just some Java guy

@Nullable / @Null / @NotNull / @Notnull / @Nonnull / @CheckForNull annotations

2011-08-25T18:41:00.000+10:00

Jetbrains never ceases to delight. As of 10.5, their IDE supports not only their own pioneering org.jetbrains.annotations Nullable annotations, but also any other arbitrary @Nullable annotations you decide to use.

Currently the most popular ones are the JSR-305 (javax.annotation) annotations, the FindBugs nullable annotations, and IntelliJ's own nullable annotations.

If you decide to use the Findbugs annotations (which are found in package edu.umd.cs.findbugs.annotations), keep in mind that you probably want to use @CheckForNull instead of @Nullable. By default IntelliJ includes @Nullable for Findbugs, but you should change that to @CheckForNull.

The reason is that @Nullable is all but ignored by Findbugs if you decide to use that as well. Findbugs' annotations seem badly named, but hey that's just the way it is.

On a related subject, be careful not to get the JSR-303 nullable annotations confused with the JSR-305 nullable annotations.

Here is a quick summary of the differences:

JSR-303

Used for runtime bean validation, NOT static code analysis
javax.validation.constraints.NotNull
javax.validation.constraints.Null

JSR-305

Used for Static code analysis - seems to be all but dead
javax.annotation.Nonnull
javax.annotation.Nullable

Findbugs

Used by the Findbugs static code analysis tool
edu.umd.cs.findbugs.annotations.NonNull
edu.umd.cs.findbugs.annotations.Nullable (Probably not what you want)
edu.umd.cs.findbugs.annotations.CheckForNull

IntelliJ

Used by IntelliJ IDEA, but also publicly available as a jar
org.jetbrains.annotations.Nullable
org.jetbrains.annotations.NonNull

As usual, IntelliJ's built-in IDE support for nullable is awesome, and Eclipse's is decidedly un-awesome.

FileNotFoundException when running a unit test in IntelliJ

2011-06-22T14:06:00.000+10:00

If you are running a unit test in IntelliJ that needs to load a test file, you might come across this error.

java.io.FileNotFoundException: src\test\resources\testFile.xml (The system cannot find the path specified)

The problem may be that by default, IntelliJ sets the working directory to be the project root. If you are working on a maven project or something else with a complicated project structure, then you probably want it to look instead at the module root.

This is easy enough to configure. Simply go to:

Edit Configurations -> Defaults -> JUnit -> Working Directory

Set this value to $MODULE_DIR$ and you are done!

Also remember to delete any existing JUnit configurations so that it will pick up the default you have just set.

Spring Validation is still pretty dumb

2011-05-27T14:29:00.000+10:00

HOW IT USED TO BE

One of the annoying things about Spring MVC 2.5 was the validation. Even Spring themselves have acknowledged it:

"In previous versions it was up to the developer to manually invoke validation logic"

HOW IT IS NOW

When Spring 3 rolled around, I was looking forward to some clever validator improvements. And Spring delivered!

You no longer have to manually invoke validators, but you can use the JSR-303 @Valid annotation to AUTOMAGICALLY invoke validation on the bean in your controller. Check it out below:

 @Controller  
 public class MyController {  
   @InitBinder  
   protected void initBinder(WebDataBinder binder) {  
     binder.setValidator(new FooValidator());  
   }  
   @RequestMapping("/foo", method=RequestMethod.POST)  
   public void processFoo(@Valid Foo foo) { ... }  
 }

Awesome sauce!

WHY IT IS STILL DUMB

Yeah that's cool and all, but that's pretty much all they've done in the way of magic. When it comes to CONFIGURING validators (which is one place we could really use some magic), Spring Validation is still pretty stoopid.

You basically have two options - manually set the validator in your initBinder() (like you can see in the example above), or call setValidator (Validator) on the global WebBindingInitializer. Which looks ike this in the applicationContext.xml:

 <mvc:annotation-driven validator="globalValidator"/>

This is pretty dumb too - having a single global validator for all models probably isn't very useful.

WHY IT IS NOT NORMALLY A PROBLEM

Now all of this isn't so bad when using Spring Validation with Spring MVC. Normally We have one Model per Controller, which is configured with one Validator (and incidentally one View - which is why it is called (yes you guessed it) MVC ).

