Field Notes
Notes on event-driven Java, Spring Boot, Kafka, and secure systems for regulated banking.
LLMs, the whole thing · Part 1
The opening part of a series building LLMs from first principles. We start where every model starts: turning language into vectors and meaning into geometry, with a runnable script and its real numbers.
LLMs, the whole thing · Part 2
Every modern LLM is a transformer, yet BERT, GPT and T5 behave very differently. The first article in a ground-up series on LLMs: the single distinction — the attention mask — that separates an encoder from a decoder.
Claude Code's /insights command handed me a mirror: 82 sessions of my own habits, scored. Here is what it got right about how I work, and the one thing that quietly costs me the most.
Running the box: Docker, Linux, the JVM
My production Postgres publishes no port at all, and I still open it in DBeaver from my laptop. The one-line ssh -L everyone reaches for connects happily and then refuses every query — for a reason that's easy to miss, and eight bytes that prove when you've actually fixed it.
Security and privacy, in practice
I froze the redirect Spring sends you through and read it parameter by parameter. Three lookalike strings turned out to close three different attacks, and PKCE was already on without me asking for it.
Putting a self-hosted identity server in front of LinkedIn deleted 240 lines of workaround and turned PKCE back on. It also handed out a privilege escalation — because the claim never changed, but the trust underneath it did.
First-come-first-served parking allocates alarm clocks. Give the lot memory — an append-only fairness ledger — and scarce slots become something you can defend out loud.
What @TransactionalEventListener actually fires on commit, on rollback, and on neither -- plus a write inside AFTER_COMMIT that survives or vanishes depending on your connection pool. Measured in a playground, not quoted from the Javadoc.
Spring's plain @EventListener runs on your thread, inside your transaction, before your next line — and a chained event is fully handled before the original finishes. Everything here was verified by running it, not by reading the reference page.
A fire-and-forget @Async listener turns every SMTP hiccup into a lost message. Here is how @TransactionalEventListener plus an event publication table makes it durable — and the four ways that setup silently does nothing.