Sunday 14 December 2008

In-Container testing with JUnit

Given the usefulness and success of a Test Driven Development(TDD) approach for developing (Java based) web applications, it is imperative that a developer chooses a good testing framework for writing unit tests. One such popular open-source test case framework is JUnit.

With JUnit 4.x, developer's can annotations to develop unit test cases. Annotations simplify the construction of test cases to a great extent leaving the developer to focus on writing the essential pieces of the testing logic. In an earlier post that included some test cases, I used the annotation
@Test that took care of marking the method as a JUnit test case to be executed by the Test Runner. Thus, all that I needed to write was the assertion for testing the method. A short tutorial on learning the essential JUnit annotations is given here while a more detailed learner guide is available here and an excellent cheat sheat can be downloaded here.

While JUnit is basically a unit testing framework for stand alone Java applications, testing web applications is an entirely different cup of tea. Web applications run within an application server (such as JBOSS), while JUnit executes its test cases in a local JVM. Then how do you test thosein-containerMock Object based approach and the second is to use another testing framework that directly performs in-container testing.

For a Struts based web application, the MockObject approach can be implemented using StrutsTestCase class. Apart from the StrutsTestCase, there are several other available frameworks such as EasyMock that allow you to easily mock up objects. It should be noted that the Mock Object approach is not the same as in-container testing of components.

In-container testing can be carried out using one of the testing frameworks that extend JUnit and enable end-2-end testing of the web application. Cactus, HttpUnit and HtmlUnit are three such testing frameworks. It should be noted that Cactus and Http/HtmlUnit provide different facets to testing the server components. While Cactus focuses on testing server objects in the J2EE spec such as Servlets, EJBs and JSPs, Http/HtmlUnit frameworks emulate the browser behaviour. In other words these frameworks help you test the rendered view after an Http Request. The good news is that these frameworks can be integrated and working together can provide excellent test coverage.

For more reading on unit testing Struts based applications with these testing frameworks, check out this excellent book chapter.

Saturday 13 December 2008

Banishing the Vundo Trojan

If your browsers have started playing up and are opening up new tabs whenever you Google something and these new tabs in turn are redirecting themselves to random sites that you in your normal sense would never visit then chances are high that you are a host to the Vundo Trojan. While the infection appears to stem from a vulnerability in Java 1.5.0_7, I found the infection on a system that was running a much more advanced version (of Java) and so it is highly probable that a new loophole is being exploited.

On the infected machine, Vundo was able to infect and control the behaviour of Firefox, IE and Chrome. An annoying symptom of the infection was random popups and new windows that redirected themselves to mad-search.com(?) and forcibly tried to install AntiVirus 360 (what's that??) on the machine. The key diagnostic tool that was able to catch these infections was PC Tool's SpyDoctor but since the FREE version only performed a scan and required a paid version for the removal, I tried MalwareByte's Anti Malware version 1.31. This tool successfully located and removed the infections. So if you are facing the same problem, head down to MalwareByte and try out the tool but be aware that the tool only locates and fixes existing infections. To guard against getting infected, keep your SpyDoctor's IntelliGuard setting ON.

Thursday 27 November 2008

Open source systems that are not really OPEN

Recently while evaluating Concourse's CRM product, Concursive for a proposed implementation, we nearly got taken in with Concourse's claim of the product being open-source. According to them, the product was "An open source Java-based application.." but on downloading it, the accompanying license stipulates quite clearly "You may not redistribute the code". Fine!! If I cannot redistribute the code, how can I deliver a solution built around it. Also, if I could not deliver the solution why would I want to waste a month or so trawling through and understanding the million lines or so lines of code before I can modify it to meet my ends.

I can understand the company wanting to hang onto its IP and earning some revenue by "selling" the license but why term the product open-source? Just because I can view or modify the code for my internal use, its of no use to me.

According to the Open-Source Initiative , the Open-Source definition includes the right to freely-distribute the source code . This is the essential spirit of open-source software and should be adhered to when sticking the open-source label on a product. Misusing the term will only annoy developers and earn the product a 'do not use' label.

Tuesday 18 November 2008

Building workflows with JBOSS's jBPM

On a recent engagement, I had another opportunity to work with jBPM. The BPM in jBPM stands for Business Process Management and since its a part of the JBOSS enterprise suite, it works closely with the JBOSS application server and the JBOSS Eclipse IDE.

jBPM has its own Process Definition Lanaguage (jPDL) that it based on an XML schema. While learning the jPDL and designing a process is one way of getting started, the other easier alternative is to use the Grahical Process Designer (GPD). The GPD is available as a plug-in for JBOSS Eclipse and using the steps outlined in this article you can get yourself setup in a matter of minutes. The second part of the same article shows how you can create your first jBPM project and a BPM process within it. If you want a more detailed overview of the process creation and deployment, this webinar is a great way to learn about the GPD.

jBPM being open-source is great value for the advanced capabilities it offers. It also integrates well with JBOSS Rules (a.k.a DROOLS) and allows the user a lot of latitude in setting up the BPM component. The JBOSS jBPM site is a good place to start learning and using the tool.