So configuring a validator for a controller isn't too bad - we're already configuring the model and view for the contrller, so one more thing is not a problem.

WHEN IT IS A PROBLEM

It becomes a problem when you want to use it OUTSIDE of the MVC framework. When you don't have a controller to configure your validator and model to - how on earth do you wire this stuff up?

Suppose I have an arbitrary model that I want validated with Spring's framework - how do I do it? I don't need any of Spring's Binding facilities. And nothing magical like this seems to exist:

 @Autowired MagicalSpringValidationMonkey magicalSpringValidationMonkey;  
 public void myService(MyModel myModel){  
   Errors errors = magicalSpringValidationMonkey.validate(myModel);  
 }

I would expect my Magical Spring validator to do three things:
1. Run any JSR-303 Bean Validation configured for the model
2. Find and run the appropriately configured Spring Validator for this model
3. Return me an errors instance containing all of those errors.

WHY IT SHOULDN'T BE A PROBLEM

JSR-303 Validation is configured on the model itself, so Spring should be able to figure out how to run that validation.

Spring Validators (my custom validation classes that implement Spring's Validator interface) are already configured to show which models they support, by means of the supports(Class clazz) method which must be implemented.

HMMM COME TO THINK OF IT

Actually now that I think about it, you know what? After writing this long rant, I figured out that it probably wouldn't be too hard for me to write the MagicalSpringValidationMonkey myself.

But you know what else? I'm annoyed that this isn't already there, and that I had to do so much investigation to find out how it works, so I'm not gonna do it. Plus I'm too lazy. And Margaret River is calling me.

I hope you enjoyed this rant.

The end.

Something I didn't (and still don't) know about SQL

2010-12-14T10:40:00.000+10:00

Take this simple Database Table:

Field1

(null)

abc

xyz

Here's a test for you. What will the following query return?

select * from table1 where field1 like 'a%'

If you answered abc you are correct - congratulations!
Ok now here is the same query slightly modified - what will it return:

select * from table1 where not (field1 like 'a%')

Surprisingly (to me) it doesn't return (null) and xyz, it only returns xyz. If anyone knows why can you please explain in the comments?

The cause of TeamCity 5 slowness and CPU usage

2010-10-12T16:10:00.000+10:00

Teamcity 5.1.2 was running like a dog for me - with skyrocketing CPU on the server.

The cause of this slowness was a slow network connection to Subversion. You see, by default Teamcity is configured to check for SVN updates every 60 seconds.

If, for some reason (like a slow network connection), it takes longer than 60 seconds to do this check, then the Teamcity svn update jobs will just keep backing up every 60 seconds until there is a whole queue of them slowing down the server.

There are a couple of things you can do:

1. Fix the cause of the network slowness
2. Change the "Default VCS changes check interval" under Administration -> Server Configuration
3. Make sure "Clean all files before build" is NOT checked in your build configuration.
4. Use the slowness as an excuse to request newer hardware :) Then do steps 1, 2 or 3.

Cached javascript files? A duh moment

2010-08-30T15:21:00.001+10:00

How do you ensure that your users don't have an old cached version of your javascript files?

The answer might come to you straight away, but I'm not ashamed to admit that this problem perplexed me for quite a while. We had problems where the users' browsers were using old cached versions of some javascript files that we had updated. Thus the web application was behaving inconsistently for them.

We flirted with ideas about fiddling with the 'Cache-control' and 'Expires' headers, but it proved troublesome and we didn't want to disable caching completely as a lot of our users are still on dialup connections (yes that's how badly our life-saving Queensland firefighters are treated).

We even thought about writing some sort of script that would find and clear the browser's cache manually each time they logon to the department's network, but for obvious reasons that would be difficult and error-prone. Plus it wouldn't take effect until they log out and log back in.

Then it occurred to me - How does Google do this? They must have heaps of js files and must be rolling out updates all the time!

The answer is very simple. Each time we deploy a new version of the webapp we simply rename the "scripts" folder that contains all our javascript files. Something like appending the version number of the app to the scripts directory name works well.

This will ensure that each time a new version of the app is deployed, each user's browser will be forced to get the latest version of the scripts, solving the caching problem.

Duh!

