# Nicolas Fränkel Nicolas Fränkel's blog This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Designing Software for Real-World Geographic and Legal Complexity DevFeed: [Designing Software for Real-World Geographic and Legal Complexity]() Original publisher: [Read original article]() Author: Nicolas Fränkel Published: 2026-09-13T00:00:00Z Content type: opinion Language: en Sources: [Nicolas Fränkel]() Topics: [systems](), [Software]() Tags: [geography](), [gotchas](), [miscellaneous](), [software](), [switzerland](), [systems]() ### AI overview This commentary uses enclaves such as Campione d'Italia and Büsingen am Hochrhein to show why software systems must model real-world attributes independently. Country codes do not necessarily determine currency, tax, customs, mail, phone, or law, so developers should research domain-specific exceptions before designing systems. ### Source excerpt Years ago, a colleague of mine told me about two pockets of foreign land surrounded by Switzerland: Campione d'Italia and Büsingen am Hochrhein, respectively Italy and Germany. Both are enclaves of their respective country in Swiss territory: An enclave is a part of the territory of a state that is enclosed within the territory of another state. To distinguish the parts of a state entirely enclosed in a single other state, they are called true enclaves. ## Build an AI Agent (From Scratch) DevFeed: [Build an AI Agent (From Scratch)]() Original publisher: [Read original article]() Author: Nicolas Fränkel Published: 2026-09-06T00:00:00Z Content type: opinion Language: en Sources: [Nicolas Fränkel]() Topics: [AI Agent](), [Large Language Model](), [Model Context Protocol (MCP)](), [Retrieval Augmented Generation (RAG)](), [Multi Agent Systems]() Tags: [ai](), [ai-agent](), [ai-agents](), [book](), [claude-code](), [coding-assistant](), [genealogy](), [llm](), [llms](), [mcp](), [multi-agent-systems](), [rag](), [review]() ### AI overview A review of Build an AI Agent (From Scratch) by Jungjun Hur and Younghee Song describes the book's coverage of LLM agents, tool use, ReAct agents, RAG, memory, planning, code execution, multi-agent systems, and agent evaluation. The reviewer considers it a fundamental introduction, while wishing the evaluation chapter were more developed. ### Source excerpt Facts 10 chapters$29.29 (at the time of this writing)315 pages Chapters Building your first LLM agentWhat is an AI agent? ## AI-assisted genealogy DevFeed: [AI-assisted genealogy]() Original publisher: [Read original article]() Author: Nicolas Fränkel Published: 2026-08-30T00:00:00Z Content type: tutorial Language: en Sources: [Nicolas Fränkel]() Topics: [Artificial Intelligence](), [data](), [GitHub](), [Software](), [Cloudflare]() Tags: [ai](), [claude-code](), [cloudflare](), [coding-assistant](), [genealogy](), [github](), [project](), [software](), [technical]() ### AI overview The article describes using AI as a tool for genealogical research. In less than a month, the author gathered more than 600 individuals and traced 12 generations in some branches, using a software-project workflow, genealogical records, GEDCOM files, GitHub or Codeberg, and Cloudflare Pages. ### Source excerpt My son recently came to me to brag about using AI to find our ancestors. While the results were correct, I didn't learn anything new, as it stopped at my grandparents. I was never very interested in my genealogy, but I decided to see if AI would be a good tool for this. TL;DR: Yes, it is, and even more than that. In a little less than one month, I managed to gather more than 600 individuals and get back 12 generations in some branches. ## Propagating User Identity Chains Across JVM Service Calls DevFeed: [Propagating User Identity Chains Across JVM Service Calls]() Original publisher: [Read original article]() Author: Peter Firmstone Published: 2026-08-23T00:00:00Z Content type: article Language: en Sources: [Nicolas Fränkel]() Topics: [Security](), [Java](), [Authorization](), [Protocol (disambiguation)]() Tags: [authorization](), [dirtychai](), [java](), [jgdms](), [jini](), [jvm](), [microservices](), [protocol](), [security](), [technical](), [tls](), [tokens]() ### AI overview This article explains how a chain of user identities crosses service calls on the wire. It distinguishes TLS machine authentication from