Read the show notes and download the full episode here.
Michaela Light
Welcome back to the show. I'm here with famous Charlie Earhart. Saw him recently in Las Vegas at CF Summit, invited him back on the podcast. And we're going to be talking about moving to Cold Fusion 2025. Cheers and challenges. So, if you are one of the very few people on the planet who does Cold Fusion, has not heard of Charlie, he is a veteran. Server troubleshooter. He's worked with enterprise IT for more than three decades, probably four decades at this point, to be honest. And he's also been contributing to the community. He's a great helper in the different ColdFusion communities. He's contributed to multiple ColdFusion books. And he provides remote, short-term, and on-demand troubleshooting, tuning assistance for organizations of all sizes. And experience level. And you can find him at cairheart.org/slash consulting. I'll put that in the show notes at terror tech.com for those of you who want to find it. Welcome, Charlie.
Charlie Arehart
Hey, well, glad to be back. It's been a little while.
Charlie Arehart
Yes. Well, I took a little break, but I'm back from the break now.
Charlie Arehart
Well deserved, I'm sure.
Michaela Light
Yes. So we're going to be talking about. Both ColdFusion 2025 and what I call ColdFusion 2026. Other people call it ColdFusion 2025 update eight. So, and we'll look at the cool things that Adobe released in there. But in particular, we're going to look at some of the hidden things that people may not have noticed. And so what are you excited about in the latest release that came out over the summer?
Charlie Arehart
Well, and let me set the stage because it'll explain why I can't pick any one thing. It's like asking to pick your favorite child, right? So this title, Cheers and Challenges, moving to TF2025, Cheers and Challenges, is one that I came up with because I'll be speaking at the CS Summit East in DC in October. And that. They have people they don't have, they only have one day, it's only several slots. So they invite a few of the presenters and then some of the Adobe folks give talks. And because there's only a limited number of slots, I gave two talks at the summit in Vegas, and one was hidden gems in Colevision 2025, and one was migrating to CF 2025. From earlier versions, migrating apps to CF2025 from earlier versions. And so I kind of jokingly said the first talk is why you would want to consider moving to 25, and then the second talk is some of the challenges you might face. And so, this talk that I'll give at the summit and that we're kind of, you know, using as a guide to our discussion today is recognizing that, yep, there's a lot that's new. 2025. And if you're not paying attention, you could easily not know. And there's the major stuff that Adobe talks about. And then, if the docs, the website, Read the available resources, or attend my hidden gem talks, you learn that there's just so many other little things, often dozens and dozens of little things. And so we don't have time to go over all of them. And in my talk at the summit, which I also repeated last week on the Co-Fusion Meetup, co-fusionmeetup.com for those who don't know. And it's available now on YouTube. I gave that talk, Hidden Gems, in CF2025. So that talk's out there with all the detail. And actually, I called that one a year later because I had done it last year at the Summit East, even to more detail. So, anyway, it's lots of information to consider. I point to resources from Adobe, and I'll just say bottom line, because we'll get to some of this in our discussion. But if you just Google what's new in Coal Fusion 2025, the doc page that that takes you to is a really full page full of lots of new things and some of the big things. And if you Read closely, some of them are the little things, then some of it's buried, and that's why some of it I pulled out in the hidden gems. So quickly, you know, I don't know if there's any one thing that would make me do it, but each of those new things that are either new big things or new little things might be the thing that makes somebody. Want to move to it that's you know no one wants to hear that as the answer like just tell us the one thing well that's like picking your favorite child there's too many and different different people's perspectives are going to lead to what they think is a compelling new thing so I'd just rather put the stuff out there and let people decide speaking of looking I just happen to notice my screen and for those that are listening to the podcast this doesn't matter But for those watching the video, that this is also recorded, you'll see a weird dot on my head and dot here and a dot here, dot here. I have sometimes facial skin cancers, and these are where the doctor just froze them. And that was just a few days ago. So once he freezes them, they scab up and then they fall. So there's little dots of red in various places on my face that'll go away.
Charlie Arehart
I didn't notice until you pointed them out, Charlie.
Charlie Arehart
Right, but somebody watching the video, especially. Big experience.
Michaela Light
Well, glad you got them treated and hopefully heal fast. My dad had those. So I know. For me, it's really the AI features in the latest version of CoalFusion that came out this summer. And I must admit, I'm still calling it ColdFusion 2026 because it's a major new update, had a bunch of LLM integrations, MCP support, RAG support, hecta databases. A whole bunch of new features in the cold fusion language, security improvements. So, better monitoring, and they improve performance of some of the features. So, to me, a release.
Charlie Arehart
Yes, it really should have been called that. And we've both discussed how there's various factions inside of Adobe that some wanted it to be a new release, and some didn't, and somehow the ones that didn't want. So, yeah, it was the most. Of any update ever to Coal Fusion. It really should have been its own release. And just to put things in perspective, you know, we've generally had two years between each version, you know, 2016, 2018. 2021 was only called that because COVID happened and it was at the end of 2020 that it came out. So they called it 2021 and then 23 and then 25. This, you know, they had been saying recently they were switch to an annual release cycle, and that would have made sense then for that to be CF 2026. For some reason that that didn't win out. But yeah, boy, let's clarify: there was so much in that update eight. And by if one just googles what's new in ColdFusion 2025 update eight, there's its own page for that because there was so much new in that. It is like a new release, and the AI stuff is by far the biggest. And I just want to say quickly. There's so much more than the AI stuff. If you look at that webpage, and I'm saying this for everybody's sake, you know, but for everybody else's sake, there's so much that was new to update eight. I could have done a talk just on hidden gems in update eight, but I, in my hidden gems talk, you know, I mostly covered stuff that was new in 2025 that has hidden gems, and then also stuff in update eight that was hidden gems. But yeah, just check out the docs and you'll find that there's so much, and often it's just things that you would never have dreamed of could because if you think it's update eight was all about AI, it's not. Now, to that point, I just want to say also that being about AI, man, it's a lot more than many people would think. They might think, well, it does this or it does that, or I don't know if I want to do that. It is optional. You don't have to use it. Since 2021, things are built in modules and packages. If you don't want the AI package, don't install it. But if you do install it, then. Opens up the door to so much integration possibility, like you said, with MCP and RAG and so on. And we won't be able to do it justice, but that page that I pointed to does discuss each one of those near the top. They have their own ample documentation. And I want to say one last thing before we might move off this topic. Others have been starting to talk about it, the cold fusion integration with AI, David Byers, especially. If one goes to coalfusion.adobe.com, that's the portal for Cole Fusion, coldfusion.adobe.com. And they have blogs and they have forums and discussions. Anyway, David has done several posts, very substantial posts about AI with ColdFusion. And then on his own. Blog, he's recently started doing even more. And that's, I wish I'd looked it up. It's not Cold Fusion Monkey. That was. I'm sorry, the name slipped my mind.
Michaela Light
But it's like send it later and I'll add it to the Yeah, but it's like code code monkey studio.
Charlie Arehart
Oh, okay. And he's got multiple, again, substantial article. Matt Gifford was Cole Fusion Monkey. Don't want to confuse that. But anyway, yeah. There's so much to it that Adobe's multiple substantial docs are quite a lot to take in. And then folks writing about it, and Ben Adele has been writing about it, and others are starting to write about it. So definitely look for that if you're interested in that. And all of its, you know, evolving. One of the really cool things about what they did was they designed it in such a way as MCP itself is designed so that things are pluggable. And as things evolve, things will be. Supported that'll change down the road, and they'll do whatever it takes to support different things. So, it's you're not going to be tied into working with a particular AI a certain way, it'll kind of be like data sources, you know, and to a degree there's some SQL variation, but there's a lot of substantial same stuff. The way you'll integrate with AI mechanisms will be very similar, even if you switch among them. So, anyway, Read about that more on your own. There's there's lots to take in. Lots and lots.