Monday 20 October 2008

Software caused connection abort: recv failed with MySQL and Hibernate

If you get "Software caused connection abort: recv failed" after attempting to login to your JBOSS server after a long period of idle time then you need to take a cup of coffee and sit down as this is going to take a while to fix.

In a web application that we developed,  we were using a JBOSS server version 4.04, connecting to MYSQL 5.0.24 with Hibernate 3.1 and we started getting these messages after the server had been sitting idle for some time and a login was attempted. The initial diagnosis was that the MySQL /JDBC connection was getting stale and it could be resolved by updating your MySQL driver to the latest version and adding a few properties to your data-source connection file. We updated the driver to mysql-connector-java-5.0.8 and as explained in this excellent post we added the following lines :
       
 (exception-sorter-class-name)
com.mysql.jdbc.integration.jboss.ExtendedMysqlExceptionSorter
(/exception-sorter-class-name)
(valid-connection-checker-class-name)
com.mysql.jdbc.integration.jboss.MysqlValidConnectionChecker
(/valid-connection-checker-class-name)        
The basic idea was that the JNDI would ping the DB periodically and keep the data source alive. Well, it didn't work for us but atleast we had the latest driver.

The next approach was to write a custom class that would operate on the database every hour or so and keep the connection fresh. (According to the docs, MySQL marked the connection stale after 8 hours but I was not in a trusting mood). I wrote a Java Timer class that was called by a servlet every 30 minutes. The objective of the class was to check the table which housed our support requests and if found a new request, it would shoot me an email. The Timer class and the Servlet hookup worked fine and I stated getting emails if there was a support request waiting to be serviced but the original problem still remained. The server would still spit out a long stream of exceptions, starting with Software caused connection abort: recv failed if a login was attempted after a few hours of idle time.This was getting annoying!

I then approached the problem in a different way and went over my Hibernate connection pooling setup. We were using C3PO but maybe something was missing? I reset the Hibernate connection pooling parameters to the following :
(property name="connection.provider_class")org.hibernate.connection.C3P0ConnectionProvider(/property)
(property name="c3p0.acquire_increment")1(/property)
(property name="c3p0.idle_test_period")100(/property) (!-- seconds --)
(property name="c3p0.max_size")100(/property)
(property name="c3p0.max_statements")0(/property)
(property name="c3p0.min_size")10(/property)
(property name="c3p0.timeout")100(/property) (!-- seconds --)

and Voila, the exceptions disappeared. We finally had a clean console when attempting login ever after several hours. So while, the Hibernate connection pooling params appear to be the main culprit, I feel that its equally important to update your MySQL driver and make sure that there are no loose ends in the JNDI data-source params.

Wednesday 15 October 2008

www.samaaj.com.au - a platform for students !!


One night while half asleep, I had a dream and in my dreams I saw a website. WoW!! People have such cool dreams and I just saw a website. But in my dream, the website was not just a website, it was a cool thing, a platform for students to get together and help each other, a helpline for students. It was something that I had to act upon.

Having been an International student myself, I understood the problems that some students faced and this was the main motivation behind www.samaaj.com.au. I got up from my sleep and shot of an email to a few friends who I hoped would share my enthusiasm of giving up their free time and instead spend time building a web-site. Well, my faith wasn't misplaced. My pals responded and we slogged through the weeks and months. Yes, there were periods of inactivity and procrastination but finally on the 13th of October, 2008 we made a BETA version of our website LIVE and available to the general public. 

While the initial version was BETA and I expected several refinements and fixes over the coming months but overall, it was a fine effort and when I look back at the year that we spent in refining and developing the application, I am happy that we acted on our impulse. Even though at times it appeared as if we were hardly moving, we persisted and today that dream is a reality. The web-app has been built in what I know best - Java. Over the next few years, we refined our user interface, added several bug fixes and changed our hosting from a home run server to Amazon Web Services's cloud infrastructure and released a brand new look of the Student Helpline version 2.1.1 in September 2012.


Wednesday 10 September 2008

Preparing for Java Certification 7?

Changes to the exam process for Java certification 7, now require two exams to be cleared if not holding an older certification. Those who hold a prior certification, can take the Java SE 7 Upgrade Exam  and upgrade their quals.
The mantra to succeed in these certification exams appears to be 
(a) practice, practice, practice writing a lot of code without an IDE 
(b) Sit for mock exams. Enthuware appears to be a popular choice for Java 7 aspirants. 
(c) Follow a good book. Kathy and Sierra are to come out with their book for version 7, sometime late 2013, but if using their SCJP 6.0 guide, follow Bert Bates advice here and here.


 ** Links to Sample Tests **
  • JavaRanch's collection of sample tests and sites that give a very good overview of the questions. This is the most comprehensive set of links and tests. A MUST!!
  • Good set of questions based on SCJP 1.4 but well worth a study.
  • JavaProgramming's  set of tests.

    ** Links to Study Notes and Materials **
  • Study Notes  on AK Gupta's site. Also visit his compilation of links for MORE tests and resources.
  • Another set of study notes on the exam. This one is based on SCJP 2.0 but it is still worth a look.
  • Read a guy's experience and thoughts on how to prepare.
       ** Links to some good Java resources **
  • Start with the JavaRanch and its forums.
  • JavaWorld has a set of Java blogs and Q&A forums.
  • JavaMagazine is Oracle's latest offering starting August 2011. 