in-band user claims, describes receiver-side limits and principal handling, and notes that standard Java 24 lacks the required authorization support without DirtyChai on both ends. ### Source excerpt Alice calls the order service. The order service calls the ledger on her behalf. At the second hop, the ledger has to decide whose authority the debit is being made under. Most stacks answer badly. Forward Alice's bearer token verbatim, and the ledger cannot tell her from the service that relayed it. Drop the token and the ledger sees a machine, with no record that a human started the chain. Neither option lets the ledger authorize the combination. ## Solving Gradle metadata and Renovate integration DevFeed: [Solving Gradle metadata and Renovate integration]() Original publisher: [Read original article]() Author: Nicolas Fränkel Published: 2026-08-16T00:00:00Z Content type: tutorial Language: en Sources: [Nicolas Fränkel]() Topics: [Gradle](), [renovate](), [Kotlin](), [Groovy]() Tags: [ci](), [dependencies](), [dependency](), [development](), [gradle](), [renovate](), [software-supply-chain](), [supply-chain-attacks](), [supply-chain-security]() ### AI overview The article describes setting up Renovate for a Gradle project and investigating why merges of updated dependency versions caused build failures. It also discusses dependency verification and software supply chain risks. ### Source excerpt My current company has settled on using Gradle. It doesn't make me very happy, but you need to learn to work with constraints. Plus, I must admit that the developers who actually implemented the build files did a pretty good job overall: they used Kotlin instead of Groovy, they moved code to regular plugins, etc. This week, I worked on improvements to a new project and set up Renovate. ## Security Baked Into the JVM: two Subjects, one call DevFeed: [Security Baked Into the JVM: two Subjects, one call]() Original publisher: [Read original article]() Author: Peter Firmstone Published: 2026-08-09T00:00:00Z Content type: article Language: en Sources: [Nicolas Fränkel]() Topics: [Security](), [SPIFFE](), [SPIRE]() Tags: [certificates](), [dirtychai](), [java](), [jgdms](), [jini](), [jvm](), [jwt](), [microservices](), [oidc](), [permission](), [process](), [security](), [spiffe](), [spire](), [technical]() ### AI overview This article examines identity and security in the JVM through DirtyChai. It describes separate process and user identities, including SPIFFE workload credentials delivered through SPIRE and JWT/OIDC-based user identity, and explains how these identities coexist across request dispatch and privilege boundaries. ### Source excerpt The constraint system stops a bad call before it leaves the JVM. The Safe Codebase Audit Pipeline stops bad code before a client ever loads it. What remains is identity: who is calling, and can you verify it? Most frameworks answer with a token check at the door. A filter validates a bearer token, sets a thread-local variable, and hopes that nothing downstream forgets to look at it. DirtyChai answers differently. ## GitHub agentic workflows and Renovate DevFeed: [GitHub agentic workflows and Renovate]() Original publisher: [Read original article]() Author: Nicolas Fränkel Published: 2026-08-02T00:00:00Z Content type: tutorial Language: en Sources: [Nicolas Fränkel]() Topics: [GitHub](), [GitHub Actions]() Tags: [agentic-workflow](), [dependencies](), [github](), [github-actions](), [github-agentic-workflows](), [pull-requests](), [renovate](), [rollback](), [technical]() ### AI overview This article explains how Renovate dependency updates can break GitHub agentic workflows by changing an action SHA without updating the matching generated scripts. It also describes a failed recompilation workflow that rolled back an unrelated Node.js update, then identifies the need to keep the generated lock file synchronized with its release. ### Source excerpt I've been a big fan of Renovate for a couple of years already. Renovate scans your repositories, detects outdated package versions, and opens pull requests to automatically bump them. It's similar to Dependabot in that it keeps your dependencies up to date. If I had to compare them in one sentence, I'd say Renovate is less integrated in the GitHub ecosystem, but handles more ecosystems and, more