You Are Number 6

Create UML diagrams online in seconds, no special tools needed.

2009-05-06T15:04:00.000+02:00

yUML is a tool that uses the URL to generate a diagram on the fly.

Here is an example:

<img src="http://yuml.me/diagram/class/[Customer]<>1-orders 0..*>[Order], [Order]++*-*>[LineItem], [Order]-1>[DeliveryMethod], [Order]*-*>[Product], [Category]>->[Product], [DeliveryMethod]^[National], [DeliveryMethod]^[International]"/>

Gives you:

The technology behind it appears to be Ruby on Rails, which begs the question "will it still be useful when it gets overused?", lets hope there is a cloud waiting to host it, because this could really take off.

Fluid Requirements (Going Down The Pan)

2009-02-25T12:20:00.000+01:00

Had this from a customer today:

Please find attached the latest version of the XXX Spec. As communicated before this document has been signed-off in-principle as it keep evolving.

Oh joy, at least it is not a fixed price contract.

BBC iPlayer finally available on Mac & Linux

2008-12-19T16:39:00.001+01:00

BBC NEWS | Technology | BBC iPlayer now available on Mac

Go here to get it.

Bamzooki still waiting

Blogged with the Flock Browser

JavaFX = Processing + (Axis2 - i18n)/2

2008-12-05T15:51:00.001+01:00

JavaFX = Processing + (Axis2 - i18n)/2

What type of Web services can I call from JavaFX applications?
JavaFX applications can call any REST- based Web service that returns ASCII data. If the returned data is in XML or JSON formats then they are automatically parsed for easy access. Examples of Web services that can be called from JavaFX are Yahoo Local and Flick Photo Web services.

JavaFX FAQ's | Howto and General Questions About Java FX

I think I will only pay slight attention this one until it is actually a step forward.

Blogged with the Flock Browser

The problem with measuring elapsed time on a laptop

2008-12-04T14:33:00.001+01:00

Someone pointed out Rachota Timetracker to me the other day, probably yet another hint that I should try and do my timesheets on time. It probably came from Elijah Alcantara's comment on this digg.

My requirement is that I need a quick way to record what I am doing, but I am not always connected to the web (although I am about 90% now). A typical day is open laptop at home, slap lid down go to office, move offline to meeting room, back to office, get on train to client site, open laptop in meeting, slap lid down and head home, open and catch up in evening. The laptop gets rebooted on average twice a week.

The problem I have is that the tools for measuring time, and reacting to it, tend to go wrong when my laptop hibernates/sleeps between usage. Lightning calendar is a classic example, alarms work fine from startup to first sleep but after that the drift causes alarms to go off at the wrong time, I could use a web based calendar as that would not suffer, but I am not always connected and when I do connect it can be too late.

I was hoping that Rachota would have sorted this out, but no, sadly. I have to remember to 'relax' before slapping the lid down and running.

There are a number of possible solutions but the best one I have found in my own work as been to 'observe the system clock'. The principal is that you sample the system clock at known intervals and note the difference between the system clock delta and the interval period, assuming normal operation the minor drift that you get should average out to 0 over time (using the right kind of timer). When the computer hibernates/sleeps or you get a DST changover then you might get a difference of +1 hour for example (depending if you read localtime or UTC). That way if I start a task at 12:00 and hibernate at 12:15 for 30 minutes, when I reawaken the process and Rachota would have said 45 minutes elapsed, I know that by observing a +30 minute shift I should take 30 minutes off. If someone was messing about with the system clock then they can move it back and forth as much as they like and the technique should keep up subject to the granularity of the time interval (which will vary depending on the timing accuracy required). The system clock observer would fire off TimeShiftEvents to elapsed time listeners that would be registered and deregistered as they start and stop.

I know there are scenarios where you want to measure that off time, but you could easily make that an option for the user.

I would do the change myself but I just can't stand netbeans based projects. ;-)

Blogged with the Flock Browser

Email is a battleground, a developer minefield

2008-11-14T01:39:00.001+01:00

The leading email apps are Outlook, Thunderbird, Mac Mail, Evolution, Lotus Notes, Gmail, Hotmail, Yahoo Mail and that's about it. In terms of market share and success there are a significant number of 'also rans', but why?

My first thought was that the main contenders dominated the market so completely that no-one bothered with the others, but then I thought back to 2003 when Thunderbird first became usable (some might say it is still not) and suddenly it gained market share. Mozilla Thunderbird proved that you can go from nothing to something, perhaps on the back of Firefox, but unlike so many other apps, users stuck with it. I have only just realised why.

A bit of background is required here. Where I work we have archives of business critical emails from certain accounts, users don't have to keep half a million emails they can access old messages using a web interface to the database of archived messages. At the moment all emails they open are downloaded as '.eml' files and so open in their desktop email client (Outlook or Thunderbird), but that method means that laptop users have to remember to remove the files as they go (which they often forget to do) because of the potentially sensitive nature of the messages. My solution was to get the web interface to display the message with the appropriate cache headers, which solved my immediate need but I realised that it would expose the system to spam (especially as some users access the system from their home networks and so cannot be proxy protected). In case the full horror is not clear, this would mean that an embedded image link in a spam email would effectively gift the spammers the bona fide email address - at best, at worst using an old IE (thinking it is in the trusted zone) we have security meltdown.

It was this that made me realise just what a fine line email clients are treading between functionality and security. The webmail systems have to inhibit the browsers natural instict to connect and show, the desktop systems have to emulate the web functionality while still limiting access. Email is a battleground, would anyone willingly enter the fray? Images, JavaScript, Applets, Flash, Ajax and application attachements all present risk in remote communications and local access.

The apps that can cut it are ones that provide just enough functionality and maintain security or provide more functionality and expose their users to 'some risk' (I would say that any risk is unnacceptable, but I don't work in their security department). Both approaches have their warfare equivalent, but what are 'acceptable losses' in this context?. There is still room for another client in the market, no-one has nailed it yet. I think Mac Mail is closest, although spammers can crash it remotely at the moment. As for my problem, I have a solution but it is probably not cost effective to implement.

Blogged with the Flock Browser

Checkout svn 1.5

2008-06-20T22:42:00.001+02:00

Subversion 1.5 has been released. For the server/repo side the changes are:

Merge Tracking - svn now sets a property [mergeinfo] to track what changesets/revisions resulted from a merge activity. What this means is that the 'safe' merging technique of first trunk to branch and then branch to trunk is more efficiently handled.
Better FSFS - svn now provides the administrator with the enough flexibility to work around the limitations of various filesystems. Basically the repository files can be split up and spread around as things get large (e.g. mount a new partition), and OS file caching can be optimised.
Scalability Proxy - svn allows the concept of master and slave svn instances (as in 1.4), but now all writes are directed to the master (via webdav proxy) and reads can work from the slave thus keeping things synchronised nicely. This really helps with distributed development and goes some way to providing some of the features of Git and Mercurial.

In addition on the client side:

Sparse Checkouts - the way in which you can specify what gets checked out or updated has been made more logically complete. What this means is that you need to issue fewer, more readable commands to checkout defined subsets of a tree than before.
Interactive Conflict Resolution - doing a 'svn up' used to then leave you hunting around for the merge to do, now it pops up with a set of options. Useful if your IDE does not have conflict resolution capabilities.
Changelists - a way of tagging files (not directories) with a name that is used to create a set of changes that can later be used by a commit or other such command. Again this is something a good IDE will normally do for you (e.g. Mylyn).
Relative svn:externals - a long overdue feature that finally permits the use of relative paths (e.g. ../other-project) in externals definitions. Prior to this externals had to use the full path which made usage via VPN or renamed servers of this feature impossible to manage. Now you can specify workspaces as disjoint repository trees and freely re-organise the repo without trashing all you externals definitions (as long as they were expressed well in the first place). Perhaps in the next version they will go even further and outlaw all absolute paths (replace external hosts with symbolic internal name?).

What else...? Bug fixes and security enhancements of course - oh and if you are still using 1.3 then you just lost your support.

Blogged with the Flock Browser

Lean build cycles with antro

2008-03-27T18:10:00.001+01:00

Antro was released last week onto SF under GPLv3. It is a kind of visualisation tool for the performance of an ant build. It gives you colour coded drill down into your build and its files, red means long running, green means quick.

And I expected it to be just another tool that works for simple examples but never for the real thing, like so many other promising ideas. And as it was so simple to use I decided to give it a chance to shine.

Simple to use the nice part here, you just add a listener and the jar to your ant command line (or drop the jar into the ant/lib folder). Run your script and then open up the UI on the output json file. If liked the way I did not have to touch my build.xml files.

It worked on my complex build (i.e. long depends tree and heavy use of antcall etc.). And I was able to see a number of interesting 'features' of my build and then shave 10% off its cycle time. So this one gets used again.

Blogged with the Flock Browser

Another missing piece in the calendar puzzle

2008-03-07T17:51:00.001+01:00

Google's Calendar Sync for Outlook is going to go a long way to solving the "I don't want Exchange" puzzle.

My objective for some time has been to combine the blinding convenience of Google Calendar with the working patterns of my family and work environments. I want to have a set of calendars for my job and home life that are read/writable as required. I use Thunderbird/Sunbird with the Google calendar add-on 'Provider for Google Calendar' at work and my web browser at home on the Mac. The missing part was for my work colleagues who use Outlook to be able to contribute to my job calendar, and this is the part that can now be solved.

Blogged with Flock

Why Multiple Exceptions is so hot

2008-01-08T02:23:00.001+01:00

It seems that Monday was Exceptional arguments day - Catching multiple exceptions: good or bad?

I have to admit that I could not be bothered to follow all the replies, after the 10th stock answer and the 10th wannabe architect half baked wisdom, I stopped reading.

The reason why there are so many right and even more wrong answers is that Exception handling is contextual, and in the end the best you can ever do is achieve a 'reasonable compromise'. Exceptions represent unforeseen circumstances, or at least that was the original idea [I don't want to judge programming style, what matters is accurate 1s and 0s and the maintainability of the code that produces them], and so someone needs to sit and think about the bigger picture.

I have seen some strange programming environments over the years, as far as Exceptions go they range from:

catch (Throwable ignoreall) {}

to dropping into a full blown AI fault analysis and blame system. Both techniques were correct for their context, and have served their masters well. This is one of the reasons why writing re-usable software is so hard; you cannot predict the context of its eventual use.

My advice is to avoid writing lines of code like the above, only special circumstances demand that degree of insanity. Generally you should follow these basic guidelines:

Never lose an Exception, always do something with it, even if that is just passing it to a piece of null code (AOP later)
Play Ball [sometimes I pander to the audience], catch and throw anew, that way you can always participate if need be.
Dots in handlers are dangerous, there is nothing worse than a NPE masking the real issue.
Never throw other people's Exceptions, it can make a real mess of your dependency tree. Catch then wrap or fix.
Don't throw when you can return, thrown business related objects make an architectural mess.

As far as the original article goes, any syntax that promotes good practice is beneficial, and this suggestion is one that might encourage developers to avoid unhealthy temptation. Java is a general language and so I don't really care how many different ways there are to specify what you want to do as long as the Jit compiler still has the opportunity to do a good job.

Blogged with Flock

Password Expiry is Evil?

2008-01-04T16:57:00.001+01:00

A colleague asked me yesterday if password expiry was considered best practice, and my immediate answer was no - changing your passwords regularly is best practice, expiry is an implementation technique that forces users to follow best practice.

Personally I hate password expiry with a vengeance, I change my passwords regularly on accounts that need it and I leave other ones the same for years on end, why should I be forced into a pattern of behaviour? Being asked to advise on a security policy I always say that users should be instructed to employ all security best practice advice and be accountable for their actions and inactions. Even when the implementation of this forces users to change via a password expiry scheme then it is human nature to adopt a password scheme.

The problem is that every single scheme makes passwords more predictable than before, so that a user can go away and drink beer for a week and then come back and get in at the second attempt. Is a randomly generated password that never expires more secure that a changed password that always includes the month in it? I think it is, at least in the online sense.

Randomly generated passwords' problem is that they are generally forgettable. People write them down as a result. What that does is shift the security issue from the virtual world to the physical world, which is a mixed blessing. On the one hand staff are more familiar and well trained in the art of physical security (doors, locks, keys, etc.) and more naturally protect their passwords in that world. The other side of the coin is that, in the case of espionage, physical security is one of the most commonly compromised elements.

