Best of this Week Summary 29 December - 11 January 2009

• Interesting comparison whether and when to use SOAP or REST.
  


• OpenSocial now has Java, PHP, Ruby and Python client libraries available.
  


• A few weeks ago, PKI which uses MD5 as cryptographic hash function, has now officially been broken at the hackers convention Chaos Communication Congress 2008. Six Certificate Authorities still give out MD5-signed certificates as mentioned in the article. Since 2004 it is already known that MD5-collisions can be created for different data. Therefore, certificates should be issued with at least SHA-1 encryption. Here's a summary of what an MD5 collision is and what Mozilla and Microsoft issued as advisories. Additionally some (other) SSL issues are described.
  


• Nice summary of lessons learned during a project using GWT, Axis and JPA. Some more comments here.
  


• Paper by Kate McKinley (a researcher at iSec Partners, a San Francisco security firm) on the privacy protection mechanisms of FireFox, Chrome, IE and Safari. Conclusion: "We find current browsers are unable to extend tracking protection to third party plug-ins such as Google Gears and Adobe Flash. Some of these require no user prompting under common configurations and even expose tracking data saved with one browser sites visited by a different browser. [...] Safari on Windows fared the worst of all in these tests with respect to private browsing, and did not clear any data at all, either before entering or after exiting the private mode. On OS X, Safari’s behavior was quirky; in no case was the HTML 5 database storage cleared before or after private browsing.".
  

My clients are getting thicker and thicker: MVC implementation shift

Last week I stumbled over this interesting article on the potentially changing Model View Controller architecture implementations. (Sidenote: here's the more subtle distinction between MVC1 and MVC2 described. And here's an article on the ambiguity of the term and pattern MVC.)
An example logical diagram of MVC2 is shown below:


For quite some years, the general practice was to generate HTML as result of the View, with the browser rendering it and being the thin web client. These days though, more and more the web client is getting heavier ("fatter") because of all the Javascript being used for AJAX, SPI and, in general, more logic on the web client.
The article takes a look at the different approaches to MVC implementations:

1. the HTML-only approach;


2. the HTML+Javascript "basic" approach; some of the Model's "business logic" is duplicated on the client;


3. the "AJAX" approach; partial views can be updated, the view consists of multiple HTML fragments, Javascript creates the View, not the application server;


4. and the full-blown Javascript-only ("a la gmail") approach; Javascript in the browser creates the views, near-complete responsibility for the Model business rules in the web client (browser), the web client would be the Controller.

The approaches range from, at the one extreme end, the definitive "thin client", and at the other extreme end, the definitive "thick client"." Example frameworks that can easily facilitate the last option are Google Web Toolkit (Java to Javascript) and Pyjamas (Python to Javascript). Below GWT's architecture diagram is displayed. Note the (relatively) limited application server procedures, part of the Model, preferably only performing basic validation, security, etc.


The new MVC2 diagram for the above mentioned fourth approach would look something like this:

Included in the article is also how you could split up work in a team between people working on the View and Model parts.

I do not completely agree with the statement in the beginning of the article that says "The Web client takes care of keystrokes and mouse movements: the Web browser application itself is the Controller". I'm reading this as: the browser is the controller. Though, when you look at the first picture, that is not what the Controller is supposed to be.
But, in general the whole potential movement of going to thick clients is an interesting one to keep an eye on.
Other pros for thicker Javascript-based clients (not mentioned in the article) are:

• Easier distribution of new versions than in the old days with fat clients like Visual Basic, where you had to make sure all clients got updated;


• Easy opening up of your SOA webservices. The fat client could directly access them;


• Easier mashup possibilities at the View layer via Javascript;


• Potentially a large improvement in scalability: the client processing power is used as much as possible, the application server only performs several basic checks;


• The Javascript generator/builder takes care of browser compatability.

Several cons are though:

• Potentially quite significant longer page loading times when the Javascript all has to be loaded at once;


• If not designed correctly, there could be significant extra network traffic;


• Being dependent on the Javascript generator/builder when a browser is (not anymore) supported (though an opensource framework allows you to build it yourself if really needed).

Best of this Week Summary 16 December - 28 December 2008

• Great insight on Second Life's architecture. For example: "A physical server (1 CPU) is responsible for about 16 acres of land and it is connected to neighboring ones which are each responsible for another 16 acres. The server is responsible for the objects existing in its area, the scripts running, the users logged in and standing in its area". Presentation is one hour in total.
  


• There's more to REST than meets the eye. And many REST APIs are not really as REST as Roy Fielding defines it. Media type design is an important item that was not in his original REST dissertation. Some interpretation of what Roy actually means can be found here.
  


