7 ms·

One of their screenshot examples flags inefficient code in crypto libraries, and the suggested "fix" is "Evaluate switching to the Amazon Corretto Crypto Provid

by redler 7y ago

One of their screenshot examples flags inefficient code in crypto libraries, and the suggested "fix" is "Evaluate switching to the Amazon Corretto Crypto Provider ACCP". I don't know enough about the subject matter area to know whether that's the right move, but it's interesting that CodeGuru is apparently, among other things, an opportunity to pay Amazon to upsell you on replacing some of your code with one of the panoply of services in the AWS universe.

ensignavenger 7y ago
Amazon Corretto is their OpenJDK Java distro that is free and Open Source. I don't know if the project was already using Corretto or not, but it makes sense for them to recommend their own, supported, open source solution.
- redler 7y ago
  Your point is a fair one, and I admit unfamiliarity with Corretto, specifically. But they're telegraphing, right on the tin, that this new service will indeed recommend solutions of the form "we see a problem pattern in your code; try Amazon _____". The fact that Corretto is actually open source further muddies the waters.
  - weego 7y ago
    We'll need to see what comes out in the wash. Maybe the more OSS they encounter the more suggestions it will be able to make. Or maybe not and it will indeed be a sales pitch masquerading as a feature.
quin3 7y ago
In the future, You should do a quick search before naysaying. This crypto lib is free and offers non-negligible performance gains.
- NegativeLatency 7y ago
  It's still increasing your dependence on AWS systems and software. (The upsell price may be free for now, but who knows maybe they add a premium version or enterprise features in the future) I imagine that the tool will be used for recommending more amazon services in the future, and this is possibly a poor POC of more to come.
  - Sebguer 7y ago
    It's not an AWS system or service at all though... This is like saying that using React will lead you to be locked into Facebook?
    - ghostpepper 7y ago
      Why does it have Amazon in the name then? Amazon Coretto?
      - Sebguer 7y ago
        Because it's maintained by Amazon? But it's entirely open source: https://github.com/corretto/corretto-8 https://github.com/corretto/corretto-8 with a very permissive license (GPLv2)
      - cowsandmilk 7y ago
        Amazon Corretto Crypto Provider ACCP Is a Java library you can install using Maven or Gradle that works with any JDK 8 on Linux x86_64. It has Amazon in the name because Amazon wrote the library.... The name might be awkward, and codeguru might be slanted towards suggesting open source libraries written at Amazon, but it is about as neutral as can be, not even requiring you to use Amazon’s OpenJDK distro. Why does Amazon have an OpenJDK district though? Because sometimes Amazon sees performance issues at scale that they have a hot fix for. Then they share the patch with the wider OpenJDK community and have discussions about if there are better approaches to fix. Amazon has been one of the top contributors to OpenJDK releases recently (typically in top 3 for contributions to a given release), so they really are upstreaming patches.
5ersi 7y ago
ACCP is an Apache licensed crypto library that has a standard JCA/JCE interface, meaning it's a drop-in replacement for the standard java crypto. https://github.com/corretto/amazon-corretto-crypto-provider https://github.com/corretto/amazon-corretto-crypto-provider They claim to be 25% faster than standard implementation: https://aws.amazon.com/blogs/opensource/introducing-amazon-corretto-crypto-provider-accp/ https://aws.amazon.com/blogs/opensource/introducing-amazon-c...

by redler 7y ago

ensignavenger 7y ago

Amazon Corretto is their OpenJDK Java distro that is free and Open Source. I don't know if the project was already using Corretto or not, but it makes sense for them to recommend their own, supported, open source solution.

redler 7y ago
Your point is a fair one, and I admit unfamiliarity with Corretto, specifically. But they're telegraphing, right on the tin, that this new service will indeed recommend solutions of the form "we see a problem pattern in your code; try Amazon _____". The fact that Corretto is actually open source further muddies the waters.
- weego 7y ago
  We'll need to see what comes out in the wash. Maybe the more OSS they encounter the more suggestions it will be able to make. Or maybe not and it will indeed be a sales pitch masquerading as a feature.

quin3 7y ago

In the future, You should do a quick search before naysaying. This crypto lib is free and offers non-negligible performance gains.

NegativeLatency 7y ago
It's still increasing your dependence on AWS systems and software. (The upsell price may be free for now, but who knows maybe they add a premium version or enterprise features in the future) I imagine that the tool will be used for recommending more amazon services in the future, and this is possibly a poor POC of more to come.
- Sebguer 7y ago
  It's not an AWS system or service at all though... This is like saying that using React will lead you to be locked into Facebook?
  - ghostpepper 7y ago
    Why does it have Amazon in the name then? Amazon Coretto?
    - Sebguer 7y ago
      Because it's maintained by Amazon? But it's entirely open source: https://github.com/corretto/corretto-8 https://github.com/corretto/corretto-8 with a very permissive license (GPLv2)
    - cowsandmilk 7y ago
      Amazon Corretto Crypto Provider ACCP Is a Java library you can install using Maven or Gradle that works with any JDK 8 on Linux x86_64. It has Amazon in the name because Amazon wrote the library.... The name might be awkward, and codeguru might be slanted towards suggesting open source libraries written at Amazon, but it is about as neutral as can be, not even requiring you to use Amazon’s OpenJDK distro. Why does Amazon have an OpenJDK district though? Because sometimes Amazon sees performance issues at scale that they have a hot fix for. Then they share the patch with the wider OpenJDK community and have discussions about if there are better approaches to fix. Amazon has been one of the top contributors to OpenJDK releases recently (typically in top 3 for contributions to a given release), so they really are upstreaming patches.

5ersi 7y ago

ACCP is an Apache licensed crypto library that has a standard JCA/JCE interface, meaning it's a drop-in replacement for the standard java crypto. https://github.com/corretto/amazon-corretto-crypto-provider https://github.com/corretto/amazon-corretto-crypto-provider They claim to be 25% faster than standard implementation: https://aws.amazon.com/blogs/opensource/introducing-amazon-corretto-crypto-provider-accp/ https://aws.amazon.com/blogs/opensource/introducing-amazon-c...