A side effect of having active password changing in use it that you end up with your users requiring a larger number of support requests when they do accidentally lock themselves out during a changeover. What this does is encourage the support systems to be streamlined and often forget the basic authentication required before resetting a users password. Try ringing up your support desk and pretend to be your boss!

So my verbose answer to the question is that password expiry generally does not improve security because of human nature and therefore is evil.

Blogged with Flock

Thanks Linus and Junio

2007-12-31T14:24:00.001+01:00

I just wanted to thank those behind Git for giving me the pleasure of including the word Git in serious corporate documents. On many occasions have I wanted to use that word, but only now can I use it without the threat of reprimand.

Git - Fast Version Control System

Blogged with Flock

Back to Flock

2007-12-02T17:35:00.001+01:00

I have been getting more and more fed up with Firefox, or more correctly its extensions. My main issue is the rate at which it gobbles up cpu & memory, so I decided a few weeks ago to find an alternative. I am still going to use FF, mainly because I cannot work without the Live Headers, Web Developer, Open QA & standards compliance checking tools. But for my general browsing I wanted something I could have running all the time without fear of grinding my machine into submission. The main issue I have with FF extensions is that I use a laptop that never really gets time to be rebooted, so it lives in hibernation for the few hours a week when I am not developing. FF extensions don't cope with hibernation well, the naive programmers who write many of these things have not thought that the clock can shift dramatically while the app is still running.

I use a number of different browsers generally, on a number of different OS, but my target environment was a Windows XP laptop, I that meant leaving out Linux & Mac based options. So I set my criteria at must be easy on the eye, supported by most websites, secure and lightweight. I started my search with Opera which is most certainly lightweight, good on security, average visually but unfortunately it is not supported by many sites I use. Then I reluctantly tried IE7 again, which has proven to be more secure than expected, I found it worked well and was surprisingly lightweight for a MS app. But after a couple of years of using FF IE rendering is ugly, large and garish, and that was enough to discourage me.

Then I remembered flock, a FF derivative with the social extensions built in. Running this with one extension 'Adbock Plus' gives me a stable environment with all the benefits of FF without the need for risky extensions. So far it works.

Blogged with Flock

Guice Flaw

2007-05-31T01:14:00.000+02:00

It is not really a flaw, more of an opportunity missed. I have just spent a wee while converting a project from semi-spring to guice. Anecdotally, I prefer to refer to this exercise as goosing, and I don't care what your culture currently associates with that word, Google is a global culture and the act of exacting its influence may take over the definition as far as I am concerned, big up for the living English language! Mr Knowles will hate me.

Back to the techie end...
Moving to Java 1.5/5.0 as our LCD of new java products led us to re-evaluate various existing design choices. The conclusion was that big steps need to be taken, quite simply because they can and should be taken (cost is worth it). Guice appears to be the ideal selection for such a way forward because you can always regress to a Spring, Pico or home grown framework without having to rewrite too much. But having gone through such an exercise there is one remaining doubt; which is the flaw of the title.

The doubt/flaw is that seriously used Guice requires you to transfer your 'design of linkage' to a module class, which previously was in a mixture of xml and lookup code. The people who designed Guice did the right thing by making the Binder class an interface so that you can unit test your modules, which helps, but that still leaves two issues:

1. It is hard to support build systems for multiple target environments. The modules tend towards the monolithic, and even if they are testable themselves, there are still better techniques for this kind of application extensibility, e.g. OSGI. I suggest that you use inheritance and delegation in the modules, but my issue is still that the linkage becomes a development exercise in its own right, and one that required in depth Guice knowledge to boot.
2. If you try to write a generic server style application, e.g. another web container, then you are forced to create a 'team' pattern between a Module implementation and its domain specific business classes, because they have to work together in this type of context.

I managed to resolve the build issues of multiple targets by using a 'ClasspathScanner' to discover indicator files that pointed to Module classes that constituted the application. For example the Swing app would have a jar in its classpath that had a Module indicator pointing at the swing module class to be included in the injection list, while the war build would be constructed using the modules in the war path. But I think Guice should take a step in this direction, as its own processes would be best suited to this 'discovery' phase.

I suppose what I am getting at is that the strong typing of Guice is both a pain and a pleasure. I hope Guice does for the J2EE framework world what Ada95 did for the fast jets of today, i.e. try and balance the industry concerns with the realities of development. Luckily the nature of DI is such that all these things are soluble, you just might have to learn another framework in the process. The pleasure is that it is testable, the pain is that you have to code it rather than just configure it.

Ant Custom Search Engine

2006-10-24T18:13:00.001+02:00

I thought I would try the Google Co-op - Custom Search Engine. So I created one for Apache Ant. I included some general technology sites as well as the usual enties, let me know if you have any suggestions.

lang:java HelloWorld - Google Code Search

2006-10-06T15:32:00.000+02:00

Google Code Search is here. Wow!

Not only can you look up to see where your open source code is being used. But you can easily police its license.

As you are developing you can be constantly searching for snippets of the code you write to see how others have used the same api.

lang:java HelloWorld - Google Code Search

Spring Simple Powerful Proven

2006-10-04T16:53:00.000+02:00

Spring 2.0 has just been released. Ironically the same day we make a strategic decision to use Spring widely in new and existing projects.

The key benefits (unordered):

Modular Development
JSP Shortcuts
Best of Breed AOP
JMS Processing Support
Scripting Support
Tight Scheduler Integration
Transaction Support
Enterprise Ready
Easy Configuration
Annotation Based Exception Handling
EJB Utilities
Efficient JDBC

But the biggest thing is that simply making your code IoC friendly improves your design and deployment options. The enterprise integrations are a bonus after that. I just wish the beans files were as simple as pico to set up.

Free Private JVM Web Host

2006-09-06T14:14:00.000+02:00

EATJ.com are providing free hosting account featuring a private JVM. But watch out, there is no backup, they switch off your VM every 6 hours to save resources, and they bump you off if you go away for too long.

The production account is not that expensive for a private JVM coming in at about half the going rate. But it sounds ideal for a quick and dirty test environment.

I was late for work because...

2006-09-05T10:46:00.000+02:00

Good excuse from a colleague:

I was unable to leave my house because the front door was stuck.

1 Habit of the upper echelons of software engineers

2006-08-30T01:24:00.000+02:00

Habit Number:

#1 Just get on with the work, stop blogy blogging about it.

Note to self - follow own advice.

Got Spam? Make Money If You Are Quick

2006-08-25T14:05:00.000+02:00

It must come as no surprise that Spammers manipulate money markets. But until I read that article I did not realise just how much of a percentage the spammer could make.

So I did a straw poll of my last 20 or so stock spam emails and looked at the online history. Fair enough, the difference is 4-6% over the period, I am always amazed about human nature. But then I realised that the time at which I received the spam emails was usually on the upcurve, so again with my small sample I concluded that I too could make 2-4% from selected scams.

I am going to carry on watching the stock spam alerts and seeing if there is a significant pattern here. I am not planning on putting my money where my mouth is, as that would be profiting from the stupidity of spam victims. But if you were an anti-spam vigilante and you needed funding it might be a good source of income.

My First GoogleCode Hosted Project

2006-07-28T17:25:00.000+02:00

It just so happens I was about to publish a small open source project. And what happens? Google let people know about Project Hosting on the same day. It had to be fate, so I put my SF application on hold and decided to give google a go.

My motives were really to check it out for a much bigger GWT based project which is still under wraps at the moment.

This is how it went:
1. I am already a Google account holder, so I assume that I skipped the first steps.
2. Filled in the create project form. [Which has changed in the 4 hours since I did it!!!] A look at other projects gave me an idea about the labels and I quickly realised that I had to make my description the entirety of the installation instructions. (Once you are in you can create links to other web pages for documentation)
3. Straight in no delay, you even get a subdomain set up instantly!
4. Fired up Eclipse (because Java is normally my thing) and checked out my source tree. Had to fiddle with the url a bit because my svn is a bit rusty. Got my generated access password and so I had a development environment within 5 minutes of the project submission.
5. Copied into the workspace all 3 of my project files. Made adjustments to the 'powered by' statement to link back to the GCH project location. And comitted.
6. Posted the roadmap as enhancement issues against the project.
7. Got bored because it was too easy.

Comments:
a) It is nice and simple
b) There is not much exposure at the moment, so I am still going to create a project reference on freshmeat.net
c) Commit was slow, probably because there are some large projects being uploaded.
d) It is under active development, the create project page changed in the space of a few hours (probably because it was a security risk).

I will watch the feature enhancements as they grow.

My project : hackstop

Spot the 3D difference - Vista 3D - LG3D

2006-07-28T16:16:00.000+02:00

First look at this one which is free, java and available now...

From https://lg3d.dev.java.net/ and make sure you look at the Minority Report (Go Monkey) video in the blog3d section

Then check out this bootleg:
Internal Review Of Microsoft Windows 3D Vista @ 2007, which is not out until next year.

Try it through webstart @lg3d.

If you look carefully you can see where they are trying to catch up with Gnome too.

Rip it up and start again

2006-07-28T14:49:00.000+02:00

Same author, same problem, better understanding, clean room implementation.
LOGBack
I wish more of the old guard of OSS projects would do this.

Rip it up and start again
I said rip it up and start again
I said rip it up and rip it up and rip it up and rip it up and rip it up and start again

[Orange Juice - Rip It Up]

And why not put it on GoogleCode Hosting while you are at it.

Microsoft = Remotely Exploitable = No Protection

2006-07-20T17:42:00.000+02:00

To illustrate the point:

By contrast...

More than 20 unpatched advisories on Win XP alone!

Weblog Discussion: Microsoft = Remotely Exploitable = Owned

Why Open Source Projects don't practice what they preach

2006-07-07T00:07:00.000+02:00

A lot of people use OSS resources, OSS projects want lots of people to use them, but my experience is that OSS projects don't use other OSS project resources as much as their closed source counterparts.

In my experience closed source projects tend to use twice as many open source libraries as similar open source projects. So I thought I would investigate why...

Developer Ego

This was my first thought. Historically it has taken a certain type of developer to make that step towards and open source project; and knowing a few of these developers I would expect that they would prefer to show off rather than save time and effort. So there must be an element of "not invented here".

Also when you make use of a large number of applied resources your project changes from being a development exercise into one of integration. But integration projects don't carry as much kudos as green field developments for their founders. If you have an ego then you would much prefer to be known for your development skills than your ability to integrate.

The Problem With Being Open

If your users are the inquisitive kind, and a lot of them are, then they are going to look at the choices you have made regarding the supporting services upon which your project is based. That is why so many projects use Apache commons logging, for example, because it alleviates the developer from fixing that choice in stone. But not every service can be abstracted so cleanly, and bad choices can reduce the scope in which your project can be applied. The most common one is the persistence layer where a choice such as Prevayler can prevent your project from scaling in an enterprise context. But the solution, to provide alternative options, can drain your development resources and give you an increasing number of maintainability issues.

Another issue is the rate of change of your chosen supporting resources. Say, for example, your project is based on Azereus libraries which update every few weeks. The question in your mind is which version or versions do I support? If 2 projects make conflicting choices then it gets harder to use them in conjunction (as happened with Cobertura, Hibernate & ASM). The other side of this coin is that you also don't know what versions of your own project are still in general use, and so when you make changes to your API are you creating compatibility problems for those that might re-use your software? Closed source projects don't have this issue because they are rarely used outside the sphere of knowledge of the creators.

Responsibility

End user applications need to go through some degree of systems testing. Bugs in live systems need someone to accept responsibility for fixing them. And there is always a license to uphold. Closed projects have an advantage with all of these areas of responsibility because there is usually some money to pay for extensive testing of incorporated systems, fix bugs in other people's code and investigate the legal basis of the product.

But open source projects typically do not have the luxury of a budget for supporting their re-distributed software. And more scarily, license compatibility and patent infringement are really nasty issues to have to deal with.

Feeling Exposed?

So the reason why OSS projects don't make use of many of their own kind are really related to the way in which most projects are run; a small number of personally involved developers working usually for small change handouts. The effects of this scenario subtly drive the developers to work in greater isolation, which is ironic.

Contributing to Java - What would you fix?