importantly, is extensible. ## RFC 9880 and the IoT Validation Problem DevFeed: [RFC 9880 and the IoT Validation Problem]() Original publisher: [Read original article]() Author: Stefano Fago Published: 2026-07-26T00:00:00Z Content type: article Language: en Sources: [Nicolas Fränkel]() Topics: [Internet of things](), [SDF](), [data](), [JSON](), [Code](), [CoAP](), [MQTT](), [HTTP](), [TLS (Transport Layer Security)]() Tags: [architecture](), [code](), [data](), [development](), [iot](), [json](), [protocol](), [sdf](), [standards](), [validation]() ### AI overview This article examines RFC 9880 and its Semantic Definition Format (SDF) as an ecosystem-neutral, JSON-based way to describe IoT devices. It argues that SDF validation is best understood as a compilation problem and discusses how different IoT ecosystems represent the same physical concepts incompatibly. ### Source excerpt The IoT/IIoT world has a data model problem and the concept of Digital Twin has made this issue more important. Plenty of people have tried to fix it. RFC 9880 and its Semantic Definition Format (SDF) are a serious attempt: a JSON-based, ecosystem-neutral way to describe what a device is and what it does. I have had some experiences with this specification, and I've understood that the format shows its full value once you treat it as source code, something you compile. ## Security Baked Into the JVM: the Safe Codebase Audit Pipeline DevFeed: [Security Baked Into the JVM: the Safe Codebase Audit Pipeline]() Original publisher: [Read original article]() Author: Peter Firmstone Published: 2026-07-19T00:00:00Z Content type: article Language: en Sources: [Nicolas Fränkel]() Topics: [Security](), [Java](), [Architecture & Design](), [systems]() Tags: [analysis](), [bytecode](), [dirtychai](), [distributed](), [java](), [jgdms](), [jini](), [jvm](), [microservices](), [security](), [supply-chain](), [systems](), [technical]() ### AI overview This article presents the Safe Codebase Audit Pipeline, or SCAP, for analyzing third-party Java JARs before clients deserialize objects from them. It focuses on supply-chain risks from malicious bytecode and blocking static initializers, and describes distributing the pipeline across hosts with separate responsibilities and restricted network access. ### Source excerpt In Part 1, the minimal deployment showed constraints traveling with the proxy: authentication, encryption, hardened deserialization, all declared in configuration and enforced at the call boundary. The proxy is a JAR. That JAR was downloaded and unmarshalled before any constraint ran. That step is the earlier problem. Distributed Java systems that load remote code are vulnerable to supply chain compromise: an attacker can replace a legitimate JAR with one containing malicious bytecode. ## Making ServiceLoader usable: a provider factory DevFeed: [Making ServiceLoader usable: a provider factory]() Original publisher: [Read original article]() Author: Stefano Fago Published: 2026-07-12T00:00:00Z Content type: tutorial Language: en Sources: [Nicolas Fränkel]() Topics: [Java](), [Code](), [JSON Web Tokens](), [JSON]() Tags: [decoupling](), [design-patterns](), [java](), [json](), [jwt](), [plugin](), [plugins](), [serviceloader](), [spi]() ### AI overview This article presents a provider-factory pattern for Java ServiceLoader. Instead of loading a service implementation directly, ServiceLoader loads a small factory with a no-argument constructor; the factory then constructs the service and can support implementation selection and custom constructors. The pattern is illustrated with a mock payments system and is related to decoupling JSON and JWT capabilities from concrete libraries. ### Source excerpt I keep coming back to java.util.ServiceLoader. I have used it to put a JSON layer behind a contract, so the core code carries no direct dependency on any particular JSON library, and I can swap the implementation without touching callers. The same shape works for JWT handling, where the concrete library might be jose4j or another JOSE implementation, and you can easily find other decoupling use-cases. ## Home Assistant timezone and configuration override issues DevFeed: [Home Assistant timezone and configuration override issues]() Original publisher: [Read original article]() Author: Nicolas Fränkel