Michaela Light
Good stuff. Yeah, I think it is great stuff. I think I'd summarize the latest released features: this enterprise AI, where you don't want to give up control to some AI vendor like Chat GPT or Claude. So it's model independent, and or even you can use one of those open source AIs if you're allergic to spending tokens with. Companies, and I've heard of some companies whose tokens like they've spent hundreds of dollars on tokens, so far more, even yes, or millions.
Charlie Arehart
And then, part of this is also about using it to reach into your stuff in a safe way, secure way with guardrails. That's all covered in the docs. And there have been multiple videos from Adobe, multiple different videos. In fact, in my Hidden Jumps talk, you'll see that when I discuss. The AI stuff that was added in eight, and again, I only get a few minutes to talk about it, I point to about several videos that Adobe did. So if you're at all interested in this stuff, the point is you can find out about it either by reading about it or watching the videos. We're not going to do it justice. That's not the focus of this talk, but there's so much to it. And again, don't be fooled into thinking you know what it is or what it isn't. It's very elaborate and capable. And it'll evolve as more people use it. And that's all for the good.
Charlie Arehart
Now, I know influential in getting some of these new features added to ColdFusion.
Charlie Arehart
Little tiny thing.
Michaela Light
Tell us, thanks for doing that, Charlie, for yourself and the community. Uh, what were the things that you pushed for that Adobe added in, and why were they? Why are they important?
Charlie Arehart
I would want to clarify that they are among the hidden gems, little tiny things. They're not the things that made people buy Cold Fusion 2025. Um, but but I brought them up, and when I mentioned that I had brought them up and Adobe addressed them, I did it more to say, Hey, I just filed them as tracker tickets on tracker.adobe.com, and people will often lament that they put stuff there and nothing ever happens. And I was trying to say, no, it does sometimes happen. People bring stuff up and they listen and they don't pay attention to mine any differently than others because all these things that are the dozens and dozens of little hidden gems that come sometimes from people bringing up things. So, like, for an example, when one was going through the CF installer, not everybody does the installer, but if you did run the CF installer, for whatever OS, if you did the full installer, one of the questions at one point was what profile were you going to be using? Was it be production or development or production plus secure? And there was one more prompt there about, and what IP address do you want to limit or allow access to the administrator? And I just said, and it used to only allow you to change it if you picked production. And I was like, well, somebody in development might want to limit or choose to control. Address. So that just you couldn't type in it if you picked development. So that was to me an obvious thing, just an oversight. Somebody thought there was a reason. So they fixed that. And then starting in CF 2016 or 2018, they stopped telling you, they stopped offering at the end of the installer to integrate with your web server to do the web server configuration tool. They just it away. And some people since then have been like, oh, you used to help me do that. And now I'm stuck. What am I supposed to do? So I said, well, just at least tell people that here's how you could proceed. So they added a new kind of final screen that says, Hey, we don't do the web server configuration anymore. If you want to do it, here's how to do it. And then one other little one was in the administrator. I would often be helping people, and they would make changes to the JVM. Maybe change the heap size or change the Java arguments, especially. That was a very common thing, some reason to change the arguments. And you'd Read something that talked about how to do it. And, you know, you just go into the field of the administrator and paste it in. And I would warn people: hey, if you ever touch that box, if you make a mistake, you leave out a space in front of a dash or you leave out a dash or you put it on a new line. It's going to take it and say, okay, on the next restart, I will make that take effect. And then the next restart would not start because you made a mistake. So, I would always point out that that page of the admin changes the underlying file called JVM config. And I would show them that up there there was a paragraph at the top of the admin that named the word JVM config. So, if you ever wondered what was that file, you'd see the name, but I always thought, well, why not just tell them where it is, tell them the path. Because if one is doing multiple instances, it would be the instance name bin. Or if you're not doing instances, it's CFusion bin. Well, you'd have to know that stuff. And I just thought, why do we have to know that? So I asked, Hey, why not just tell us right there? So there's a little thing. Again, are those anything going to make somebody buy as you have? No. But if you're using it, they're just an example of the kind of things that make your life easier. And there's development things that I cover that I didn't recommend, but others did. Admin things and security things and just so much. But anyway, to answer your question, those were the couple of things that I noticed they did that I said, oh, yeah, I asked them to do that. So thank you.
Michaela Light
That's great. So I noticed one of the things they added is making HTTPS SSL on the CF admin easy little thing. But when I walk into mid-market companies, many people leave their CF admin. It may have HTTPS on it, but it's still open to the world. Um, do you find that often when you're helping people out that people have left their admin?
Charlie Arehart
I hear people bring that up, and I just want to clarify that technically that's not possible anymore through the web server like IIS or Apache. I just want to be clear about this because not everybody thinks this through the built-in web server, which is what we were just talking about. You can make that require HTTPS, that's what. You know, 8500, port 8500, whatever you want to make it be. That has always been HTTP by default. And there was no obvious way to make it be HTTPS. That's what was changed. Let's clarify that for everybody. In CF2025, there is now a page in the admin called security and certificate. I forget what the exact title is, but it's right there at the top in the first section of the admin. And it's on the right. And it's, you just click a checkbox. And if you want to. It'll create a self-signed certificate or you can point to a certificate. So, if you know what that's about, one is you can set that up. But if, but back to your question, accessing the admin from outside of the environment, not using that built-in web server, but using IIS or Apache, which are the provided web server connector web servers, those have not allowed access to the admin by default since. CF10, I believe, right? I believe, yeah, CF10 in 2012 that first no longer asked you if you wanted to make this built-in web server available. It just did it. And it said, we're going to put the admin on the built-in web server. So out of the box, it was no longer accessible through the web server. You didn't get to it that way. But there were virtual directories and stuff that people sometimes define that said CFIDE and stuff like that. So in CF2016, literally in 2016, 10 years ago, they changed that so that they split the administrator and this folder called CF scripts into separate places. And they no longer put CFIDE in as a virtual directory in your web server like IIS or Apache. Therefore, out of the box, by installing CF2016 and above, your admin should not be available through the web server. Now, some people said, We want that, we'll do that, and they forced it in there. And soon Adobe put in blocks to make that not possible, but people still got around it. And then it was about two years ago that they did an update, and in that update, they made the web server connector such that you cannot even work around it. You can't get to the admin. Let's be clear since CF 2021, whatever update in 23, CF 2023, same time in 2023, and also now in CF 2025 out of the box. You cannot get to the CoFusion administrator through IIS or Apache if you've used the CoFusion web server configuration tool. That connector will not let a request through to the admin. Now, I'm making that specific clarification because if one on their own sets up, you know, Nginx or Apache or any of the various proxies, you could port forward in those to the built-in web server. And if you port forward to the built-in web server, then you're taking some responsibility for what you're doing. And you're saying, I really want the built-in web server to serve the content. And I'll just forward to it. That won't make sense to everybody, but for those to whom it makes sense, I'm saying, well, that then you would want to add a block of the administrator, the CFIDE folder, literally. And it used to be that you couldn't just block the CFIDE folder because it had this scripts thing in it. Well, it doesn't. Since CF2016, that's in a CF scripts folder. So, yes, if you're going to do your own web server configuration and your port forwarding to the built-in web server, you could add that it doesn't allow access to the administrator. But one more time, that's where that IP address thing we talked about in the installer, or it's in the admin for those who don't pay attention. In the admin, there's a security page and there's an IP addresses page, and it's who's allowed to get to the administrator. And you could lock it down to be only 127.001 or whatever IP addresses as a list that you wanted to. So, so much to this stuff. We can hope that people would find these things out from AI, but sometimes AI gives you answers that are dated or incomplete. So I still like to clarify these things when I get the chance.