2006-06-28T13:23:00.000+02:00

The article:

Sun says open-source Java possible in 'months' | InfoWorld | News | 2006-06-27 | By Jeremy Kirk, IDG News Service

...inspired me to think.
What would I contribute to an Open Source version of Java?

Assuming that Sun provide a nice test environment so that I know that I will not break the sacred compatibility of the langauge and its standard libraries, then what could you do?

These are my first thoughts:

An interface based abstraction of the Swing widgets.
Better use of models in Swing widgets, e.g. ModelBasedJLabel
Back 'plumbing' of JMX and JNDI support into older APIs

Please comment with your own.

Why version 6 is always crap

2006-05-04T01:42:00.000+02:00

Whenever you write a new bit of product/functionality at the best of times you might:

Test version 1

Write code for version 2

Do design for version 3

Create requirements for version 4

Fill a need for someone with version 5

So it is always number 6 that lets you down. Perhaps I should rename my blog.

My Maiden Mythical Mac Month

2006-04-28T00:34:00.000+02:00

I am cheating really, I first used a Mac in anger in 1992 as part of a University project, since then I have been a Solaris-Linux-Windows based developer (in that rough order of environments) and I kind of lost touch with what they were doing and where they were going. What is virgin status as a OS user?

Anyway, So when it came to upgrading my audio-visual equipment I came up with the plan to create a media centre machine in the lounge next to a new TV. I costed the 'build your own' Linux/Haupage/MythTV option, and decided that the cost of mistakes would be too high. So that left me with three options - dedicated hardware (Kiss), Microsoft Media Centre or a Mac Mini. To cut a year long story short I ended up waiting for the Intel based Mac Mini to come out.

In the beginning I was dissapointed, my Mac user mates had over-hyped it. Despite spending hard earned cash on some Tiger books (like the one for Tux fans) and actually reading them, I found the user interface very unfamilar. This is surprising as I was expecting some kind of cunning cross between XP and Gnome. Several times I resorted to the command line and my Linux knowledge to bail me out of 'where is that dialog box' syndrome.

Of course I expected to have issues, after all I had bought a brand new hardware/software combination. There were issues with the matchbox sized freeview decoder, Quicktime media formats, network protocol compatibility, and various software glitches in things like iMovie. But I expected that. But I also expected that I would like the Mac environment, and that is a close call.

What has grown on me is iTunes. So Easy (Eple Eple). I don't have an iPod, but still once I got past the quirky UI and 'unlearned' how to copy tracks to my mp3 player and organise smart playlists I was hooked. You don't need a Mac for iTunes, but having one with 10x rip rate is quite amazing. You put in a new CD, it starts ripping track 1 at 10x, I select track 6 to listen to at the same time, tick tick tick goes the box, the ripping continues at 9x and I listen to my track, before the end the ticking of the CD head stops because the ripper has overtaken the player. That is the kind of quality functionality I demand of my own work.

Front Row is magic, I don't let the kids touch the remote control. Just one suggestion Mac developers - plugins please.

The next big thing was iMovie HD. I took the video of my family skiing in the alps, and in a couple of hours had edited to a rather neat summary video. Smart, just as Jeff Goldbloom had adverised. Combine that with EyeTV and for my next trick I took Michael Schumacher's hot lap at Imola and cut it into 2 laps looped then added Gorillaz 5/4 over the top (sorry Martin) and I made myself a memorable piece of art, good driving good music.

The TV on demand side of things is not that special, there are lots of systems out there that do the same for less. But I got the Mac for its ability to expand and adapt over time. Having said that the quality of the TV that I watch (when I am not fighting to turn Swing code into proper MVC) has been dramatically improved by having digital recordings at the click of a mouse (even from work).

My next mission is to investigate Xcode which looks very promising. I am coming up to a laptop upgrade at work, if Xcode works well then I might investigate Steve's new portable offerings.

But what of the month...
Now I am used to the interface things are getting better. The shock of the new environment is more than that encountered when switching from XP to Gnome for example; and in my opinion a great deal of the quirkyness seems just to be there to be different (why Apple-C not Ctrl-C? I don't care which came first any more). Visually the UI is excellent, and the concepts like Hot Corners and Spotlight search are really addictive. The real winner is the applications though.

Make Jars of Your Ant Builds

2006-04-11T00:44:00.000+02:00

This article describes the use of the antlib task to make common build tasks into deployable jars.

Browser Security Summary

2005-10-23T14:44:00.000+02:00

I bet they call it 'fairway'

2005-10-07T18:09:00.000+02:00

BBC NEWS | Technology | Golf lovers get broadband package

Forget Maven, jpackage.org and Ivy - use HttpUnit!

2005-10-07T01:25:00.000+02:00

With a 24k jar, 4 lines of xml you get the jars you need in a classpath of your ant script - job done. The HttpUnit team have a little known ant extension that does the 'maven download' thing very well. It is so little known that it is easier to find it from the Ivy site than the HttpUnit site.
http://www.httpunit.org/doc/dependencies.html

I suppose that it is a little unfair on the 'dependency management' tools to compare them to something as simple as a Maven aware downloader. But the problem with all of the dm tools is their habit of being dependant on things not in their respective repositories.

HttpUnit's ant-dependencies tool avoids that issue by not bothering with the minefield of inter-jar dependencies, and simply concentrating on search, version resolution and caching. Ant has built in process dependency management: e.g. <target name="hibernate-download" depends="c3p0-download">... should do the trick. And with tools like jarhoo, jarfind etc. it does not take long to sort out your dependency tree.

All this simplicity makes the tool much faster than the others. And good developers should know their class dependencies quite well anyway. For example, hibernate only requires c3p0 if you use its pooling facilities. So you would have the line: <dependency group="c3p0" latest="true" if="hibernate.use.connectionpool" /> and use the same flag to control your hibernate config generation. Manual conflict/dependency resolution is a small price to pay for empowerment.

Credit where it is due though. None of this would be possible without the vision of the Maven style projects that have both driven expectations and developed the invaluable repositories.

JavaCast becomes The Java Posse

2005-09-23T14:47:00.000+02:00

Dick Wall has managed to get things moving again after a bit of a stormy time by the sound of it.
You can find the new feed here:
The Java Posse - RSS powered by FeedBurner

MG4J: Managing Gigabytes for Java™ 1.0 Released

2005-09-23T14:08:00.000+02:00

MG4J is a project that aims to provide facilities to index and query vast quantities of information. It is the kind of thing that will allow you to build your own version of GoogleDesktop. To be precise it implements a compressed inverted-index.

The critical feature of the release is its fundamental scalabiliy - both for its simple performance and its scope for multi-index, multi-process handling. All very useful features for a LGPL licensed library.

It is certainly on my 'to evaluate thoroughly' list.
http://mg4j.dsi.unimi.it/

Making the native XML pill easier to swallow for RDBMS addicts

2005-09-20T02:29:00.000+02:00

The Simple XML Data Manipulation Language is still a draft version. But it provides an interface and environment that is less alien than directly using a native XML database.

For a start SiXDML provides a hybrid syntax that combines the familiar SQL format with XPath and other query languages. Secondly the driver provides transaction support, which is a must in any serious environment these days.

This allows you to quickly leverage the very powerful hierarchical nature of XML databases through their ability to query objects at any depth in the document collection. Which frees the data model from the rigity and prescriptive nature of RDBMS.

There are some features worthy of any killer app too. Let your imagination wander... SELECT //myobj FROM COLLECTION mydata AND TRANSFORM WITH XSLT IN http://www.mine.com/transformer.xsl ...nice

A Disk Full of JAR Files

2005-09-20T00:59:00.000+02:00

I am not bragging, but I have 12698 JAR Files on my local hard disk. I am a heavy Java user and developer, but surely there must be something wrong with the platform if you get this kind of proliferation. I don't expect it to be any kind extraordinary example - certainly no record.

I know that if I used a better OS I could hard link them and get a few gig back, but I should not have to do that. I am also aware that quite a few of these jars are copies produced by various application server instances and ant builds.

To illustrate the scale of the problem I scanned for Jakarta's commons-logging.jar. I found over 200 of them - 4 different versions. That is not too bad because each jar is only around 30k. But log4j is ten times the size and when I searched for that jar I found about the same number. Some commonly used (and growing) jars are very large, like Xalan and jaxrpc.

All this disk usage makes the Java platform/technology the single biggest user of disk space on my machine. Java is already the biggest user of my cpu cycles and memory. And this annoys me, that bloat could be easily avoided.

So that is my suggestion for the next version of Java: solve the bloat problem.

My own suggestion for a solution would be to make the classloader use an inbuilt cache of jars. So that way jars are imported into the VM environment rather than just loaded by reference. Now that most manifest files have the 'Class-Path:' setting then it would be possible to extend this behaviour to a build guid style reference model.

There are obvious problems with this solution that I am aware of. But even a slightly better system would alleviate the issue.

A Replacement for JavaBlogs.com?

2005-09-14T16:32:00.000+02:00

Google have launched their new blog search tool, which like their news search tool obviously needs to keep track of a vast number of web resources.

It is still early days for the tool because its indexing appears to be several hours behind (either that or they forgot to set their timezone). For example a search for Java shows the latest entry as from 5 hours ago. Whereas specialist aggregators will be typically under 1 hour behind.

Where it does win is the way that it is a search tool and thus a complex filter. Javablogs is an opt in environment where anyone who mostly talks about Java opts into the aggregator. This means that sometimes you get stuff that is unrelated, and sometimes you miss good content on 'not normally Java' blogs. With the search you get what the Google engine considers relevant, which means that you may miss all those blogs on Ruby (shame :'( ).

The 'link:' and other search options are supported, which is an improvement on the javablogs search (which rarely works anyway).

The really good feature is the atom/rss feed option for a search. That really is a nail in the specialist aggregator coffin.

JavaCast? RIP!

2005-09-13T10:53:00.000+02:00

For those of you who can't find an explanation.

Dick Wall's blog.

Ant macros - one step to an abstraction in the build process

2005-09-03T22:43:00.000+02:00

binkley's Blog - Fun with Ant macros explains very clearly why macros are good for your build process. This alone is a good enough reason to move to the latter versions of ant (app server vendors take note).

Combine this with the suggestions here to build better builds and you are bound to be able to improve your build process.

ePOST Serverless Email System

2005-08-08T10:20:00.000+02:00

ePOST Serverless Email System
is an interesting concept. I wonder if it will catch on.

Slicker, Quicker, Slimmer IDE

2005-07-20T02:47:00.000+02:00

I was reading the page "Why Switch to NetBeans IDE ?" after yet another person had harped about it. I was reading it because I wanted to satisfy myself that my approach was still correct.

What is my approach?
The same one I apply when the RAD borg try and assimilate me [Rational will always be the 'borg' to me no matter who owns them]. Always Always Always know what you are doing. Transparency of tools is paramount, and being able to see what they are doing on your behalf is the most important factor when choosing a tool. Evaluations of tools normally only scratch the surface of a tool's capabilities and being able to spot when it makes a mistake (and then when to throw it away). I can just about stomach mock object test facilitating tools polluting the test using their own helper classes, but I draw the line at production code.

So what is slicker, quicker and slimmer? I rely on very few tools, but I use them to the limits of their capabilities. Those tools are J2SE, ant and junit at the first level and then I use another set of tools that give me the ability to perform verification. These other tools are Eclipse (minimal plugins), xdoclet and various J2EE aids. The key thing is that none of them 'sing and dance' they should 'sing or dance'. So why give myself extra work? The answer is that it is usually no extra work, except when things go wrong, but then you have good visibility anyway. And if you don't understand what you are doing then you are lost anyway.

In recent tests my ant build that shelled out to the wsadmin tool outperformed RAD/Websphere in a web services development project. And I have acheived similar results with Weblogic targeted builds in the past. Furthermore, such environment agnostic approaches lead to very portable development processes should you switch servers or even just have variations between development and production environments.

So in the same way when you are developing enterprise software you do not want to 'eat the elephant again' then I urge you to not 'eat the donkey' in your development environment.

Fedora goes forth with Eclipse!

2005-06-13T22:06:00.000+02:00

The Fedora Project has release Core 4 today. To anyone interested this is hardly news, but here is a quick summary on why I think it is work checking out:

Eclipse built in! IBM's Java development platform that has become popular with other languages now. [smart move]

AND combine that with OpenOffice which already has good MS compatability, but is also no heavily Java enabled, and finally a Java desktop integration [ish]

GFS, operating system level clustering.