    Saturday 6 September 2008

    Test Driven Development and a Code Kata

    (Please click on the images to get a more readable version).


    This week I thought of trying out a CodeKata problem and choose Kata 4 . The kata requires you to read a data file, parse it , extract some values and print the difference between them. A simple exercise one would say.

    To explain the problem in brief. A data file containing the results of the football league is provided. The requirement is to extract the name of the team with the lowest goal difference in For and Against goal values. I decided to make this problem a bit more exciting by not just coding along a 'happy path' but also looking out for scenarios where there might be no valid data rows or there might be two teams matching the lowest goal difference criteria.

    Using a test driven approach, I hacked out a set of basic JUnit tests to parse a valid data row and extract the For and Against goal values. My data row looked somewhat like this.



    and the tests to extract the values from this data row looked like this:

    Now that I was getting the For and Against Goal values, all I needed was to calculate their difference and store the team name (& goal difference) in a 'results list'. The tests for doing this were accomplished as below:

    As evident from the test, my 'controller' class has ONE main function which is updateLowestGoalDifferenceTeam(). This function performs the core business processing in terms of updating the list holding the lowest goal difference team names. This function is given as below.




    The function gets the list holding the team name, extracts the goal difference values and compares the same against the goal difference value passed to it as a parameter in a HashMap. If the passed in value is lower, the existing team becomes a part of the list.



    In all the Kata was a simple excercise but it was instructive in analysing the data structures that could be used and in studying the different approaches that could be taken to solve this problem. If you would like to compare your efforts with mine or wanted to know more about the solution, ping me for the complete code as an Eclipse project.

    Saturday 9 August 2008

    Is 'Cuil' really COOL?

    Late last month Cuil (pronounced 'Cool') became the latest entrant to the search domain. Launched by an ex-Googler, Cuil is old Irish word for 'Knowledge'. Its claim of claim of being the 'world's biggest search engine' and its approach in indexing information based on relavance and content has generated a lot of interest and hype.Barely a week old (It was launched on July 28, 2008), it is seen by some as a threat to Google's monopoly over the search market. WOW!!

    In a note on its website, Cuil says that it 'searches more pages on the Web than anyone else---three times as many as Google and ten times as many as Microsoft.' and 'Rather than rely on superficial popularity metrics, Cuil searches for and ranks pages based on their content and relevance.'

    Hmm..interesting claims. I decided to test them out. I Googled the word 'Cuil' on Google and 'Cuiled' the same on Cuil. The findings were even more interesting

    Cuil gave me 121,578 results. In the first ten results, only the first 2 referred to itself. Google on the other hand (kudos to them for fair play), gave me 2,200,000 (is this figure an approximation?) results. Out of the first 10, 8 results were related to 'Cuil'. Impressive!!

    I guess it will take some time before the claims of 'ranking pages based on its relevance can be met' and on a personal note, the black background will have to go.

    Tuesday 5 August 2008

    Midori Microsoft' new OS

    Microsoft has a new game and its called 'Midori '. The new game looks just like an operating system, feels like an operating and IS an operating system. The only difference is that it will work unlike its much loved big brother -Windows in the sense that it is a 'network-centric' os. With Midori, MS is hopeful of opening the doors of cloud computing.To contain panic and dropping sales, Microsoft has been quick to point out that existing Windows applications will be able to survive on this 'network-centric' platform.

    Applications on Midori will live as services and will thrive on an Asynchronous Promise architecture.But the most interesting thing for us small time developers will be that we will no longer have to rely on a dual core powered desktop to get things done. I could use a super computer in Carnegie Mellon without being oblivious to the fact. Now we are talking!!

    Sunday 3 August 2008

    Web 2.0 - What was that again?

    With social networking becoming a widely acceptable and usable form of expression, the Web2.0 bandwagon has been able to piggyback into our lives without us really realizing it.

    I came across this 50 second video wherein Tim O'Reilly when asked a definition of Web2.0 responded with two nuggets. The network is the platform and users add value.

    I guess this is as clear and succinct that one could get when talking about Web2.0.Many organisations are starting to base their business models on Web2.0 and established software powerhouses are rolling out 'Web2.0' based product suites.

    I have read and heard many individuals question if Web2.0 has had any 'big' success stories. I guess the very fact that Web2.0 has become a transparent fabric of our virtual world is a big win in itself. Looking for 'big' wins in the form of 'Web2.0' products or applications may not happen with a big bang but the affect of Web2.0 will permeate across the software industry and business models in vogue.

    The Web has changed. It is now linking people not content and Web2.0 is the glue. Here is a cool 5 minute video that shows you how..

    Wednesday 23 July 2008

    Flocking to 'Flock'- A Social Networking Browser


    Flock built using Mozilla's Firefox technology is a cool browser that implements social networking amongst other Web 2.0 features. The latest stable release available for download is 1.2 while version 2.0 is in beta testing.

