9/29/09

Simple Proxy Server in Java ~ Joey's Scribble's

Simple Proxy Server in Java: "In this post, I am going to show how a simple Proxy server can be designed in Java which will provide the core functionalities of a proxy. From Wikipedia, “a proxy server is a server (a computer system or an application program) that acts as an intermediary for requests from clients seeking resources from other servers.” The proxy server generally has some resources, or has access to some resources and when it receives request from a client, it access the appropriate resource and sends back the response."



(Via Joey's Scribble's.)

Developing A Simple Pluggable Java Application | SolitaryGeek

Developing A Simple Pluggable Java Application: "Most of the applications we use on daily basis are pluggable. Popular applications like Firefox, Eclipse, NetBeans, JEdit, Wordpress, Hudson are all pluggable. In fact, pluggability has played a major part in the success of most of these applications. Why not make the Java applications we develop pluggable as well? Yes, we get pluggability out of the box, if our applications are based on a rich client platform like NetBeans or Eclipse. But for some reasons if you decide not to use those platforms, it doesn’t mean that they should not be pluggable. In this article, we will learn how to write a simple pluggable application that will load it’s plugins dynamically."



(Via SolitaryGeek.)

Monitor home energy with AMEE

Monitor home energy with AMEE: "Electricity is invisible. To understand how people use it, you need to make it visible. This tutorial will show you how easy it is to build a Web-based energy monitoring system yourself, using a Current Cost real-time energy monitor and AMEE, a neutral Web-based API for energy data, combined with some XML, Ruby, Rails, and Ajax."



(Via developerWorks : Linux : Technical library.)

Tech Tip: TCP/IP Access Using bash

Tech Tip: TCP/IP Access Using bash: "


Most of us default to wget, curl, netcat and
others when in need of network data from the commandline,
not knowing, or perhaps forgetting, that bash often provides
the support that we need using redirection from
/dev/proto/host/port."



(Via Linux Journal - The Original Magazine of the Linux Community.)

RESTful SOA with Open Source

RESTful SOA with Open Source: "With the exponential growth of the Web, REST as an architectural
style [REF-1] has found its niche in the modern services landscape with
its popularity poised to grow even further. JAX-RS is a new JCP
specification [REF-2] that provides a Java API for RESTful Web services
over the HTTP protocol. JAX-RS uses annotations on POJOs (Plain Old
Java Objects) to map to the RESTful architectural style of..."



(Via Javalobby Front Page.)

Testing Exceptions in JUnit 4.7

Testing Exceptions in JUnit 4.7: "JUnit 4.7 introduced a few features that make it a little easier to work with exceptions. JUnit 4 introduced the expected parameter, which makes a test succeed if and only if a certain exception is thrown. For example, in the following code sample, we are testing a UserManager class. When the login() function is called, it should throw an UnknownUserException when no user is found."



(Via Javalobby Front Page.)

9/24/09

Sonar to identify security vulnerabilities

Sonar to identify security vulnerabilities: "

During the last few months, Sonar has definitely become the leading Open Source Platform to manage Java code quality. The objective to democratize access to code quality is becoming concrete.


However when analyzing source code, quality is only one aspect of things. The ultimate platform should be able to handle Quality, Security and Architecture. Sonar 2.0 will take care of Architecture with a DSM and several valuable Object Oriented metrics.


What is the plan to handle Security ? Technically speaking, there is no difference between a quality rule and a security rule. They both consist in writing a piece of code that analyzes an Abstract Syntax Tree (AST) or the bytecode depending on what needs to be done.


Sonar already embarks a bunch of security rules that detect security vulnerabilities. What is really missing today in Sonar is the possibility to group rules by security categories. This will be implemented at some point in time with tags associated to each rule. For now and for people concerned by Security, there are two solutions to detect security breaks. First is to use the Security Rules Plugin that highlights files with such breaks. The second one is to look directly at available security rules :


SQL Injection Vulnerability


Read this very well-written page on the OWASP web site, to quickly understand why you should activate the two following Findbugs rules :



  • Nonconstant string passed to execute method on an SQL statement

  • A prepared statement is generated from a nonconstant String


Password Management Vulnerability


Those two other Findbugs rules will create respect for the person who someday invented the word ‘password’



  • Hardcoded constant database password

  • Empty database password


Error Handling and Logging flaws


When there is an airplane crash, the black box is the only way to perfectly understand what happened to be able fix the root cause. A software has its own black box, and the following PMD rules will make it effective :



  • Preserve Stack Trace.