• JanRain (known for their OpenID libraries) have created a nice widget named RPX that allows you to integrate authentication within your existing site in an easy and user-intuitive way. I really like the clear, easy and non-intrusive way the possibilities are shown. For real novice users the redirecting to and from the authenticating sites might still be a little bit confusing though. Supported protocols are: OpenID 1.x/2.0, Facebook Connect, MySpaceID and Google. Below is a screenshot of what the registration part looks like:
  
  A couple of example sites where this is already implemented can be found here. And some more on the possibilities here.
  Note that from the technical overview you can see that the RPX server sits in between. That is the only disadvantage of this solution: that you are dependent on an intermediate server.
  


• The W3 Consortium has released a webpage mobile-friendliness checker. The tests it performs can be found at the mobileOK Basic Tests 1.0 specification. Other validators you might know from them are the feed validator, XML Schema Validator, CSS validator or Markup validator. Running these very succesful services without any advertising is costing a lot of money. Therefore you can now donate here for support. If you compute how much time those validators have saved you, donating any small percentage of that will already help W3C keep these validators running.
  

Best of this Week Summary 15 December - 21 December 2008

• A nice and simple logical diagram of the "open stack" for the social web and how the different technologies relate, including OpenID and oAuth.
  
  
• Mostly quite valid points of criticism on the currently available Java persistence frameworks. Some more comments on the article on TSS.
  


• A bit off-track interview with Bjarne Stroustrup (designer of C++) on educating software developers and the fact that companies are complaining about the lack of skills of current computer science university graduates. Especially in the area of writing maintanable code.
  


• Google just released the free Browser Security Handbook whitepaper, which is "meant to provide web application developers, browser engineers, and information security researchers with a one-stop reference to key security properties of contemporary web browsers".
  


• Awesome, unit testing for Javascript with FireUnit is now available, a Firebug/Firefox extension.
  

Best of this Week Summary 8 December - 14 December 2008

• Spring's Web Flow 2 now lets you use JSF as view technology. It addresses a couple of the existing JSF issues and already some features only present in JSF 2.0.
  


• Microsoft (yes yes, don't stop reading immediately ;-) has published a How-To Design Using Agile Architecture guide which "will help you start the process of designing your application. It discusses the six main steps you should follow, and then discusses the issues involved in making logical choices. It also provides checklists to help you ensure that the proposed design will meet your requirements", including patterns, best practices and agile considerations. This is a quick summary of the guide.
  


• A tiny bit off-track, but still interesting to point out: of course you know Google's GWT, in which you can create a Javascript web front-end application in Java. But now this is also possible in Python (recently releasing version 3) with Pyamas! Pretty cool!
  


• Talking about software architecture, how would you document that correctly? Here's a bunch of good tips trying to answer that. It is a good high-level overview of what you should document in an application architecture. Focus is on UML 2.0, but what should be in the documentation is valid for any notation format.
  


• Here's the first list (and maybe last :-) I'll post on looking back @ 2008: on overview of what happened with Java in 2008.
  

Best of this Week Summary 1 December - 7 November 2008

• Post from UI expert Jakob Nielsen on what to think about regarding user interaction and usability when using an Agile methodology (like Scrum).
  


• This week, Sun released version 1.0 of JavaFX, their RIA platform. Too late or just in time? The competion Smooth animation demo here. Quite some reactions here.
  


• These days you see quite some integration happening with Flex at the front-end and Java at the back-end of a web applications. There are a couple of things to consider whether you might want to choose Flex or not.
  


• Tips to help you pass the SCBCD (Sun Certified Business Component Developer) exam.
  

Best of this Week Summary 17 November - 30 November 2008

• Interesting recent long discussion (with a bit of framework flame-war in between) and tips on when to pick what web client framework. Tapestry, Wicket, Stripes, GWT, Flex seem to jump out.
  


• Interesting Javascript optimizer: Razor Optimizer. It dynamically analyzes the runtime profile information, trying to load each Javascript function only when needed, potentially creating 60-90% savings. It does require a client and server component. The question is: are you prepared to take a (small?) risk that your Javascript is dynamically modified?
  


• Good article that explains why Scrum often fails as implementation of Agile. Lots of times Scrum is only seen as fast Sprints and Scrums. But: "Don't leave out the 'regular' agile good engineering practices". Check also the comments for good tips.
  


• A good introduction to RESTful webservices.
  


• Great, soapUI 2.5 now also suppports testing RESTful webservices. It includes testing JSON output.
  