Selenium and untrusted SSL Certificates

2010-08-27T07:34:00.000+10:00

Our Web App uses SSL and is deployed daily to a development server that has a certificate signed by our internal Certification Authority. This causes some problems with Selenium, as this is essentially an "untrusted" certificate in the eyes of Firefox.

It is easy to get around this, you just answer the prompt that Firefox throws up and tell Firefox to trust this certificate. But this isn't good enough for an automated build, as Selenium can't answer this prompt for you every time.

So to get around this I am running my Selenium tests against a custom Firefox Profile that I have created and checked into subversion. There are instructions how to do this here. Inside this profile I have told Firefox to trust the certificate, and remember that to "permanently store this exception".

I found that the "Permanently store this exception" box was greyed out when I first tried this. This was as a result of previously configuring firefox not to save any history. The solution for this problem is this:

1. Enable History
2. Permanently store the exception (The box is not greyed out now)
3. Disable History

I only needed to do this once - Firefox seems to remember the certificate exception even though I set it to not remember History afterwards.

How to process all the sql files in a directory using ant and sqlplus

2010-07-08T15:57:00.001+10:00

This is useful if you have a build process where you would like to run a bunch of Oracle sql scripts in a directory as part of your build.

In my current project, developers add their schema update scripts to a certain directory each sprint. This ant target will pick up all the scripts in the directory and apply them to the local schema so you (and the continuously integrated build) are always up to date.

It requires the ant-contrib plugin.

    <target name="developer.scripts.run.all" depends="db.init">
        <foreach target="developer.script.run.single" param="sqlFile">
            <fileset dir="../data/patches/${db.patches.directory}" casesensitive="no"/>
        </foreach>
    </target>
 
    <target name="developer.script.run.single" depends="db.init">
        <exec resolveexecutable="yes" executable="sqlplus" failonerror="true">
            <arg line="-s ${db.userid}/${db.password}@${db.database} @${sqlFile}"/>
        </exec>
    </target>

UPDATE 4/8/10 :

The code snippet above processes the files in random order. To process the files in alphabetical order, wrap it using sort and path like so:

    <target name="developer.scripts.run.all" depends="db.init">
        <foreach target="developer.script.run.single" param="sqlFile">
            <path>
                <sort>
                    <fileset dir="../data/patches/${db.patches.directory}" casesensitive="no"/>
                </sort>
            </path>
        </foreach>
    </target>
 
    <target name="developer.script.run.single" depends="db.init">
        <exec resolveexecutable="yes" executable="sqlplus" failonerror="true">
            <arg line="-s ${db.userid}/${db.password}@${db.database} @${sqlFile}"/>
        </exec>
    </target>

Find a person in a group with an LDAP Filter

2010-05-20T15:22:00.000+10:00

I've never before had the joy of trying to authenticate a Java app with LDAP. It turns out you can do all sorts of tricks with an LDAP filter - which is just like a weird query language.

Most of it made sense to me, but filtering users that belong to a certain group was a little tricky.

Here is a filter that will locate a user that belongs to a specific LDAP Group:

(&(objectClass=user)(sAMAccountName=%u)(memberOf=CN=GROUP_NAME,OU=Security Groups,DC=desqld,DC=internal))

Using Active Directory for Authentication on a Spring App

2010-05-07T16:04:00.000+10:00

When attempting to connect to a trusted LDAP Server using Spring, you may be confronted with an error like this:

org.springframework.ldap.CommunicationException: simple bind failed: SERVERNAME:636; nested exception is javax.naming.CommunicationException: simple bind failed: SERVERNAME:636 [Root exception is javax.net.ssl.SSLException: Connection has been shutdown: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]

The error is fairly difficult to understand, but it does give some clues. Basically, it means that the LDAP Server does not have a server certificate that has been issued by a trusted Certification Authority (e.g. Verisign).

This is fairly typical, as usually organisations will use self signed certificates for their internal servers.

The situation is actually similar to what you would see in a browser when you try to go to a site with an unrecognised SSL certificate. However it will usually give you an option like "I know the risks - just let me in anyway". And that is exactly what we want to do here.

