Blog on Kamran Zafar

The AI That Isn’t Allowed to Remember

Sun, 13 Sep 2026 20:00:46 +1000

Building a Qur’an and Hadith research tool meant treating the general purpose LLM’s own memory as a liability, not a feature. And three production failures that taught me why every layer of the pipeline around it earns its keep.

Ask a general-purpose chat model to quote a hadith on a specific ruling, and it will usually hand you something that looks right: a plausible book name, a narrator chain, a quote in confident English. Ask it to check its own answer and it will often defend the fabrication just as confidently. That’s not a rare glitch, it’s the model doing exactly what it was trained to do, produce fluent, plausible continuations. The problem is that “plausible” and “real” are unrelated properties, and for a domain where the exact wording of a source is the evidence, a fluent misquote isn’t a stylistic slip. It’s fabricated primary-source material attributed to a real book and a real scholar.

Building an Intelligent Document Indexing & Search System with OpenSearch Vector DB, and Ollama AI

Wed, 15 Apr 2026 21:54:31 +1000

Organisations today generate enormous volumes of documents — contracts, statements, reports, compliance evidence, engineering drawings, emails, and more. Traditional keyword search struggles to extract meaning from this information. Today’s users’ want answers and deep document insights, not just matching text.

By combining Spring Boot, OpenSearch Vector DB, and Ollama AI, you can build a modern document intelligence platform capable of:

Indexing documents into vector embeddings
Performing semantic and hybrid search
Running Retrieval‑Augmented Generation (RAG)
Delivering grounded, context‑aware answers

Real-Time Data Replication Using Change Data Capture (CDC) with Debezium and Kafka

Thu, 03 Jul 2025 14:53:57 +1000

In today’s world of distributed systems and real-time analytics, keeping data in sync across databases is critical. This blog post walks you through a practical demo of implementing Change Data Capture (CDC) to replicate data from SQL Server to PostgreSQL, using Debezium, Apache Kafka, and Kafka Connect.

We’ll set up a fully functional pipeline that captures changes in SQL Server and streams them to a PostgreSQL sink — all within Docker containers.

Securing Hazelcast (tcp) traffic with Stunnel

Tue, 11 Jun 2019 11:16:04 +1000

Hazelcast is a distributed in-memory data grid, which allows to evenly share data among nodes in clustered environments. The open source version of Hazelcast does not support encryption at the transport or even at the cache level. So in order to secure traffic in the Hazelcast cluster, we need to extend it by making some code changes, which may not always be an option.

There is however another way to secure the transport by using stunnel. As the official documentation states, “Stunnel is a proxy designed to add TLS encryption functionality to existing clients and servers without any changes in the programs’ code”. This sounds like a perfect option in our case, and allows us to decouple transport encryption from our Hazelcast applications.

Docker and iptables firewall

Wed, 05 Apr 2017 02:20:42 +1000

Docker works perfectly fine when no firewall is running on the host machine. Without the firewall docker containers can communicate with each other and with the outside world. But with the firewall we need to setup some rules in order to allow traffic to and from the docker interface. Below it is detailed how we can configure the firewall for docker on a Centos server.

First of all let us find the docker interface and IP, we can do that using the ifconfig command:

Atomic Updates on MongoDB with Spring Data

Tue, 25 Oct 2016 00:04:09 +1100

MongoDB provides operators for atomic updates in addition to the normal insert and modify functionality. These operators include, $inc, $set and $unset; and are particularly useful for keeping counters and for thread-safe field updates, which helps resolve data-related concurrency issues in web and multi-threaded applications. If persistence is required and performance is not an issue, these operators can also be a good replacement for single-threaded caching solutions like Redis by providing persistent atomic operations. The use cases for using these operations include, real-time web analytics, leader boards, rate limiting etc.

