Sunday, November 30, 2008

Best of this Week Summary 17 November - 30 November 2008

  • Interesting recent long discussion (with a bit of framework flame-war in between) and tips on when to pick what web client framework. Tapestry, Wicket, Stripes, GWT, Flex seem to jump out.

  • Interesting Javascript optimizer: Razor Optimizer. It dynamically analyzes the runtime profile information, trying to load each Javascript function only when needed, potentially creating 60-90% savings. It does require a client and server component. The question is: are you prepared to take a (small?) risk that your Javascript is dynamically modified?

  • Good article that explains why Scrum often fails as implementation of Agile. Lots of times Scrum is only seen as fast Sprints and Scrums. But: "Don't leave out the 'regular' agile good engineering practices". Check also the comments for good tips.

  • A good introduction to RESTful webservices.

  • Great, soapUI 2.5 now also suppports testing RESTful webservices. It includes testing JSON output.

Thursday, November 20, 2008

JSFUnit static analysis unit testing in ADF

Introduction
Currently I'm working on the framework design of an ADF application in JDeveloper 11.1.1.0.0 (yes sometimes a man's got to do what a man's got to do ;-). One of the parts is how we are going to do (unit) testing. And one of elements in there is testing the JSF part of the ADF application. Application Developer Framework consists of several layers where the View layer consists of a JSF implementation. This JSF implementation is named ADF Faces (RichFaces) and built on top of Trinidad, the open source JSF components implementation. ADF Faces has many components Ajax-ized and has more components than Trinidad.
My eye caught JSFUnit, an open source project from JBoss. I was only able to focus on the static analysis part JSFUnit offers (it offers also other dynamic "regular unit" tests). But little information was found about that. I couldn't find any installation tips for ADF (JBoss here and here, and Websphere setup tips were available).
Thus it was just me and the computer. Here's the steps that in the end did do the job (running on Windows XP).

Setup
A couple of things are needed for all types of static analysis.

  1. Download via JSFUnit Getting Started under the section “Files”: jboss-jsfunit-core-1.0.0.Beta3.jar en jboss-jsfunit-analysis-1.0.0.Beta3.jar

  2. Note that it was not necessary to download/install myfaces-api-1.2.0.jar or JSF 1.2 API.

  3. Start JDeveloper 11.1.1.0.0 and open an ADF application with Model and ViewController project.

  4. Right-click the ViewController project, select Properties and select Libraries and Classpath in the popup. Add the above downloaded jars there.

Three types of static tests are possible with JSFUnit. I'll describe setting up each type seperately. Most information was deducted from this part of the JSFUnit documentation.

Configuration static analysis
These tests test your JSF configuration. See the above mentioned documentation part for examples of what tests are performed.
  1. Create a JUnit testclass in your ViewController project. Modify it such that it matches this example class:


    package test.com.project;

    import java.io.File;
    import java.util.HashSet;
    import java.util.Set;
    import org.jboss.jsfunit.analysis.AbstractFacesConfigTestCase;

    public class JSFUnitStaticAnalysisConfigTest extends AbstractFacesConfigTestCase {

    private static Set paths = new HashSet() {{
    // Example absolute path: add("C:/work/workspace/jsf-unit/src/faces-config.xml");
    // Relative path example below.
    add("public_html\\WEB-INF\\faces-config.xml");
    }};

    public JSFUnitStaticAnalysisConfigTest() {
    super(paths);
    }
    }



    Note the paths variable which points to the faces-config file to validate. Relative paths work too. Of course might not be valid in your test/production environment.

    Tip: notice for easier separation at deployment, I put the test class in a separate package, starting with "test.".

  2. And you're set: run the test. Of course you should see a green bar. If not, your config is probably not 100% ok (probably because what if a JSFUnit test is incorrect... Of course you then immediately contribute to the JSFUnit community project :-). I had for example several Serialization errors.

    Below is a screenshot with the result of running the config testcase:



TLD analysis
These tests test your TLDs. See the above mentioned documentation part for examples of what tests are performed.
  1. Add the dependent libraries mentioned here, at the bottom of the page: maven-taglib and commons-logging. For the commons-logging you can use the one provided by JDeveloper: Commons Logging 1.0.4. The third one, jsp-api-2.1.jar does not seem to be necessary in the ADF project.