  • Avoid Catching Throwable

  • Exception As Flow Control

  • Avoid Throwing Null Pointer Exception

  • Avoid Print Stack Trace

  • Avoid Using System Println


Insecure direct object reference


Do you feel confident to give the keys of your car to somebody you don’t know ? To avoid this, here are the Findbugs/PMD rules that should get activated :



  • May expose internal representation by returning reference to mutable object

  • May expose internal representation by incorporating reference to mutable object

  • May expose internal static state by storing a mutable object into a static field

  • Public static method may expose internal representation by returning array


And some more…



  • Do Not Call System Exit

  • Servlet reflected cross site scripting vulnerability



Those available rules are a good start to identify security vulnerabilities. If you want to increase the set of existing rule to help Sonar grow on the subject, please create Jira tickets on the ‘Security rule’ component to request for new rules.


"



(Via Sonar.)

InfoQ: Opinion: Pair Programming Is Not For The Masses

InfoQ: Opinion: Pair Programming Is Not For The Masses: "Pair Programming continues to be one of the most debated and controversial practices of recent years. Most proponents don't falter in their praise of the benefits, but many of even these same people will admit they struggle to get pairing really going in their shops. Why? Obie Fernandez opinions 10 reasons why this might be so."



(Via InfoQ.)

InfoQ: Modular Java: What Is It?

InfoQ: Modular Java: What Is It?: "Over the last few years, modularity for Java has been an active discussion topic. From the (now defunct) JSR 277 to the recognition of JSR 291 and the ongoing JSR 294, modularity is seen as a necessary step in Java's evolution. Even future JVM-based languages like Scala are considering modularity. This article, the first in a multi-part series on Modular Java, discusses what modularity means, and why you should care."



(Via InfoQ.)

9/23/09

InfoQ: Encrypting the Internet

InfoQ: Encrypting the Internet: "The evolution of the Internet has resulted in large quantities of information being exchanged by businesses or private individuals. The nature of this information is typically both public and private, and much of it is transmitted over the hyper text transfer protocol (HTTP) in an insecure manner. A small amount of traffic, however, is transmitted by way of the secure sockets layer (SSL) over HTTP, known as HTTPS. HTTPS is a secure cryptographic protocol that provides encryption and message authentication over HTTP. The introduction of SSL over HTTP significantly increases the cost of processing traffic for service providers, as it sometimes requires an investment in expensive end-point acceleration devices. In this article, we present new technologies and results that show the economy of using general-purpose hardware for high-volume HTTPS traffic. Our solution is three pronged. First, we discuss new CPU instructions and show how to use them to significantly accelerate basic cryptographic operations, including symmetric encryption and message authentication. Second, we present results from a novel software implementation of the RSA algorithm that accelerates another compute-intensive part of the HTTPS protocol—public key encryption. Third, we show that the efficiency of a web server can be improved by balancing the web server workload with the public key cryptographic workload on a processor that is enabled with simultaneous multi-threading (SMT) technology. In conclusion, we show that these advances provide web services the tools to greatly reduce the cost of implementing HTTPS for all their HTTP traffic."



(Via InfoQ .)

9/15/09

Improve Application Responsiveness With Terracotta for Hibernate

Improve Application Responsiveness With Terracotta for Hibernate: "Terracotta released version 3.1 today, which includes Terracotta for Hibernate, a plug-in distributed cache for the Hibernate frame. Along with last months acquisition of EhCache, this continues Terracotta's moves to become the definitive solution for scalable Java applications. Including the Hibernate plug-in is bound to increase the usefulness and relevance of Terracotta across the Java..."



(Via Javalobby Front Page.)

JPA Implementation Patterns: Mapping Inheritance Hierarchies

JPA Implementation Patterns: Mapping Inheritance Hierarchies: "This week I will dwell on the choices offered when mapping inheritance hierarchies in JPA. JPA provides three ways to map Java inheritance hierarchies to database tables:

InheritanceType.SINGLE_TABLE - The whole inheritance hierarchy is mapped to one table.


James Sugrue"



(Via Javalobby Front Page.)

9/11/09

11/9, ottavo anniversario

11/9, ottavo anniversario: "

Per non dimenticare


Otto anni fa, 343 dei colleghi di questi vigili del fuoco persero la vita nel tentativo di salvare le persone intrappolate nelle Torri Gemelle di New York, colpite dall'attentato più sanguinoso della storia contemporanea: quattro aerei dirottati e usati come missili umani.