Charlie Arehart
Or just out now, hallucinates sometimes. Yeah, or it does it. So let's move on to container improvements. Tell us about those.
Charlie Arehart
Well, it helps to stop for a second and remind people who don't know that CF started supporting. Containers, by which we mean Docker, Kubernetes, Compose, and variants of those things since 2018. But many people didn't know back then. They weren't paying attention. And 2021 had containers, 2023 had containers. And 2025 still has containers, you know, images. There's GoldFusion images from Adobe. And those images can be used to build containers. And the point that you are acknowledging is that in CF 2025, they made substantial improvements in that support of those containers. And in particular, perhaps the most important thing is if anybody had tried working with CF images and containers prior to 2025, if you use the environment variables available to configure things like whether to enable the integration with the add-on server or to change some characteristic through these environment variables or to add packages. You would find in 23 and 21, especially when the packages were added, that the startup of the container would take considerably longer than you might have thought it should. It would actually basically take twice as long as you thought it should, because it literally was restarting the container if it saw that you gave it. These environment variables to reconfigure things. When it detected that, it reconfigured things and then restarted the container as a part of the startup of the container. And that was lamentable because it was a choice, but it was not a good choice. So in 2025, the images that are built for CF2025 no longer have that weird, unexpected restart of the container. And you might not notice it. You just notice, hey, it's not available for a minute. Well, now it should be available in like 20 seconds. Some circumstances can control how long it'll take, but they can be available now in less than a minute from your starting it to it being available and ready to run. So that's the performance benefit to them. I'll also throw out that, I'm just doing this from memory. I'm not looking at any notes when I look away, it's just my brain trying to think, what else did we talk about? There was new support for secrets and configs, and those are. A different way to get information like passwords or keys into the container without them being in a file, through a mechanism that might be available depending on how you're deploying your containers. Different container runtimes provide ways to provide these secrets and to inject them as environment variables into the containers when they start. That's an important thing for some people. One, some people would never notice it. And you know, it's all part of the maturing people go through in working with containers. Some people, they still use them. Others have been using them, but maybe haven't changed how they use them in years. As you learned about some new capabilities that Docker and Kubernetes and Compose have added, you can do those things with ColdFusion. And I'll just throw out that the secrets, by the way, are not just with Swarm, for those who know what Docker Swarm is. There's a discussion of that in the docs, and no, it's not just limited to Swarm, it works with compose files, and it would, of course, work with Kubernetes.
Charlie Arehart
Well, that's exciting because a lot of people do use containers these days and for you know, make it easier to share the same configuration.
Charlie Arehart
Unfortunately, CoFusion's licensing makes it not as common among CF as it could be. It's certainly more common with Lucy and Boxlang.
Michaela Light
Yes, it is. Those being open source cold fusion engines, they don't have the same licensing constraints. But let's not go off into licensing. We had quite a discussion.
Charlie Arehart
That's all that before. Although we should say, for those who don't know, that CF2025, there was a substantial change about it's now subscription-based. So no more perpetual license. If you have a perpetual license of 23 or 21, those still work. 21 is no longer updated. 23 will be for another two years. But if you're buying CF2025 going forward, it will be subscription-based.
Michaela Light
Yes. And I think that's partly explains the naming difference between update eight and Coal Fusion 2026, because under the subscription license, the idea is they continually provide new features to subscribers to encourage people to stay subscribers. So that's, I think, partly why it was not named differently. And also, I just want to point out from a technical point of view, you don't have to do a fresh install to get update eight features, you apply an updater. Just like you do any other hotfix update, and magically you get all those new features.
Charlie Arehart
So, yeah, I think that was probably for some reason that was the bigger point for some people's perspectives that they didn't want you to have to reinstall it. Now, the funny thing is, if we twist things around, from a licensing perspective, had it not been subscription-based, then that new version, if it had been called a new version, you'd have had to buy the new version.
Charlie Arehart
Yeah, so you don't have to buy, you've already subscribed.
Charlie Arehart
That's what I'm trying to say with subscriptions. It's not as big a deal anymore. They could have called it 26. But yes, if they made you reinstall it to get that new version, and that's what perhaps we're going to find out with whatever the next release is. Will the next release require reinstalling or will they somehow find a way to update it in place? Right. We've never had updates in place with ColdFusion ever. It's always been side by side or on a new machine. But maybe they're working towards making it to be available as an update in place. That's always risky, you know, but there might be that something that they're moving toward.
Michaela Light
You can always choose to do a fresh install with an updater if you really want to. I mean, they do roll up all the prior updates anyway. So if you have to blow away your server and put another virtual server in, you can do a fresh install if the updater feature doesn't work.
Charlie Arehart
Of course.
Michaela Light
But I do think this move to making it easier to keep things updated is a good idea. Because I've talked to a lot of people who they just get nervous when they have to do a new version install. Whereas updators, they seem to be a bit more calm about. But what are you seeing with how people are dealing with? Their procurement departments or, you know, buying Coal Fusion, have people settled into subscriptions or is there still a lot of subscription resistance?
Charlie Arehart
Well, it's kind of hard to say in general terms because different organizations respond differently. Sometimes the people involved in running CF are the ones buying it, and sometimes they have nothing to do with it. And it's people way up who don't know how to spell CF. So anyway, you know, so it's kind of hard to name any generic. Perceptions, but I will say that one of the things I pointed out in my Hidden Gems talk is just to keep in perspective that the price of the subscription is the same price effectively as if you had bought it every time a new version came out. I just want to throw that out because let's say the price was X to buy a new version of CF, and the next version came out and the price was X. Often it hadn't changed. But if you on the old version and you went to the new version they gave you the new version at 50 off of x so over the course of four years you wouldn't pay two times the price you'd pay one and a half times the price well if you divide that one and a half times the price by 24 or 48 48 months because it's um every two years if that turned out to be the same price that you're paying on a monthly basis a subscription. I just say, bottom line, the subscription pricing is equal to the price one would pay if they bought CF every two years with that 50% discount because they were a prior user. So that's a good thing. It's like they didn't raise the price, they just changed the subscription. That doesn't take away, you know, back to your question, that doesn't take away the angst some would feel that, well, but I'm not getting a perpetual license, I must pay that. Subscription. If I stop paying it, by the way, if you stop paying it, this hasn't happened yet, right? Because we're still within the first year of CF2025, having come out. But I believe what will happen is that the license will no longer be, if you bought standard or enterprise, it won't be that anymore. It'll revert to the free developer edition. And you're not supposed to run that in production. And some know that it has limitations. And one of the key limitations is it can't run more than two concurrent requests. It used to be years ago that it was about IP addresses and limited to only so many IP addresses. That changed years ago. The developer edition has, for several releases, been about no more than two concurrent requests. So that means if two are running some long-running thing and a third one tries to run something, it doesn't matter how quick it would be. Once there's two running, any beyond those two has to wait. And they'll get a message that literally says this CF instance is running in the developer edition. Please wait and try your request again later. Now, that's not bad in development. That's pretty cool that you don't have to worry about that problem other than be waiting and be patient. But in production, that would be very embarrassing. And again, you're not supposed to be running the developer edition in production. So, again, if the license ends, my understanding is it will just revert back. The developer edition. So it won't just stop, but you won't be able to use it for production purposes.