  2. Create a JUnit testclass in the ViewController project with .tld files. Modify it such that it matches this example class:


    package test.com.project;

    import java.util.HashSet;
    import java.util.Set;
    import org.jboss.jsfunit.analysis.AbstractTldTestCase;
    import static org.junit.Assert.*;

    public class JSFUnitStaticAnalysisTLDTest extends AbstractTldTestCase {

    private static Set paths = new HashSet() {{
    // Example: add("C:/work/workspace/jsf-unit/src/demo.tld");
    add("C:\\myprojects\\app\\src\\META-INF\\myjsf.tld");
    }};

    public JSFUnitStaticAnalysisTLDTest() {
    super(paths);
    }
    }



    Note the paths variable which points to the .tld to validate. Did not try if a relative path also works.

  3. And you're set: run the test. Of course you should see a green bar. If not, your .tld is probably not 100% ok.

    Below is a screenshot with the result of running the TLD testcase:



View static analysis
These tests test your JSF views. See the above mentioned documentation part for examples of what tests are performed.
  1. No extra libs are needed, so we can immediately create a JUnit testclass in the ViewController project. Modify it such that it matches this example class:


    package test.com.project;

    import java.io.File;
    import java.util.HashSet;
    import java.util.Set;
    import org.jboss.jsfunit.analysis.AbstractFacesConfigTestCase;
    import org.jboss.jsfunit.analysis.AbstractViewTestCase;

    public class JSFUnitStaticAnalysisViewTest extends AbstractViewTestCase {


    private static Set absoluteViewPaths = new HashSet() {{
    // Example: add("C:/work/project/src/home.xhtml");
    add("C:\\myprojects\\app\\mysite\\ViewController\\public_html\\detailsPage.jspx");
    }};

    private static Set recursiveViewPaths = new HashSet() {{
    // Example: add("C:/work/project/src/views");
    add("C:\\myprojects\\app\\mysite\\ViewController\\public_html");
    }};

    public JSFUnitStaticAnalysisViewTest() {
    super(absoluteViewPaths, recursiveViewPaths,
    "public_html\\WEB-INF\\faces-config.xml");
    }

    }



    Note the paths variables. Nowhere I could find what they exactly mean. The above runs a test that passes, so I assume the paths are set correctly...

  2. And you're set: run the test. Of course you should see a green bar. If not, your view is probably not 100% ok.

    Below is a screenshot with the result of running the view testcase:


Conclusion
So that's it. Not hard at all! If you want to know a bit more high level stuff about JSFUnit, check this presentation by the project lead at the Javapolis conference (currently rebranded to Devox conference). And here's another introduction presentation.

The Shale Test Framework could be an interesting alternative for unittesting JSF. Needs some more investigation...

Saturday, November 15, 2008

Best of this Week Summary 04 November - 16 November 2008

Sunday, November 9, 2008

Best of this Week Summary 03 November - 09 November 2008

Saturday, November 1, 2008

Best of this Week Summary 29 October - 02 November 2008

Saturday, October 25, 2008

Best of this Week Summary 20 October - 26 October 2008

Sunday, October 19, 2008

Best of this Week Summary 07 October - 19 October 2008

  • Having nice user-friendly bookmarkable URLs when you're using the Wicket web framework is not so trivial. Especially if you want those nice URLs when validation errors occur. As an example, on this Wicket based site enter "hello" in the end-date field. Now check the URL in your address bar just before you click Filter (http://online.ddpoker.com/leaderboard) and right after the submit when you see the validation error (http://online.ddpoker.com/?wicket:interface=:0:1:::). Here's the solution for those cases too!

  • Have you been clickjacked lately?

  • More clarification from Rod Johnson on the new maintenance policy for Spring.

  • As a side note, Microsoft is designing a new programming language "M", part of its new Oslo development and service-oriented strategy. Most likely it will be .Net based. Will it ever see the day of light? Much more concrete is this new open source Touchless SDK, which enables developers to create multi-touch based applications using a webcam for input.