Progressively improving security with the SELinux security architecture.

Xen virtual machine environment.

Downloading now...................

Probably the best free web log file analysis tool?

2005-06-10T00:35:00.000+02:00

NetTracker Lite was released as 'freeware' a couple of months ago. I needed a solution that would show me user experience data in particular. So I thought I would give it a try.

Most analysis tools are fiddly to set up, especially on Windows. But NetTracker Lite installed and ran first time, hooked up with my log files and gave me top class reports within minutes. The drill down reports are very impressive and the export options are useful.

The free version is limited to one website and one million page views, but that should do for most sites.

We are hiring Java/XML people - Surrey UK

2005-05-13T10:51:00.000+02:00

We are looking for recent/new graduates and project lead developers.
It is a friendly and challenging place to work.

Here is the formal advert for the junior role:

Trainee Junior Developer

Based in Guildford, Point specialise in eCommerce software and consultancy. Due to recent expansion, new business and ongoing projects, we are interested in discussing career opportunities with high quality graduates with Java and/or good XML skills to join our software development team. Web development experience would be a distinct advantage as would an understanding of network/infrastructure management.

The successful candidates would join an established team of developers with a background in delivering successful enterprise-scale applications to undertake customer project work as well as enhancing the feature set of Point’s software products. Initially, additional duties would include web-site development and management as well as general network and infrastructure management.

Key requirements are the ability to work as part of a team and to contribute to, and learn from, the team experience. Good communication skills are essential as the role may include direct customer interaction.

Salary and benefits will be related to the successful candidates’ skills and experience.

If you are interested in joining a dynamic, leading-edge environment, where your personal and technical skills will be fully valued and developed, email us an introductory letter outlining your reasons for applying and why you believe you would make a positive impact on Point.

For further information, please contact Max Liguori on 01483 685295

Point Solutions, Surrey Technology Centre, 40 Occam Road, Surrey Research Park, Guildford GU2 7YG

email to recruitment@point-solutions.co.uk

This will be an ongoing process over the next few months, so get in touch anyway if you come across this later in the year.

Usual EU working regulations apply.

Tip: When Weblogic says "String index out of range: -1"

2005-04-25T14:49:00.000+02:00

This is more of a 'note to self' than a tip, but when Weblogic says "String index out of range: -1" upon deployment, what it really means is that the length of the classpath in the manifest file has exceeded the maximum number of allowed characters.

Shaj simple, uncomplicated, perfect for a white hat hacking tool

2005-04-22T09:50:00.000+02:00

Shaj is my kind of open source. You only have to overcome the hurdle of using JNI and then you have a useful tool simply expressed.

When you are basing products on open source there is a large element of risk associated with each library. Keeping each one simple and not allowing it to take over your architecture is the key to mitigating this risk.

I like Shaj because its API is 3 methods, but its impact on the functionality of the system is potentially huge.

Here are some potential uses:

To verify on a local system that the user who originally logged in is still the user of the application.

This is the only safe use of this library.

To verify that a remote user is a valid user of the operation system.

Just don't tell your system administrator that you are using it, they might get a little worried about exposing OS security through an application - unless you are using a powerful distributed security framework already.

To write a password cracker. Although, you would need access to run your own JVM on the target machine.

What would be nice is if there was the option to 'become' that user as far as the OS is concerned, either on a VM or Thread level. But that would make things more complicated.

XSL the ball and chain of FO

2005-04-11T01:34:00.000+02:00

Reading Kris Thompson's XSL-FO... just shoot me! blog entry, echoes an internal report on FO processing that I recently produced. Well, almost...

I had an 'Ugly' section to my summary and that was focused on the tool support. And I am not just talking about rendering engines or XSL processors, I am talking about IDE support and authoring tools. As Kris touches on, bad FO is too easy to do - which is normally where you have some great tool to help you out (like a good IDE does). And although there are commercial FO authoring tools, and HP's stirling effort FOA, by the time you learn the tool you might as well have learned FO.

The scary thing about FO is its multitude of options. And knowing which option to use to get what effect is not that obvious. But combine that with all the headaches that go with XSL and you have a 'train wreck' prone feature. As I recommended in my report, stick with the FO - forget the XSL; if your app is already dealing with XML at the DOM or SAX level then treat the FO as just another XML format (as you would XHTML). With that strategy the renderers work much more effectively (mainly using less memory which speeds things up), which only leaves the black art of good FO.

Don't read this the wrong way. FO is top class. A client recently requested that the content of a FO sourced PDF document be sent in a plain text email, it was almost too easy. Just don't let the, was trendy, XSL part drag it down.

PDF vs CSS printing

2005-03-23T02:29:00.000+01:00

Having just spent the last few weeks setting up a FO based print solution for an enterprise architecture (SoA + JCA), and going through the hoops required to get it working with plugin branding and other dynamic stuff, I finally had time to return to polishing the final stages of my new look personal website. [I do have other parts to my life, but I left those out]

I generate the website, and for a while I used Forrest and other similar technologies that created a pukka pdf for every page, but the pdf templates were lame and hard to improve without deep FO knowledge. I now have that knowledge, but I wanted to find an easier way.

The main argument used for requiring PDF is that of security, because in theory a PDF document is immutable. In practice they are not, but they are a lot harder to change than almost any other electronic document format I know. The second reason is portability, i.e. that the document will look the same on all platforms. Ignoring the security aspects, the portability aspect is what I am getting at here.

The web is increasingly portable, standards compliant browsers and better formats like CSS2 and XHTML are making life easier. One such improvement is the 'media' type of CSS layers. And this is the technique that I have employed for my website. The 'print' media type is used to turn on and off the visibility of certain divs and spans to make a printable version. Other more subtle changes like wrapping code blocks in the printed form, but scrolling them in the online format, make the whole distinction cleaner.

So I thought: why don't companies who want you to print their material supply CSS based printing instead of the costly to develop and cumbersome PDF files? The client for the enterprise FO solution can sleep soundly because they required the PDF anti-tamper support, but very few purposes need this feature. But FO processing is relatively slow and resource hungry (especially Apache FOP) and client side processing is much more server friendly.

I can only assume that your average web technical architect these days has not kept up with the advances in CSS over the last few years. Shame, because one of the advantages of using media typed CSS is the easy integration of handheld, kiosk and mobile clients. The rebadging or 'white label' capabilities of CSS is also much simpler because of CSS support for multiple inheritance of properties of elements (one of the few areas of less than 100% support though).

If James Bond was a tux fan...

2005-03-14T13:38:00.000+01:00

Q: "Right look here James, take this watch "

Bond: "What's so special about this one Q?"

Q: "Just listen for a moment! Connect this USB cable to any PC and reboot, and in no time at all..."

Bond: "I am listening."

Q: "...the PC will be running Linux, with all kinds of useful applications including JEdit. It is based on a version of Feather Linux and we have remastered it to connect to the MI6 extranet. And James..."

Bond: "Don't worry Q I will be careful with it."

Q: "Ah but thats just it, this time you don't have to because it is not very expensive to buy a new one."

Bond: "Where is the fun in that?"

Tales of CatastrophicFailover

2005-03-08T15:06:00.000+01:00

Martin Fowler's blog on CatastrophicFailover reminded me of a classic example.

I was working on a military command system project about 10 years ago. The project was in the 'systems shakedown' phase as it would now be called, which involved doing lots of things that the local population complained about, great fun but nauseatingly slow project. After 4 years and 200 developers working shifts, we had a reasonably good system. The core was in Ada (draconianly typed, excellent in other ways), interfaces to hardware were in C and C++ and the system consisted of 200 nodes each with several processors and truck loads of dual redundancy to resist physical damage.

One fine day in the main operations room something happened. One by one, each of the control consoles in the room rebooted, you could see that it was happening in sequence but at a very high rate. Ada is a very robust language, the strong typing means that runtime exceptions should never happen, as a result the default exception handler is normally set to reboot the system in this context. This had never happened in the simulated 'facility'.

Obviously, what was happening was that one console was being rebooted by an exception, but as part of its systems handover it was propagating the cause to its failover node, which was in turn being tripped up by the same problem. The system used a core memory replication system as a means to implement lossless hot failover, very effective but prone to this problem. Just to make matters worse the error could only be replicated (or so we thought) during periods of high activity, and so the background logging thread had not had time to record the state of the node yet and so the sophisticated replay system was useless.

Step one was to avert the domino effect. So extra exception handling was temporarily added to prevent the exception from causing the meltdown. And then extra logging was added to try and discover the source.

It did not take long to find the source, at least the line of code. The read of a variable that represented the direction of a target was the culprit. But this variable had been set in another node by another part of the software that had in turn read it from a hardware interface. Why then in 99.999% of cases did it work and then under conditions of heavy load it was being tripped about once a day? Heads were scratched for weeks, until one day I was in the 'facility' at a strange time of day doing some very 'quiet' testing of systems and (as we were still running the old build) the consoles rebooted in sequence. We only had a low load on the system that day and I noticed that one of the targets had just passed north....

The next day I went back to the nice warm development site and started ploughing through the source of the relevant sections of code, tracing the variable back through the layers of software to its hardware origins and see why north might be significant. I discovered that the variable was being converted back and forward between radians and degrees in several different layers, but this did not answer my question. Then I took a close look at the value of PI being used, and in the C code the value was specified to one more decimal place than the Ada definition. And that was the answer, the numerical accuracy of the C conversion was different from that of the Ada so in rare circumstances the Ada could be given a value of more than 360.0 degrees and fall over in a heap.

The reason why I am writing this now is that I am in the process of integrating an enterprise standard Java calculation engine with various J2EE based platforms, and despite so called standardisation - this problem of botched numerical accuracy still exists in code today. At least Java's exception handling conventions are more forgiving.

Herons drink trendy coffee?

2005-02-24T02:25:00.000+01:00

Heron is a programming language that aims to embody best practice principles in a kind of 'meta' C++. It pulls together several good patterns (including AOP) in such a way that it promotes open, maintainable code; but at the same time it avoids the common pitfalls of C++.

From a Java perspective, I looked at the 'hype' style text and thought 'yes', but when I looked at code examples I thought 'no not again'. The problem is that it has inherited some of the ghastly C/C++ syntax that after years of Java programming seems pathetically cryptic. And before anyone complains, I have seen the look on fresh graduates faces when they first see C syntax, and we don't need barriers like that in this industry.

Syntax shock aside, Sun could have learnt a thing or two from this language definition when they spawned Java 1.5. No casts, pragmatic OO, templates and references - Christopher Diggins deserves a pat on the back. I have not had time to really get into it yet (too many customers, too little time), but the more I look at the features and see the examples the more I am reminded of a language that celebrates its 10 (or 22) year birthday - Ada95 [an excellent but overengineered language that has never been called trendy, that defined generics and mandated programming by contract back in 1983, and has the best runtime kernel for multithreaded applications - search for 'ravenscar rendezvous']. I hope Heron fares better than that countess.

First Security Flaw in IE7

2005-02-16T14:45:00.000+01:00

The RSA Conference 2005 saw the announcement of IE7 as a 'more secure' browser. Presumably he means more secure than Firefox. I wonder if any of the major betting companies are taking odds on the date of the first security flaw being found? Or how about the number of days that IE7 has fewer vulnerabilities reported than Firefox? Post a comment if you find one.

5 Top Articles For 2005

2005-01-03T17:13:00.000+01:00

I thought that I would start the year with some topical articles of the last few months.

Developing Secure Applications Through Aspect-Oriented Programming

Distributed Agile Development

Java Management Extensions for application management

Dependency Injection with XStream

Comparative Study of Persistence Mechanisms for the Java™ Platform

Make LOVE not SPAM

2004-11-30T12:13:00.000+01:00

Make LOVE not SPAM is a very good idea.

One word of warning though.
If you have a mail server running at your point of presence on the default port then be careful as your ip address will appear in the logs and then the spammer will be able to target you back. My advice is only use this if you have your email server on a different ip address.

Google again does the right thing

2004-11-29T16:44:00.000+01:00

When you use a web based email service like gmail, you rely on the service provider to protect you from virus infection. Unlike spam protection, you never need to be consulted by any filter ("would you like to be infected by this virus that I found in your email?" - Yes my name is George or No), you just ditch the message.