Charlie Arehart
So, well, and you won't get hot fixes either.
Charlie Arehart
Well, I mean, technically, we can update the developer edition. So, yeah, it's an interesting point that you make. I mean, technically, Adobe gives the product the updates out to anybody. You don't have to be the license holder to get the updates. So, you could update the developer edition. We do. I do. But, um, but yeah, there's this other risk that that's the bummer: is that you people have to keep paying to keep using it. Whereas, right, you know, for 23 and earlier, once you bought it, you could keep using it. But let's turn what you just said around and say, Well, that's great, but like if you're on 21 or earlier, there are no more updates. You don't want to be on 21 or earlier because Adobe is no longer updating them, and that's why you should have bought the next version, but you didn't have to. But boy, let's just repeat that for everybody. You do not want to be running on CF21 because it stopped getting updates in November of last year. It's always five years. And it came out in November of 2020, not 21. So it came out in November of 2020. And so in November of 2025, five years later, it got its last update. There have been no more updates. And those who are on CF23 or 25 know that there have been about eight updates, maybe nine since then. I don't know, 12. Sorry, there's been 12 for eight for 2025 alone. So that would be like 13. There was one more, I think, in 2025. So 2024, whatever. I'm getting confused. Point is, there's been a lot of updates, and 21 hasn't gotten them. Yeah, now that about it, it was November of 2025. So, whatever that would have been at that time, probably like update four. So, yeah, there have been about eight to get to the 12 that we're on now. But the point is, you're several updates behind. If you're on 21, you're not getting those updates.
Michaela Light
There have been some of those updates as you've written about, Charlie, and I've written about, they were priority one security things. They could really, you know, someone. Hacker uses those, and hackers these days are far more sophisticated. They, you know, they're very organized, they have KPIs. We laugh at enterprises having all these goals and, you know, rah-rah cheerleading meetings. Hacker companies do the exact same thing. They have like a profile for their target, you know, hacking thing, and they have goals and they give out bonuses. And they're now using AI to help with the hacking as well. So you really want to have all your software patched. It is.
Charlie Arehart
And as long as we're talking about that, let's also mention that some people have hesitated to do the update quickly because they want somebody else to be on the bleeding edge, let somebody else suffer the problems. Well, I understand that motivation, but boy, something else that's worth considering. And not unique to ColdFusion. Nor to 2025. But nowadays, when an update comes out, the hackers seek to dig apart what changed in that update. They can do that. Some aspects are not supposed to. You're not supposed to decompile ColdFusion Java classes to find out what the source code was, but the hackers don't care, right? So when an update comes out, they're digging into what changed and then trying to infer from that. What vulnerability did this close? How can we penetrate that vulnerability? So you can't sit around and wait for a week or a month because there's a good chance that in that time, the bad guys are going to reverse engineer the update and figure out how to prop to perpetrate it. I want to throw else that twists on all this: some people might wonder: why are there so many updates with vulnerabilities? Crap, why can't they make? Better software? Well, it's what you said. Is making it so easy to find vulnerabilities. And then let's add this twist that a lot of people don't think about or maybe don't know about. Adobe, like so many enterprise organizations that sell software, offers a bug bounty program. So they will pay people who find vulnerabilities in any Adobe product. ColdFusion is just one of the 100 Adobe. But if somebody identifies a vulnerability and Adobe affirms it, then A, they'll pay money to the person that reported it. So there's their motivation to find bugs and report them, even if nobody ever would have found them. But conceptually, something would have found it eventually. But the point is, now the Adobe product security. Response team, PCERT, goes to the CF team and says, Hey, here's a vulnerability. We've affirmed it. You guys need to patch it. So they gather up a few of those things, depending on urgency, perhaps sooner than others, and come out with an update that says we've fixed these. And that's why there's so many. It's not that there's, I mean, it's kind of funny. Are there, there are vulnerabilities? Yeah, there's vulnerabilities in every piece of software. Is CF more vulnerable than other things? You know, that's debatable.
Michaela Light
I don't know. I've done research on that. It's not more vulnerable to it. It's probably the most secure language platform out there. And that's testified by many U.S. Federal agencies use ColdFusion partly for that reason.
Charlie Arehart
But I wonder if some statistics might be different now. And I'll just say, I don't think it's because CF's become more vulnerable. It's just because everybody's. Especially an enterprise like Adobe that's willing to spend money on bug bounties, they're going to get bugs reported. And then we, that's the tragedy to me, is that we who manage CF servers now have to deal with new updates. Like there's been at least three updates within a month for the past two or three months. It's a lot to deal with if you're an administrator. But again, I want to say it's not that CF is. Vulnerable inherently. It's that bad guys are being motivated, or you know, good guys trying to protect us are being motivated to identify vulnerabilities and report them. And then we have to fix them. That's why you don't want to be on 21. That was where we started this point.
Michaela Light
Or earlier. I still meet people. Oh, I, of course, or earlier.
Charlie Arehart
It's terrible. On 18, 16, 11, 10, 9. I've helped people like you on each of those in the past. Couple years. And I just, even if 21, I say, please don't stop. But they don't want to hear it or they don't, you know, they didn't want to spend the money to buy the new license when they were on 2018. Eight years ago, they didn't buy the new license for 21 or 23 or now 25.
Michaela Light
Well, I think in some ways, once we get over the, you know, the change to subscription, it makes it easier because you just don't, like many other pieces of software these days, it's part of an annual subscription fee and it stops being a thing you have to lobby for every two years. It's like, yeah, this is just something we pay for.
Charlie Arehart
But you then do have to implement it. So that's the part that trips people up: they're always afraid. And that's part of what my talk will cover. And by the way, let me say for everybody's sake. Tomorrow. Yeah, today's Wednesday. Tomorrow on the Coal Fusion Meetup. It's coldfusionmeetup.com. And I know some people are going to be hearing this podcast days or weeks later, but on the 27th of August, tomorrow, as we record this, I'll be doing my second part of the talk, which is migrating apps to ColdFusion 2025 from earlier versions. And I'll talk about what are the challenges that you'll face in making that move. That talk will cover those elaborately and identify resources and tools to help you get the job done, identify ways to mitigate compatibility issues that are introduced for security and discuss some of the pros and cons. I just want to say that I'll cover that. And even if you're seeing this days, weeks, months later, the meetup, the CoalFusion meetup sessions are recorded immediately to YouTube. So tomorrow afternoon. The recording of that talk will be available on YouTube. If you just look for my Kerhart or Charlie Earhart, anyway, just Google it. Actually, if you go to recordings.cofusionmeetup.com, I've made that URL do a redirect to that YouTube playlist of the meetup recordings and you can find them going all the way back to 2015.
Michaela Light
Now, talking about licensing, some good news there is, I think I Read that the API manager doesn't need a ColdFusion license anymore. Tell us a bit about that.
Charlie Arehart
Yeah, I mentioned that in my Hidden Gems talk. And, you know, the API manager, I'll just say quickly, I think it was ahead of its time. It came out with CF 2016, 10 years ago. And I think when it came out, the majority of CF people didn't see the need of an API manager. They weren't. Doing APIs, or if they were, they didn't appreciate what an API manager will do. So Adobe came out with this thing in 2016. And just to be clear, it's not written in ColdFusion. It's not even specifically for ColdFusion. It is an API manager that Adobe, a team at Adobe created for being a proxy traffic protector. Bit of a waff in some ways. You could do versioning of APIs, you could throttle APIs, you could control who could access APIs. It was very powerful, but I just think it was ahead of its time. People weren't ready for it. And so you didn't hear much about it in those early years of 2016, 2017, 2018. And then it kind of, I still think it fell by the wayside. Well, in the years since, other platforms have come out and they have API managers of their own. Or there's other API managers you can get and add. So, unfortunately, now I just think people are going to probably think of some generic API manager. But to answer the point you were bringing up, is that Adobe did no longer require you to have a license of ColdFusion to use the API manager. It's not open source, but you're free to use it. And it's still there and you can still download it. It hasn't changed a whole lot. It's more powerful than most people realize, and it's got its own entire documentation set. There have been videos about it over the years. So, but I won't get too excited about that licensing change because for a lot of people, it's water under the bridge. They've got other API manager solutions where they'll look at other ones. But yeah, everybody should be at least if you're doing APIs with ColdFusion or even not in ColdFusion. And you don't like an API manager you've seen, check out the one that's called the CoalFusion API Manager. It is not restricted to ColdFusion.