    While configuring and adding different sites (Facebook, Blogger) is easy as pie, uploading photos to a Blogpost is where I pulled a hammy. While this post has been written and posted via Flock's interface to Blogger, I needed to login to Blogger to upload a screen shot of Flock.

    But while Flock may need tweaks / improvements , it is certainly a good tool for being socially active. I guess in some ways, its like meebo and in others its like iGoogle if you consider its feed gobbling and its 'widget' integration philosophy. Within Flock, you can get updates from your friends (on Facebook), post to your blog, read news, upload photos (to Flickr /Facebook).
    Flock is described as "The Social Web Browser". and "the browser for the modern web". I guess having a browser advertised as a vehicle for social networking is an accurate summarization of where the web is headed and the grip that social networking has on our day to day lives.
    Blogged with the Flock Browser

    Addendum (Added on 12th September 2011) Flock has been discontinued since April 2011 and users to the www.flock.com download page are advised to download Chrome or Mozilla.

    Sunday 20 July 2008

    Negativity... Stay Away!!

    Last weekend, I had a conversation with a good friend that initially started off as an interesting technical discussion and degenerated into what I can only term 'raw negativity'.

    The negativity stemmed from my friend's 'firm' belief that a particular country that he had spend a significant amount of time in had made 'no progress in the last 50 years'. The transport system was very bad and no where near 'world class' standards.Inflation was high and there was rife unemployment. The medical system was no good because 'he had to wait' to get 'FREE' treatment at a government run hospital. When I pointed out that transport system was plagued by fare-evasion, his response was to 'get more ticket inspectors and issue fines'. Hey, what about doing the right thing and buying a ticket? From public transport, the next target was roads. We have 'only four lanes on highways', why doesn't the government 'break homes/ building' and put in six lanes? Why don't they build an underground tunnel? The latest freeway that had been inaugurated 5 months before time and under budget was 'useless' and 'should have been free'.

    Gaah!! All this about a country and a system where he had migrated on his own accord, had striven very hard to become a citizen and had earned around a 100K a year. Unfortunately, I found myself arguing and defending the 'system' and the country. Unfortunate, more so because I was his guest and I do not believe in arguing with a host who has been so hospitable.

    In hindsight, the conversation and the negativity stemming from it could have been avoided. The issue was not a country, its system or a person. It was the negativity that stemmed from a pointless discussion (my wife called it an 'argument') that had no productive outcome.

    Let me clarify my stand a bit. I am critical of things but my criticism is objective. Rather than bagging an 'entire transport system', I would have preferred 'the service on this particular line is irregular'. My problem with such full-on negativity is that it tends to bring you down and make you also negative. Tomorrow, if I am using the same 'system' and am late for an appointment due to a train service being late or a traffic pileup, my thought will be, 'Yeah that guy was right'.This system is bad and I will conveniently forget, that I have seen worse and others have it even worse than me. Ultimately, I will become a negative guy. I will always end up criticizing people and things. I will never be appreciative of what I have, rather I will always crave for what I don't.

    Life is not about negative things. It is about being positive. It is about riding the storm. It is about making the best of what you have. In my years on this planet, I have failed more than I have succeeded and in many cases, my failures have been due to circumstances out of my control. After each such failure, I could have either 'cursed my luck or the system that I was in' or try again with renewed vigor. I have always chosen to try again and let me tell you, It has always been a good option.

    And on a parting note, my response to my misguided but good friend is that if you feel so negative about a situation, then do something about it. Stand for election, define the policies and make the World a better place.I am with you.

    Canada's Top 20 Web2.0 practitioners

    Backbone magazine compiled a list of Canada's Top 20 Web2.0 practitioners. An interesting pick was Jiibe that reportedly helps you compare (hold your breathe) 'workplace culture'. Some of the workplace descriptions I came across were like..

    "Even if the customer isn't always right, their needs are usually taken care of over the needs of the employees."
    and

    "Like back in the wild west, this company is focused on the frontier of new discoveries but always keeps its Smith & Wesson by its side."

    Another one goes like "This company can't see the forest because they're too busy juggling chainsaws. They might lose all their limbs as a result but wow, what a show while it lasted."

    WOW!! Are you seriously allowed to say things like this in print??

    Wednesday 16 July 2008

    Portlets, Servlets, Application Servers and Portal Servers

    Portlets have been around for a few years now and after JSR 168 have matured as a technology.Easy plugability, interoperability (of Portlets) with various Portal Servers (post JSR 168) and the rich user interfaces possible in Portlets have made them a popular choice in the J2EE development world. The main purpose of this post is to briefly explain the difference between a Portlet and a Servlet (technically and functionally).

    Portlet as a technology borrows heavily from the traditional Servlet model. While both, Portlets and Servlets are Java components that have to be hosted within a Java container (JVM), there are some essential differences.

    Portlets as compared to Serlvets are relatively specialised components. They give the developer a chance to focus on capturing some essential function without worrying about the 'other' things that go with making the function available to the real world. Further, unlike Servlets, Portlets cannot be invoked via a URL. This is hardly a limitation as they aren't meant to be invoked in such a manner. Portlets are realized and invoked via Portals. Thus browsers (web-clients) communicate with Portlets via Portals.

