work on fixes. Lemme start with my ideal: IntelliJ, Android Studio, and a command-line…
This is a running archive of my technical presentations. I’ve also posted about my process, and I also follow Jake’s advice on conference talks. 2026Deconstructing OkHttp 2025Coroutines Party Tricks 2024GC You Later, Allocator 2022Nerding Out on Okio Dynamic Code With Zipline 2019JSON Explained HTTP in a Hostile World…
I presented this at Droidcon NYC on September 19, 2024. Available as code, video, slides, Droidtube, & Speaker Deck. Memory management on Android is easy: the garbage collector does almost everything and LeakCanary handles the rest! But Kotlin/Multiplatform brings new challenges. Your new features could be blocked if Kotlin/…
Originally published on May 23, 2024 in fun code(). The programs I write frequently involve strings that identify things: email addresses, file paths, URLs, time zones... even credit card numbers and drivers’ license numbers. For many years I followed the patterns of the Java standard library when creating my own…
In some of the projects I work on, we publish an artifact for every build on the main branch. We don’t want to give these nice semver names like 1.5.0 because that’s too much work! Instead we just wanna generate a version name based on the…
I pair program a lot and it makes me happy. Here’s some thoughts on pair programming... Tuple is AmazingI’ve tried pairing with Copilot, Screenhero, Drovio, Zoom, macOS Screen Sharing, and Code With Me. Tuple is my favorite of these. Not Just ProgrammingI use pairing software for all kinds…
People do open source for lots of reasons. One reason that I do open source is because I enjoy it... Recently I had fun connecting Okio to zlib. It even had fun side quests: I learned about zlib, info-zip, PKZip, and how they relate. Sometimes a project’s logo tells…
Most of the software I write exists to automate a process. It might automate a high-level workflow like peer-to-peer money transfers, or a low-level implementation detail like encoding an HTTP request as bytes. I’ve learned that my code is healthier when it’s strictly divided into value objects, service…
Okio's has an openZip() function that views a .zip file as a FileSystem. To expose file metadata in the file system API, Okio must extract it from the .zip file. There’s at least four ways to encode timestamps in a .zip file. I wanted to find out which of…
I don’t do many crimes. I don’t even do crimes that I could do without getting caught! Every single time my dog poops on the sidewalk, I pick it up. Even if nobody’s watching! I have honor. With that disclaimer out of the way, here’s instructions…
If you’re sending data from one computer to another, it’s probably JSON. But it hasn’t always been this way. How we Transmitted Data Before JSONBefore JSON got popular (2005ish) we had XML, CORBA, Java serialization, Python Pickle, and a bunch of other clever and complex encoding schemes.…
Suppose I’m connecting my home Christmas lights to the Internet. Perhaps I’ll make a mobile app that calls my home control server via an HTTP API: POST /lights/toggle HTTP/1.1 { "subjects": ["maple_tree", "roof"] }HTTP/1.1 200 OK { "toggled": true }It works. I can finally…
I work on a big product at a big company and we have lots of backend services that have big responsibilities: The messaging service sends customers their emails, SMS messages, and push notifications.The banking service manages the customers’ bank accounts.The identity verification service verifies customers’ identities.Except that…
Suppose your organization has a widely-used internal library for validating customer usernames: private val usernameRegex = Regex("[a-z]{2,40}") fun isValidUsername(username: String): Boolean { return usernameRegex.matches(username) }The function becomes widely adopted: Some callers use it during customer sign-up. We don’t want customers putting slashes in their usernames!…
I like writing unit tests that read test cases from a data file: Zipline does ECDSA and EdDSA signing. It gets test data from Project Wycheproof.OkHttp does URL parsing. It gets test data from The web-platform-tests Project.OkHttp-ICU does Unicode Normalization. It gets its test data from Unicode’s…
Bob Lee was murdered on April 4 in San Francisco. I met Bob in 2006 when I joined him on the AdWords front end (AWFE) team at Google. He was charismatic, inventive, and kind. With Kevin B. he created Guice, a dependency injector that we could use to make AWFE…