Michaela Light
So let's talk about content security policy and yeah, non-support. So tell us a bit about that.
Charlie Arehart
So that's one of the many new things in CF2025 that are, you know, kind of big deals in that. This is not something Adobe came up with. It's something that the world of web servers and browsers and organizations that support them came up with as one of the many means to deal with things like cross-site scripting. And so, if one chooses to declare that they want to follow those more secure policies, then one of the side effects is that. You'll find that you can't have inline JavaScript and inline CSS, and even the files you might point to, you have to do more to identify and protect and clarify that you're using that your app is using what you want it to use. It's all for your protection if you choose to implement it. And so, CF2025 offers the ability at the admin level or the application level or the code level to enable this CSP. Capability. And I don't have it in front of me, but I think it's content-security-policy.com is a website that I point to in my talk. So you can learn more about content security policy, have nothing to do with GoldFusion. You can learn about it. And then CF2025 just implements it. And one of the things that you can do if you enable it is generate this thing called a nonce, a number used once. And that nonce is a way that you can identify that the thing you're sending is something you generated. It's not something that off the web from some other funny place. So it's all just part of trying to improve the security of your use of software through the browser in ways that there's just a constant cat and mouse game of how to secure things. And CF is just participating in this CSP notion if you choose to. Again, you don't have to, if you don't want to. And in my talk, I pointed out that if you do enable that CSP protection, you'll find that your dumps, CF dump, write dump, those things won't look right anymore. And you can fix that. I provided in the presentation, which again is available online, both at YouTube, you can see the recording, or at my website, careheart.org/slash presentations. You can find that presentation that I gave last week, Hidden Gems in CF2025. And in it, I talked about this CSP feature that if you enabled it, you'd find dumps would not work right, wouldn't look right, wouldn't work right. And I give you an alternative CSP header. You can literally set a CF header that sets the correct header that allows it to work. And I talk about the pros and cons there. And I hope that Adobe will address it. There's a way I discussed there about how Adobe could address this, but I just want to throw that out. If you start doing this thing, you'll find your dumps don't. Look right. And when I say they don't work right, you we who've been around a long time know this, but a lot of people are just shocked to discover if you're looking at a dump, a CF dump, a right dump, and it's a struct or an array or a CFC or a query, you can click on it and it will collapse it. It'll collapse the struct, collapse the array, collapse the query, and click it again, and it'll expand it. A lot of people don't even know it. They never think to try it. Well, that collapsing capability. Is done through some JavaScript that is not available. If you turn on the CSP, because it's inline JavaScript, it gets blocked. But you can add this header that says, no, please allow me to continue to do that. So if you're in a development environment setting up to test this stuff and you want to allow your dumps to work, you'll need this. Of course, in production, you wouldn't likely use dumps. So it isn't a big deal.
Michaela Light
No, you don't want any dumps appearing in production because it was well they might do it, but I highly recommend people don't because it exposes a lot of information.
Charlie Arehart
Well, it depends on what you're dumping, right? If you know what you're dumping and you're dumping it for an intentionally good reason, that's different than debugging. We don't want debugging in production, but somebody could turn on, dump is a pretty cool looking thing for some people's needs. But anyway, the point is, yeah, most people wouldn't use it in production. And so this was more to say in your development environment, you'll want to be aware of this.
Charlie Arehart
this.
Michaela Light
So let's talk about things that got removed in these updates.
Charlie Arehart
Oh my. Yes.
Michaela Light
Yes.
Charlie Arehart
Well, that's a big deal, by the way, for those who don't know, for all the good things, and we have not covered, even touched the tip of the iceberg of the new things. There were so many new things that we've not discussed that Adobe promoted. And then my Hidden Gems, we've only touched on a few. But yes. So with the good comes the bad.
Michaela Light
And it's not bad. They're just doing a cleanup of stuff that's been hanging around that not many people use and has some issues.
Charlie Arehart
Yep. So there were features of CF, either features or language elements, functions and tags, things that people sometimes had never used, like the mobile development stuff that came out with CF11. Virtually nobody used it. They finally got rid of it. But then there’s some stuff that’s been around for a long time, and that might have been used pretty frequently, like HTML edit format was a way to convert a string to be safely rendered with, you know, the ampersands and stuff so that it wasn’t abusive able to be abused with CSS. Well that's one way to do it and then I believe it was in CF10 that they added the new functions called encode for HTML and other ones encode for JSON and things like that. Well, so yeah, and 10 years ago, they came out with a new function called encode for this and encode for that. And they marked the old one as deprecated. But, you know, who pays attention to deprecations, right? And your code works. That's what matters.
Charlie Arehart
And then all we should pay attention.