    A Portal defined in layman terms is a 'web-site' but in essence it is a collection of Portlets. It includes a theme other user interface features that define the look and feel of the Portal. Cameron McKenzie explains it well when he says that Portals build upon existing J2EE functionality and simply management of several diverse applications. Content management is a good example of simplified Portal functionality that is considerably simplified. I experienced this first hand when I installed and ran JBOSS Portal Server 2.6.5.

    While Servlets are hosted by an Application Server (such as JBOSS application server, Bea's Weblogic), Portlets require Portal servers. Examples of popular Portal servers are JBOSS Portal Server 2.6.5 and IBM's Portal Server 6.1. Portal servers are super sets of Application servers in the sense that they extend their capabilities and provide specialised functions which make single-sign on, customisable security, one-look applications and rich user interfaces possible in Portlets.

    To summarise Portlets are specialised Java components.They can be persisted, configured, manipulated via the addition of buttons and while they aren't allowed to generate general HTML code, the iFrame tag can be used with caution. Nifty??? eh??

    Monday 7 July 2008

    Art, Children and Nudity

    I guess I am not an artist. I am not much of a photographer and moreover don't photograph people naked (especially children) so I guess I wouldn't know what I am 'talking about' but read my views if you care about what by-standers have to say about this whole controversy about nude children being photographed that has been raging in Australia for the last two months. Today, the PM of Australia, criticised a Melbourne magazine's decision to depict a naked 6 year girl on its cover. As expected, the art community reacted strongly to his comments.

    There are two opposing viewpoints. Artists feel that showing naked children in the 'proper context' is art. Children who have been photographed have appeared on TV programs as adults now to acknowledge that they never felt exploited, even though they prefer to keep their names hidden fearing a backlash of some sort. The moralist brigade feels that photographing nude children is not art, they were not 'mature' enough to rightly judge their decision to allow themselves to be photographed naked and displaying such images will encourage pedophiles.

    Hailing from a traditional Christian family and having grown up in the conservative mould of Indian society, I have witnessed child exploitation in different forms. Coming to Australia was a big change as far as cultural values and beliefs were concerned. While there is a big gap between these two melting pots of culture, the core values with respect to children remain the same.
    Neither India nor Australia encourage child exploitation and have very strict legislation to keep the same in check.

    With the current raging controversy over the depiction of nude children as Art refuses to go away, I have a few questions that maybe if answered clearly and directly without hedging will settle this controversy once and more all.

    We all agree that child exploitation especially pedophilia is a deplorable state of mind then in this case...
    1. Can the supporters of this form of art guarantee that the images of naked children will not be viewed in a sexual nature by pedophiles? Can artists guarantee that their images will not spur pedophiles to commit more crimes ?

    2. I have heard children as young as 13 saying they knew what was right for them.Cool. Ten years down the line, if you were to decide to become a school teacher, are you sure that your decision to pose naked will not stand between you and your teaching job (or any other job involving children.) ?

    3. For parents and photographers who take photographs of children and then make them available for public view. Can you guarantee the safety and the future of your 'model'?

    I guess if the answer of all three questions above is "No" then you would know where my heart and yours should lie too.

    Wimbledon 2008: Rafa dethrones the King

    Last night / early this morning, I witnessed one of the greatest tennis matches between probably who will be, the greatest champions of the modern day tennis era. Rafa beat the FedEx to win his First Wimbledon and in the process derailed Federer's quest for a sixth straight crown.

    It was a high voltage match that see-sawed as the champions fought it out, interrupted by rain and hampered by bad-light. In the end, only Rafa stood tall. The FedEx express had been derailed but what a fightback it was for the five time Wimbledon champ after being 2 sets down, he came back to be within two points of another sensational victory when leading 5-4 in the fifth set but Rafa had the nerves to hold him back. Talking about nerves, the FedEx was the ice-man when he hit a backhand winner with Rafa on matchpoint.

    Truly, this was one of the most brilliant exhibitions of tennis and while the Federer's 65 match winning streak on grass may have been broken, in his words "Don't write me off". He will be back stronger, faster and more hungry. In fact I feel that he may finally win Rolland Garros next year and stop Rafa from making it a 5P.

    Tuesday 1 July 2008

    Wimbledon 2008: FedEx thumps Hewitt

    Federer started week 2 at Wimbledon 2008 with a thumping straight sets win against Leyton Hewitt who didn't really play all that bad.Federrer just outplayed him and even though his game wasn't 100% on target, it was enough to earn him a well deserved straight sets victory.

    Going by the draw, it appears as if we may be treated to another Rafa vs Federrer final. Two finals in two months between these two and the world of tennis can't get any better.Although the last Grand Slam final between these two (at Rolland Garros this year) was a bit of an anti-climax with the FedEx being steamrolled by Rafa so much so that Rafa apologised to Fedex for his own 'brilliance' and praised Roger's attitude on court during the match.

    It would be interesting to see if Roger could put it across Rafa and repeat last year's performance on his favorite hunting ground, Wimbledon given the powerful, fluent tennis that Rafa has been playing lately.