CAS and distributed Infinispan integration

Tue, 18 Oct 2016 21:02:08 +1100

CAS is a centralised authentication server that makes it very easy to implement single sign-on (SSO) in java application, and is a very good OAuth alternative. For distributed/clustered environments CAS also offers integration with a number of caching technologies in order to support single-logout (SLO). Recently we had an issue on clustered Wildfly J2EE servers where we had to support SLO in our distributed spring-boot based applications. Infinispan is the default distributed caching technology used by Wildfly, and unfortunately we didn’t find any integration support provided by CAS for Infinispan. So I wrote an integration library for CAS & Infinispan, which is available on github under Apache License. This library makes it possible to achieve SLO in distributed J2EE applications on Wildfly.

Spring and Infinispan Integration on Wildfly Cluster

Sat, 17 Sep 2016 20:45:37 +1000

Spring framework provides a caching abstraction API that makes it very easy and consistent to use a lot of embeddable caching frameworks like, EHCache, Infinispan, Hazelcast etc. But sometimes it is also necessary to integrate with the underlying application server’s caching framework, especially in a clustered, distributed environment. In this post I will show how we can integrate a spring-boot application, deployed on clustered Wildfly application servers (version 10.1.0.Final), to integrate with the distributed Infinispan cache. Below is an illustration:

Spring Boot and WordPress CMS Integration

Mon, 08 Aug 2016 18:02:53 +1000

There are a lot of excellent open source content management systems available today, WordPress being one of them, which is widely used. WordPress is a PHP based CMS so not a lot of cohesion is available with other technologies like Java, and is simply ignored as a viable content management option just for being non-Java.

In this post I will demonstrate how WordPress can be integrated with Spring Boot applications, all made possible with WordPress REST plugin and a Spring client. Both of these are open source and available for free. Below is a simple design diagram that explains how this integration works. This post assumes that the reader has prior knowledge of WordPress and Spring Boot.

Using Standalone ActiveMQ Broker with Wildfly

Thu, 07 Apr 2016 21:37:45 +1000

Wildfly is an open source J2EE container, which comes with an embedded HornetQ JMS broker enabled by default in it’s full configuration. The embedded HornetQ works great out of the box, but sometimes it can be handy to use an existing JMS broker, like ActiveMQ. ActiveMQ includes a JCA resource adaptor that can be used to integrate it with J2EE containers. Below we will see how to integrate standalone ActiveMQ 5.13.2 with Wildfly 9.0.2 server.

Protect your identity from SSH servers

Sun, 17 Jan 2016 22:19:18 +1100

Recently I came across a tweet that highlighted a serious privacy issue related to SSH servers and online services that publish user information in public domain without having to explicitly take permission from users.

Added a OpenSSH roaming vuln test to the whoami server $ ssh https://t.co/MSn1TEQGTs (code: https://t.co/HMIH00CxHg) pic.twitter.com/9tolWWvXZJ

— Filippo Valsorda (@FiloSottile) January 16, 2016

In this tweet the guy talks about running a SSH server that matches the incoming connection’s public key with the public keys of Github users, which for some reason Github has kept in the public domain (totally not cool!).

Real-time Web Cam Surveillance with Raspberry-PI

Sun, 29 Nov 2015 21:46:23 +1100

Raspberry PI is a great little tool for building small projects, from personal web servers to robot butlers. With it’s linux core you could potentially use RPI like a regular linux box. There are loads of example projects available on the internet. Here I will present how to use RPI to build a poor man’s surveillance camera using an ordinary web cam. I found an old web cam in the drawer, I seldom open, that came in handy for this project.

XMPP web chat with ejabberd, Converse.js and Spring MVC

Wed, 05 Aug 2015 23:15:58 +1000

Converse.js is a fine little XMPP web chat client that can easily be used in web applications. It can integrate with various online XMPP services, like Google Talk, MSN etc. In this post I will demonstrate how to use converse.js with ejabberd in a Spring based application. I used Ubuntu linux box to for this demo.

ejabberd is available in main Ubuntu repositories so can be installed by using the following command.