Charlie Arehart
It doesn't work. That's why we're bringing it up, right? Yes. Those things, that's an example where that function literally will not work anymore. Now, the good news is with that one, HTML format, HTML edit format, that's literally just a plug-and-place replacement with encode for HTML. In my experience, there might be some edge case I'm not thinking of So, that one can handle pretty easily. Another one that's gone that some people will go, I didn't even know it existed. But if you've either been using CF for a long time or your code was written by somebody a long time ago, or who had used it and didn't know that they weren't supposed to, was a function called parameter exists. It's been around since like CF2, maybe even one, I don't remember. But starting in CF3, they came out with is defined and said, hey, you shouldn't use parameter exists anymore. Use is defined. The difference is is defined takes a name of a variable in as a string and you can append another variable to that string and make it be a dynamically you know determined name of the variable whereas parameter exist just took the name of a variable and you couldn't dynamically build a variable well that's a subtle difference and those of us that were around then we were you know okay I could do is define parameter exists are pretty easy but I'll start doing is defined well then in the years since people said, Don't use this to find, use struct key exists. If you're looking for something in a particular struct, look for that particular struct. Don't just use is defined to say, hey, go find it anywhere. Well, anyway, those things evolved, the languages involved, and that old function parameter exists, been marked deprecated for over 25 years. Well, Adobe decided with CF2025 to impose greater restriction that if something has been deprecated, for a long time, we're just going to remove it. It's time to fish or cut bait, as the saying goes. So they literally just removed things that have been deprecated for a long time. They're not keeping them around anymore. And there's some things that are still around. Like in my talk, somebody asked about what about CF Report. Well, CF Report's been deprecated for a long time. They did not remove it, but it'll probably be removed in the next release because something else they announced, or not the next, but let me back up. They announced. That the policy going forward is that anything marked deprecated now that isn't removed will be deprecated and unsupported in the next release, meaning unsupported, they won't even fix it if there's a problem, and then it'll be removed in the next following that. So, see if reports days are numbered. And we hope that they'll come out with something else like it for building reports and producing reports. But anyway, to answer your question. There's been lots of things removed. So in my talk, I pointed to, let me just say this, if you just Google ColeFusion deprecated, two words, not depreciated, it's deprecated. Coolfusion deprecated, that page, which comes up from Adobe lists all the features that have either been deprecated and or removed, and it says what version they were removed or deprecated in. So you can find this. Summarized it a lot in my Hidden Gems talk last year, and I led a few more this year because some are important, others are again like nobody's going to miss the mobile development feature, no one's going to miss some of the funky enterprise gateway things that they're still there, but some of them are gone. The SMS or I forget the Flash Gateway is gone. Anything Flash-related is finally gone, gone, gone. Maybe another one that will bum people out is those that are still using the CFML tags that build HTML with JavaScript and CSS, things like CF grid and CF calendar and things like that. Those, I don't remember the exact one, so I don't want to say those don't work. In fact, I'm pretty sure those do still work. But there's some facets of them that no longer work, and certain tags. Are gone, no longer work. It's like CF table, too bad. Call, you know, it's too bad. They were pretty cool. And I didn't agree with that one because it just built HTML, didn't really build JavaScript. But anyway, moving on, if you look at that deprecated features page, you'll see what things there's a column with 2025 and what things were removed. So you can assess for yourself. And then let me say as well that there's a co-fusion. Compatibility, a code compatibility analyzer. Some of you know about this in the Coal Fusion Administrator. There's a page in the admin. I think it's on the debugging page, which is not where it should be, but on the debugging button on the left, up at the top, you'll see compatibility analyzer. That's been there forever. And every release, you can point to your code in one folder, many subfolders, doesn't matter. Tell it, I want you to analyze that code and tell me what are be compatibility issues. That's been there forever, it's there now. It'll ask you what's your current code running as 23 or 21. That's what it's asking. It's comparing those to 25. And in 23, it asked if you were on 21 or 2018, and so on. Anyway, that tool's there. You should definitely leverage it. One gotcha, though, and I meant to look into this to see if they changed it since my original talk. Talk. It doesn't tell you the things that were removed. It just tells you the things that are changed. If it finds things that you have that have been changed in 2025, it tells you, hey, this has changed, or it might have changed. You should look into it. And at first, it did not tell you these things have been removed, which is a bummer because you'd like it to also tell you this was removed. So that feature is there. You should look at it. It's in the admin. Then Pete Frytag. Who many know, has wonderful tools, FuseGuard and HackMyCF, and he's got a tool called Fixinator. And Fixinator came out in 2016 or 2018, 2018 with Adobe's security analyzer, which was built into VS Code, the CF Builder. But anyway, moving on, his Fixinator tool, when it first came out eight years ago, was focused on security issues. And it identifies security issues in your code, which is wonderful. And the CoalFusion security analyzer and CF builder can do that as well. Well, Pete's tool is not free and it works with Command Box, but you don't need to be using Command Box, but it uses Command Box. It's an extension for Command Box. But you can point it at any code anywhere that you can point to, and it will analyze the code and tell you by default security vulnerabilities. And now he's added. As of late 2023, he'd added a mode of checking for compatibility. And it can check against compatibility of moving code from 21 to 23 or 23 to 25 or 21 to 25. Or check this out: Lucy 6 to CF2025 or CF2023 to Lucy 7. He supports all those variants in his compatibility analysis. So, again, if you are perking up your ears now, that's Foundeo. Foundeo.com and his tool, Fixinator, F-I-X-I-N-A-T-O-R, FixInator, has now, for the past two and a half years, the ability to check code compatibility in addition to security. So wonderful tool, not free, but boy, it's probably going to be worth it for most people.
Michaela Light
Yeah, he makes some great tools and that compatibility. Check is a good thing to run. So, I mean, the other way you can run it is if you're using codecs or clawed code, you can ask it to find all the stuff that's been depreciated or is going to cause migration issues.
Charlie Arehart
So, I haven't heard if that's successfully. Have you heard that it can identify stuff?
Charlie Arehart
Okay.
Michaela Light
And was that particularly Claude or one of them or more than one that you think in that case it was Claude Code, but I mean these things are all quite similar in their capabilities. So at some point I'm hoping to talk to Ray Camden who's now working as the codex evangelist. So hopefully he'll be able to shed light on that. So he just changed jobs as he sometimes does. And I think just to be fair to Coldfusion, generally speaking, ColdFusion is great at backwards compatibility. Really, they're trying to do some cleanup here. And, you know, other languages clean up old features. Python, PHP, they're always removing stuff. I hear from friends who deal with that. And they, you know, something's depreciated. And then a year or two later, it's gone. You know, whereas ColdFusion keeps it around for quite a few years. I mean, it used to keep them around for 20 years. I think you're saying they're now moving to a more aggressive language life cycle. But they always let us know up ahead it's depreciated or it's obsolete, unsupported, and then finally removed.
Charlie Arehart
So that deprecated features page, if you guys Google it, you'll find it. And it's just so easy to keep saying depreciated, but it's deprecated. And that's important if you're looking for it. It's deprecated.
Charlie Arehart
Oh, deprecated. Yes. No, depreciated.
Charlie Arehart
You're not the only one that does it. It's easy to fall into that trap. Depreciate means its value has gone down. Deprecated. Yes. You shouldn't use it. I know you know that. I'm just saying, for others who are, why is he being picky about it? Deprecated means you shouldn't use it. And then removed means you can't use it. And there are things that WordMark deprecated in 2025. You can still use them. And I'll leave you to look into that. I pointed it out in my Hidden Gems talk, but again, you can find it on that deprecated features page. And I don't think it's on, it might be on that page. And if not, then in my Hidden Gems talk, I gave you a link to where Adobe has stated the new policy going forward. And that's good. They just have a firm policy now going forward, and we won't have to worry. You know, five releases from now, something is still marked as deprecated. That won't happen anymore. So they say that's that's the plan.
Michaela Light
So, yeah, it's it makes sense to me to clean things up. Um, and so what about some of the underlying technology? I think you know, they moved to a much newer version of Java. And Tomcat. Tell us a bit about that.
Charlie Arehart
Yeah, so it supports Java. It comes with 21 out of the box. So CF2025 comes with Java 21. For those who didn't notice, CF2023 came on Java 17 and CF21 had been on Java 11, as had been CF2018 and CF2016 eventually. So you have to stay with the version that Adobe says they support. Java, Oracle Java and other open source Java, you know, they moved on to 22, 23, 24, 25, 26, 27. We can't go moving up to newer versions. The good news is that the Oracle with regard to Java from Oracle, which is what is embedded with ColdFusion, included in your license, that's something else you're paying for, is you get license for Java for use with ColdFusion only with ColdFusion. But anyway, that's included. You don't have to pay Oracle for anything. Oracle and the open Java community, they update them every quarter. And then they come out with, they started about five years ago, four years ago with coming out with new versions every six months, or three months. I can't remember what the pattern is, but I want to be clear that all the Java versions regard certain Java versions as LTS, long-term support versions. So, Java 21 is an LTS version, 17 is an LTS version, 11 is an LTS version, and 8 is an LTS version. And then 25 is now an LTS version. Well, the point there is that those get updated every quarter right now. And by the way, it's about to change it every month. But anyway, right now, it's been for years that every quarter they all got updated. So I do a blog post every quarter when a new Java comes out. So I bring all this up to say, so CF. Runs on Java 21. It's up to date and it's updated. So is 17, but you can't use 17 and you wouldn't want to. You shouldn't want to. Don't try. And you cannot use one above 21. Don't try it. You can't do it. ColdFusion is tied to the Java version. So to answer the question, CF2025 runs on Java 21. That is a fully modern, fully updated Java version. We can expect that the next version. Will probably come out on Java 25. Anyway, that's Java.