    Thursday 12 June 2008

    Security in Enterprise 2.0: Building a case for Security 2.0

    While reading up on the security concerns highlighted in this article from the NY Times, I could see many E2.0 evangelists shaking their head in despair. The recent attack on Google /Orkut's network that compromised close to 400,000 users within a few hours is going to scare people even more.

    Web 2.0 and Enterprise 2.0 is all about 'opening up', sharing information, communicating and collaborating. While the latest breed of techies are seeped in blogs, wikis, chat programs, Google docs and social networking sites, traditional firms continue to rely on the good 'old' trusted means of 'securely' disseminating information via emails and file attachments. The idea of sharing company documents that may have client names, sales figures on websites (yeah, Wikis are glorified websites) appears appalling to the senior management. Security concerns are always brought up when someone talks of adopting an Enterprise 2.0 outlook and many cases, these concerns are justified.

    My attempts to Google the term "Security 2.0" bought up an interesting post which talks about the author's attempt at Googling 'Security 2.0" in October 2006 and his thoughts on what security 2.0. I can tell you that on today's date, my Googling attempts did not give me much either. Around the same time, Symantec spoke about bringing out Security 2.0 products but to me, the vision looked a lot like anti-virus packages bundled up in a new name.So where are we with Security 2.0?

    The secure Enterprise 2.o forum and the ongoing E2.0 conference are good starts towards fostering dialogues between the participants of E2.0. Currently security in an Enterprise 2.o setup is limited to policies and mainly role based authentication but unless some convincing protocols are not established with regards to securing information management in an E2.0 setup, Enterprise 2.0 will not attain its goals of 'open communication and collaboration'.

    Sunday 8 June 2008

    Seeing God in Doing His Work

    This morning, I was blessed to hear from Pastor Russel Ames, a very powerful and interesting insight on "Seeing the face of God". I have interspersed Pastor Ames's message with some of my own thoughts and the result is as under.

    Being a Christian and having professed my love for Christ, I have sometimes wondered what it would be like to 'see' God face-to-face. Moses saw the Glory of God but before his time, Jacob saw God face to face. He wrestled an entire night with God and for what? He wanted God to bless him. He fought with God for a blessing. And this was the same Jacob, who had taken the birthright of Esau. The same Jacob who was returning to meet his brother, fearful of his wrath, fearful of death and while he was mentally tormented with visions of what would happen the next morning, he wrestled with a man, whom he believed was God. And he does prevail. He receives his blessing. God puts his hip out of joint and in this deformity, he is blessed as he is recognized.

    The next morning, Jacob sends his cattle, his wives, his sons and his servants in front of him as he approaches his brother Esau. Why? He is petrified that his brother will rebuke him and might even kill him. His is a peace offering but how does Esau react. Esau ran to meet him, and embraced him, and fell on his neck, and kissed him: and they wept. (Genesis 33:4)

    Esau forgives Jacob and refuses his gifts saying that the LORD has given him enough. To this Jacob answers, ".. Nay, I pray thee, if now I have found grace in thy sight, then receive my present at my hand: for therefore I have seen thy face, as though I had seen the face of God, and thou wast pleased with me.(Genesis 33:10)"

    Jacob said that He saw the face of the LORD in Esau's face. What did he really mean? How can you see the face of the LORD in the face of your relatives or friends. Ps. Ames explained this using the example of Mother Teresa and her service. In every destitute that she served, in every tear that she wiped, she saw the face of the LORD. She saw the face of Jesus. Indeed she did as these verses from Mathew Chapter 25:35-36 testify...

    "For I was an hungred, and ye gave me meat: I was thirsty, and ye gave me drink: I was a stranger, and ye took me in: Naked, and ye clothed me: I was sick, and ye visited me: I was in prison, and ye came unto me."

    Serving Jesus can only lead to one thing in a physical world.Pain, suffering and rebuke but looking beyond the boundaries of a physical world, there is much more to be achieved. Yes, in serving Jesus there is the one real chance to see HIM and to meet HIM, face-to-face and to be in HIS presence forever and that would be really something worthwhile.

    Tuesday 27 May 2008

    Speaking of India..Spelling names right

    I recently happened to browse through Craig Storti's Speaking of India:Bridging the Communication Gap When Working With Indians and while I must applaud Craig for his attempt to explain the difference between Indians and Westerners and how they perceive each other, he appeared to have missed out one key point that is Westerners don't always catch and Indians never let go off and that is 'Spelling names right'.

    In the book, Craig quotes the CEO of Infosys, one of India's largest, globally recognised software power house as follows
    "India has always been seen as a country of promise and potential,” notes Mamdan Nilekani, CEO of Infosys"

    All good in the above sentence except Mamdan is actually spelt Nandan. A big blooper and not the best way to put your foot forward in India or in any country for that matter. Yup, when it comes to communication. Indians are as touchy as the rest of the world.

    Monday 26 May 2008

    Connecting Infomation Dumps

    I work for a traditional management consulting firm which is just beginning to embrace Web2.0 and its principles of blogging and Wikis. Today was a momentous day in the sense that I was involved setting up the corporate Wiki space where we (or rather projects) could create pages and collaborate using the functionality offered by the Wiki. Some of the managers I discussed the Wiki with, were skeptical about using the Wiki to blog about projects, upload documents and collaborate. The reason for their lack of enthusiasm was the presence of other traditional collaboration tools that have been used by previous projects to maintain project documents and track progress and there was not one but several such tools. As a result, there were several silos of information that were isolated and to a certain extent unusable as not everyone knew about their existence.