Otto anni. Vuol dire che c'è una generazione di giovani adulti che all'epoca non poteva rendersi conto di cosa significò quell'attentato, insieme a quello simultaneo contro il Pentagono e quello fallito grazie alla ribellione dei passeggeri e probabilmente destinato a colpire la Casa Bianca o il Campidoglio. L'11 settembre 2001 sta ormai diventando un episodio storico, epocale ma psicologicamente remoto e irreale, quanto il crollo del Muro di Berlino o il disastro di Chernobyl.

Per non dimenticare, o per conoscere quel martedì mattina di settembre che cambiò il mondo, consiglio di scaricare il monumentale, documentatissimo libro digitale Crono911, che spiega in italiano tutta la vicenda con la ricchezza che soltanto otto anni di indagini, montagne di documenti prima segretati e una ricerca meticolosa possono consentire.

Per gli ottusi che ancora credono alle favolette dei complottisti, segnalo la foto qui sopra: mostra i vigili del fuoco di New York che, impotenti e distrutti, aspettano che crolli il WTC7, la 'terza torre', quella che secondo i complottisti fu minata di nascosto. A dimostrazione che il crollo non fu né inatteso né straordinario, se non nella mente di chi non sa nulla d'incendi e di chi vuole fare soldi sulle sciagure e sull'ingenuità del prossimo.
"



(Via Il Disinformatico.)

Alan Turing, governo GB chiede scusa

Alan Turing, governo GB chiede scusa: "

Governo britannico: sorry, mister Turing


Con soli cinquantasette anni di ritardo, il governo del Regno Unito ha chiesto ufficialmente scusa per il trattamento che inflisse nel 1952 a uno dei suoi più brillanti matematici: Alan Turing, l'uomo che aveva decifrato i codici segreti nazisti, cambiando le sorti della Seconda Guerra Mondiale, e aveva nel contempo gettato le basi dell'informatica moderna.

E' sua quella che poi prese il nome di macchina di Turing: un concetto astratto che dimostrò nel 1936 che una macchina semplice era in grado di effettuare qualunque calcolo matematico, anche il più complesso, purché rappresentabile come procedura (algoritmo) e che quindi si poteva immaginare un 'calcolatore' artificiale programmabile. In sostanza, non importa quale computer, telefonino o altro apparecchio elettronico stiate usando: sotto sotto, se contiene un sistema operativo o un programma, state usando una macchina di Turing.

E' suo il test di Turing: un metodo per determinare se una macchina è intelligente o no, ossia se 'pensa'. Alan Turing si poneva già domande di questo calibro nel 1950, quando il suo articolo intitolato Computing Machinery and Intelligence smontò tutti i preconcetti dell'epoca e dimostrò che era concepibile che un giorno si potesse arrivare a un'intelligenza artificiale indistinguibile da quella umana, liquidando il mito dell'unicità e della superiorità dell'intelletto umano. Considerato lo stato della tecnologia informatica dell'epoca, è come se un biologo avesse scoperto il funzionamento dei neuroni di una mosca e avesse intuito e dimostrato che tanti neuroni messi insieme potevano produrre la Nona di Beethoven.

Il test di Turing è un esperimento nel quale un essere umano deve decidere se le risposte che gli arrivano tramite telescrivente sono prodotte da un altro essere umano o da una macchina: se non azzecca, la macchina è da considerare a tutti gli effetti intelligente. Finora nessuna macchina ha superato il test, ma gli esperimenti proseguono tramite iniziative come il Premio Loebner.

Ed è sua gran parte del lavoro top secret di crittanalisi che permise ai britannici di decifrare i codici cifrati militari tedeschi, quelli basati su macchine come Enigma. Insieme al matematico Gordo Weichman, Turing progettò un dispositivo elettromeccanico, chiamato in inglese bombe, che automatizzava i tentativi di decifrazione e fu fondamentale nel consentire la lettura in tempo quasi reale dei messaggi segreti del nemico. Questa conoscenza delle comunicazioni naziste permise di alterare drasticamente il corso della Seconda Guerra Mondiale, salvando un numero incalcolabile di vite. La natura del suo lavoro militare fu così segreta che l'alta onorificenza che gli fu conferita nel 1945, l'Order of the British Empire, aveva la laconica motivazione 'per servizi resi al Foreign Office'.