This article - Webmail Email Virus Protection Comparison, shows that Google is doing the right thing by protecting users completely where it can. And even though Hotmail manages to do the same by enforcing "thou shalt not have attachments" rules, infected files still get through.

Interestingly it appears that Norton beats McAfee at finding virus infected files.

7 Signs of Agility

2004-11-25T10:47:00.000+01:00

Alistair Cockburn has released a sample chapter from "Crystal Clear Applied: The Seven Properties of Running an Agile Project". I thought I would blog about it because I like that it is neatly and succinctly explained. Even though most of the signs are just repeats of 'Mythical Man Month' principles with the agile spin, it is still worth having a read through. It is nice that he applies his own signs to the article.

For those without time to plough through 10 pages here is my summary of the 7 signs:

Frequent delivery/integration using time-boxed iterations

Reflect and improve, criticise and fix

Osmotic (passive) knowledge acquisition and communication through office organisation and open channels

Personal Safety, safe to be honest, confidence to court criticism

Stay focused, clear tasks, priorities on work, limit the workload

Access to expert users, fast, quality feedback

The usual agile stuff: automated testing, CM, continuous integration

iText 1.1

2004-11-22T13:24:00.000+01:00

iText is a PDF library. It is widely used.
Version 1.1 adds significantly XFDF merges, 1.5 compression, more font subsets, better scripting support and signed/verified documents.
Apparently it is much better at recovering damaged PDF files now.

SOA - "Super Open" Architectures

2004-11-09T02:00:00.000+01:00

I was reading the snippet on SOA in this Javalobby article and it struck me that a large number of people consider SOA to be "yet another software architect's differentiating gravy boat", and to a certain extent it is. If you approach a classic consulting architect and ask them to drive you down the SOA road, then chances are they will "do you for the basics" - in other words you might get an ESB (tarted up MOM layer), a set of technology components (repackaged Tuxedo) and a half proven (Corba style) interface framework with the badge 'SOA'.

The challenges of a standard SOA implementation have not really been solved. The vendors of the likely SOA platforms are only just now getting around the table to either buy each other, swap specs or invite each other into court, and almost no implementation has been accepted as the 'industry leader' (not even IBM imho).

The general idea of having well defined component interfaces that meet the broad requirements of all their possible clients is understood by the designers of SOA systems, but the technical challenges of having complete consistent and efficient interfaces for all the range of service users are very difficult to reconcile.
The issues are further compounded by the lack of a real answers to the following:

How do you achieve reliable communications?

How do you ensure enterprise standard security?

How do you keep the business logic and processes out of the technical quagmire?

How do you maintain integrations with legacy systems?

Add to this the transitional issues related to rolling out architectural change across business critical systems and you have a challenge that is beyond most technical architects.

From my own experience, it has become clear that a successful SOA implementation is more down to defining good services and having well organised interfaces into those services than any ESB or BPEL integration. The stock answer from a consulting architect is normally, base yourself on vendor X and Y, use the backbone technology Z and the platform technology U, and then defining your interfaces is as easy as ABC and glue it all together with XML. The trick is in the bit that they typically skip, or leave to the troops on the ground - the systems design.

But how do you design a component to be 'at home' in any system? With great difficulty. The problem is like having a house that you should be able to pick up and move anywhere, one that will automatically connect up to the local pipes and facilities after each relocation. One of my colleagues likens SOA design to changing jobs every month, where each time you have to forge new trust relationships, define your role in the organisation and get your email and business cards. In both analogies it takes time to get to know your surroundings, and so it follows that any component must also adapt as we do to changes. And although self adapting software does exist, the best we can hope for is configurable scripted tailoring and 'hints' management. But to script or hint correctly you need to understand the system design.

I fear that most people use SOA to hide the true cost of having a good systems design. The technologies in use work well to enable flexible systems implementations, and as such allow the architect the opportunity to rework the systems design without a great deal of cost. But your first SOA implementation will typically be only about 50% efficient. And that is why I refer to SOA as "Super Open" and not "Service Oriented", architects tend to leave the systems questions open and use low quality scripts and inefficient messages to paper over the cracks.

"Jim is a tool, Donna is a database" - designing good interfaces through roleplay

2004-11-05T01:21:00.000+01:00

For a while now I have been trying to find a way of describing to those around me the mental process that goes into designing good software interfaces, APIs, web services or SOA components. And now I have found a good analogy I wanted to share it.

The basic idea breaks down into the following stages:

Having reached a degree of business knowledge you start by trying a first cut of the grouping of operations into interfaces.

Next, you give each interface a person's name and one that has nothing to do with anyone you know.

Then you build a human character around the persons name, based on the type of operations they carry out and their degree of responsibility for the underlying business purpose.

Having done that you can start to refine your interfaces based on imagining a person in a role, doing the kind of operations you require. And that is when the human aspect comes into its own.

Take for example a B2B system, there you might have Lucy who speaks good XML and will happily go out of the office to meet clients, and Nigel who has a lot of work to do in his backroom office, normally only speaks Cobol and goes home at 6pm every day.

By imagining your interfaces as people you can assign them behaviour and apply common sense to that behaviour. It allows stakeholders to be able to discuss what is in each persons job description and whether it is efficient for them to perform various tasks.

So in our example B2B system, if a new customer needs an account number - then you would much rather they deal with Lucy than Nigel, but Nigel is the one with the master list of account numbers. So you have a compromise to make and decisions to be take, you might want to install an ESB telephone so that Lucy can ring Nigel from her mobile to get the number or Lucy takes a new account number before leaving to visit any potential new customer, or even introduce James as a middle man.

I find that it makes spotting mistakes on an interface straightforward. If Jess your office post boy had been assigned operations that involved any degree of business knowledge then there is obviously something wrong, and similarly wrong would be if the CEO had to deliver his own post. From experience this technique works better in higher level interfaces than the programming language level, because the language level is far mor abstract and it is harder to assign human characteristics.

Thoughtworks Crystallise Selenium

2004-10-28T10:04:00.000+02:00

Selenium is a web based testing tool. It has been developed using standard JavaScript and uses test scripts that are themselves simple html pages, which has big implications for test management.

You define tests by writing a single html table with 3 columns, command, target and optionally value. The commands are what you might expect, doThis, checkThat style, but I did not see a 'sleep' command which might be useful for session management testing and customer acceptance tests (so they can watch).

Although you can operate setup/teardown activities and there is rudimentary support for continuous integration I think that a test generation tool would be a better way to manage the complexity of tests. For example, if you had a database of low level tests and setup activities then there is no reason why the test table provided to the JavaScript test engine could not be either generated from a database or spliced together on the fly by a test server.

Keep up the good work.

Why I went Thunderbird

2004-10-03T01:13:00.000+02:00

The Thunderbird Mail Project has legs, but not quite wings.
I have used Outlook to manage my correspondence for many years, and over the last 2 years I have enthusiastically and reluctntly converted to Evolution. Up until a few weeks ago I wanted Outlook on my XP and Evo on the good stuff.
"Save messages on server" is a must in this scenario, 2 environments 2 email clients, no option. But that is where the TBird starts soaring, being 'standards compliant' no matter how loose the standard, means that I can share the client files not just the connection. So what?

I have an ant script that makes heavy use of the sync task to keep my laptop, desktop, and home systems in a 'ready for action' state. It is along the lines of Martin's Subversioned Desktop, but without the version control. Almost every project I have been involved with starts with an exchange of very meaningful emails, and being able to access and search these emails is relatively important to the success of the project. In the past I have found myself converting Outlook PST files when necessary, it all depends on what I was doing when I received the pertinient email.

TBird allows me to share a common email folder in both Windows and Linux environments. And its news/rss etc. integration gives you the ability to mix emails with targeted news. I am still a long way from reaching the limits of what it can do to merge and cross polenate ideas between fields.

However, there is no calendar/scheduling function. Mozilla consider this to be a separate project, but they have 2 projects that fit that niche. Unusually, they are letting both run - one version targeted at integration with email and browser technologies and the other designed to work on its own. Microsoft have proved the value of such integrated applications, and I hope that Mozilla can make the right decisions in this area. In the mean time the 2 project complement very nicely the 'de facto' functionality provided.

TBird is nothing special on its own. It is a mixture of familiar common email features; which makes reading the manual almost obsolete. But what is does do is free you from a proprietary email system - you can even grep your emails. To sum it up, Thunderbird is sharing friendly.

Ready Set Go Document

2004-09-29T00:54:00.000+02:00

The ReadySet project provides a useful resource of project templates. Born from academia, it is intended to be honed by industry professionals who are supposed to put the templates and checklists through their paces on a daily basis.

A nice idea, but is anyone really using them?

I am leaving today

2004-09-17T10:58:00.000+02:00

Just to keep up with the theme of 'getting out' blogs recently I thought that I would add mine. Yes, today is my last day at the ponderous governmental organisation, Monday will be the new dawn of a new company in a new country working in a new industry - but still doing the same old J2EE stuff only hopefully better, faster and lighter.

How to Resign with Style and Dignity

Might be a bit too busy to blog over the next few weeks though.

What's New In GNOME 2.8

2004-09-16T11:34:00.000+02:00

1. New File Manager with an inversion of the relationship between the file manager and the applications. The apps now tell the file manager what they can cope with.
2. The Glider theme "wow...smooth...boring"
3. Keyboard layout previews, "does your keyboard look like this?" useful if you use a remote desktop in another country (as you do every day).
4. Panel Applet selector.
5. Calendar now integrated with Evolution
6. Network Monitor now does wifi monitoring.
7. A battery monitor that actually works.
8. Weather now supports the new UK forecasts, yet another topic of conversation on the train - "did you catch the Gnome forecast last night?", "yes its going to rain later", "yes". Just in time, I move to the UK next week.
9. Evolution 2.0 (the evolved one)
10. Epiphany desktop aware web browser
11. Built in VNC for big brothers
12. Unified system clock, network and user management tools
13. GUI for network analysis tools, hmmm...familiar
14. Configuration search, hmmmm...dangerous

See GNOME 2.8

Java Open Single Sign-On Project

2004-09-14T09:37:00.000+02:00

Ever since the concepts behind JAAS really clicked inside my head I have been meaning to write this kind of thing. The Java Open Single Sign-On Project groups together the sign on requirements of a system.
One of the useful things it adds is a reverse proxy, something that is quite unique among OSS security projects.
It is at RC1 at the moment, but I can envisage a whole raft of feature requests for version 1.1 - like adding a distributed element (multi layer Realm) or supporting other security schemes like one-time passwords.

LDAP in Eclipse from Cyrone

2004-09-10T17:13:00.000+02:00

Cyrone have released an LGPL LDAP plugin for eclipse 3.0.

Robot that eats flies for fuel

2004-09-09T13:45:00.000+02:00

UWE have produced a robot powered by dead flies or rotten fruit. How it catches the flies in the first place is not clear from the site, but perhaps they land on the rotten fruit.

Web Design with Apache Forrests Skins

2004-09-08T09:29:00.000+02:00

Recently I have been using Forrest to generate websites for existing projects (I use maven for new ones). And like a number of people have pointed out it is very good at doing that.

On the other side of the coin there are a few websites that are not techie orientated that could benefit from this kind of 'just type forrest' generation.
One of the key enabling factors is that Forrest 0.6 will have docbook 4.1.2 support that means that Open Office and Abiword documents can act as sources. But in my experience most people are quite happy with WordPad to edit structured text.

Installation for a website owner is very simple, install forrest, seed or unzip a template I give them, create a couple of links on their menus, add a record task to the ant build to log to a desktop file, set up the upload.

The biggest drawback of Forrest is that its skins are a real mess. They produce standards compiant xhtml, but the design is not up to slick business website quality - with a large number of little 'hacks' here and there to make things look better. For example the ForrestTable template has 'width=100%' which makes page alignment die.

I have just completed my first conversion of an Open Source Web Design template to a Forrest Skin. It took a while to unpick the XSL from the nested html elements of the default skin and apply that to the test design from the OSWD. I chose the Gila design as my test because it is one I know quite well, and it looks good IMHO.