JSFUnit static analysis unit testing in ADF

Introduction
Currently I'm working on the framework design of an ADF application in JDeveloper 11.1.1.0.0 (yes sometimes a man's got to do what a man's got to do ;-). One of the parts is how we are going to do (unit) testing. And one of elements in there is testing the JSF part of the ADF application. Application Developer Framework consists of several layers where the View layer consists of a JSF implementation. This JSF implementation is named ADF Faces (RichFaces) and built on top of Trinidad, the open source JSF components implementation. ADF Faces has many components Ajax-ized and has more components than Trinidad.
My eye caught JSFUnit, an open source project from JBoss. I was only able to focus on the static analysis part JSFUnit offers (it offers also other dynamic "regular unit" tests). But little information was found about that. I couldn't find any installation tips for ADF (JBoss here and here, and Websphere setup tips were available).
Thus it was just me and the computer. Here's the steps that in the end did do the job (running on Windows XP).

Setup
A couple of things are needed for all types of static analysis.

1. Download via JSFUnit Getting Started under the section “Files”: jboss-jsfunit-core-1.0.0.Beta3.jar en jboss-jsfunit-analysis-1.0.0.Beta3.jar
   


2. Note that it was not necessary to download/install myfaces-api-1.2.0.jar or JSF 1.2 API.
   


3. Start JDeveloper 11.1.1.0.0 and open an ADF application with Model and ViewController project.
   


4. Right-click the ViewController project, select Properties and select Libraries and Classpath in the popup. Add the above downloaded jars there.
   

Three types of static tests are possible with JSFUnit. I'll describe setting up each type seperately. Most information was deducted from this part of the JSFUnit documentation.

Configuration static analysis
These tests test your JSF configuration. See the above mentioned documentation part for examples of what tests are performed.

1. Create a JUnit testclass in your ViewController project. Modify it such that it matches this example class:
   
   

   package test.com.project; import java.io.File; import java.util.HashSet; import java.util.Set; import org.jboss.jsfunit.analysis.AbstractFacesConfigTestCase; public class JSFUnitStaticAnalysisConfigTest extends AbstractFacesConfigTestCase { private static Set paths = new HashSet() {{ // Example absolute path: add("C:/work/workspace/jsf-unit/src/faces-config.xml"); // Relative path example below. add("public_html\\WEB-INF\\faces-config.xml"); }}; public JSFUnitStaticAnalysisConfigTest() { super(paths); } }

   
   
   Note the paths variable which points to the faces-config file to validate. Relative paths work too. Of course might not be valid in your test/production environment.
   
   Tip: notice for easier separation at deployment, I put the test class in a separate package, starting with "test.".
   


2. And you're set: run the test. Of course you should see a green bar. If not, your config is probably not 100% ok (probably because what if a JSFUnit test is incorrect... Of course you then immediately contribute to the JSFUnit community project :-). I had for example several Serialization errors.
   
   Below is a screenshot with the result of running the config testcase:
   
   
   

TLD analysis
These tests test your TLDs. See the above mentioned documentation part for examples of what tests are performed.

1. Add the dependent libraries mentioned here, at the bottom of the page: maven-taglib and commons-logging. For the commons-logging you can use the one provided by JDeveloper: Commons Logging 1.0.4. The third one, jsp-api-2.1.jar does not seem to be necessary in the ADF project.
   


2. Create a JUnit testclass in the ViewController project with .tld files. Modify it such that it matches this example class:
   
   

   package test.com.project; import java.util.HashSet; import java.util.Set; import org.jboss.jsfunit.analysis.AbstractTldTestCase; import static org.junit.Assert.*; public class JSFUnitStaticAnalysisTLDTest extends AbstractTldTestCase { private static Set paths = new HashSet() {{ // Example: add("C:/work/workspace/jsf-unit/src/demo.tld"); add("C:\\myprojects\\app\\src\\META-INF\\myjsf.tld"); }}; public JSFUnitStaticAnalysisTLDTest() { super(paths); } }

   
   
   Note the paths variable which points to the .tld to validate. Did not try if a relative path also works.
   


3. And you're set: run the test. Of course you should see a green bar. If not, your .tld is probably not 100% ok.
   
   Below is a screenshot with the result of running the TLD testcase:
   
   
   

View static analysis
These tests test your JSF views. See the above mentioned documentation part for examples of what tests are performed.

1. No extra libs are needed, so we can immediately create a JUnit testclass in the ViewController project. Modify it such that it matches this example class:
   
   

   package test.com.project; import java.io.File; import java.util.HashSet; import java.util.Set; import org.jboss.jsfunit.analysis.AbstractFacesConfigTestCase; import org.jboss.jsfunit.analysis.AbstractViewTestCase; public class JSFUnitStaticAnalysisViewTest extends AbstractViewTestCase { private static Set absoluteViewPaths = new HashSet() {{ // Example: add("C:/work/project/src/home.xhtml"); add("C:\\myprojects\\app\\mysite\\ViewController\\public_html\\detailsPage.jspx"); }}; private static Set recursiveViewPaths = new HashSet() {{ // Example: add("C:/work/project/src/views"); add("C:\\myprojects\\app\\mysite\\ViewController\\public_html"); }}; public JSFUnitStaticAnalysisViewTest() { super(absoluteViewPaths, recursiveViewPaths, "public_html\\WEB-INF\\faces-config.xml"); } }

   
   
   Note the paths variables. Nowhere I could find what they exactly mean. The above runs a test that passes, so I assume the paths are set correctly...
   