Some of the trickiest bugs I’ve seen happened because a function unexpectedly occurred multiple times on the call stack. Re-entrant ListenersTo illustrate, consider a TextField widget that implements the listener pattern: class TextField { var listeners = mutableListOf<Listener>() var value: String = "" set(value) { val previous = field if (value…
I use lots of factory classes in my code. But not everywhere. I don’t like the ceremony they require to create and use: why not a constructor? Factories don’t solve a business problem directly; they solve an architecture problem. They feel enterprisey and architecture astronauty. /** * For example, a…
Easy code changes are additive: introduce a new database table, network call, or screen. Difficult changes are transformative: split a database table, combine a few network calls, or change a component that’s used on many screens. These changes tend to motivate refactoring: Introduce feature flagsExtract interfacesMove code between modulesAdd…
One aspect of programming that’s more art-than-science is making things efficient. I love finding shortcuts that make a system work better! It’s particularly satisfying to gather insights that we can exploit! I’ll illustrate with an example. Optimal for TodayHttpUrl is a class I wrote that implements URL…
This post expands on a section in my Writing Code That Lasts Forever talk. Here's what it takes to release a new version of OkHttp: Confirm the code is in a releasable state!Name the version (5.0.0-alpha.10 ?, ick)Summarize what’s new in the changelogTag the release…
I presented this with Jake Wharton at Droidcon NYC on September 1, 2022. It’s part one of a 2-part presentation with Native UI with multiplatform Compose. Available as video, slides, Droidtube, & Speaker Deck. As products grow, teams tend to move business logic to the backend. Keeping clients dumb…
Let’s make a fictional company that employs workers in two levels: Senior worker: does important work; gets paid $50/hour.Principal worker: trusted with the most important work; gets paid $100/hour.Unfortunately, it’s difficult to differentiate the two levels! If a project completes early it might because…
I presented Nerding Out on Okio at Android Worldwide last month. After sharing the video link and slide deck, Andrew Kelly tweeted asking if I’d share my process. I’m flattered by the question! So here I’ll indulge and share what works for me. The gist of my…
In 2013 I opened OkHttp Issue #270, ‘Analytics API’. The request was to just add some debug logging: We should add verbose logging for the response cache. Folks occasionally are puzzled when the cache doesn't work. Let's make it easy for them to figure out why.We didn’t add…
I presented this at Android Worldwide on April 19, 2022. Available as video, slides, YouTube, & Speaker Deck. Quirks and features of the I/O library that powers OkHttp.…
I’ve been working on OkHttp’s Happy Eyeballs and exploring testing strategies along the way. Happy Eyeballs is the fun name of RFC 6555, which is a clever hack to deploy IPv6 even if some client’s IPv6 connectivity is unstable. Here’s how it works: A client has…
Gradle has powerful features to check signatures of downloaded artifacts. If you want to check that things are signed right, that’s the best place to start. But if you wanna verify an artifact’s signature manually, here’s how... Find the signer’s keyThere’s a bunch of key…
Every so often an exasperated teammate recommends enabling -Werror in all our repos. The reasoning is sound: Compiler warnings are bad.Having lots of them is demoralizing.If we had prevented them from ever occurring we wouldn’t be in this mess.This is a particularly good policy to prevent…
I’ve been working on a file system API for Kotlin Multiplatform. It’s simple & fast and I’m excited about it. We’ve got these: FileSystem.SYSTEM: the local file system.FakeFileSystem: our in-memory implementation. Use checkNoOpenFiles() to be confident that your code doesn’t leak!ForwardingFileSystem: like…
I’ve been working on a product that’s grown from 5 developers in 2013 to 400 developers today. Our product complexity and customer numbers have grown similarly. I’m lucky and thankful to have been on a team whose hard work has paid off so much. But I’m…
All systems have limits. If I don’t design for them that doesn’t make them disappear! It just means I’ll be unprepared when they’re reached. Most of the systems I work on accept HTTP requests, perform operations on databases to satisfy them, and format their responses. Though…