OWASP Asia Pacific Conference

Andrew Hallam | | 12 January 2008, 11:42

The Open Web Application Security Project promotes security best practices for web application development. OWASP have run training and conferences in the US and Europe. The good news is that Australia has been added to the list, along with Asia and Israel.

When 27-29 February 2008
Where Gold Coast Convention Center, QLD
What Training agenda, Conference agenda

Useful OWASP artifacts:

If you build web applications I highly recommend taking the time to look at those documents.

A Simple Netkernel Application

Andrew Hallam | | 27 April 2007, 19:08

I’ve been interested in Netkernel for a while. It offers a decarative development approach, like using SQL to query a database instead of writing the code that performs the actual query processing. Netkernel also gets extra bonus points for embracing REST (but I digress).

Netkernal lets you focus on logical resources that are loosely coupled. You can use declarative and imperative languages where they make sense.

As a simple example, I set out to build the simplest possible application that could accept an HTTP GET request, query a database, and return the results of the query as an XML document. Here’s the core application, minus the configuration of the module and database connection:

<idoc>
  <seq>
    <instr>
      <type>sqlQuery</type>
      <operand>
        <sql>
          SELECT id, name 
          FROM items;
        </sql>
      </operand>
      <target>var:queryResult</target>
    </instr>
    <instr>
      <type>xslt</type>
      <operand>var:queryResult</operand>
      <operator>ffcpl:/resources/style/get-item-list.xsl</operator>
      <target>this:response</target>
    </instr>
  </seq>
</idoc>

This is a Declarative Process Markup Language (DPML) document. It contains a <seq>uence of three two <instr>uctions. The first instruction queries the database and stores the result in the variable “queryResult”. If you view an XML representation of the query result it looks like:

<results>
  <row>
    <id>1</id>
    <name>Foo</name>
  </row>
  <row>
    <id>2</id>
    <name>Bar</name>
  </row>
</results>

This could be returned as the response document, but elements named results/row don’t exactly describe the sematics of the data. Therefore, the next instruction uses a small XSL stylesheet to change the document structure to:

<itemlist>
  <item>
    <id>1</id>
    <name>Foo</name>
  </item>
  <item>
    <id>2</id>
    <name>Bar</name>
  </item>
</itemlist>
<pre>

The third instruction “casts” the result to a MIME type of text/xml. As Peter pointed out in the comments, if I use the stylesheet to define the output method as XML, using <xsl:output method=“xml”/>, I don’t need the third instruction, which was:

<instr>
  <type>cast</type>
  <operand>var:serviceResult</operand>
  <operator>
    <cast>
      <mimetype>text/xml</mimetype>
    </cast>
  </operator>
  <target>this:response</target>
</instr>

Notice that I haven’t had to worry about object types. Netkernel takes care of that for me.

Production Ready

The use of a declarative development approach means that if it works as desired it’s ready for production. There is no imperative code in this application so there isn’t a whole lot to test. The only optimisation would be to use Netkernel’s built in caching to minimise the load of the database.

This example plays to Netkernel’s strengths, but contrast it with the imperative code required to build this application in Java or C#.Net.

The Backstory

A while ago I ran some code metrics on a Java servlet Web application that I’d written. I was surprised at just how much code was involved. 5,500 non-comment source statements (NCSS) for an application that had about 20 data entry forms. That seemed like a lot.

Stripes had been used for the Web framework and Hibernate was used for the database layer. These two tools had reduced the amount of Java code that had to be be written, and about 500 NCSS were to manage an archaic interface with another system. That leaves 5,000 NCSS for user interface logic and domain model.

This exercise prompted me to start looking at alternative ways of developing applications. What’s that? Ruby on Rails, Django, and friends. Sure, they are options, but I was looking for something different. I wanted something declarative, not imperative. Netkernel fits that requirement.

Update: A simple Netkernel Spatial application

Dream Job

Andrew Hallam | | 14 March 2007, 05:37

Taking an organisation to level 5 on Pete Lacey’s Resource-Oriented Architecture Maturity Model. :-)

JavaScript Goodness

Andrew Hallam | | 25 February 2007, 18:22

Three presentations by Yahoo! JavaScript Architect Douglas Crockford, of JSON fame, are available from the Yahoo! UI Theater:

  1. The JavaScript Programming Language (111 minutes)
  2. Advanced JavaScript (67 minutes)
  3. An Inconvenient API: The Theory of the DOM (78 minutes)

You can view the videos online, or download M4V files (for video iPods). To get the videos to play on Ubuntu Linux (Dapper) I renamed the files to *.mpg and MPlayer just did its thing (well, for the first file, the rest are still downloading).

Database Design, SQL and Replication

Andrew Hallam | | 10 January 2007, 04:56

Today was almost a WTF day. The goal was to replicate selected tables from one SQL Server 2000 database to another. Here are two simple hints that will help ensure that replication won’t break your applications.