2. And you're set: run the test. Of course you should see a green bar. If not, your view is probably not 100% ok.
   
   Below is a screenshot with the result of running the view testcase:
   
   

Conclusion
So that's it. Not hard at all! If you want to know a bit more high level stuff about JSFUnit, check this presentation by the project lead at the Javapolis conference (currently rebranded to Devox conference). And here's another introduction presentation.

The Shale Test Framework could be an interesting alternative for unittesting JSF. Needs some more investigation...

Best of this Week Summary 04 November - 16 November 2008

• Part 2 in a series on server load architectures: application-level load balancing, including client-stickiness.
  


• How to write maintainable CSS; a presentation by Natalie Downe.
  


• ProgrammableWeb is tracking APIs and has now reached the 1000 milestone. In the pie charts you can see the top 15 categories and which protocols they use: 63% of the APIs uses REST! 22% SOAP. The protocols diagram is shown below:
  
  


• Here's some more details on why Google forked OpenID. See my related post of two weeks ago.
  


• A presentation with the current state (it's growing big time!) of OpenSocial shown at OpenSocial's first birthday at MySpace's headquarters.
  


• I'm currently trying out Wicket with Spring and Hibernate, using AppFuse Light as a starting point. In case you're looking for an introduction to Wicket, check out this one that has been around for a while, and this new one that's been posted this week.
  

Best of this Week Summary 03 November - 09 November 2008

• Three reasons why you could switch from Subversion to Git (distributed source code management tool, created by Linux Torvalds). Here's a quite extensive comparison and here you can compare it yourself.
  


• What makes good REST? Roy Fielding lists a couple of criteria.
  


• Tips and Q&A on optimizing and tuning Apache Tomcat.
  


• Yahoo! opened up its open strategy platform: Yahoo! Application Platform (YAP), Yahoo! Social Platform (YSP), and Yahoo! Query Language (YQL). All services are accessed via oAuth.
  


• Is the Sun (pun intended ;-) setting for Swing in favor of JavaFX???
  

Best of this Week Summary 29 October - 02 November 2008

• Lots of OpenID news this week: Microsoft Live ID will be an OpenID provider. It is still in a testing phase; you can already try it out. Google is also going to be an OpenID provider, including the use of OAuth. But that looks less promising when looking carefully: the implementation is not completely following the OpenID standards! See step 3 and 4 in the image below.
  
  A clarification on why Google has done this can be found here. Basically, two reasons:
  
  1. this way users can use their Gmail accounts instead of the normally required URLs. But a URL does exist in the form of 'https://www.google.com/accounts/o8/id'.
     
  2. Google doesn't allow OpenID for users at sign-in, because its federated login would break many of their rich-client applications. Google is working on this one.


• Whitepaper on how the JTeam company has implemented Continous Integration. Their complete list of CI tools is described; handy when you're looking for inspiration.
  


• Things to think about when considering Maven as your build tool (different angle on the post :-)
  


• Interesting posts from the Google Chrome team on the decisions they made creating the browser.
  

Best of this Week Summary 20 October - 26 October 2008

• Good tips on how to write clean code.
  


• A high level comparison of JAX-RS (Java API for RESTful Web Services) four implementations: CXF (Apache), Jersey (Sun), RESTEasy (JBoss), and Restlet (open source). Here's how they integrate with Spring.
  


• Four approaches to get to a canonical message model (CMM) in an ESB. Check also the previous two articles in this series.
  

Best of this Week Summary 07 October - 19 October 2008

• Having nice user-friendly bookmarkable URLs when you're using the Wicket web framework is not so trivial. Especially if you want those nice URLs when validation errors occur. As an example, on this Wicket based site enter "hello" in the end-date field. Now check the URL in your address bar just before you click Filter (http://online.ddpoker.com/leaderboard) and right after the submit when you see the validation error (http://online.ddpoker.com/?wicket:interface=:0:1:::). Here's the solution for those cases too!
  
  
• Have you been clickjacked lately?
  


• More clarification from Rod Johnson on the new maintenance policy for Spring.
  


• As a side note, Microsoft is designing a new programming language "M", part of its new Oslo development and service-oriented strategy. Most likely it will be .Net based. Will it ever see the day of light? Much more concrete is this new open source Touchless SDK, which enables developers to create multi-touch based applications using a webcam for input.
  