Ma allora perché il governo britannico ha pubblicato ieri le proprie scuse formali ad Alan Turing sul sito ufficiale del primo ministro, Number10.gov.uk? Perché nel 1952, mentre stava lavorando allo sviluppo dei primi computer moderni, fu processato per il reato di omosessualità, o gross indecency (oscena indecenza) nell'eufemistico gergo legalese dell'epoca, esattamente come era successo a Oscar Wilde più di cinquant'anni prima. Qualunque atto omosessuale era illegale nel Regno Unito di allora, e a Turing fu data la scelta fra il carcere e la 'cura' tramite castrazione chimica. Scelse la seconda opzione e fu sottoposto a iniezioni di estrogeni talmente forti da fargli crescere il seno.

La condanna portò alla revoca di tutti i suoi privilegi di sicurezza, rendendogli impossibile lavorare significativamente nel campo in cui eccelleva. Nel 1954 fu trovato morto, avvelenato dal cianuro probabilmente contenuto in una mela morsicata trovata accanto al suo letto, come la protagonista di Biancaneve, che era la sua fiaba preferita. La morte fu archiviata come suicidio Alan Turing aveva solo 41 anni.

Le scuse del governo britannico non sono arrivate spontaneamente: sono il risultato di una petizione, avviata dal programmatore britannico John Graham-Cumming, che in pochi mesi ha raccolto migliaia di adesioni prestigiose. Da qui la scelta del primo ministro Gordon Brown di porgere le scuse ufficiali per il trattamento 'raccapricciante' (come lo definisce Brown) al quale fu sottoposto.

'Per quelli fra noi che sono nati dopo il 1945, in un'Europa unita, democratica e in pace, è difficile immaginare che il nostro continente fu un tempo teatro del momento più buio dell'umanità. E' difficile credere che in tempi ancora alla portata della memoria di chi è ancora vivo oggi, la gente potesse essere così consumata dall'odio – dall'antisemitismo, dall'omofobia, dalla xenofobia e da altri pregiudizi assassini – da far sì che le camere a gas e i crematori diventassero parte del paesaggio europeo tanto quanto le gallerie d'arte e le università e le sale da concerto che avevano contraddistinto la civiltà europea per secoli,' scrive il primo ministro.

E' davvero difficile da immaginare. Forse Alan Turing avrebbe dovuto porsi un altro quesito nella propria ricerca: anziché chiedersi se esista l'intelligenza artificiale, domandarsi se ve ne sia a sufficienza di quella naturale.
"



(Via Il Disinformatico.)

9/10/09

Tech Tip: Port Forwarding in Virtualbox with VBoxManage

Tech Tip: Port Forwarding in Virtualbox with VBoxManage: "


VirtualBox is a free, powerful and versatile
virtualization program which is available for Linux, Mac, and Windows hosts,
and can virtualize many different Operating Systems. VirtualBox was
originally developed by Innotek, but was purchased by Sun and renamed Sun
xVM VirtualBox."



(Via Linux Journal - The Original Magazine of the Linux Community.)

9/9/09

JPA Implementation Patterns: Field Access vs. Property Access

JPA Implementation Patterns: Field Access vs. Property Access: "I will continue the JPA implementation patterns series by discussing the relative merits of field access vs. property access.
The JPA specification allows two ways for the persistence provider
to access the persistent state of an entity. The persistence provider
can either invoke JavaBeans style property accessors (getters and
setters) or access the instance fields of the entity directly...."



(Via Javalobby Front Page.)

Introducing Apache Mahout

Introducing Apache Mahout: "Once the exclusive domain of academics and corporations with large research budgets, intelligent applications that learn from data and user input are becoming more common. The need for machine-learning techniques like clustering, collaborative filtering, and categorization has never been greater, be it for finding commonalities among large groups of people or automatically tagging large volumes of Web content. The Apache Mahout project aims to make building intelligent applications easier and faster. Mahout co-founder Grant Ingersoll introduces the basic concepts of machine learning and then demonstrates how to use Mahout to cluster documents, make recommendations, and organize content."



(Via IBM developerWorks.)

9/2/09

Thanks for the memory

Thanks for the memory: "Running out of Java™ heap isn't the only cause of a java.lang.OutOfMemoryError. If native memory runs out, OutOfMemoryErrors that your normal debugging techniques won't be able to solve can occur. This article explains what native memory is, how the Java runtime uses it, what running out of it looks like, and how to debug a native OutOfMemoryError on Windows® and Linux®. A companion article covers the same topics for AIX® systems."



(Via IBM developerWorks.)

The rsync family

The rsync family: "Summary: Synchronizing two machines (such as a laptop and a desktop computer) is easier and faster when you use rsync, which boasts an efficient algorithm and options for just about everything you might need. And if a command-line operation isn't your thing, several graphic tools make using rsync easier still."