Organizing Media files on Linux

Tue, 24 Dec 2013 17:10:09 +1100

Recently I was doing some cleanup on my Dropbox account, and I found that some folders (especially “Camera Uploads”) had like a million unorganized images and video files that were auto uploaded from my mobile phone and other devices. Unfortunately Dropbox doesn’t automatically organize these files in date folders or even gives you an option to do so. So I decided to write a script to organize the files myself in the Dropbox folder on my Linux Desktop. Below is a simple shell script that can do this.

Clustering and Load balancing Tomcat servers

Sat, 03 Aug 2013 23:11:12 +1000

Tomcat is by far the most popular open source Java servlet container that can easily be scaled to ensure high availability. In this post I will show how easy it is to distribute and scale java web applications using tomcat clusters. In this example we will also use Apache web server to load balance the cluster.

Below is a simple setup of a cluster with two Tomcat 7 nodes with Apache web server 2.2 as a load balancer.

Demise of J2ME

Fri, 14 Sep 2012 23:24:03 +1000

Since the arrival of iOS and Android smartphones, J2ME has really faded into the background. And it is not because iOS and Android are better platforms, it is because J2ME didn’t evolve with the rapid technological growth of mobile devices. J2ME was originally intended for low-end devices, as a lightweight Java runtime and was very successful. But we haven’t seen any new enhancements to the platform for the commonly available new high-end mobile devices nowadays. There has been some maintenance releases here and there but no substantial improvements were seen in the platform. Some proposed enhancements are lying dormant in the neo-political and ever bureaucratic JCP. And since Oracle acquired Sun Microsystems, and started pushing their ADF platform for corporate mobile solutions, the future of J2ME is looking very bleak.

Sharing VPN connection on Linux

Thu, 16 Aug 2012 23:52:48 +1000

Most VPN servers allow a single remote session per user, which is all you need most of the times. But sometimes it is necessary to connect multiple devices to the VPN server; but using a single user account it is impossible if the server doesn’t allow it. There is a way around this problem by sharing the VPN connection from a central node to other computers by setting up an ad-hoc wireless network using the wireless modem of the central computer as a hot-spot. The idea is fairly simple provided the central computer has two network cards:

Near Field Communication (NFC)

Sat, 10 Sep 2011 20:00:17 +1000

Near Field Communication (NFC) is a wireless/radio-frequency technology that works over short-range. This involves communicating data between devices(“initiator” and “target”) in close proximty normally requiring less than 10 centimeters. In the realm of mobile phones, the “initiator” is the mobile handset and the target is typically a RFID(Radio Frequency Identification) Tag for passive communication. To understand it; RFID Tags, for passive communication can be thought as QR/barcodes and the smartphone as a “reader”. But with NFC it is also possible to have an “active” communication, which requires powered RFID Tags enabling peer-to-peer communication between itself and the NFC-enabled device, similar to Bluetooth.

A free software license

Thu, 21 Apr 2011 22:59:28 +1000

There are many free software licenses available these days, from viral and stringent licenses like GPL, with some grey and confusing like LGPL to business friendly licenses like ASL and X11. All of these licenses are “open source”, which means the software source is also available to public along with its binaries. Which is great for open source and I personally like ASL among the lot and tend to use it for most of my open source software. But sometimes you might feel that these licenses are not “free” enough, and pack tons of terms and conditions in a pretty complicated language. There should be a software specific license which doesn’t restrict the user in anyway and allows to freely use, modify and distribute the software in any way the user likes. And the derived work should be allowed for both commercial and personal use, with or without a charge.

Why is git better than svn

Thu, 07 Apr 2011 16:42:46 +1000

Well I am not going to start debating over this question, as most people on the web are doing so. I am not going to list pros and cons of both svn and git and make a vague conclusion in the end. I being a user of both svn and git, found git better for the kind of work I do and the way I do it. I was mainly a svn user before I heard people talking about git being easier etc. than svn; after I started using git I agree with these people. With git, it is much easier, simpler, faster and natural(in the realm of development) to manage your code, to create and clone repos; branch, tag and merge code. Apart from being simple and powerful, git is also decentralized and distributed in nature, which undoubtedly is git’s main advantage over svn.