    Reality check time.Information will continue to exist on File Servers, Email folders, Intranets, Wikis, Content Management Systems and local file systems . A good part of this data will be duplicated, redundant and even in some cases, out-dated. How does one connect these different sources and make data usable and easily manageable. Google Enterprise piggybacking on a Google search appliance can make finding information inside an organization easier but a search solution is not the key. The key is manageability.

    While moving information out of every source into a central repository and forcing the workforce to use the central source is out of the question, it brings to the fore front, the need for pluggable interfaces that can connect information across these silos based on content and more importantly update information across several sources when information in one source changed is the need of the hour.

    Such a system while in essence would be a Content Management System (CMS) that would manage content held by other CMSs, File Servers and other similar sources, it would need to identify and group together 'similar' data. In such a scenario, Tagging could act as a glue between these disparate sources of data. Moving one step forward, a bookmarking software such as Scuttle could be used to tie in various sources and formats of 'similar' data.


    Saturday 17 May 2008

    Lucene.. still needs Google?












    While reading up on Lucene, which is advertised as a 'high performance, scalable,powerful and accurate' search engine , I noticed that the search function available on the hosting Apache site was 'Search this site with Google'. Wouldn't a search want to use itself for the very purpose it existed??

    Needless to say, it doesn't inspire much confidence in all those who want to use it. Watch this space for more.

    Saturday 26 April 2008

    Survey of J2EE open source tools and libraries

    I came across this excellent collection of open source tools and tag libraries with a focus on Java / J2EE tools. There are links and reviews of open source AJAX frameworks, content management systems, J2EE Frameworks, JSP tag libraries and a lot of other goodies.
    Most of the topic reference links are active and the content is relatively current. Worth bookmarking if you are working in the Java domain and want to see some of the various open-source offerings on a particular subject.

    While on the subject of surveying J2EE tools, an interesting book on the market is Java Power Tools. While the book is basically a compendium of 30 tools ranging from version control systems to QA analysis tools, it tends to gravitate a lot towards the use of Unit testing, Continuous Integration and Stress and Volume testing tools. A look at the TOC doesn't reveal much for the experienced developer but for the newbie J2EE guy, this might be a good starting point. I would have liked it a lot more, if it had a chapter on application servers and 'compared' different frameworks (albeit briefly) such as Struts and Tapestry or Struts and Cocoon. I also missed Hibernate in the TOC. :-( But overall, it looks to be a good read for a newbie.

    Monday 21 April 2008

    Curvy Corners in Web Pages ..without digital editing

    With the influx of 'Web2.0' look and feel web-sites, the prevalence of curvy corners has caught the imagination of web-designers. While the majority of web sites having curvy corners require digital editing. In simple language, you would normally create an image with curved corners, cut off the corners and stick it into your web-page to get the appropriate look. However, if you aren't much of a digital web-designer, you would prefer to go in for curvy corners.

    Curvy corners is a free Javascript library that allows you to create on-the-fly DIVs with curved corners. While implementing the library and using it to get the required effect is easy, some tinkering might be required to your own CSS files before you can get it work.
    The logic behind curvy corners is that it 'straps' on 20px to your existing DIVs. The additional 20 px inherit the look and feel of the DIV element that you specify and so they look like a natural extension of the same div.

    A few problems that you should watch out for is that padding within the specified DIV (that gets curvy corners applied to it) disappears. You can configure the padding parameter to come back on by setting the auto-pad flag to true but it applies padding by implementing a work-around. The 'work-around' is an inner DIV that is created on the fly and all text that was a part of the original DIV gets moved into the inner DIV. Thus, the original DIV becomes a parent of the new 'inner' DIV. In my case, this broke some of the other JavaScript functionality, like my DateTime picker stopped working as it could not figure out the DIV that it belonged to.

    To summarise, while Curvy Corners is an excellent snappy script that gives you curvy corners without digital editing, it may mess up some of your existing Javascript libraries so be sure to test your application in FF and IE after applying curvy corners. Happy Rounding Off!!

    Saturday 5 April 2008

    Implementing pagination in JSPs

    I recently implemented Pagination in my JSPs so that if there were several results returned by a query (Search function), the user could view the results in a page-wise format. The image on the right is what I ended up with after implementing pagination through an open-source tag library, displaytags. In this post I will explain the basic steps that I followed in order to install and use the tag library.

    While implementing pagination is not a complex task as there are only a few scenarios that need to be taken care off, I preferred to use a taglib to implement the same. While the web and Google will throw up several solutions, I tried implementing the pager taglib available at JSPTags first.

    The pager taglib has several look and feel features available, I was not happy with the documentation and examples provided and after struggling with the installation of the taglib, I gave it up in favor of the displayTags taglib. I found this library easy to install and use, with a good mixture of code examples and features. Needless to say, I was able to achieve my objective.