Charlie Arehart
And then, and maybe that will require a full install at that point.
Charlie Arehart
Usually, right? Usually, that's what they do: when they come out with a new version, they come out with a new installer and that bundles in a new Java version. I do believe there was one time in the past where they said we'll support the new Java version, and you didn't have to run an installer if you chose to get a new one. I think that's the way it worked. Or maybe you had to do it. But anyway, that's we don't know what's going to come in the future. That's where things are a little bit different now. But back to your Tomcat question, which is another excellent point. For those that install what's called the server version of ColdFusion, either as the full installer or the zip installer, where under the covers of ColdFusion is a Tomcat. Well, that Tomcat that's bundled with ColdFusion is now Tomcat 10.1 in CF2025. Covision 23, it was Tomcat 9. And before that, in 21, I think it was Tomcat 8. So they're keeping that up to date. Well, Tomcat gets updated often as well. And that one's a little trickier. Adobe does not provide a way for us to update Tomcat ourselves when a new version comes out. And so for that, we need to await them to come out with a new version. So sometimes, like when it came out. Update 12 came out about two weeks ago. It was then running on the latest version. I didn't write it down here, but whatever it was the latest Tomcat 10.1.whatever at that time. Well, in the weeks since, Tomcat's come out with another update. And so people are soon going to be complaining that CoalVision's 2025 support of Tomcat 10.1 isn't the latest. And that's one where we do have to wait. Now, I said earlier. If you run CF the normal way where it comes with Tomcat under the covers, but let's just point out, some don't know this, you can implement Tomcat yourself and you could run CoFusion as a war file on top of Tomcat. You can do that. It's not everybody's cup of tea. It's not as straightforward. And it requires an enterprise license to run that in production. People don't know that. Can't do it with standard, which, by the way, under the covers command box deploys. Cofusion as a war on undertow, not Tomcat, but undertow. Well, that is why you can't run a standard CoFusion license with Command Box because it's running Cofusion as a war and you can't use a Cofusion war. Even though you don't know it's a war, Commandbox under the covers is implementing it as a war and you must give an enterprise license. But for development, of course, it's great. And if you've got an enterprise license, you can use it in production.
Charlie Arehart
It's great.
Charlie Arehart
Anyway, so that's. The thing about Tomcat is it does support ten point one and it was the latest version as of the update that came out two weeks ago. And so the next version, next update will come out, might update it again. We'll see.
Michaela Light
Well, this sounds like a good thing from the point of view of keeping technology up to date and security. And I know some of the new features and performance in ColdFusion twenty twenty five came from Adobe moving to a newer version of Java.
Charlie Arehart
And as I pointed out in my Hidden Gems talk, usually those new versions of Java, we don't see much benefit as ColdFusion people, but the engineers that built ColdFusion might leverage it in ways that benefit us. Or in time, they may take advantage of new features and expose them to us. So, for example, the Java 21 had virtual threads. That's a big deal in recent versions of Java and wasn't in 17, but it is in 21. And we'll I hope we'll see that cold fusion cf thread or its other uh capabilities async this and async that could leverage that virtual threads capability again for cf people they don't even know or care by and large but it'll be a good thing from a performance and scalability standpoint so yeah we just keep watching for things yeah there was a whole talk at cf summit about the async features uh that came out and new language features controlling async threads. You know, back to the title of your podcast, Coal Vision Alive. I mean, you know, look, CF2025, we've talked for an hour and we've only touched on about, probably five or 10 things. There's dozens more that come out with every release. And that's the point, you know, to let people know that it's evolving all the time, evolving in some ways that are powerful and will solve enterprise problems. Important problems. In other ways, it'll be minor stuff that nobody will notice, but some people. There's an important OAuth change, for example, open authentication. There was a new support of a new variant of OAuth from Microsoft, which will be very important because next in October, there's a feature, EWS, if I think I remember it correctly, is going away. And for that, when it goes away, we need CF to support the new way, which is graph. So, anyway, I discussed that more in my talk. And again, if you go to that what's new in 2025, it's right there among the top of the page of what's new as it talks about this change in OAuth. So, if it's a value to you, check it out. There's another example where if you don't use it, you're not going to sell you or float your boat. But if you do use it, you might go, that's great. We knew that was coming. And oh my gosh, we're still on 2023. When that door closes, what are we going to do? Well, with 2023, you won't be able to do anything. But with 2025, there's this new support for the new form of OAuth. So, and that's more than just Microsoft, too. It also works with Google and some other things. So, again, Read the docs to learn more.
Michaela Light
Now, looking at the support matrix for third-party software, I noticed that they now support Windows 2025 as it can install on that. And we had a client who they love to keep their software up to date. And we went to install CF2025, and it, you know, last year it failed, now it works. So, um, that's good.
Charlie Arehart
Well, let me respond to that before you move on. Yeah, because it's an important point. So, when CF2025 came out in February of 2025, at that time, Windows 25 didn't exist yet, or you know, was in preview. So, the installer that came out with CF2025 out of the box didn't know about it, couldn't support it. And by and large, that's what it's about. And by the way, it's not even about Adobe and ColdFusion, it's the software under the covers they use called Install Anywhere. That Install Anywhere software looks at specifically what version the thing is being installed on, and it didn't know about 2020, you know, server 2025. Well, in May, when update eight came out, May of this year, when update eight came out, at the same time, as often has happened with updators over the years. Adobe announced with that update date of 2025 that they also now offered what they call refreshed installers. They're new installers. So if you get since May of this year, if you get the ColdFusion installer for 2025 for Windows, that installer knows how to install on server 2025. That's it. Now, if you don't, let me just tell you, if you you know, some I've had people I've helped say, I've got a 2025 installer, it still won't install on server 2025. That's because you don't have the new installer. So, again, if you get it now or if you've gotten it since May, since mid-May, yeah. And you know, there's on their website, they have the codes for doing a verification of what the hash code is for that file. So you can check and see. And I've got a blog post on how to get that hash code on Windows, CertUtil with a certain argument, lets you get the hash code for ND5 hash of a particular file. And you can see, is your file that latest one? And if not, just go get the new one.
Michaela Light
now, I noticed that in it, as well as things being added there, some things went away. You know, Sybase as a database is no longer directly supported. Solaris as an open text search isn't slaughtered. WebLogic, WebSphere are no longer supported.
Charlie Arehart
So tell us a bit about Those are just things where the number of people using them didn't justify keeping them supported. You know, because I've been people. I remember helping people using WebSphere and WebLogic and deploying war files on Tomcat 25 years ago when the battle was coming out of is it be.NET or is it going to be Java? And at the time, a lot of discussion was, hey, you want to deploy war files and ear files and run them on a engine that's a J2E or now JEE. And by and large, the people that got into that got into that and a lot of people didn't. And so most of the folks that use CF, they don't deploy ColdFusion as war files on anything. They just run the installer or the zip. And let's just throw out for those who don't know, starting in CF21, so five years ago, there's two kinds of available ways to install ColdFusion. One is the full installer available for Windows and Linux and Mac. And then the other way is a zip, also available for Windows and Linux and Mac. You know, or Atar. Anyway, the point is on Windows, for example, it's a zip, and you just unzip it. You unzip it into a folder, and then you run a little script called cfinstall.bad or cfinstall.sh on Linux or OS X. And it runs through the licensing and some setup stuff. So there is that way to install CF. It's not an installer per se. It's an extraction of a zip. So again, new in 21, and those are available. We were just talking about something that made me think of that. I don't know if you remember what I was saying, but whatever we were talking about, I was kind of around how few people are using WebLogic, WebSphere, Warfare. Yeah, and I was saying they generally do the installer, or if they don't do the installer, they do the zip. Now, I did want to bring up the zip because some people, when you go to certain pages on Adobe site, either the only thing you might see is a zip or the first thing you might see is a zip. And you might think the zip is just a zipped-up version of the full installer. It's not, it's a separate thing. Now, they both will result in Covision being implemented. But one is you literally extract the zip and run the CF install, and it won't be the same. They will not be the same. So be careful. Make sure you're doing what you want. If you're in an environment where you guys have always run the CoalFusion installer, don't get the zip, get the installer, it'll be familiar, it's what you've been used to. But if you want to automate things or if you want to really pare it down lightweight, you might think that the zip is the way to go. I'll just tell you, you can also run the installer and remove all the packages and it'll be lightweight like the zip would be. Because out of the box, the zip doesn't implement any packages. The installer implements all the packages. So that's part of why it's bigger. So anyway. That's enough.