Best of this Week Summary 06 October - 12 October 2008

• One of the many nice editions of The A-Z of Programming Languages series, this time on C#. Yes, yes, that word is not supposed to be on this blog, but this article is still interesting if you're into programming languages. For example the challenges when designing a language. Check also the other editions, for example about: AWK, Forth, Modula-3, Python and Javascript.
  


• An Amazon S3 introduction/beginners guide for setting up hosting of images.
  


• Four cases of CSRF attacks desribed, including one were it was possible to transfer money from a bank account! Check also the mentioned paper on how to prevent them: Cross-Site Request Forgeries: Exploitation and Prevention. The paper explains how to prevent CSRF in your web-application/frameworks: don't let a GET modify anything and pass a random number in the cookie and each form POST. It also describes XSS and the same-origine policy.
  

Best of this Week Summary 29 September - 05 October 2008

• Check the elaborate 95 slides comparison of Javascript libraries at the bottom of this post. It's a presentation by John Resig, Mr JQuery. The presentation is very objective. Compared are: Prototype, jQuery, Yahoo UI, Dojo and Mootools. Another short comparison of 14 RIA/Ajax/Javascript frameworks shows jQuery as the winner, as seen by the User eXperience reviewer. Great news for jQuery this week anyway: both Nokia and Microsoft are adopting it as part of their official application development platform.
  


• Can't get enough of these RIA frameworks comparisons? Here's another one, which is a short comparison/intro of three Rich Internet Application frameworks: Adobe AIR, Google Gears and Silverlight. See also my (bit older) post here, which also includes JavaFX.
  


• Summary of an article by Martin Fowler on how Agile can be used in building SOA implementations. The answer: yes you can quickly get value out of it. The biggest proof is the internet: loosely coupled and many unexpected changes.
  


• Quick-start JSF book free for download. Only 65 pages. Beginners level, step-by-step. With some mixed "infomercials" about the soon to be open source Eclipse IDE extension Exadel Studio Pro, but not in an annoying way.
  


• Key API design points from Joshua Bloch, Chief Java Architect at Google
  


• An explanation why a canonical message model (CMM) is a "good thing" in SOA and ESB.
  


• How to manage and lead geeks in a team. For technical and non-technical teamleaders.
  

Best of this Week Summary 22 September - 28 September 2008

• 10 aspects of web 2.0 strategies that a CTO and CIO should know about.
  


• AJAX security fundamentals. With XSS, CSRF and securing JSON.
  


• Recently started foundation by Tim Berners-Lee (inventor of the web). Its goal is to study the web and how to make it more accessible.
  


• Short overview of forms of API authentication: keys, username/password, digest and tokens. I'm missing oAuth in the examples mentioned.
  


• From March 2008: short overview of the status of web frameworks and their marketshare: Spring MVC, GWT, Struts 2, JSF, Flex, OpenLaszlo. Also mentions AppFuse as starting point for building a web application.
  


• One of many architecture and design diagrams for an application built on Struts2, Spring, Hibernate and ExtJS. Could be a good starting/reference point.
  

Best of this Week Summary 15 September - 21 September 2008

• It seems the SOA world is finally starting to take the Web-Oriented Architecture seriously.
  


• Summary of a recent whitepaper from IBM Global Services describing five high level best practices for successful deployment of an SOA. 120 IT Architects, developers, IT Specialists and project managers evaluated nearly 100 case studies, with 750 lessons learned and 650 best practices.
  


• SpringSource announced a maintenance policy for SpringSource Enterprise. Definitely check Rod Johnson's clarification comment in this thread on The ServerSide. Important to verify when you're using Spring in your company.
  


• Elaborate introduction to persistence, ORM and JPA, and a comprison of two open source persistence frameworks: iBATIS and Hibernate. Notable points: iBATIS encourages the direct use of SQL queries; it enables the object model and the data model to be independent of eachother via its data mapper (compared to a metadata mapper framework like Hibernate). Note that fully ORM tools generate SQL, where iBATIS uses SQL directly. A nice quick overview of the Hibernate architecture is described; the diagram is shown below:
  
  
  Recommendations from the article:
  
  1. Use iBATIS when you need full control of the SQL
     
  2. Don't use iBATIS when you are in full control of both the application (with its domain model) and the data model.
     
  3. Don't use iBATIS when the database is non-relational
     
  4. Use Hibernate to leverage end-to-end OR mapping
     
  5. A potential reason to use it could be that it is more easy to use for object-oriented programmers who are less familiar with SQL
     
  6. Use JPA when you need a standards-based persistence solution
     
  
  
  My own recommendations:
  
  1. With Hibernate it might be harder to tune the queries because they are generated by Hibernate. You can't really "just handover" the queries to the DBA. The DBA will have to monitor the database for bad queries.
     