You can import the remote server certificate into your local certificate store by running the following code:

/*
 * Copyright 2006 Sun Microsystems, Inc.  All Rights Reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 *   - Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 *
 *   - Redistributions in binary form must reproduce the above copyright
 *     notice, this list of conditions and the following disclaimer in the
 *     documentation and/or other materials provided with the distribution.
 *
 *   - Neither the name of Sun Microsystems nor the names of its
 *     contributors may be used to endorse or promote products derived
 *     from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
 * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLException;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
import javax.net.ssl.X509TrustManager;
import java.io.BufferedReader;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.OutputStream;
import static java.io.File.separatorChar;
import java.security.KeyStore;
import java.security.MessageDigest;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;

public class InstallLDAPCert {
    private static final int DEFAUL_LDAP_SSL_PORT = 636;

    public static void main(String[] args) throws Exception {
        String host;
        int port;
        char[] passphrase;
        if (args.length == 1 || args.length == 2) {
            String[] c = args[0].split(":");
            host = c[0];
            port = c.length == 1 ? DEFAUL_LDAP_SSL_PORT : Integer.parseInt(c[1]);
            String p = args.length == 1 ? "changeit" : args[1];
            passphrase = p.toCharArray();
        } else {
            System.out.println("Usage: java InstallLDAPCert <host>[:port] [passphrase]");
            return;
        }

        File dir = new File(System.getProperty("java.home") + separatorChar + "lib" + separatorChar + "security");

        File file = new File(dir, "cacerts");

        System.out.println("Loading KeyStore " + file + "...");
        InputStream in = new FileInputStream(file);
        KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
        ks.load(in, passphrase);
        in.close();

        SSLContext context = SSLContext.getInstance("TLS");
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(ks);
        X509TrustManager defaultTrustManager = (X509TrustManager) tmf.getTrustManagers()[0];
        SavingTrustManager tm = new SavingTrustManager(defaultTrustManager);
        context.init(null, new TrustManager[]{tm}, null);
        SSLSocketFactory factory = context.getSocketFactory();

        System.out.println("Opening connection to " + host + ":" + port + "...");
        SSLSocket socket = (SSLSocket) factory.createSocket(host, port);
        socket.setSoTimeout(10000);
        try {
            System.out.println("Starting SSL handshake...");
            socket.startHandshake();
            socket.close();
            System.out.println();
            System.out.println("No errors, certificate is already trusted");
        } catch (SSLException e) {
            System.out.println();
            e.printStackTrace(System.out);
        }

        X509Certificate[] chain = tm.chain;
        if (chain == null) {
            System.out.println("Could not obtain server certificate chain");
            return;
        }

        BufferedReader reader = new BufferedReader(new InputStreamReader(System.in));

        System.out.println();
        System.out.println("Server sent " + chain.length + " certificate(s):");
        System.out.println();
        MessageDigest sha1 = MessageDigest.getInstance("SHA1");
        MessageDigest md5 = MessageDigest.getInstance("MD5");
        for (int i = 0; i < chain.length; i++) {
            X509Certificate cert = chain[i];
            System.out.println(" " + (i + 1) + " Subject " + cert.getSubjectDN());
            System.out.println("   Issuer  " + cert.getIssuerDN());
            sha1.update(cert.getEncoded());
            System.out.println("   sha1    " + toHexString(sha1.digest()));
            md5.update(cert.getEncoded());
            System.out.println("   md5     " + toHexString(md5.digest()));
            System.out.println();
        }

        System.out.println("Enter certificate to add to trusted keystore or 'q' to quit: [1]");
        String line = reader.readLine().trim();
        int k;
        try {
            k = line.length() == 0 ? 0 : Integer.parseInt(line) - 1;
        } catch (NumberFormatException e) {
            System.out.println("KeyStore not changed");
            return;
        }

        X509Certificate cert = chain[k];
        String alias = host + "-" + (k + 1);
        ks.setCertificateEntry(alias, cert);

        OutputStream out = new FileOutputStream(file);
        ks.store(out, passphrase);
        out.close();

        System.out.println();
        System.out.println(cert);
        System.out.println();
        System.out.println("Added certificate to keystore " + file.getAbsoluteFile() + " using alias '" + alias + "'");
    }

    private static final char[] HEXDIGITS = "0123456789abcdef".toCharArray();

    private static String toHexString(byte[] bytes) {
        StringBuilder sb = new StringBuilder(bytes.length * 3);
        for (int b : bytes) {
            b &= 0xff;
            sb.append(HEXDIGITS[b >> 4]);
            sb.append(HEXDIGITS[b & 15]);
            sb.append(' ');
        }
        return sb.toString();
    }

    private static class SavingTrustManager implements X509TrustManager {

        private final X509TrustManager tm;
        private X509Certificate[] chain;