Saturday, October 11, 2008

Best of this Week Summary 06 October - 12 October 2008

  • One of the many nice editions of The A-Z of Programming Languages series, this time on C#. Yes, yes, that word is not supposed to be on this blog, but this article is still interesting if you're into programming languages. For example the challenges when designing a language. Check also the other editions, for example about: AWK, Forth, Modula-3, Python and Javascript.

  • An Amazon S3 introduction/beginners guide for setting up hosting of images.

  • Four cases of CSRF attacks desribed, including one were it was possible to transfer money from a bank account! Check also the mentioned paper on how to prevent them: Cross-Site Request Forgeries: Exploitation and Prevention. The paper explains how to prevent CSRF in your web-application/frameworks: don't let a GET modify anything and pass a random number in the cookie and each form POST. It also describes XSS and the same-origine policy.

Saturday, October 4, 2008

Best of this Week Summary 29 September - 05 October 2008

Saturday, September 27, 2008

Best of this Week Summary 22 September - 28 September 2008

Saturday, September 20, 2008

Best of this Week Summary 15 September - 21 September 2008

  • It seems the SOA world is finally starting to take the Web-Oriented Architecture seriously.

  • Summary of a recent whitepaper from IBM Global Services describing five high level best practices for successful deployment of an SOA. 120 IT Architects, developers, IT Specialists and project managers evaluated nearly 100 case studies, with 750 lessons learned and 650 best practices.

  • SpringSource announced a maintenance policy for SpringSource Enterprise. Definitely check Rod Johnson's clarification comment in this thread on The ServerSide. Important to verify when you're using Spring in your company.

  • Elaborate introduction to persistence, ORM and JPA, and a comprison of two open source persistence frameworks: iBATIS and Hibernate. Notable points: iBATIS encourages the direct use of SQL queries; it enables the object model and the data model to be independent of eachother via its data mapper (compared to a metadata mapper framework like Hibernate). Note that fully ORM tools generate SQL, where iBATIS uses SQL directly. A nice quick overview of the Hibernate architecture is described; the diagram is shown below:


    Recommendations from the article:
    1. Use iBATIS when you need full control of the SQL
    2. Don't use iBATIS when you are in full control of both the application (with its domain model) and the data model.
    3. Don't use iBATIS when the database is non-relational
    4. Use Hibernate to leverage end-to-end OR mapping
    5. A potential reason to use it could be that it is more easy to use for object-oriented programmers who are less familiar with SQL
    6. Use JPA when you need a standards-based persistence solution


    My own recommendations:
    1. With Hibernate it might be harder to tune the queries because they are generated by Hibernate. You can't really "just handover" the queries to the DBA. The DBA will have to monitor the database for bad queries.
    2. Hibernate gets quite complex when you have to map more complex associations (like a unidirectional many-to-many association with custom columns added to the link-table). I've never used iBatis so can't tell how hard it is for that framework.
    3. When trying to only use JPA defined elements, you'll find that JPA's possibilities are quite limited (e.g. caching is not well defined in JPA), and that you quickly will start to use (ORM-tool) implementation specific features. A good way to implement this, is to specify the full package path when using implementation specific annotations. That way you can see where you deviate from the JPA standard.

Saturday, September 13, 2008

Best of this Week Summary 8 September - 14 September 2008

Saturday, September 6, 2008

Best of this Week Summary 1 September - 7 September 2008

Sunday, August 31, 2008

Best of this Week Summary 25 August - 31 August 2008

  • Water & Stone PDF with an analysis of 19 open source content management systems. WordPress, Joomla! and Drupal come out best.

  • Recently released Keyczar is an open source cryptographic toolkit designed to make it easier and safer for developers to use cryptography in their applications. It supports authentication and encryption with both symmetric and asymmetric keys. Keyczar is designed to be open, extensible, and cross-platform compatible. It is not intended to replace existing cryptographic libraries like OpenSSL, PyCrypto, or the Java JCE, and in fact is built on these libraries.

  • How to add custom columns to the association using Hibernate 3.2.5 (and Spring 2.5). Quite unbelievable that this has to be so complex. It's quite simple with a @ManyToMany or similar annotation if you don't want an extra column in the association (link table). But I think it's quite normal that you like to add more columns, for example a timestamp of when the record was created.

