Hello, Spring Security 5.2 with Ria Stein

Episode 143 · 17:57 · SRT · archive.org · all Tanzu Talk

Hey everyone. This week we have one of our interviews with a SpringOne Platform speaker where you get to not only hear a little bit of what they'll be talking about, or preview if you will, but some about themselves as well. Now we have SpringOne Platform coming up in my hometown, Austin, Texas, October 7th to 10th. Now if you're listening in the future, this is in 2019. Sorry if you missed it. You have to write a letter to me. Tell me how 2025 is doing. Always curious. Anyhow, you should take a look and register for it. If you register before August 20th, you'll get a nice discount from it. Otherwise, if you just go to springoneplatform.io, you can sign up for it and come see us in Austin. So with that, enjoy the interview. Today we're joined by Rhea Stein as part of our Women of SpringOne Platform series. And I just thought I would introduce Rhea to you, or better yet, let Rhea introduce herself to you. And we'll kind of get started picking your brain a little bit about the exciting stuff she's doing and the things that she's going to be discussing at SpringOne Platform. So Rhea, first, welcome. Thank you. And if you would, please just share a bit about yourself, however you want to kind of introduce yourself to our audience. Sure thing. So I'm Rhea and I'm working on the Spring Security team. I'm an engineer on the Spring Security team. And I'm working out of the Toronto office where I am right now. Prior to joining the Spring team, I was actually part of Pivotal Labs. So I've been part of Pivotal for a while, but I only started with Spring about three months ago. Wow, that is recent. That's cool. Okay, so now this begs all kinds of questions. Let's go back a little bit further yet. If you would kind of share with our audience, how did you get into tech to begin with? What drove you or dragged you into this field? When I was starting in university, I wasn't sure what I wanted to do. And I actually applied for math because that was something that I knew I liked. And I ended up getting accepted to the

University of Toronto. And I started my first year studying math. And as a mandatory requirement, you have to take a computer science course, actually two of them. One of them is more programming oriented. And one of them is more theoretical oriented. And in the theoretical course, I learned about travel at the traveling salesman problem and P versus NP theorem. And I really started to like that part of it because it was kind of a mix between computer science and math. And I decided to go down that road more, where I could study both computer science and math in this kind of domain. So I ended up doing both degrees because I didn't want to leave my math degree, but I got into computer science as well. And then when I graduated, it was a lot more reasonable to find a computer science related job than it was to find a math related job. I can understand and relate. That's a very similar path to what I took. Yeah. Yeah. And sometimes, so did your friends think you were crazy? Did they think that was a great idea? Did they come with you? I don't think there were that many people that enjoyed the theoretical part of computer science as much as I did. Most of my friends that were in computer science as well loved all the programming courses, which I thought were fun, but they weren't quite as exciting as trying to figure out how one problem relates to another and coming up with proofs and figuring out complexity. That's the part that I was really interested in. And the person that I look up to very much is Steven Cook, who is a professor at the University of Toronto. And the first time I had a class with him, I was so excited. I was excited for probably the three months before that I knew that I was having a class with him. And then the first day, I was sitting beside my friend. And when he came into the classroom, I started just like shaking my friend. And they're like, calm down. It's okay. Why are you so excited? But yeah, that was one of the very exciting memories from my undergraduate. So it's almost like a rock concert type of experience.

Yeah, for me it was. You know you're a nerd, wind. So you've kind of hinted at this already, but if I could ask, what do you love about tech in general, about your job, or anything to deal with this craziness that we deal with? So as I had said, I really like the theoretical part of computer science, the more mathematical part in dealing with complexity. And I can think about that a little bit when I'm coding, but that's not the main part of my job right now. The part that I really like about the tech industry in general is how much new tech there is all the time. And the fact that we just keep improving upon it. So it seems like we're automating more and more every day, but there's always something new to create or something new to automate. And even though 10 years ago, we couldn't have imagined how efficient everything is today and how many resources there are for us out there to help us write code better and deploy code better and serve it to our customers. But in 10 years, I think that we're going to look back to where we are right now and think, oh my gosh, how did people code and deploy things, you know, back in 2019. And I think that that's really cool. And new problems to solve. And even when they aren't new problems, they're problems that have been here a while that we just maybe haven't had a great way of solving. So yeah, there's, it's one of those really cool or really frustrating, depending on your perspective, things about our industry, right? It's, there's never a lack of things to do. There's never a lack of new things coming at us, which is kind of cool. I mean, along those same lines, how do you keep up? How do you, how do you prioritize what is important to read about, to dig into, to know, versus what may be of lesser importance or maybe not important at all?