  2. Hibernate gets quite complex when you have to map more complex associations (like a unidirectional many-to-many association with custom columns added to the link-table). I've never used iBatis so can't tell how hard it is for that framework.
     
  3. When trying to only use JPA defined elements, you'll find that JPA's possibilities are quite limited (e.g. caching is not well defined in JPA), and that you quickly will start to use (ORM-tool) implementation specific features. A good way to implement this, is to specify the full package path when using implementation specific annotations. That way you can see where you deviate from the JPA standard.
     

Best of this Week Summary 8 September - 14 September 2008

• An interview with leads of PHP, JavaScript, Ruby, Perl, Python, and Tcl on the state of these dynamic scripting languages.
  


• Interesting technical development: IE8 and Google Chrome are putting tabs in new processes instead of threads. The main reason for creating threads used to be that it takes a relative long time to create a new process and inter-process communication is slow. But, these days the processor speeds are so fast (following Moore's Law etc), creating processes is a piece of cake/can be done really fast.
  


• How do individualism and teamwork go together in an Agile development project. Why type of roles should you have and what to expect from those roles.
  


• A short comparison of 8 java web frameworks: Struts 2, Spring MVC, Wicket, Tapestry, MyFaces, JSF, Grails and Rife.
  

Best of this Week Summary 1 September - 7 September 2008

• An update how OpenSocial is doing...
  


• 12 good Hibernate tips you might not know.
  


• A list of the 10 worst scalability practices/anti-patterns for large distributed systems. The areas covered are: the golden hammer: use of only 1 technology, resource abuse, big ball of mud: bad versioning/deployment management, everything or something: packaging of the application, forgetting to check the time (did you know that only just recently, since JDK 1.5, you can set timeout on reads on HTTPURLConnection? And that DNS lookups in Java are cached for the lifetime of the JVM unless configured differently?), the hero pattern: one operational "do it all", not automating deployment, build etc, and finally: monitoring of the system.
  


• In case you lived under a rock the last week without Internet access :-), Google introduced its browser: Chrome.
  A couple of interesting things from posts around The Net: Chrome does a better job on the ACID test than the latest Firefox 3 build and IE 7.
  The first performances tests show that Chrome's performance is outperforming all the current browsers!
  Mozilla countered this with another test using their new javascript engine TraceMonkey, which should be released by the end of the year in Firefox 3.1. And this is the current standing in browser marketshare.
  Quite a big surprise is that it is currently only available for Windows. Clearly Google is going for marketshare by addressing the users of the most used operating system... And finally, below is an overview how Chrome got its logo (via neatorama, with custom edit):
  
  
  

Best of this Week Summary 25 August - 31 August 2008

• Water & Stone PDF with an analysis of 19 open source content management systems. WordPress, Joomla! and Drupal come out best.
  


• Recently released Keyczar is an open source cryptographic toolkit designed to make it easier and safer for developers to use cryptography in their applications. It supports authentication and encryption with both symmetric and asymmetric keys. Keyczar is designed to be open, extensible, and cross-platform compatible. It is not intended to replace existing cryptographic libraries like OpenSSL, PyCrypto, or the Java JCE, and in fact is built on these libraries.
  


• How to add custom columns to the association using Hibernate 3.2.5 (and Spring 2.5). Quite unbelievable that this has to be so complex. It's quite simple with a @ManyToMany or similar annotation if you don't want an extra column in the association (link table). But I think it's quite normal that you like to add more columns, for example a timestamp of when the record was created.
  


• Great summary of Eric Meyer's talk at An Event Apart San Francisco 2008 about 9 CSS frameworks: 960, Blueprint, Content With Style, That Standards Guy, YAML, YUI, Elements, Tripoli and WYMStyle. In short: CSS templates are a good starting point, but to make the design unique you will very likely have to modify the templates.
  

Best of this Week Summary 18 August - 24 August 2008

• Patterns-based Evaluation of Open Source BPM Systems: jBPM, OpenWFE, and Enhydra Shark. Report's conclusion: "Overall one can conclude that the open source systems are geared more towards developers than business analysts. If one is proficient with Java, jBPM may be a good choice, although if not, choosing jBPM is less advisable. Similarly, whilst OpenWFE has a powerful language for workflow specification in terms of its support for the workflow patterns, we postulate that it will be difficult to understand by non-programmers. Finally, Endydra Shark’s minimalistic support for the workflow patterns may require complicated work-arounds for capturing nontrivial business scenarios."
  


• As part of their EC2 offering, Amazon introduced this week their Elastic Block Store, enabling you to mount an EBS and format it or setup a database on it. S3 is not really intended for database-like storage. Here's another introduction, including a link to an article on how to setup MySQL on EBS. Here's ESB explained, including some diagrams.
  