Published: 2026-07-05T00:00:00Z Content type: opinion Language: en Sources: [Nicolas Fränkel]() Topics: [Home Assistant](), [timezone](), [Automation](), [bug](), [configuration](), [YAML]() Tags: [automation](), [bugs](), [config](), [home-assistant](), [locale](), [technical](), [timezone](), [user-experience](), [yaml]() ### AI overview The author describes Home Assistant shutter automations that ran an hour late during summer time because the instance timezone appeared as Paris/+1. Overriding the timezone in configuration removed UI-set settings, requiring all settings to be specified again in YAML. ### Source excerpt Last year, I motorized the rolling shutters on the southern façade of my apartment. My idea was to manage them via Home Assistant. I had a couple of automations in mind: In the evening, roll down the shutters of my bedroomIn the morning:If it's too hot outside, roll down all shuttersIf it's too cold outside, roll down all shuttersIn other cases, roll up all shutters but my bedroom's Living in France, I added the official Météo France integration. ## Security Baked Into the JVM: why fork Apache River and OpenJDK? DevFeed: [Security Baked Into the JVM: why fork Apache River and OpenJDK?]() Original publisher: [Read original article]() Author: Peter Firmstone Published: 2026-06-28T00:00:00Z Content type: opinion Language: en Sources: [Nicolas Fränkel]() Topics: [Security](), [Java](), [openjdk](), [Architecture & Design](), [Remote Procedure Call (RPC)](), [Networks]() Tags: [authorization](), [dirtychai](), [discovery](), [distributed](), [ipv6](), [java](), [jgdms](), [jini](), [jvm](), [lock-free](), [microservices](), [openjdk](), [rpc](), [security](), [self-healing](), [technical]() ### AI overview This article introduces DirtyChai, a community fork of OpenJDK that restores Java authorization infrastructure, and JGDMS, a security-hardened fork of Apache River for dynamically discoverable microservices over IPv6. It argues that distributed systems require security beyond network firewalls and outlines the projects' complementary roles, including authorization, service discovery, hardened deserialization, transport security, proxy trust verification, and codebase safety checks. ### Source excerpt The more distributed a system, the harder it is to secure. Code crosses JVM boundaries. Objects are serialized across trust boundaries. Third-party proxies run inside your process. The usual answer is a network firewall. It helps, but it operates at the wrong level. Java 17 deprecated the SecurityManager, Java 24 put the final nail in its coffin. Most developers didn't notice. ## On programming languages, targets, and platforms DevFeed: [On programming languages, targets, and platforms]() Original publisher: [Read original article]() Author: Nicolas Fränkel Published: 2026-06-21T00:00:00Z Content type: opinion Language: en Sources: [Nicolas Fränkel]() Topics: [Programming](), [Programming language](), [multiplatform](), [Scala](), [Java](), [JavaScript]() Tags: [developer](), [development](), [java](), [javascript](), [kotlin](), [languages](), [multiplatform](), [programming](), [programming-languages](), [python](), [rust](), [scala]() ### AI overview A personal discussion of how programming languages have evolved from targeting a single compilation target and platform toward supporting multiple targets. It uses Scala.js as an example and mentions Kotlin and Clojure as other JVM-originated languages targeting JavaScript. ### Source excerpt I started as a Java developer, but for some time now, I have broadened my horizons. Recently, I thought about how early languages were dedicated to a single target and platform, and now they are broadening their focus. In this post, I want to write down my thoughts in the hope that it may be useful to others, probably to my future self. Definitions You may have been wondering about the title terms. ## double, BigDecimal, or Fixed-Point? DevFeed: [double, BigDecimal, or Fixed-Point?]