Charlie Arehart
So let's look at the big picture here. What's your thought on that Adobe is staying committed to the CoalFusion platform?
Charlie Arehart
I see no signs of there being any change at all in that. And I know that's a constant, you know, we have both been around for 25 plus 30 years. This has been debated and contested and argued all that time. And yet it keeps plugging along. And as far as I see, everything about it is copacetic and you know, on to the next, you know, for those from the American football, on to Cincinnati, as Bill Belichick used to say, on to the next co-fusion version. And, you know, it'll be CF 2027. They haven't announced it yet, but they're already working on it. There will be a preview starting probably in the next couple of few months. And I don't see any change at all in the nature of how Adobe feels about CF. I'm not in there. I don't know anything beyond what T Lee's we Read from the outside, but I don't see anything changing. And I know people often will lament that nobody's using any. I can tell you that's not true because we both know going to the conferences we go to, just talk about the CF Summit West, for example, it's like 500 people that come to that. And Adobe announces that there's often new people. That have never been to the
Michaela Light
And they already announced that they're having next year's events.
Charlie Arehart
Absolutely. And there'll be CF Summit East in DC in October. And that's where I'll be giving this talk that is combining the hidden gems and the moving to 25. I'll combine those into one. But anyway, I wanted to say as well that at CF Summit West in Vegas in whenever it was May, they announced that they also have been tracking people coming to Cold Fusion anew. So some people say, oh, it's just new people going to the conference first No, no, no, they're saying people that are using Cold Fusion for the first time. And nobody wants to believe, not nobody. Many people don't want to believe that. They want to think nobody uses it, nobody's moving to it. And of course, they want to argue that there's few small numbers of people, even if that's any, and that it's hard to find people, and that no one's teaching it in colleges. I get all that. All I'm trying to say is that. That nothing to me, nothing's different than it's been for decades. We've been hearing these same tales of woe, stories of challenges. It's not new or different, and it just keeps rolling along. And there are new people coming. And I'll just say quickly, in my work, I've seen it over the 20 years. I have about 100 active clients every year, and I get new ones, and I lose old ones who don't need my help because I've helped them. They don't need me anymore. I constantly get new clients. How could I get new clients if there aren't new people? Of course, some of them are just new to me. I get it, but some of them are new to Coal Fusion. I've worked with some people that were new to Coal Fusion or that are new to it working in an environment that was already using it. The point is, there's a wide range. I want to say this too: don't buy that it's only in government and education. No, that might be where a lot of it is. But I can tell you most of those hundred customers I have actively are not in those. They're in everything else, big companies, small companies, every kind of company you could imagine. It's amazing. And over my 15, 20 years, it's a thousand different companies. Again, every size, every kind of company. And I'm just one guy providing support. You, Terratech, offer, you have lots of clients. You know, I don't know if you publicize much about that, but I know over the years you've had. Many different clients, and there's many other consultants that do development, that do trucks.
Charlie Arehart
Over 100.
Charlie Arehart
Well, there's 100 agencies, I think.
Charlie Arehart
Exactly. So, you know, there's you can speak to whether you've seen a big change, but I'm just saying, from what I see in the community, at the events, in my business, it's nothing's changing. So, I don't think there's any. Tales of woe to be told, other than it's good fodder. It's often people who haven't been using it for years and have an axe to grind and they're basing it on their perception of things.
Michaela Light
You just thought they'd have ground these axes enough at this point, but there you go. Um, so congrats on speaking at CF Summit East. What are you excited about for that conference?
Charlie Arehart
Well, it's always great. So, for those who don't know, like I said, they have a repeat of several of the talks from Summit West. In the DC area because that is a hotbed of Coal Fusion. And so they have a special event there that's free. So let's say if you don't know about it, just Google Coal Fusion Summit East 2026 and you'll find Adobe's website. Cara Soft, who I have nothing to do with, Cara C-A-R-A-H-S-O-F-T, Cara Soft is the partner in the DC area, especially, but they help them with the Summit West. But the event is held at Cara Soft's. Facility in Reston, Virginia. And it's a great event all day, party in the evening, food, morning, afternoon, evening. And there'll be about seven or eight or 10 presentations. I believe they're in one track. I've been to each one, so I can't remember how things might have changed, but there's multiple presentations. Adobe's there in force, vendors are there, and another. 200 to 300 people, if I remember correctly, are there. Definitely recommend it. It's a great event.
Michaela Light
Yeah, it's a great event. I've been to For those who need to fly in, it's near Dulles Airport. Right next to Dulles. So, yeah, rest and vision.
Charlie Arehart
I mean, I shouldn't say right next to it because I got burned by that. As an Uber, it was like 20 bucks because it's about a 10-minute drive, 15-minute drive.
Charlie Arehart
Well, it's just down the freeway. Yeah, it's down. I think there is a metro line now that goes to it. Yes.
Charlie Arehart
But even then, the metro stop is not walkable to facility. But you could catch an Uber from that. I think it's Wheelie Avenue. Anyway, you can all can look that up. But the bottom line is: yes, if you're either in the DC area or anywhere within 100 to 200 miles, I would recommend you go. It's free and it's a great day of celebrating Cold Fusion. And that's what we're here for.
Michaela Light
There you go. You don't need to get budget approval to attend. Yes. If you're working, if you're working for one of the many organizations that use Coal Fusion in the Washington, D.C. Or Baltimore area or even further afield. So, if people want to find you online, what are the best ways to do that?
Charlie Arehart
Very easy. My domain name careheart.org C Earhart. And I did that kind of help you pronounce it because it looks like RHART, but it's Earhart. And then on social media, everything is Care Heart. So Twitter, LinkedIn(opens in new tab), Facebook, GitHub, X, all of them, Care Heart, C-A-R-E-H-A-R-T. And I always welcome feedback, ideas, questions. And if I can help solve problems, that's what I do, often within an hour. Satisfaction guaranteed. You won't pay for the time if it's not valuable. So any problems you face, reach out. I can usually help.
Michaela Light
help fabulous well thanks for coming on the show today Charlie and um so sorry to hear about your your dog that passed away yesterday so I said yes I'd I'd mentioned that um literally just yesterday my dog of several years diesel just the sweetest smartest friendliest guy passed away very sad yeah it's very sad I know ben nudell's dog died a few months ago too so it's a big deal. But hopefully, he went to wherever dogs go. And, you know, maybe there's a new dog in your future for you and yourself. He lived full life.
Charlie Arehart
And we enjoyed him. We're blessed to have him for several years. God gives and God takes away.
Michaela Light
Praise God. There you go. All right. Well, have a fabulous rest of 2026 and look forward to seeing you at a future event.
Charlie Arehart
And you. All right. Thanks again for everything you do.