  • Great summary of Eric Meyer's talk at An Event Apart San Francisco 2008 about 9 CSS frameworks: 960, Blueprint, Content With Style, That Standards Guy, YAML, YUI, Elements, Tripoli and WYMStyle. In short: CSS templates are a good starting point, but to make the design unique you will very likely have to modify the templates.

Sunday, August 24, 2008

Best of this Week Summary 18 August - 24 August 2008

  • Patterns-based Evaluation of Open Source BPM Systems: jBPM, OpenWFE, and Enhydra Shark. Report's conclusion: "Overall one can conclude that the open source systems are geared more towards developers than business analysts. If one is proficient with Java, jBPM may be a good choice, although if not, choosing jBPM is less advisable. Similarly, whilst OpenWFE has a powerful language for workflow specification in terms of its support for the workflow patterns, we postulate that it will be difficult to understand by non-programmers. Finally, Endydra Shark’s minimalistic support for the workflow patterns may require complicated work-arounds for capturing nontrivial business scenarios."

  • As part of their EC2 offering, Amazon introduced this week their Elastic Block Store, enabling you to mount an EBS and format it or setup a database on it. S3 is not really intended for database-like storage. Here's another introduction, including a link to an article on how to setup MySQL on EBS. Here's ESB explained, including some diagrams.

  • Article on the succesful execution of a large project (20 man years, 100.000+ lines of code) with an Agile approach using Scrum, with developers from India and The Netherlands. Includes lessons learned. Technologies used: Java, Spring, Hibernate, WebLogic, Oracle, Swing (UI) and Flex (for the displays) and Bamboo (continuous integration).

  • Handy short comparison between LWUIT (recently open sourced by Sun) and JavaFX Mobile. Here's another comparison from Sun.

Sunday, August 17, 2008

Best of this Week Summary 11 August - 17 August 2008

Monday, August 11, 2008

Best of this Week Summary 04 August - 10 August 2008

  • Good article on the current status of Ajax frameworks. Most interesting is the notion that in 2005 there were already 48 Ajax frameworks and in 2007 there were already 240! Clearly the expected consolidation did not occur yet. Nice conclusion I agree with at the end: for Ajax use Prototype and script.aculo.us, they have been around for 3-4 years. For more heavyweight RIA applications use Flex (Silverlight is in a too early stage). What about AIR? I'd say the same. Though AIR needs its own runtime, so is a bit different.

  • Good intro on google's recently introduced open sourced binary encoding format Protocol Buffers, including references to pros and cons articles.

  • Recently the Open Web Foundation was launched. It "[...] will be focused on developing the technical specifications of protocols used for communication and inter-operability between applications on the web. The foundation will also set out the legal terms and best practices for the use and transport of both private and public data, and the usage of web services". Here's how it relates to the Data Portability Working Group and who's in it.

  • Microsoft is now sponsoring the Apache Software Foundation. Note that is not a move away from IIS, as mentioned in the referred blog in the article.

  • Drizzle is the name of the new lightweight MySQL spin-off, which aims at systems that have to process massive amounts of concurrency (mostly reads) on multicore systems. Think Cloud and Net(?) applications. Or, as they say it: "A High-Performance Microkernel DBMS for Scale-Out Applications ".

  • Quite elaborate article and comparison on how secure the current major web frameworks are.
    Discussed are: Struts, Spring MVC 2, Struts2, Spring, Webwork, Stripes, JSF, MyFaces, Wicket and MS .Net.

Sunday, August 3, 2008

Best of this Week Summary 28 July - 03 August 2008

The iPhone Push Notification Service: what to watch out for

This week Apple introduced its Push Notification Service API to a restricted set of developers.
What's so special about this? The new iphone 3G does not allow developers create applications that can run in the background. An example would be a chat application for Facebook that sounds a 'ping' when one of your contacts goes online; this chat application would need to be running all the time on your iphone and now and then ask the server "anybody new?". Or it just has to sit listening for a message from the server telling that one of your contacts logged on.
This push notification service sits between the 3rd party server (e.g the facebook application server) and the iphone device. See here for a clear basic architecture picture. It allows any 3rd party server to contact this Apple(!) service, which in turn then contacts the related iphone device. This means Apple will have all the knowledge of all the 3rd party applications and their communication with the connected iphones!! Scary. This sounds sooo Microsoft.
Here's another post dedicated to this too.