() Original publisher: [Read original article]() Author: Stefano Fago Published: 2026-06-14T00:00:00Z Content type: article Language: en Sources: [Nicolas Fränkel]() Topics: [Java]() Tags: [bigdecimal](), [engineering](), [floating-point](), [java](), [numbers](), [performance](), [pitfalls](), [precision]() ### AI overview A Java-focused article explains how to choose among double, BigDecimal, and fixed-point arithmetic based on required precision, rounding rules, and performance constraints. It covers IEEE 754 binary representation, floating-point equality pitfalls, tolerance-based comparisons, and production concerns such as serialization, testing, and concurrency. ### Source excerpt There is an evergreen debate in the Java world: should you always use BigDecimal for money? The short answer is no. The real answer is: it depends on your computational context: the precision you need, the rounding rules you must follow, and the performance budget you have. The problem is that this conversation is often driven by dogma rather than engineering. ## Seasons time-lapse - the video DevFeed: [Seasons time-lapse - the video]() Original publisher: [Read original article]() Author: Nicolas Fränkel Published: 2026-06-07T00:00:00Z Content type: tutorial Language: en Sources: [Nicolas Fränkel]() Topics: [Image](), [Code](), [DateTime]() Tags: [art](), [cameras](), [code](), [development](), [images](), [information](), [location](), [metrics](), [model](), [pipeline](), [pixel](), [project](), [python](), [rotation](), [screen](), [speed](), [time-lapse](), [video]() ### AI overview The third and final post in a series explains how the author creates a time-lapse video from photographs taken from the same position over multiple years. It discusses ordering images by day of year and time of day, using EXIF metadata, and practical observations about video generation. ### Source excerpt In the first post of this series, I focused on the project foundations: what should I do to create a video from photos taken from the same position year after year? I dedicated the second part to aligning images. It wasn't as easy as I expected. I stumbled upon new concepts, such as ORB and RANSAC. In this third and final post, I want to tackle the video creation itself, explain some 'artistic' decisions, and leave the door open to future work. ## AI gateways: why and how DevFeed: [AI gateways: why and how]() Original publisher: [Read original article]() Author: Nicolas Fränkel Published: 2026-05-31T00:00:00Z Content type: article Language: en Sources: [Nicolas Fränkel]() Topics: [Amazon API Gateway](), [LLMs](), [Artificial Intelligence](), [Routing (disambiguation)](), [Claude](), [Security](), [litellm](), [Caching](), [Scalability](), [Load Balancing](), [observability]() Tags: [ai](), [ai-gateway](), [anthropic](), [api-gateway](), [backend](), [caching](), [claude](), [claude-code](), [coding-assistant](), [decoupling](), [devstral](), [gateway](), [litellm](), [llm](), [llms](), [load-balancing](), [mistral](), [observability](), [open-source](), [routing](), [scalability](), [security](), [technical]() ### AI overview This article explains how AI gateways apply the API gateway pattern to AI clients and LLM backends. It discusses using a gateway to centralize model and provider management, governance, cost control, routing, caching, failover, load balancing, and observability, and considers routing Claude Code requests to another provider. ### Source excerpt Before working for 2 years on the Apache APISIX API gateway, I was mainly oblivious to API gateways. It's only by working with them that I understood their value. Decoupling the client and the server unlocks a lot of options: moving authentication to the API Gateway, securing APIs, deduplicating API requests, etc. In this post, I want to describe how the same pattern applies to AI. AI gateways AI gateways work in a similar way. ## Seasons time-lapse - alignment DevFeed: [Seasons time-lapse - alignment]() Original publisher: [Read original article]() Author: Nicolas Fränkel Published: 2026-05-24T00:00:00Z Content type: tutorial Language: en Sources: [Nicolas Fränkel]() Topics: [Computer vision](), [OpenCV](), [image distortion](), [Algorithms]() Tags: [algorithm](), [algorithms](), [art](), [camera](), [computer-vision](), [development](), [iphone](), [open-source](), [python](), [time-lapse](), [transformation]() ### AI overview This article explains how the Seasons time-lapse project aligns photographs taken from slightly different viewpoints and with different phone cameras. It describes using OpenCV feature matching with ORB, followed by RANSAC and a homography to estimate the