Best of this Week Summary 19 April - 25 April 2010

• An introduction to Gizzard, an open sourced sharding framework (store data across multiple computers instead of on just one) which is used by Twitter.
  


• A hands-on tutorial of creating a Spring application that uses Hibernate as JPA provider and JTA for transaction demarcation. A simple Order Processing Message Driven Bean is implemented that showcases this integration. It is deployed on a WebLogic 10.3 server.
  


• Last week Jira from the Apache Foundation was compromised. Here's a description of how the hackers gained access via XSS.
  

Best of this Week Summary 06 April - 12 April 2009

• Big news this week was of course that Google App Engine now also supports Java, though still in closed beta. Other reports of this news can be found here, here, and this summary from the related Campfire '09. A nice two pager overview can be found here. Also immediately available is an Eclipse plugin. Groovy is supported too btw.
  
  Note that the Java 1.6 support is not (yet?) 100%:
  
  
  • It hasn't passed Sun's Java certification tests
  
  
  • Over 7 items of what's not supported are listed here.
  
  
  • 9 mostly similar are listed here.
  
  Here's a runthrough of getting a Wicket Hello World example running on GAE.
  


• Google also tries to introduce a new standard to easily take your contacts with you to other sites: Portable Contacts. It's used in combination with OAuth.
  


• Interesting, this opensource XSS bookmarklet (thus javascript) scans for potential XSS problems.
  
• 
  
• Talking about scanners and security, here's a free HP Flash .swf scanner that decompiles it and searches for well known leaks.
  


• Great survey results on Javascript/RIA frameworks. Questions surveyed were: which frameworks do you use the most, quality on documentation and community support, performance, ease of implementation, popularity, and 3rd party plugins quality.
  

Best of this Week Summary 06 October - 12 October 2008

• One of the many nice editions of The A-Z of Programming Languages series, this time on C#. Yes, yes, that word is not supposed to be on this blog, but this article is still interesting if you're into programming languages. For example the challenges when designing a language. Check also the other editions, for example about: AWK, Forth, Modula-3, Python and Javascript.
  


• An Amazon S3 introduction/beginners guide for setting up hosting of images.
  


• Four cases of CSRF attacks desribed, including one were it was possible to transfer money from a bank account! Check also the mentioned paper on how to prevent them: Cross-Site Request Forgeries: Exploitation and Prevention. The paper explains how to prevent CSRF in your web-application/frameworks: don't let a GET modify anything and pass a random number in the cookie and each form POST. It also describes XSS and the same-origine policy.
  

Best of this Week Summary 22 September - 28 September 2008

• 10 aspects of web 2.0 strategies that a CTO and CIO should know about.
  


• AJAX security fundamentals. With XSS, CSRF and securing JSON.
  


• Recently started foundation by Tim Berners-Lee (inventor of the web). Its goal is to study the web and how to make it more accessible.
  


• Short overview of forms of API authentication: keys, username/password, digest and tokens. I'm missing oAuth in the examples mentioned.
  


• From March 2008: short overview of the status of web frameworks and their marketshare: Spring MVC, GWT, Struts 2, JSF, Flex, OpenLaszlo. Also mentions AppFuse as starting point for building a web application.
  


• One of many architecture and design diagrams for an application built on Struts2, Spring, Hibernate and ExtJS. Could be a good starting/reference point.
  

Best of this Week Summary 21 January - 27 January 2008

• Nice routing pattern for webservices that need to provide both synchronous and a-synchronous calls. You can even make the router such that depending on certain criteria (like load, response time), it will either turn the call into an a-synchronous call when needed. Disadavantage of this approach is of course that the caller has to be able to support both an a-synchronous and a synchronous version of each call. Related patterns you can find in these seven Self-Service: select application patterns.
  


• An effort to give answer to the question whether Tomcat is an application server or not. GREAT introduction to JEE btw, so good read for beginners or as a refresher. The answer: Tomcat does not support the entire Java EE stack: no distributed transactions, EJBs, and JMS.
  


• IBM made their Jazz tool available for the public. It can be used to "build a scalable, extensible team collaboration platform for integrating work across the phases of the development lifecycle." Note that it is not fully opensource yet. There's also a Mylyn connector available for Jazz.
  


• Version 3.0.0 of HTML Purifier has been released. It will scan your HTML for malicious XSS code, check for compliance and will try to fix your code.
  


• Summary of a statement made by Bruce Eckel in this article that Java should not change much anymore: it should stop growing and just become stable, and Sun should focus on optimizing/extending the JVM. Interesting considerations.
  


• And finally for this week, for the developers among us, a bunch of shortcut keys in Eclipse you might not know about.
  


• The Open Source hardening Project of the US Homeland Security department together with Coverity has led to the milestone where in 11 opensource projects all main bugs have been fixed. These 11 have been moved up to the new level Rung 2. Here you can see all the results of the scan.