    Here I will show you the basic steps of setting up the pagination feature using the displayTags library in a Struts based JSP that is deployed on a JBOSS server (version 4.04) running on Java 1.5. Okay, lets get started. We will do this in steps.

    1.Download the displayTags library (At the time of writing version displaytag-1.1.1.jar is the latest jar). In the download, you will also get a WAR file that you can directly drop into your web-server and view the examples. But for setting the tagLib for your own use, you are best off extracting (unzipping) the WAR and using the files inside.

    Extract the displaytag-1.1.1.jar and place it into your WEB-INF/lib directory.
    I did not need to add a directive in my web.xml as I am using JSP2.0. (Tomcat 5.5)

    You will also need to make sure that the commons-* jars that come with the displayTags download are available in the WEB-INF\lib directory.

    2. In your JSP,add the following directive:
    <%@ taglib uri="http://displaytag.sf.net" prefix="display" %>

    3. You may wish to add the CSS styles available in the downloaded displayTags library. There are several theme css files that can be used and I chose to use the file (displaytag.css). Drop this file into your style sheets directory within your WEB-INF and reference it in your JSP.

    Be aware that the data that will be displayed by the tagLibrary will be within a table and sometimes nesting a table within a table (if your JSP has one) can cause display problems but in my case, I had a very simple layout so I was fine.

    4. Now add the displayTags that will display the data in a paginated format.
    Add the following lines to your JSP:
    The table name in this case, requestScope.SEARCH_RESULTS_LIST matches the name of a List that has been placed into the request scope by the servlet (Action class) that forwarded to this JSP. So for this table name to be workable, I have a list that I set in the servlet using the following line of code.

    request.setAttribute("SEARCH_RESULTS_LIST", searchResults);

    In the list, searchResults, I have a row of String data which is named as searchResultRow (set as the property name in line 6 above). The variable base (on line 1) points to the URL that I want page links to forward to.

    Lines 3 and 4 are display properties that you can set to control the look and feel of the paginated data results. A more detailed list of what can be done is available here.
    Another feature that is advantageous is that data that is presented in a grid layout can have sortable column headers. In other words, clicking on a column will sort the data displayed on the page.

    Well, thats it. Build and Deploy your application and if all goes well, you'll have pagination going with no problems. This is what my page looked like, after I finished.





    Sunday 2 March 2008

    India wins a big one at the Sydney Cricket Ground

    Indian cricket's new youthful face came of age at the Sydney Cricket Ground when they won the 1st final in the Commonwealth Bank Series. The match was special in more ways than one. The Indians lost the toss and saw the Aussies bat first. Something that is daunting in itself but the Indian team did not look down.The bowlers first stymied the Aussie batting Juggernaut by restricting them to measly 239 runs.Measly when you consider the batting might of the Aussies.

    The Indian batsmen came out cautiously but positively.The scoreboard was always ticking with the Indian batting master , Sachin Tendulkar in full flow. A lot has been written about his lack of form, his repeated failures in crunch matches, his inability to produce a 100 in his previous 39 matches 0n Aussie soil. Today was a different day. As the sun set over the Sydney Oval, Sachin took the Australian bowlers to task. Not even cramps or a searing 143 kmph beamer from Brett Lee that hit his shoulder could stop Sachin.His batting chart showed shots to all parts of the ground. His 117 not out took India across the line and answered a lot of critics.

    The rubber still has two matches to go and India are still the underdogs but now underdogs with the ability to ask questions of the opposition.

    Friday 29 February 2008

    Hibernate is Lazy : The LazyInitializationException scenario

    While Lazy Instantiation is an important feature and does improve performance in J2EE applications, it can be a bit of a headache if not correctly used or should I say implemented.

    Consider a J2EE scenario where you might have a one-to-many parent-child relationship defined between two classes.In the scenario, data retrieval is handled by the DAO layer. In it a DAO retrieves a dataset and passes it to a view. The view is controller by a servlet and rendered by a JSP. The JSP attempts to print out the parent's name and voila, you have a LazyInitializationException.

    As section 19.1.4 of the Hibernate documentation states " A LazyInitializationException will be thrown by Hibernate if an uninitialized collection or proxy is accessed outside of the scope of the Session, ie. when the entity owning the collection or having the reference to the proxy is in the detached state."

    Two obvious (and suggested) counter strategies would be
    1. Keep the session open until all objects that are required have been initialised.

    In my opinion, this is not a good approach as you are liable to forget closing a session and will end up nesting transactions. Something which the J2EE container does not like.
    (Yes, Yes..you can use a servlet filter to ensure that you do close the session but you can have performance degradation with requests being parsed by the filter. In addition to this, you will also need to have a robust exception handling mechanism in place to ensure that sessions do get closed when exceptions occur.

    2. Prepare all uninitialized collections in the business layer before they get passed to the view.
    I feel that this is a better and a much more organised strategy as you can initialise the objects and their associated objects in the same DAO call (and the same session).
    Of course you need to be sure that you are going to really use these objects otherwise you will end up with a lot of unused objects on the heap and a sluggish application to boot.

    While there are several strategies to counter the LazyInitializationException scenario, To fully understand the solution, one should have a good grasp of the Fetching strategies employed by Hibernate as they are the key to the problem and to the solution.