geometric transformation. ### Source excerpt In the previous post, I described the Seasons project: a time-lapse of hundreds of pictures taken from nearly the same viewpoint over the years. The hardest challenge wasn't taking the pictures or assembling them, but aligning them. You might have noticed the nearly part about viewpoint in the above paragraph. Indeed, it's an approximation. I'm a human being, not a tripod. The position changes ever so slightly, and so does the exact angle. ## Seasons time-lapse - the foundations DevFeed: [Seasons time-lapse - the foundations]() Original publisher: [Read original article]() Author: Nicolas Fränkel Published: 2026-05-17T00:00:00Z Content type: article Language: en Sources: [Nicolas Fränkel]() Topics: [Python](), [OpenCV](), [Vibe coding](), [Inference]() Tags: [art](), [development](), [image](), [llm](), [photos](), [python](), [technical](), [time](), [time-lapse](), [video]() ### AI overview This article introduces a multi-part retrospective on building a seasons time-lapse video from photographs taken over several years. It describes using an LLM-assisted workflow, choosing Python, and designing a typed, tested image-processing pipeline that inventories, filters, aligns, and orders photos. ### Source excerpt I live close to nature. I regularly go for a run in the countryside. Over several years, during my runs, I've taken pictures from the same position, always roughly the same angle. I had a vague idea in the back of my mind, as an 'artistic' project. One day, I'd turn those photos into a time-lapse video, one that would show the passage of seasons across a single place. Spoiler, here's the work in progress: However, I knew that this project would take ages. ## Tokensparsamkeit for coding assistants DevFeed: [Tokensparsamkeit for coding assistants]() Original publisher: [Read original article]() Author: Nicolas Fränkel Published: 2026-05-10T00:00:00Z Content type: opinion Language: en Sources: [Nicolas Fränkel]() Topics: [coding](), [Large Language Model](), [Command-line interface](), [Compression](), [Rust](), [Claude Code]() Tags: [agents](), [claude-code](), [cli](), [coding](), [compression](), [llm](), [opinion](), [rust](), [sparsamkeit](), [technical](), [tokens]() ### AI overview This opinion article argues for "Tokensparsamkeit," or token frugality, in coding assistants: using only the tokens needed to achieve comparable results. It discusses compressing prompts and describes a Rust CLI proxy that the author says reduces LLM token consumption by 60-90% on common development commands, with limitations for Claude Code's built-in tools. ### Source excerpt Good engineers make decisions based on data. Most businesses assumed that the more data, the better the decision. Then, several factors put a halt to the hoarding of ever more data. GDPR and its localized counterparts, and the cost of storage. However, before the GDPR came into effect, the Datensparsamkeit approach already existed. Datensparsamkeit is a German word that's difficult to translate properly into English. ## Designing a team of agents DevFeed: [Designing a team of agents]() Original publisher: [Read original article]() Author: Nicolas Fränkel Published: 2026-05-03T00:00:00Z Content type: opinion Language: en Sources: [Nicolas Fränkel]() Topics: [Artificial Intelligence](), [Claude Code](), [Software Engineering](), [Code]() Tags: [agentic-engineering](), [agents](), [ai](), [autonomous-agents](), [claude-code](), [software-engineering](), [technical]() ### AI overview The author describes experimenting with AI for software engineering by designing a team of autonomous agents to implement features from design through implementation. The article discusses coding assistants, agentic engineering levels, Claude Code's experimental Agent Teams feature, and subagents. ### Source excerpt I continue to experiment with AI in the context of software engineering. I'm fortunate that my team supports me in exploring different ways to improve our daily work. This week, I designed a team of autonomous agents to implement features, from design to implementation. Why autonomous agents? A long time ago, we were delighted when the IDE offered auto-completion. In the previous two years, things have changed. A lot. Coding assistants have become our primary interfaces for coding.