(Via IBM developerWorks.)

9/1/09

Top 10 tips for writing successful Software as a Service

Top 10 tips for writing successful Software as a Service: "Discover 10 essential tips for creating Software as a Service (SaaS) applications
that come in on time and under budget, yielding a positive and preferable return on
investment."



(Via developerWorks : Open source : Technical library.)

Application Logging: What, When, How | Javalobby

Application Logging: What, When, How: "Logging is a fundamental part of applications. Every application has a varying flavor of logging mechanism. A well designed logging system is a huge utility for system administrators and developers, especially the support team. Logs save many valuable hours for both the support team or developers. As users execute programs at the front end, the system invisibly builds a vault of event information (log entries) for system administrators and the support team."



(Via Javalobby .)

What is Data Mining? | E-Commerce Center

What is Data Mining?: "Generally, data mining (sometimes called data or knowledge discovery) is the process of analyzing data from different perspectives and summarizing it into useful information – information that can be used to increase revenue, cuts costs, or both. Data mining software is one of a number of analytical tools for analyzing data. It allows users to analyze data from many different dimensions or angles, categorize it, and summarize the relationships identified. Technically, data mining is the process of finding correlations or patterns among dozens of fields in large relational databases."


(Via E-Commerce Center.)

Java Performance Tuning, Profiling, and Memory Management | Javalobby

Java Performance Tuning, Profiling, and Memory Management: "Java application performance is an abstract word until you face its real implications. It may vary depending on your interpretation of the word 'performance'. This article is meant to give the developer a perspective of the various aspects of the JVM internals, the controls and switches that can be altered to optimal effects that suit your application. There is no single size that can fits all."



(Via Javalobby.)

Sonar for code quality «

Sonar for code quality: "Sonar is a tool to analyze and visualize code quality in Java projects. It isn’t a static code analysis tool itself, rather it uses a number of open source tools to analyze the code, then Sonar gathers the metrics. Its strength is in providing a dashboard, trend reports, and drill downs to help visualize the state of a software project’s code quality."



(Via Coveros.)

JPA Implementation Patterns: Using UUIDs as Primary Keys

JPA Implementation Patterns: Using UUIDs as Primary Keys: "The default way in JPA for primary keys is to use the @GeneratedValue annotation with the strategy attribute set to one of AUTO, IDENTITY, SEQUENCE, or James Sugrue"



(Via Javalobby Front Page.)

Anatomy of the Linux virtual file system switch

Anatomy of the Linux virtual file system switch: "Linux is the very definition of flexibility and extensibility. Take the
virtual file system switch (VFS). You can create file systems on a variety of
devices, from traditional disk, USB flash drives, memory, and other storage
devices. You can even embed a file system within the context of another file system.
Discover what makes the VFS so powerful, and learn its major
interfaces and processes."



(Via developerWorks : Linux : Technical library.)

Learn Linux, 101: The Linux command line

Learn Linux, 101: The Linux command line: "GUIs are fine, but to unlock the real power of Linux, there's no
substitute for the command line. In this article, Ian Shields introduces
you to some of the major features of the bash shell, with an emphasis on the features that are
important for LPI certification. By the end of this article, you will
be comfortable using basic Linux commands like echo and exit,
setting environment variables, and gathering system information.
[The first two notes following Listing 8 have been updated to correct the process IDs
(PIDs). -Ed.]"



(Via developerWorks : Linux : Technical library.)

Learn Linux, 101: Text streams and filters

Learn Linux, 101: Text streams and filters: "There's a lot more to text manipulation than cut and paste,
particularly when you aren't using a GUI. Study for the Linux Professional
Institute Certification (LPIC) 101 exam, or learn
for fun. In this article, Ian Shields introduces you to text manipulation on
Linux using filters from the GNU textutils package. By the end of this
article, you will be manipulating text like an expert."



(Via developerWorks : Linux : Technical library.)

Learn Linux, 101: A roadmap for LPIC-1

Learn Linux, 101: A roadmap for LPIC-1: "Use this roadmap to find IBM developerWorks articles that will help you
learn and review
basic Linux tasks. And if you're also pursuing professional certification as
a Linux system administrator,
these articles can help you study for the Linux
Professional Institute Certification (LPIC) exam 101 and exam 102.
This roadmap is organized according to the
43 objectives in the 101 and 102 exams, which you are required to pass for
LPI level 1 certification."



(Via developerWorks : Linux : Technical library.)