There were a number of things that I needed to compromise on to get it to work visually as well as functionally. The use of logos in a skinned page does not work well and so I opted to use the project/group names that could be compatibly styled. I moved the search, host, credits and pdf links to a right hand panel. To get the pdf link outside the document section I needed to select an otherwise hidden section of the document template output and import it to the panel. The menu was a bit ticky to keep working properly, I ended up keeping the group div that the javascript depends on and losing all the other divs in favour of ul/li structure. I also adjusted parts of the document colour scheme (e.g. table) to match the overall skin scheme.

The tabs and the content of the page needed some XPath voodoo, because the default skin designs are based on referencing certain div classes created by other templates. Cocoon is a very powerful tool, and the ability to do this is important to be able to have flexibility, but it creates a really difficult to maintain coupling between different templates.

I am going to release a website with a Gila like skin soon, then you will see what it can look like. In the mean time if you want a beta version of the skin then email me at skins ut hughreid ot com. Imagine what your project website might look like with this Face skin.

"Maths holy grail could bring disaster for internet"

2004-09-07T08:57:00.000+02:00

Sensational journalism really gets to me sometimes. The article Maths holy grail could bring disaster for internet is a prime ;) example.

The piece of news is that 2 big maths problems might have been solved. And almost every other media agency has taken that slant. But this headline is pure sensationalism, based on a grain of fact, that understanding why primes are primes will pull the rug from under strong encryption.

On the one hand, Tim might be right.
Assuming that, armed with intimate knowledge of prime numbers, someone can devise a way to crack any strong encryption quickly and efficiently. And then that technique falls into the wrong hands, and becomes widely used.
What you get is the internet a few years ago again, where there is no https in general use and 'man in the middle' attacks are impossible to detect or protect against.

But more likely is that the maths does give you that first step to understanding primes. But instead of opening the flood gates it only gives the number one step of many insights required to provide instant cracking.

Security is not just about encryption. Excryption is a technology that enables many features of internet security systems. Take away that technology and you still have some security, but you need to plug the holes with solutions based on other technologies. While this might be really inconvenient it is not impossible.

So if you have any ideas kicking round your head that provide security without encryption then now is the time to file the patent. But I wouldn't bother building them yet.

AnandTech - MythTV Setup and Install

2004-09-06T18:52:00.000+02:00

This is interesting stuff at the moment, shame I did not have this before the glorious summer of sport.

AnandTech.

Guarded against myself

2004-09-06T17:54:00.000+02:00

I was trying to track down why my email just appeared to melt away over the last few days. I checked the usual reason, my ISP, but for once they were blameless and actually helpful.

I eventually realised that it must be Yahoo! SpamGuard that was declaring each and every email I was getting as spam. Once real emails are classified as spam then they can very easily get lost in the bulk folder, as many spams are post dated, leading properly dated emails to appear on about page 19 - and there is no way to sort by sequence. So to get anything back I have to do some imaginative searching, for emails I think I might have recently recieved.

Even now that I have retrained SpamGuard not to classify emails from myself to myself as spam, they still end up going back in the bulk folder eventually. The reason for that is that spammers send thousands of emails claiming to be from me, and these get bounced as spam by ligitimate system admins, then SpamGuard associates emails from me with being spam.

Hell.

IETF Sender ID ready in sendmail patch!

2004-09-01T11:14:00.000+02:00

If you are a sendmail user then the sendmail.net test site is advertising for testers for the soon to be launched 'Sender ID'.

You need to be at the latest version of sendmail and download a small patch program. Whether or not you agree with the solution I think that it is worth trying.

I hope that initiatives like this will finally turn the tide against spam and prove that my article is wrong.

Program with Smileys

2004-08-31T07:53:00.000+02:00

Here is the latest in my list of minimalist programming languages.
Vertica Smile - The Programming Language of the Future, takes a different approach, instead of using single characters it uses various types of smileys. For example the increment operator is :-) and the decrement :*(.

Open Source, Closed Shutters

2004-08-31T07:44:00.000+02:00

As ever here is another example of how OSS is driven by real needs rather than just profit. See MegaTrack, Tropical Storm Tracking.

The red storm in the top right looks like it is heading straight for my house.

Cargo Cult Security - Windows Live Update

2004-08-30T09:56:00.000+02:00

It is like saying that "our roads are safer now that we have much faster ambulances". Microsoft have obviously looked at effective security products and effectively secure operating systems and decided that in order to give the impression that their systems are secure they need to exhibit the same features as those systems.
Richard Feynman describes this 'form' as the cargo cult, put into a software engineering context here. In the security context the cult of good security exhibits:

Full Disclosure

Open Source Audit

Built in Cryptography

Active Patching

The OpenBSD model of "proactive" auditing of software and "security by default" distributions, leads to good security. The fact that they have all the exhibited form is incidental. The OpenBSD patch mechanism is very basic, because there are not that many security holes to patch, most potential exploits were designed out from an early stage.

I suppose when you have a 'runaway train' of security issues then you would need a 256Mb brake. I hope it works.

Doctor, Doctor - I am suffering from the Agile virus!

2004-08-30T08:36:00.000+02:00

"Take two requirements documents now, come back on Monday for your analysis, then Tuesday for design, then Wednesday for coding, then Thursday for testing and on Friday you can meet the customer"

Dean Margerison has released an article, Agile Practices, which describes how "viral adoption" is spreading this new way of working.

It is very high level look at the world of Agile technologies and practices, it has some nice phrases sprinkled around like "weight of the ceremony associated with methodology" and even some stats on things like Maven.

Microsoft leaves the door open for the competition.

2004-08-30T08:16:00.000+02:00

Bill, does it really take 5 years to make your Windows product secure? Has the slip in launch dates been directly related to the effort to make Longhorn secure?

I am sure that Apple, IBM, HP and RedHat are not going to pass up this opportunity to take a slice of market share. But how are they going to do it? Where is the key to the market? What segment should they target?

Apple have a good, but expensive, alternative to Windows already doing reasonably well. IBM's drive to integrate everything should put them in a good position to move into the desktop (presumably with Java applications). RedHat have a very well packaged Linux distribution that gets better on a daily basis.

It used to be that the home market was made up of souped up games machines, until people realised that they could afford to get the equivalent of their office machines. Now the tables are a bit turned, the home market tends to lead the office market on the operating systems, whereas the office market leads the home market on hardware. For example, my office machine is 10x faster than my home machine, my office operating system is 10x older than my home operating system.

XP is 3 years old next month, and I have to say that in my experience its adoption into the office environment has been cautiously done. I don't think there is a sysadmin out there who has not been challenged by the TCO question of switching to a Linux alternative.

Maybe the delay of Longhorn will allow XP to cement itself properly, by giving Windows sysadmins a chance to improve systems without changing them every 2 years. Or it might give them time to test out alternative solutions. Whatever the situation, the door has been left open for a short time, see who makes the most of it.

Also watch out for Google, they might not have any plans in this area but there is something going on behind the scenes at the moment (they keep hiring top Java people). It might be that they enter the platform market with integrated desktop applications.

Technology News Article | Reuters.com

Swing JAAS - poor Dr Dee

2004-08-27T14:49:00.000+02:00

I don't want to be too critical about Swing JAAS, because its is a nice idea. But...

Dr. Dee appears to be confusing the UI (Swing in this case) with Client applications. The two normally go together, but the former implies JAAS4Swing and the latter distributed JAAS. Reading the design notes it is obvious that this library tried to do both.

In a bit more detail:

Distibuted JAAS is very hard to achieve without going vendor specific, because there is little support for the concept in the standards.
Having written two djaas implementations over the last few years I know the difficulties (sorry closed source). For example certain key components of the JAAS framework are not Serializable, and you always have the security issues associated with 'man in the middle' attacks. Once you have solved these problems Distributed JAAS is very cool, because you can break the single server notion. Using the EJB model is probably a bit limiting in this case because it is not as powerful as the JAAS mechanism (but a bit easier to get your head round).

Swing Authentication & Authorisation, is what I think Dr. Dee was originally trying to do here.
The authentication part should be simple, provide a default callback handler that delegates to a Document and bean model that is used to power the app's login screen; you can also allow an app to register its own CallbackHandler if it needs to.
With the current approach to authorisation you are likely to get problems, because of the 101 ways that swing lets you do things. Using actions is the right way to do things if you are going to take this approach, and developers should be using actions for all things they want 'authorizable'. But if you go further then you must be prepared to do the whole job, rather than leaving it ad hoc and inconsistent.

The way an EJB client security normally works is by using a Proxy object, that checks the authorization of the method call in progress. Exceptions are thrown to represent the various failure cases. Because all EJB components are produced from their Home interface, which does the Proxy magic, then all access is protected by this mechanism. Doing the same with Swing is a very difficult task because it is not all action based, nor would using Proxy objects to wrap the various Model interfaces work either because the interface is so inconsistent. You could require and impose good techniques on the developer, but unfortunately security is normally an afterthought, and so requiring major code adaption would make people look at other solutions.

The real world examples of UI authorisation that I have actually seen and built are all based around bespoke implementations of the AccessController concept, because it is quicker to do than wrap most of Swing. You can of course use AOP point cuts to augment the swing byte code or even use a decompiler to build checks into faux versions of the swing components (and you might get a visit from Sun's lawyers). Another idea is to use an XML driven UI that would be unique for each role.

The most plausibly workable, but still simple, solution I have come across is the 'permit on pack' paradigm. Most swing application UIs are fully formed when the window.pack() gets called, all the panels, text boxes and buttons are in the component tree. Typically you have also logged in at this point, just before the window.show() is called. So why not parse the component tree and try and match all optional elements to their authorisation settings? The code to do this would not be pretty, but at least it would be a 'one stop shop' for making panels in/visible and menus enabled etc. You could also find out what to authenticate for by analysing the tree at the same time; so if your ACL permits you to use features of another system then you could log into that one as well.

How do you do it? In your Swing implementation you make sure that you add your nested components to the parent containers in the constructor (which is fortunately what most people do by default). Then in the Applet.start() or JFrame.show() method your wrap the super call in a Subject.doAs() having obtained the Subject from a LoginContext. Inside the doAs call you should then call the code that does the turning on and off of the various parts of the UI before actually starting/showing the application. This 'one time' check works for most application types. Running the whole application as a particular Subject has the added advantage of providing support to remote security like samba drive access.

Embedding Perl in Java - PLJava

2004-08-27T10:14:00.000+02:00

JPL was the first commercial Perl tool, it embedded a Perl interpreter into the JVM. Now a free alternative has emerged PLJava.
It is still very alpha but looks promising.

James Drools

2004-08-26T17:17:00.000+02:00

Take two top class bits of Java technology, James apache's mail server and Drools from Codehaus. Mix them together and what do you get, a powerful rule engine for email processing.

The way to do it is to take the Mailet interface of James and write a DroolsMailet like this:


public class DroolsMailet extends GenericMailet {



    private WorkingMemory memory = null;



    public void init() throws MessagingException {

        super.init();

        MailetConfig config = getMailetConfig();

        String rules = config.getInitParameter("rules");

        RuleBase ruleBase = RuleBaseBuilder.buildFromUrl(

            this.getClass().getResource(rules));

        memory = ruleBase.newWorkingMemory();

    }



    public void service(Mail mail) throws MessagingException {

        ...

    }

}

You may want to persist the working memory or have some kind of rule reload, but this simple implementation should do for most things.

When James calls the service method you want to trigger Drools to work on the new message. So the service method in its basic form looks like this:


    memory.assertObject(mail);

    memory.fireAllRules();

But there is a problem with that, your working memory will slowly fill up with all the messages that go through James. So you want to have some way to limit the number of messages in your working memory. You could do this by timestamp, have a Drools rule that retracts messages where the lastUpdated timestamp is more than a certain time ago. But if you get a flood of emails through your server then you could still blow its memory capacity. So instead you should fix a limited number of message to hold, like this:


    private final LinkedList messageList = new LinkedList();

    private int maxMessagesToHold = 100; // some default size

then in your init method:


    maxMessagesToHold = Integer.parseInt(config.getInitParameter("windowSize"));

and in the service method:


    messageList.addLast(mail);

    if (messageList.size() > maxMessagesToHold) {

        Mail oldMessage = (Mail) messageList.removeFirst();

        memory.retractObject(oldMessage);

    }

So now your Drools working memory holds the last X messages in it, so what! This is where you start being able to write some powerful rules. Most people are probably thinking of various spam filtering techniques. But how about this for a different kind of rule:


  <rule name="ClientRecordIncoming">

    <parameter identifier="message">

      <java:class>org.apache.mailet.Mail</java:class>

    </parameter>

    <parameter identifier="clients">

      <java:class>com.mycorp.ClientDatabase</java:class>

    </parameter>

    <java:condition>clients.isClientAddress(message.getSender())</java:condition>

    <java:consequence>

      Client client = clients.getClientByAddress(message.getSender());

      clients.recordMessage(client, message);

    </java:consequence>

  </rule>

This rule will record all incoming messages from a recognised client in your client database, assuming you can write the ClientDatabase class and load it into working memory in the mailet init method. You could just as easily write this into the mailet, but the power of Drools really shows when you start cross relating emails.