Saturday, July 26, 2008

Best of this Week Summary 15 July - 27 July 2008

Saturday, July 19, 2008

Best of this Week Summary 14 July - 20 July 2008

  • Real world cases used to describe vertical scaling for Java EE applications. Definitely check also the comments.

  • An interesting theory and technology: host-proof hosting. This is a technique where the browser encrypts the data to be stored on the server, such that the host (application) only sees encrypted data, thus completely preventing the host from seeing the actual contents of the user data. Thus enables for "zero knowledge web applications". Two examples of implementations are Clipperz (sourcecode partially AGPL v3) and Passpack (sourcecode MIT license).

  • Visualize your code in CVS with this Visual Code Navigator. Too bad that's CVS, which is quite old. Hopefully there'll be an SVN version soon!

  • Sun this week released their
    Sun Java Mobile Enterprise Platform 1.0: "MEP is a framework for developing mobile enterprise applications. Based on robust synchronization technologies, it enables enterprise users to synchronize enterprise data (from back-end systems like Siebel or SAP) with their mobile devices. In a nutshell, MEP enables enterprise users to carry the enterprise in their pockets". You can get a free evaluation here.

Saturday, July 12, 2008

Best of this Week Summary 7 July - 13 July 2008

Saturday, July 5, 2008

Best of this Week Summary 29 June - 6 July 2008

Saturday, June 28, 2008

Best of this Week Summary 23 June - 28 June 2008

  • This post summarizes the key parts of the LinkedIn architecture (40M pageviews/day). Full presentations also available. Lots of Java. Below an architecture overview diagram from one of the presentations:

  • Overview of the plans of the BBC for their application/website infrastructure: moving it from mainly Perl and static files to SOA, Single SignOn, REST, Java and PHP.

  • Orbitz (the online travel booking agency yes) is open sourcing their Extremely Reusable Monitoring API (ERMA) and Graphite this coming Monday. Here's why they're open sourcing their ERMA and Graphite, which are "part of a Complex Event Processing system designed to monitor large distributed applications, analyze the data that is gathered and display that data in real-time graphs."

  • All of Google's Data APIs now support oAuth. So no need anymore to store a username and password in web applications that use one of Google's Data APIs. Recently also PhotoBucket and SmugMug announced oAuth support.

Sunday, June 22, 2008

Best of this Week Summary 16 June - 22 June 2008

Wednesday, June 18, 2008

How to sign a Firefox 3 addon

Of course you've noticed that Firefox 3 has been released (and that it didn't go that smoothly, trying to break the world record).


One of the major changes in the new FF3 release is that add-ons (plugins, extensions, whatever you wanna call it :-) need to either use an HTTPs updateLink, or if it is an HTTP updateLink, you need to sign the .xpi. The exact info on how to do this is quite scattered, so here I summarize it all in one place, in three steps! :-)

Below I'll focus on Step 2 mentioned in the high level migration steps: providing secure updates.

Step 1
Add the updateKey tag to install.rdf inside the em:updateKey tag. For details see here. Follow the mentioned McCoy link. In short: create a key with the tool, rightclick on the key you created, select Copy and put that inside em:updateKey tags within install.rdf, below em:updateURL.

Step 2
Create the .xpi and add its sha1 hash (right click on the .xpi + select properties in Windows.) to update.rdf as mentioned here. Note that you should put the em:updateHash below each em:updateLink you have in your update.rdf. Also don't forget the sha1: prefix.

Step 3
Add the signature to update.rdf. See here for an example signature. Select the key you used in Step1 in the McCoy tool. Click Sign in the menu. You'll be prompted to select your update.rdf. It will then generate (and overwrite!) your update.rdf, with the em:signature in it. I guess you can reuse this generated update.rdf for next updates (you'll need to re-hash and re-sign it when you update it), but to be save I also made a backup copy of my original update.rdf).