How do you filter through the noise to get to the signal? So it's funny that you mentioned prioritization, because that's a big thing from Pivotal Labs and trying to figure out what the next highest priority feature is. And I think it's similar with the things that I decide to focus on and learn and create and work on. It's very much driven by what the customer needs. So on the Spring team, for example, if people are really into Kotlin and have started using Kotlin with Spring, then we're going to put more effort into Kotlin and I'm going to start learning Kotlin. Meanwhile, I won't spend as much effort learning Go or something that our customers aren't really asking for. Yeah, that makes perfect sense. And which kind of leads me into the next question. This is, I love conversations that just kind of evolve of themselves, but you do have a really cool trajectory within Pivotal, moving from Pivotal Labs, where you work directly with customers on a daily basis, to the Spring Security team, where you primarily work with other Pivotal developers. And obviously, there's still customer interaction, of course. I mean, you've already mentioned that, but it's an entirely different dynamic, right? Care to share any thoughts or observations about any of that? Yeah, I think Pivotal Labs was such a good place to start in order to get a really good understanding of the practices that Pivotal has, both within the Pivotal Labs team and the platform teams and the Spring team as well. So Pivotal Labs tries to establish certain practices with the teams that they work on, such as test-driven development, pair programming, user-centered design, and they try to have an autonomous team. So the idea with the autonomous team is that the team itself gets to decide what their practices are going to be and just their general cadence of meetings and team interactions. So nobody's telling them, you know, you need to have a stand-up at

9.05 every morning, or you need to use Concourse as your pipeline. And the autonomous team themselves decides what works for them. And I think that's something really cool about coming into the Spring team. They're almost like a team that has been working with Pivotal Labs for a really long time. So in labs, we would see this with teams that have had multiple engagements with Pivotal Labs that they've gotten to this point where they are making a lot of decisions for themselves and modifying the practices. So initially, when a team joins Pivotal Labs, the labs pivots are fairly strict about their practices. So they have to learn the basics first, like test-driven development, continuous integration, continuous delivery, before they can decide how exactly they want to modify them. But the Spring team is at the point where they've made these decisions and modified the practices to a way that suits the team very well. And I think that that's really cool to see because they still have all the same values, and they still get to the same results, but the practices are slightly different. I think it's also cool that we can decide that, for example, let's try doing a retrospective at the end of the week. And then if it doesn't work, we don't do it anymore. Or let's try using this tool to manage our backlog. And we give it a run, and if it doesn't work, then we switch it out for something else, or we get rid of it completely. And it's been really cool to see that on the Spring team team and just how much autonomy they have to drive what's best for their team. Yeah, when you describe it that way, it just really does sound like a very natural and very complementary progression, which is very cool, quite frankly. If I could ask too, you know, because now we're approaching SpringOne Platform, that's the series, right? That's the interviews. This is the big

event of the year, and this is where all of the best and brightest minds get together and exchange information and we get to see each other again and discuss what has been happening, maybe some conversations that we haven't had a chance to have lately. We get to renew. But this year, you're speaking about, well, your talk is called Hello, Spring Security 5.2. And I read over the description, it looks really fascinating. It looks like a really great introduction to Spring Security 5.2, the new features, what have you. If you could, how did you arrive at that topic? What brought to your mind that this was something that you wanted to share with our greater community? So I'm doing the talk with Rob, who's the Spring Security project lead. And our talk is pretty much what you said or what you understood from the description. We're going to be talking about the new features that are coming out in Spring Security 5.2. And we're also going to be doing a bit of an introduction to Spring Security in general for anyone that hasn't used it or hasn't seen it. So Spring Security 5.2 is actually coming out around the same time as SpringOne platform. So it made sense to introduce it there and talk about the new features that are coming out. There's also the part where we're going to go over some of the existing functionality and how to integrate it into your project. And I think the reason for that is because even if you know about Spring Security, it's good to have a resource for best practices and how the Spring team expects you to use it. So if you're already using it, this might still be a good talk for you to come to and see what the intent was behind these. And we're also going to be doing a little bit of diving into Spring Security and debugging, getting to see what's happening under the hood. And I think that'll really help people if they ever have issues with it to figure out what the issue is by debugging it once they know what's happening a little bit under the scenes. Yeah, that always helps when you understand what's happening and why