  <rule name="RelationshipMapper">

    <parameter identifier="first">

      <java:class>org.apache.mailet.Mail</java:class>

    </parameter>

    <parameter identifier="second">

      <java:class>org.apache.mailet.Mail</java:class>

    </parameter>

    <java:condition>first.getRecipients().size() == 1</java:condition>

    <java:condition>second.getRecipients().size() == 1</java:condition>

    <java:condition>first.getRecipients().contains(second.getSender())</java:condition>

    <java:condition>second.getRecipients().contains(first.getSender())</java:condition>

    <java:consequence>

      EmailRelationship related = Relationships.get(first.getSender(), second.getSender());

      if (related.isNew()) {

        drools.assertObject(related);

      } else {

        drools.modifyObject(related);

      }

    </java:consequence>

  </rule>

This rule will fire when there is an exchange of emails between two addresses within the window. This way you could track the business relationships of your staff through their emails.


  <rule name="DepartmentalRelationshipMapper">

    <parameter identifier="related">

      <java:class>com.mycopr.EmailRelationship</java:class>

    </parameter>

    <parameter identifier="staff">

      <java:class>com.mycorp.StaffDatabase</java:class>

    </parameter>

    <java:condition>staff.deptOf(related.first) != staff.deptOf(related.second)</java:condition>

    <java:consequence>

       ...

    </java:consequence>

  </rule>

And the list goes on...
It reminds me of chinese wall compliance tools.

Backdoor DI with XStream

2004-08-25T15:43:00.000+02:00

Simple, scary; got objects, externalize them to XML, tinker with the XML, render them back, and bingo a static IoC container implementation. No getters, setters or constructors in sight.

This article Dependency Injection with XStream follows on in the vein of "cool things you can do with XStream" that I began with this blog, combining it with my other meme of the moment, IoC.

It works because XStream uses XPath to ensure that object relationships are preserved in the same Object graph. That way when objects get unmarshalled they are created with their dependencies already injected. The defined container is transparent because it uses a Proxy implementation to delegate to its contents, simple (and restrictive) but very clean.

The two main drawbacks are that there is no lifecycle and the object definition can get a bit messy. But with a bit of extra code you can get round these issues.

I would appreciate comments.

What the butler said about Gymnastics

2004-08-25T01:13:00.000+02:00

The BBC delivered a memorable evenings viewing tonight when a servant commentator, used to rugby, was given a 'free hand' to wax lyrical about olympic synchronised swimming. Oh the humour, oh the irony, it is what makes an uninhibited BBC worth paying for. Seriously, it is what counts.
From the heart of the EU, i.e. abroad.

Never mind the 'beer blogs in the morning'.

Start of a Java OSS name drought?

2004-08-24T11:19:00.000+02:00

Marius is quite certain that his new alpha GPL project called Jini is not IRC is a good name. The fact that it has been listed as Jini on freshmeat and is packaged as jini also, make it probably not a very good name. It might be quite a good IRC client in the end, so I don't want to knock the project. But is this a sign that we are running out of OSS names?

The classic Java OSS naming conventions are getting quite well used now. I am talking about:

j[something]

[something]4j

Java[something]

And most meaningful words to substitute for something have been used. e.g. jLog, log4j and JavaLog.

I don't think that we will ever run out of names. And some names will eventually get re-used (Jini is in use Marius). But there may be a lack of unique representative names in some topic areas. There are a couple of ways to handle the name drought.

Create an official OSS name registry, to prevent duplicates and speed up name re-use.

Have a more structured naming scheme - org.java.logging.myspecialframework project

I don't actually like any of these suggestions. There are some advantages to having an official registry, things like trademarking. Project owners would be discouraged from naming projects things like 'MicrosoftWord4j' while with the help of funding protected from the reverse - commercial name hijacking. Offensive names could be weeded out too.

Sourceforge (and the osdn in general) could probably be considered as the master list of OSS projects; but there is not a 100% coverage, particularly in areas of Sun's technology and Apache's projects.

I would be interested in hearing about any suggestions for Java naming conventions for OSS projects, or any comments on the idea of a registry.

How to stop your CM from strangling Eclipse

2004-08-23T13:42:00.000+02:00

How many times have you had to abandon a refactoring exercise because you can't check something out or regretted doing it after spending days blocked in a merge?

Eclipse, or any other modern IDE, should be able to let you refactor hundreds of files in one go. But most projects would shy away from any such change, preferring to work in an imperfect world than face the project disruption or ensuing merge hell.

I don't like it when support tools like CM, invaluable though they are, have a direct influence to the project implementation. Which is why this article came about. It tries to solve the issues of using archive files as the unit of control, albeit with a step back in technology.

Using a higher level of source control produces some benefits that may tip the balance. Things like consitent checkins, build script simplification, one source one jar etc. But these are more conveniences, the main gain is in allowing the refactoring to take place unhindered.

502 Server Error - from Google!

2004-08-23T10:02:00.000+02:00

I have encountered a Google server error for the first time ever today. 502 are normally sent when the proxy gets garbage from the backend servers.
Monday, August 23, 2004, at 08:00:00 UTC ish

Open, Honest and Exploitable?

2004-08-23T09:18:00.000+02:00

The blog JXTA Yields an Application for P2P Backups is worth a read, because it has a great deal of good information in it. I applaud the 'declaration of interests', which is always good to know when you are reading something in a public context. And I agree with the comments on Swing, done right it is as good as any other.

LeanOnMe is a good idea, and by being a commercial product makes the 'size' problem less of an issue. The 'size' problem is that when you create a backup, your backup sets are generally larger than the original (the exact size depends on the compression to number of versions ratio). So your backup media needs to be at least the same size as what you are backup up.

I differentiate between backups that allow a user to get the file back that they accidentally deleted on Friday (when they got back from the pub); and backups that permit timely recovery from virus attack, disk failure or "your office is toast". LeanOnMe is potentially a good piece of a larger backup scheme, where local and remote backups play different roles. I like the idea of being able to upload my entire HD when upgrading my PC. See my other blog for another idea about remote backup.

There is a danger when being this open though. By naming the technologies involved and describing the process Daniel has provided hackers with one piece of the puzzle required to write a successful exploit. The security consultants mantra "the hacker knows your system" is true now for LeanOnMe, and although "security through obscurity" is a myth (even the Amiga has worms), keeping your security system quiet is still a good idea to prevent you becoming the Google "I feel lucky" choice. 312 should keep a very close eye on security advisories for the technology used. A virus infested backup is almost useless.

Agile Pigs and Unit Testing Tips

2004-08-20T12:07:00.000+02:00

I have just posted an article that people might find interesting. Agile Bug Finding with Risk Targeted Testing in Java, is a bit of a long winded way to say "use the Halstead Volume metric".

But part of its is tips on unit testing in Java that is more blog relevant.
Here is an extract:




  Run the tests every time you change something. If you use Ant then have a 

  test task that gets triggered on change. Keep your old test results for 

  reference.

  Use XML for your test data. Hard coded tests are more difficult to 

  maintain. An XML database is the ultimate form, but using a simple tool like 

  XStream can do what you need. Use the XML include directive to share data 

  between sets of test cases.

  Check your test classes with FindBugs. FindBugs will examine the logic, 

  which should be very simple in test classes. Having passed that your test 

  classes can be safely used.

  Use MockObjects or real classes with Proxy interceptors to keep the unit 

  tests at the unit level. This insulates test classes, test data and test 

  running against changes to other parts of the system.

  The test class hierarchy should mimic that of the real code under test, 

  this allows abstract classes to be tested properly.

  For reviewing code use an integrated tool like Jupiter for Eclipse, that 

  stores the review information with the source code.

  Build metrics collection into your test process. Use the extensions to 

  Checkstyle to get some and test to get the others. For example try running a 

  complex test case 1000 times to get an idea of performance, or at the end of 

  the test serialize the object under test and see its size. You can then watch 

  for dramatic changes in metrics.

  Use architectural checks like Macker rules to preserve the architecture 

  standards.

  Use a tool like vDoclet to generate an initial set of test cases and your 

  basic JUnit test class from the interface definition.

Got a question about Java? Fred or Eric will know.

2004-08-20T08:13:00.000+02:00

For a while now I have been asking Eric about Java links. But I have recently discovered that Fred is worthy of note too.

No one would have believed in the last years of the nineteenth century...

2004-08-19T22:55:00.000+02:00

New type of spam warning: The Literary Quote form

In the last few days several emails trying to sell me mortgages have got through my multi tool net, those dirty rats.

For those of you who did not recognise it, the title is from the first lines of H.G.Wells' War of the Worlds. Which my bayesian filter would not have caught, because I live where the book was set, and so quite a number of words in the text appear in my valid emails.

I try and keep track of the variations using the article Spammers Will Always Win. Which will get updated shortly with this one.

Concentrate on the leaks in your Java heap, without springing a leak in your bank account!

2004-08-19T21:21:00.000+02:00

I give the Java Memory Profiler (JMP) a Silver medal, no Gold, no, my mistake, Silver (pending appeal).

It is written in C (herecy!) but for 2 very good reasons, firstly the JVM interface is a native one anyway, and secondly it needs to out perform the JVM to work at all.

The UI is GTK+ based, which means that the Windows version is a bit fiddly to install. And provides a simple uncomplicated interface to controlling the program. There is, however, a way to use it without the UI, presumably for shell based usage.

Feature wise, JMP does the basics. If you work the JVM built in profiler hard then you just about get what JMP gives you out of the box. If you work JMP hard then you can get results that are just as useful as those from a pro tool like JProbe.

The latest version just released contains a call tree display, which is a useful addition, and also improves on the filtering capabilities. JMP provides a very effective way to analyse memory usage and time spent in method calls.

$$ per CPU cycle and better, faster, lighter applications

2004-08-19T09:42:00.000+02:00

Reading about Gmail prompted me to do a rough cost per CPU cycle on some of the systems I have been using.

Using Google as one extreme example. Say it has 100,000 servers that run on average a 1GHz clock, and that the networking overhead is around 10% of cpu cycles. Then imagine that each server costs $100 a year to run (estimated - mostly power consumption, support and investment cost). The creation cost is far higher. You get 9Mhz per dollar per year, or each CPU cycle costs 0.00001111 cents per year. The reason why that figure can be so low is because of the scale of the system, the low initial cost of the units and support cost per unit.

Next lets take my home PC. 1 CPU with a 333Mhz clock. It cost $3000 about 8 years ago which equates to $500 a year (assuming 10 year life and I could have got 6% in the bank). Doing the same calculations you get 666Khz per dollar per year, or 0.00015 cents per cycle per year. I assume my support is free in this case.

How about an upgrade? 1 CPU with a 2.4GHz clock at $1000 equates to around $200 a year. This gives you 12MHz per dollar per year or 0.0000083 cents per cycle per year. Even my wife might be convinced by that one.

Now an example of a lightweight dot com (circa 2000). 10 twin processor 1.8Ghz CPUs. From memory this costed at $2300 per year per server, which comes mostly from support and infrastructure charges. Tap,tap, tap... 1.5MHz per dollar per year or 0.000064 cents per cycle per year.

A development server. 1x8 CPU 800MHz box from a major brand with double gold SLA. This typically comes out at $30000 a year (support is a big earner). Equates to 213KHz per dollar per year, or 0.00047 cents per cycle per year.

Which means that if you spend $1 per year you get (in KHz):
12000 New PC
9000 Google
1500 Dot Com
666 Old PC
213 Dev Server

Take for example a set of programs that you can run. Each one takes a certain percentage of the CPU when in operation and so you can roughly equate that to an 'in use' figure in MHz of cycles required. For example an application that uses 100MHz continuously would cost a new PC user $8 per year to run, Google $11, Dot Com $67, me $150 and a Dev Server $470 a year.