• Article on the succesful execution of a large project (20 man years, 100.000+ lines of code) with an Agile approach using Scrum, with developers from India and The Netherlands. Includes lessons learned. Technologies used: Java, Spring, Hibernate, WebLogic, Oracle, Swing (UI) and Flex (for the displays) and Bamboo (continuous integration).
  


• Handy short comparison between LWUIT (recently open sourced by Sun) and JavaFX Mobile. Here's another comparison from Sun.
  

Best of this Week Summary 11 August - 17 August 2008

• Water & Stone survey of market share in the open source content management system market. Out of the 19 investigated, WordPress, Joomla! and Drupal came out best.
  


• Tip for when you are losing your JRuby session in a clustered environment. You're probably using in-memory storage (:memory_store) for your session, while you should be using database storage (:active_record).
  


• Beginners tips for unit testing: why do you need to do them, how etc.
  


• Three extensive articles on Java runtime performance monitoring.
  


• Reaction on an article in the New York Times on three problems with OpenID: authentication, information cards, and no adoptation.
  


• This week Yahoo! opened its geolocation platform Fire Eagle to everybody. "Fire Eagle is a storehouse for personal location information. If you tell Fire Eagle where you are, or have applications or devices that can do so on your behalf, then other applications can grab that info (with your permission) and provide you geo-related services or social network features". Another explanation here.
  
  
• This IBM Alphaworks tool automaticly generates an Ant build file after analysing your project's structure. Finally! Amongst others an Eclipse plugin. Weird part: needs Microsoft Word!!
  

Best of this Week Summary 04 August - 10 August 2008

• Good article on the current status of Ajax frameworks. Most interesting is the notion that in 2005 there were already 48 Ajax frameworks and in 2007 there were already 240! Clearly the expected consolidation did not occur yet. Nice conclusion I agree with at the end: for Ajax use Prototype and script.aculo.us, they have been around for 3-4 years. For more heavyweight RIA applications use Flex (Silverlight is in a too early stage). What about AIR? I'd say the same. Though AIR needs its own runtime, so is a bit different.
  


• Good intro on google's recently introduced open sourced binary encoding format Protocol Buffers, including references to pros and cons articles.
  


• Recently the Open Web Foundation was launched. It "[...] will be focused on developing the technical specifications of protocols used for communication and inter-operability between applications on the web. The foundation will also set out the legal terms and best practices for the use and transport of both private and public data, and the usage of web services". Here's how it relates to the Data Portability Working Group and who's in it.
  


• Microsoft is now sponsoring the Apache Software Foundation. Note that is not a move away from IIS, as mentioned in the referred blog in the article.
  


• Drizzle is the name of the new lightweight MySQL spin-off, which aims at systems that have to process massive amounts of concurrency (mostly reads) on multicore systems. Think Cloud and Net(?) applications. Or, as they say it: "A High-Performance Microkernel DBMS for Scale-Out Applications ".
  


• Quite elaborate article and comparison on how secure the current major web frameworks are.
  Discussed are: Struts, Spring MVC 2, Struts2, Spring, Webwork, Stripes, JSF, MyFaces, Wicket and MS .Net.
  

Best of this Week Summary 28 July - 03 August 2008

• Introduction from google on OAuth and why you should/might want to use oAuth, including a few examples.
  


• A bit more than a week ago (July 20th to be exact), Amazon's S3 had a big outage of several hours, affecting many (startup) websites. Here's the explanation why, from Amazon. The short story: message corruption in server-to-server communication.
  


• In this blog I of course also take care of the starting software engineer :-), so here's ten concepts every software engineer should know.
  


• MySpace is now also supporting OpenID.
  


• Finally, Sun introduced the JavaFX preview SDK. Official announcement here. Below a screenshot of the demo application:
  
  
• In case you're not using it yet, definitely worth checking out this opensource LGPL static Java analyzing tool Findbugs.
  

The iPhone Push Notification Service: what to watch out for

This week Apple introduced its Push Notification Service API to a restricted set of developers.
What's so special about this? The new iphone 3G does not allow developers create applications that can run in the background. An example would be a chat application for Facebook that sounds a 'ping' when one of your contacts goes online; this chat application would need to be running all the time on your iphone and now and then ask the server "anybody new?". Or it just has to sit listening for a message from the server telling that one of your contacts logged on.
This push notification service sits between the 3rd party server (e.g the facebook application server) and the iphone device. See here for a clear basic architecture picture. It allows any 3rd party server to contact this Apple(!) service, which in turn then contacts the related iphone device. This means Apple will have all the knowledge of all the 3rd party applications and their communication with the connected iphones!! Scary. This sounds sooo Microsoft.
Here's another post dedicated to this too.