1. Every table must, must, must have a primary key.

SQL Server’s transactional replication requires that each table being replicated have a primary key, as any well designed database should. Even better, make sure your tables are normalised. If you don’t know what “database normalisation“ means then please take the time to learn. (I’m no expert, but I can tell you that a lot of things become much easier to do in a well normalised database.)

Sadly, none of the 13 tables that had to be replicated had a primary key. We ended up adding surrogate primary keys by adding an autoincrementing integer column to each table. This hack would not have been necessary in a well designed database.

2. Never use the * wildcard to select all columns in SELECT queries.

SQL Server’s transactional replication adds a version column to each table being replicated. If you have any SELECT queries in stored procedures, views or application code that look like

[sql]SELECT * FROM table_name[/sql]

then there is a good chance that something will break when that version column is added. Always specify the names of the columns in your SELECT queries.

In this case a large stored procedure was using column wildcards to select data into temporary tables that no longer had enough columns. This query has the same issue because the source table will likely have more columns than the target table:

[sql]INSERT INTO target_table_name FROM (SELECT * FROM source_table_name WHERE column_a = ‘foobar’)[/sql]

The views seemed OK, but the only way to check the applications that use this database is to search their source code.

Simple practices can save you a lot of hassles in the long run, particularly if your database is used by more than one application.

  • Normalise your tables,
  • use primary keys,
  • use referential integrity and checks,
  • always name columns in queries,
  • use indexes wisely, and
  • use consistent naming conventions.

Most of the above have exceptions, but unless you know why the exception is valid stick with the basics. Your life as a database application developer will be much better. And, any developers who have to maintain your applications are less likely to be seen with voodoo dolls bearing your name.

Java is Open Source

Andrew Hallam | | 14 November 2006, 04:48

Wow! It looks like it is actually happening. “Unmodified GPL2 for our SE, ME, and EE code.” Read Tim Bray’s post at ongoing for more details.

Australian Scrum Community

Andrew Hallam | | 29 October 2006, 19:10

The website for the Australian Scrum Community is now online. That’s the Scrum software development methodology. Sorry, nothing to do with Rugby. (Well, there is a tenuous link but let’s not go there).

If you know anyone using Scrum please send them a link to www.scrum.com.au.

Windows Services for Tomcat

Andrew Hallam | | 22 June 2006, 08:00

The installation of both Tomcat 5.0.28 and Tomcat 5.5.17 on a single server caused some problems yesterday. Plan A was to use the Windows Executable installers, thinking that they would make the job easier. Not so, in this case.

What we needed was Tomcat 5.0.28 running on JDK 1.4.2, and Tomcat 5.5.17 running on JDK 1.5.0, a Windows service for each, all on the one Windows 2000 Server. However, even when the “service” option was unchecked during installation the Windows Executable installers still created Windows services.

The problem was the installers for both 5.0.28 and 5.5.17 were attempting to create services named “Tomcat5”. Not good.

Plan B was to use the Zip install option for Tomcat and use tomcat.exe to manually create a Windows services. After Googling on the latter it was not clear how this works, mainly because I didn’t find the documentation.

Planc C was to use the Java Service Wrapper. There are detailed instructions on setting up services for Tomcat. Worked a treat!

All the settings are in the wrapper.conf file, so it’s simple to make changes like increasing the maximum heap size. Just check your paths carefully.

[tags]tomcat, windows service, java service wrapper[/tags]

Useless Visual Studio Error

Andrew Hallam | | 23 May 2006, 05:14

I’m seeing this very informative error message several times per day when trying to run an application from within Visual Studio 2005 Professional:

The operation could not be completed.

Googling for that error message reveals that it can be caused by several issues:

  • Source code control plug-ins. We’re using Subversion without any Visual Studio plug-ins, so I’m confident that is not the problem.
  • Corrupted Windows Scripting Host. (Haven’t tried to update it yet.)
  • Some unidentified error in the project metadata files.

I get around it by:

  1. Opening the project properties.
  2. Selecting the Compile tab.
  3. Changing the Options Explicit value from On to Off.
  4. Saving the project (Save All).
  5. Changing the Options Explicit value from Off back to On.
  6. Saving the project (Save All).
  7. Running the applications again.

Damn tedious, and a distraction no developer needs. If you have a suggestion on how to fix this I’d be grateful for a comment.

Java Developers Needed - Sydney

Andrew Hallam | | 20 May 2006, 02:48

A colleague’s company is looking for an experienced Java web application developer, or two. If you are looking for work in this area, or know someone who is, please get in touch and I’ll pass along your details. (No agencies, thanks.)

Note: What follows is my interpretation of the position based on some brief emails.

Skills/Experience

Three years of solid real world commercial experience with Java development, including JSP, J2EE, and Struts. Experience with AJAX development and Oracle would also be well regarded.

You must have excellent communication skills because you will be dealing with clients, and be self motivated.

Employment Arrangements

Initially contract, may become permanent.

Location

Sydney, Australia. In the city near Wynyard Station.

When

ASAP

« Previous |

Powered by Textpattern | Tranquility White made TXP-ready by Textpattern Templates