Then take your inhouse application running on your business systems server (not unlike a dev server). In production using classic elephant techniques you might have a 5GHz application. That's $23k per year for your monolithic server or $555 for Google. Using better faster, lighter techniques you might have a 3GHz application with the proportional saving in cost.

When you scale up your platform the costs obviously come down and the cycles per dollar rise. For example having 2 monolithic servers pushes the 100MHz cost down to around $350 per year. So if the 5GHz application became a 10GHz app and you added another server then the delta cost is around $12k. If you were running the lighter version then you could stick with 1 server and the delta cost for doubling requirements would be $14k or if you went for 2 anyway $6k (but don't forget the $100k capital investment).

How about an email spam filter server, something an ISP might consider putting in. Assuming a fast pipe, we are talking about a 20GHz application, costed using the dot com model $13k per year. But what if you used a peer-to-peer architecture for the application, cost at home PC model is $1670 per year. So even if you compensated the PC users for their loss of cycles and even bandwidth it is still cheaper.

To summarize:

Unless you are google then server side processing has to be lighweight.

Client side processing is cheap, therefore peer networks are cheap.

Moore's law will soon make even the time spent to write this blog seem costly.

I must try not to write rambling blogs.

Finding a home for your open source baby

2004-08-19T07:53:00.000+02:00

Assuming you are intending on using Java and a license like LGPL then here are some choices.

SourceForge

Savannah (GNU)

java.net

Codehaus - if you are interesting.

Tigris - if you fit their mission.

Apache Incubator

So what are your requirements from a host?

CVS or similar

Website

Mailing List

Bug Tracking

Membership Management

Automated Build & Test

Download Server

High Visibility

Good Security

Legal Aid

This is a good place to start. No host matches all the requirements, but they are after all free services.
But it comes down to 2 really, sf.net and java.net and by all accounts there is not much to choose between them. java.net sounds more reliable (probably because its is still small), sf.net has slightly better features and visibility.

Configurable Factories and Proxy Injection using XStream

2004-08-17T12:51:00.000+02:00

XStream is a useful lightweight persistence/transport/config xml round-trip library. Here is an example of how to use it for configurable factories.

So you have got your factory pattern in use:


MyObject.java

MyObjectImpl.java

MyObjectFactory.java

[please don't nit pick about the pattern implementation it is not the point of the blog]
You interface class MyObject is implemented by MyObjectImpl and you use the MyObjectFactory class to bind them together.

Here is the basic factory skeleton:


class MyObjectFactory {

    ...

    MyObject getMyObject() {

        MyObject object;

        // whatever creational method is used will contain

        object = createMyObject();

        // and whatever

        return object;

    }

    private MyObject createMyObject() {

        // return new MyObjectImpl();

        ...

    }

}

Next we create a utility class to abstract out the file and XStream handling. This is only a simple implementation, if you do this for real you should consider JNDI, getResourceAsStream and the use of patch directories.


public final class PrototypeFileReader {

    private static final XStream XSTREAM = new XStream();

    public static Object read(Class prototypeClass) {

        try {

            String fileName = prototypeClass.getName() + "-prototype.xml";

            Reader myPrototypeReader = new FileReader(fileName);

            return XSTREAM.fromXML(myPrototypeReader);

        } catch (FileNotFoundException e) {

            e.printStackTrace(); // or whatever

            return null;

        }

    }

}

The factory method then becomes:


    Object created = PrototypeFileReader.read(MyObject.class);

    if (created == null) {

        // throw a runtime exception of your choice

    }

    return created;

And to make it work you create the MyObject-prototype.xml file:


<example.xstream.MyObjectImpl>

  <name>defaultName</name>

  <value>defaultValue</value>

</example.xstream.MyObjectImpl>

And to make that file you would use this little utility:


public class PrototypeOutput {

    private static final XStream XSTREAM = new XStream();

    public static void main(String[] args) {

        String className = args[0];

        try {

            Object object = Class.forName(className).newInstance();

            System.out.println(XSTREAM.toXML(object));

        } catch (Exception e) { // naughty

            e.printStackTrace();

        }

    }

}

Note that XStream will normally leave null fields out of serialized form. See the documentation for more details.

That is how you get the basic version running. The real power comes when you need to change the implementation either temporarily or permanently.

Here are 2 use cases of how you might want to change what the factory produces:

Version 2 needs to use an extended version to support a new feature.

To do this you add the new class to the classpath and change the xml file to be something like:


<example.xstream.MyObjectExtendedImpl>

  <name>defaultName</name>

  <value>defaultValue</value>

  <description>defaultDescription</description>

</example.xstream.MyObjectExtendedImpl>

You need to trace the calls to the methods of the object.

XStream has a DynamicProxyConverter which is very useful for inserting a proxy implementation in the place of your class, as in:
```
<dynamic-proxy>

  <interface>example.xstream.MyObject</interface>

  <handler class="example.xstream.MyInvocationHandler">

    <real class="example.xstream.MyObjectImpl">

      <name>UNKNOWN</name>

      <value>UNKNOWN</value>

    </real>

  </handler>

</dynamic-proxy>
```
This example uses the InvocationHandler implementation MyInvocationHandler which is constructed with the member variable 'real' that is invoked as you trace the call. Other handlers might not need the 'real' implementation and could instead bind to test data or raise exceptions.

Getter-based is the mother of all dependency injection

2004-08-17T10:46:00.000+02:00

A while ago I wrote the blog Containers & their injections, and I have noticed that arguments still rage on the merits of the various types of IoC paradigm.

Using a getter based pattern gives you full control of how to manage your injections. You are then free to map this to any of the various types, even those that use AOP.

So for example you have:


abstract class MyThingy {

    final void doMyThingyThing() {

        ...

        serviceThingy = getMyRequiredServiceThingy();

        ...

    }

    protected abstract ServiceThingy getMyRequiredServiceThingy();

}

Note the lack of a constructor and that it uses the classic getter style. You can use this class directly for getter based injection using AOP, but you can also use constructor and setter based approaches using subclasses.


class MyThingySetter extends MyThingy {

    private ServiceThingy myRequiredServiceThingy;

    protected final ServiceThingy getMyRequiredServiceThingy() {

        return myRequiredServiceThingy;

    }

    final void setMyRequiredServiceThingy(ServiceThingy thingy) {

        myRequiredServiceThingy = thingy;

    }

}

So you can now support getter based and setter based, but the class is not final and so you can subclass to the next step.


final class MyThingyConstructed extends MyThingySetter {

    MyThingyConstructed(ServiceThingy thingy) {

        setMyRequiredServiceThingy(thingy);

    }

}

or even for static relationships


final class MyThingyConstructed extends MyThingy {

    private final ServiceThingy myRequiredServiceThingy;

    protected ServiceThingy getMyRequiredServiceThingy() {

        return myRequiredServiceThingy;

    }

    MyThingyConstructed(ServiceThingy thingy) {

        myRequiredServiceThingy = thingy;

    }

}

A library that implements its service management in such a way, with the three levels of abstraction, is capable of being used in most common types of injection model. It is also capable of being used effectively in a factory pattern for those systems that are not container orientated.

How to set a world record for code reviews using Eclipse plugins.

2004-08-16T14:36:00.000+02:00

Code reviews are boring, but necessary. What gets really boring is reviewing unit tests for correctness too. Code reviews can also get personal and hit team morale as a result. What you need are the tools to take all the nasty note taking, bug explanation, and other tedious parts away and concentrate on the 'does it do what is says on the tin' checks.

The eclipse plugins are:

Jupiter, which organises all the reporting and tracking of defects. It incorporates a good review process.

FindBugs, which uses byte code analysis to notice strange things about the code - and could quite possibly be sufficient for reviewing unit test classes on its own. See this paper for more information.

JDocs, to help you look up the API information you need.

CheckStyle, with all the class design and metrics analysis extras turned on. Use the metrics to target your second glances.

and Dupman will analyse for duplicates, if you are brave enough to tackle the German documentation.

There are a number of other tools that can help, but these cover the same areas as CheckStyle and Dupman do together, so rather than put in a large number of specialised tools you can get away with using the extras of the latest version of checkstyle and a good (free) duplication spotter.

FindBugs is a fantastic concept, it is really a time saver in this case. It finds "problem areas" more than anything else and so does require someone afterwards to look at the code and say something like "hmmm... that could have been embarassing" or "its not actually wrong, but it needs refactoring anyway".

Departmental Eclipse with Ant

2004-08-16T09:08:00.000+02:00

Oleg Shteynbuk has come up with an ant task set that allows you to script the installation and update of eclipse. Update/Install Eclipse with Ant Script, different Update/Install Strategies describes this great piece of work.

I have been working for a number of largeish companies recently and (probably too often) they notice my extensive eclipse experience and ask "can you set up a template/default eclipse for our standard installation?". Installing eclipse as an individual is straightforward, but installing a department wide version is not easy. I now prefer not to do it because it takes a long time to get right, and being an architect I don't really want to spend my time on tools. But Oleg's work might change that.

The alternatives are to use the services that 'sell' tested eclipse installations, like Yoxos, but these still need tailoring to the CM, filesystem and project settings required. You could also use rpms, such as those from jpackage.org, but this would require you to repackage your plugin set.

The key elements of a department wide installation are:

Ease of management.

Tested plugins.

Common settings, e.g. checkstyle settings.

Project information integration.

I will use a current situation to illustrate the problems - moving from eclipse 2 to 3. To do this manually is prohibitively costly where I am at the moment. The update instructions for users is 3 pages of detailed commands that take more that an hour to complete. The number of working plugins has been drastically reduced and the number of minor configuration tweaks required is large. To complicate matters many users have additional plugins and non-standard workspace architectures. Combine that with the length of time developers will spend playing with the new version and you have a cost in man days rather than man hours - so we are sticking with version 2 for the moment.

What this ant task should do is automate the first two parts. Make installation and update a simple matter of releasing updates to the network. A separate installation can be used to test the bleeding edge versions and manage the plugin dependancies. The way the update works should preserve a large number of the configuration settings between versions, but there will always be tweaks required. Eclipse 3's new workspace switching implementation should also make the project integration simpler.

SDK for ASR and TTS from IBM

2004-08-16T07:58:00.000+02:00

On Friday, alphaworks released the Embedded ViaVoice Multi-Application SDK project. This is an SDK for creating applications involving speech recognition (ASR) and text-to-speech (TTS).

There is a subtle shift in this offering and that is that the sound devices are no longer required to be dominated by the speech software. This release's main feature is its ability to share resources between applications.

TTS software has been around for some time now, most free implementations are based on the Festival project.
ASR software is less common, but there is Sphinx-4.

This release from alphaworks is aimed straight at the mobile platform market. You can imagine dictating text messages at the same time as making voice dial calls for example, or having a transcription of all your conversations for that day.

But being aimed at the mobile market will highlight the CPU and memory/storage cost of these applications. This is why IBM have come up with a client server model for these services so that the CPU intensive activity can be centralised, how effective for applications this will be remains to be seen.

GOOG.O - but no dividends

2004-08-13T10:57:00.000+02:00

Google goes IPO in the next few hours. Will Eric, Larry and Sergey become billionaires or will it turn into a Friday 13th nightmare?

I think we all know the answer to that question. I just wish I was eligible to bid, and had the cash to.

If you are eligible beware, the prospectus says:
We do not intend to pay dividends on our common stock

ZetaGrid from alphaworks - J2EE based

2004-08-13T07:50:00.000+02:00

ZetaGrid is a grid computing solution that is based on a standard 3 tier J2EE architecture using a client server model. The name comes from the first project that used/developed it - zeros of the zeta function.

It claims "ZetaGrid is also the first ever specification of simple J2EE interfaces to distribute applications securely and reliably in a cross-platform grid infrastructure" (strange claim?), and communicates "via stateless sessions using HTTP" (EJB?).

A great deal of the project effort seems to have gone into being able to make it work in a real world scenario. The project has been careful to give its participating systems full control of client resource consumption. The system is client driven, so no unusual firewall rules required, and takes into account the connection speeds and network architectures to communicate 'work units' effectively. The server side's big plus is that it functions as a J2EE application on an application server with a database making it easy for sysadmins to get to grips with.