Best of this Week Summary 15 July - 27 July 2008

• Part 2 of last week referenced, this time horizontally scaling JEE applications.
  


• "Microsoft has developed a new static code analysis tool for finding SQL Injection vulnerabilities in ASP code. Web developers can run the tool on their ASP source code to identify the root cause of the attack and address them to reduce their exposure to future attacks. The tool will scan ASP source code and generate warnings related to first order and second order SQL Injection vulnerabilities. The tool also provides annotation support that can be used to improve the analysis of the code."
  


• On the fun side: a Java based Massive Multiplayer Online Game with about 6 million unique active users per month.
  


• Detailed info on whether you are affected from the (Spring) source ;-) on last week's security problem in Spring MVC.
  


• Summary of Flickr Database Architecture presentation on how Flickr database scaling is implemented.
  

Best of this Week Summary 14 July - 20 July 2008

• Real world cases used to describe vertical scaling for Java EE applications. Definitely check also the comments.
  


• An interesting theory and technology: host-proof hosting. This is a technique where the browser encrypts the data to be stored on the server, such that the host (application) only sees encrypted data, thus completely preventing the host from seeing the actual contents of the user data. Thus enables for "zero knowledge web applications". Two examples of implementations are Clipperz (sourcecode partially AGPL v3) and Passpack (sourcecode MIT license).
  
  
• Visualize your code in CVS with this Visual Code Navigator. Too bad that's CVS, which is quite old. Hopefully there'll be an SVN version soon!
  


• Sun this week released their
  Sun Java Mobile Enterprise Platform 1.0: "MEP is a framework for developing mobile enterprise applications. Based on robust synchronization technologies, it enables enterprise users to synchronize enterprise data (from back-end systems like Siebel or SAP) with their mobile devices. In a nutshell, MEP enables enterprise users to carry the enterprise in their pockets". You can get a free evaluation here.
  

Best of this Week Summary 7 July - 13 July 2008

• Bjarne Stroustrup in an interview describing what every programmer and software engineer should know about C++.
  


• Browser memory performance comparison between Safari 3.1, Firefox 3.0, Flock 1.2, Opera 9.5 and IE 8.0 B1. Conclusion: Firefox 3 beats them all in memory efficoency.
  


• Definite interesting read this white paper from Kent Beck "Tools for Agility". On an invitation basis from Microsoft, he wrote "thoughts on the relationship between tools and agile software development. He looks at how tools have evolved in aiding software flow, efficient transition and team transparency". It includes what makes agile development different and difficult from other development-cycle approaches. For example the tools should support: even shorter development cycles, even more automated testing, much more transition between activities, transparency and real time collaboration, .
  


• Great list of eight REST anti-patterns.
  

Best of this Week Summary 29 June - 6 July 2008

• Top 10 SOA pitfalls.
  


• The TLS Report, a recently started website, is keeping track of how major sites have implemented TLS (Transport Layer Security, formerly SSL). Check the first surprising results of the best and worst here.
  


• Presentation from Jason Sobel, the manager of infrastructure engineering at Facebook, on how Facebook implements the storage of about 6.5B images (profile pics, regular photos) in 4 or 5 sizes, totalling about 30B files, 540TB and serving 475K images per second! Their servers (10K Apache webservers, PHP, Memcached, 1800 MySQL servers) can't handle that so they use CDNs.
  Here's a page from the presentation that shows the "read" setup:
  
  


• Adobe announced that they've created a special Flash player that runs on the server which allows search engines to better index Flash and Flex applications: Rich Media Search. The search engines are now supposed to "see" the Flash application just as the user does. Well, that's one reason less to not use Flash ;-) Google is also improving its Flash indexing by using this new searchable SWF library.
  
  

Best of this Week Summary 23 June - 28 June 2008

• This post summarizes the key parts of the LinkedIn architecture (40M pageviews/day). Full presentations also available. Lots of Java. Below an architecture overview diagram from one of the presentations:
  
  
• Overview of the plans of the BBC for their application/website infrastructure: moving it from mainly Perl and static files to SOA, Single SignOn, REST, Java and PHP.
  


• Orbitz (the online travel booking agency yes) is open sourcing their Extremely Reusable Monitoring API (ERMA) and Graphite this coming Monday. Here's why they're open sourcing their ERMA and Graphite, which are "part of a Complex Event Processing system designed to monitor large distributed applications, analyze the data that is gathered and display that data in real-time graphs."
  


• All of Google's Data APIs now support oAuth. So no need anymore to store a username and password in web applications that use one of Google's Data APIs. Recently also PhotoBucket and SmugMug announced oAuth support.