All in all not too complex, but the information was scattered. Useful in getting my mind around it and how it all relates was this thread.

Sunday, June 8, 2008

Best of this Week Summary 31 May - 08 June April 2008

  • Interesting article on how to do estimates with Use Cases.

  • The Google Ajax APIs will be available via cached versions for faster load times, stored at Google's servers. Hmmm, doubt that you want to depend on that...

  • An insight in Google's datacenters. Definitely worth reading. Google's core software consists of: GFS, BigTable and MapReduce.

  • The OpenAjax Alliance has created a set of papers "as a guide to help Web developers and IT managers understand and evaluate Ajax, define a successful Ajax strategy, and become familiar the important role OpenAjax plays in the development of the Ajax market". This one is an interesting one as it describes Ajax for mobile devides. On the other hand, browsers like Opera can already handle (some form) of regular Ajax, so is it worth making the distinction?

Sunday, June 1, 2008

Google Friend Connect vs MySpace Data Availability vs Facebook Connect

More and more users are not spending time on one website anymore. And users are getting "tired" of entering their contacts ("social network") every time again and again. The big social websites are realizing that and have created their own solutions to that. Well, potentially not their own solutions, but more their own branded solutions for what's defined by the Dataportability group.

The three announcements were:

Google's FriendConnect. It should give users a shortcut to social connections they have built on different social networks. The user can login with their Facebook, Plaxo etc accounts, allow the FriendConnect enabled site to retrieve the friends on that site, and if they're online, the user can interact with them. FriendConnect will use open standards like OpenID and oAuth. Biggest disadvantage is that an iFrame will be provided as the solution, so no API will be made available. Note that this makes Google the big switch between all these social networks! Since they don't really have a (big) social network site, this is their way of getting a piece of the cake: sitting right between all the social network sites! Some other concerns can be found here.
MySpace Data Availability. A bunch of launch partners will be able to access MySpace user data and be able to present it outside the regular MySpace widgets. MySpace users should be able to revoke the rights of the third party anytime. The third party is not allowed to store the retrieved user data. The good thing here also is that it will be made available via a REST API.


Facebook Connect. In short, the new API will give third parties' users the ability to transport the relationships from their Facebook accounts to the third parties' website. Compare it with what's now already available for Facebook applications (running on the Facebook platform) being made available for third parties. Immediately a big "chick fight" broke out, because apperently Google's Friend Connect is not respecting Facebook's user privacy control, as Facebook blocked FriendConnect! But it might just be Facebook protecting it's own turf :-)


Relationship with Dataportability.org
"The DataPortability Workgroup is actively working to create the ‘DataPortability Reference Design’ to document the best practices for integrating existing open standards and protocols for maximum interoperability (and here’s the key area) to allow users to access their friends and media across all the applications, social networking sites and widgets that implement the design into their systems."
So, let's hope the above initiatives will comply with the standards defined by the DataPortability Workgroup.


Relationship with OpenSocial
Both Google and MySpace are in the OpenSocial Foundation ("a common API for social applications across multiple websites. Built from standard JavaScript and HTML"). For MySpace their Data Availability project is outside the OpenSocial framework, but will stay involved in it too and incorporate when available.


The current status
All three are announcements are kind of the "branded" version of DataPortability implementations within the respective organisation. The furthest seems to be MySpace:
Facebook: no technical specifications released
MySpace: rolling out with only a few launch-partners
Google: not ready to launch yet.

Sunday, May 25, 2008

Best of this Week Summary 19 May - 25 May April 2008

  • Wow, that's quick: Spring now already supports oAuth. For a refreshment on a practical example of oAuth, see this TSS article.

  • Two great JavaOne2008 summaries here and here.

  • Opera's answer to Firefox's Firebug: Dragonfly.

  • MyOpenID now gives you the ability for an additional security check with your mobile phone(!) when logging in with your OpenID. When signing in, you'll instantly get a call on the phone number you setup at MyOpenID and you have to answer with pressing '#'. Nice!

Sunday, April 27, 2008

Best of this Week Summary 12 May - 18 May April 2008