in terms of how you implement the end solution, right? Anything that you want to share to give us a sneak peek of what you're going to be talking about in terms of the new features and 5.2? Or should we just meet up with you there? Well, there's going to be some lambdas that are new. Oh, lambdas. Okay, I'm in. Oh, that's it. Okay. Wow. That was a small sneak peek. Really tight-lipped about this. Oh my gosh. So we're just going to have to go, which is what we should be doing anyway, right? Yeah, come check it out. Well, okay. So now in terms of SpringOne platform, I've talked about some of my favorite things, kind of getting together with the team and obviously drinking from the Spring source. Yeah, terrible jokes, I know. But what is your favorite thing about SpringOne platform? What are you looking forward to in particular? So this year, I'm really excited about the fact that SpringOne is going swagless and they're doing donations instead. I just saw the page that came out about that and I think that's really cool. I'm excited for that to happen. The other thing that I'm excited about is to see customers that I've worked with before. So as I think I had mentioned before, I was in labs for about three and a half years. So I'm really excited to see customers that I've been on engagements with before because I know a lot of them are going to come to SpringOne and just catch up with them and see how their product is doing, how their practices have evolved within their team. I got to see a couple of people last year that I hadn't seen for a while and it was really cool to catch up with them and see what they're up to. Yeah, that is cool. When you see actually the end result that comes of all of this work that we all do and they're doing and see the good things that they put together using Spring, right? So what would you say to someone who's not yet made the commitment, who is kind of on the fence? Should I go to SpringOne platform? Should I not? Gee, the barbecue sounds awesome in Austin, but what should I do? How should I convince myself? And if that happens, you know, how do I take this to my boss?

What would you say to someone who's considering going but isn't fully committed just yet? So I think one reason to go is to see all of the new features that are going to be coming out from the different Spring teams. I know a lot of the teams are planning releases around the same time that SpringOne platform is and they're going to be doing walkthroughs of new features and you can get the first look at the features that are going to be coming out in the next releases, which I think is cool. The other thing that I think would be useful for customers attending is talking to other customers about the products and the practices that they're using and what's worked well for them. I found that really interesting last year when I was there talking to various customers and seeing them interact with each other and saying, you know, oh, you tried this out and it worked really well for you. Maybe we should try it out because we've been doing something else and it's not working because of these reasons. And seeing organizations that are similar to yours and what kind of practices they've adopted and what kind of products they've adopted and seeing how that might fit into your organization because it might be very similar. Yeah, that's a great point you bring out that I think we don't really stress enough, which is the community and how much the community builds the community, how much we all help each other, right? So that's something that I'm really looking forward to as well. And you bringing that up, it really makes me even more excited to go. So that's, we're all going to be in Austin in October and that's pretty much it. So the one thing I would suggest to folks is if you want to come and meet Rhea, this would be perfect opportunity to do so. Come to her talk. Hello, Spring Security 5.2. Hear Rob and Rhea talk about the new features of Spring Security in version 5.2, as well as just kind of general best practices, tips, tricks, and how to better secure your applications and your systems. So with that, Rhea, do you have anything else you want to add,

any way that folks can follow you, reach you, or just meet up with you at SpringOne? I would love if people came to talk to me at SpringOne. I love talking to customers and seeing how they're using Spring and Spring Security. I don't have a Twitter or social media account. I might one day, but I don't right now. So any kind of code that I do would be on GitHub. So people are welcome to follow me there as well. Wonderful. Now, what's your GitHub account? I think it's Eleftheria S. But I will double check that for you. Okay, excellent. Yes, that's right. Okay, Eleftheria S. Yes. So that's perfect. Folks, follow Rhea on GitHub and come see her at SpringOne Platform. Hope to see you there. With that, Rhea, thank you so much for your time. And we'll let you get back to your day. And look forward to seeing you at SpringOne Platform in Austin. Thank you very much. Well, I hope you enjoyed that interview. I sure did. Hey, and as a bonus for listening this far, if you want to register for SpringOne Platform, the wonderful conference we have coming up October 7th to 10th in my hometown, Austin, Texas, when you go to spring1platform.io to register, you can use the code S1P200 underscore M Heckler. That's M-H-E-C-K-L-E-R. That's Mark's last name. You can find the discount code if you go to pivotal.io slash podcast as well. And that'll get you $200 off the registration fee, price, winning admission, however you want to think about it. Well, we've got several of these coming out. So if you enjoyed this one, you should check out the other ones. And otherwise, tune into the regular Pivotal Conversations each week or so. And we'll see you next time. Bye-bye.

Tanzu Talk · 🍕 Get more pizza.