        SavingTrustManager(X509TrustManager tm) {
            this.tm = tm;
        }

        public X509Certificate[] getAcceptedIssuers() {
            throw new UnsupportedOperationException();
        }

        public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
            throw new UnsupportedOperationException();
        }

        public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
            this.chain = chain;
            tm.checkServerTrusted(chain, authType);
        }
    }

}

Lazy loading under a Spring OpenSessionInViewFilter without a Transaction

2010-04-08T17:04:00.000+10:00

You can't do it.

Yeah I know it's a pretty dry and boring topic, but this needs to be said.

If you are using an OpenSessionInViewFilter*, then you must use transactions for all data access, even just for readonly access.

They don't make it super clear in the javadoc, but OpenSessionInViewFilter REQUIRES, DEMANDS and EXPECTS all data access to be wrapped in a transaction. If you are getting LazyLoadExceptions and don't know why, then make sure your data access is transactional.

Of course, the transaction can be finished before you try to do the lazy loading; OpenSessionInViewFilter just expects that a transaction happened at some prior point in the request.

* and expect to be able to lazily load your data, which is pretty much the point of OSIV

Dr Strangecode, Or: How I Learned to Stop Worrying and Love the Legacy

2010-03-09T08:44:00.004+10:00

Someone recently asked me what technologies I would recommend for the next Enterprise Web Project.

Like a good little software developer, my initial reaction was "I would have to see the requirements first".

And of course that is true. As much as possible I try to fight the tendency to fit requirements around the technology, because I know that I am wont to be enamoured by the latest shiny thing in the software world.

But even though I have no idea what my next job will be, I already know what it is. It will be another Java/Spring/Hibernate enterprise web application for a government department or medium sized corporation, probably replacing one or more existing systems. That is what people want, and that is what I am good at doing.

The software nerd in me is repulsed by these things. I would love nothing more than to write my next enterprise web app in Javascript with a NoSQL database and write server side web services in a pure Functional language, which I feel can more directly solve the enterprise problems I have been confronted with in my career so far. But the corporate world is simply not politically or culturally ready for it. I can accept and respect that.

So let's get on with the business of writing good Java Web Apps.

Something I have come to observe is that ALL code is legacy code. The moment somebody else looks at it, it is legacy code. Right now, somebody is probably working with my lovingly handcrafted feats of software engineering (in my mind) and thinking "Man, what was this guy on? grumble grumble legacy code..."

So my reasoning goes like this: I love my own code; all of my code is legacy code; therefore I love legacy code.

How can I make the legacy code that I write as painless as possible for the next guy? Here are some of my favourite techniques:

Covert Code Reviews

Management hates pair programming, but every couple of days just give the guy sitting next to you a 5-10 minute tour of the code you have written. You'll have to swallow your pride the first few times, but it will promote consistency in the codebase, which is the single most important attribute of good legacy code.

Automated Code Test Coverage Tools

Set a minimum test coverage percentage that will fail your automated build tool when it dips below that value. This will at the very least promote dialogue (probably heated) between developers.

Style Checking Tools

Like the Test Coverage tools, a set of checkstyle rules that fail the automated build will go a long way towards keeping the codebase consistent.

Frameworks and Code Generation Tools

Yeah I know we love to hate frameworks. But for all the pain they cause us, at least it forces us to write code in defined and consistent way. One shiny thing that I have in mind is Spring Roo, which I really would like to try on a future project.

Get an end-to-end build process

Ideally something that runs nightly, deploys the application to your real application server and runs all of your tests.

Don't live with broken windows

TestNG for example (I'm not picking on TestNG in particular) allows you to create a test annotation called "broken", which permits the build to ignore tests that are temporarily broken for some reason. DO NOT USE THIS TAG! One broken test will quickly become two, then ten then fifty. Soon it becomes normal practice for developers to mark tests as broken, and the malaise sets in.

Use a decent IDE, get 2 monitors, work on a powerful machine

These are essential tools for writing good legacy code. Also, IntelliJ > Eclipse (what good is an opinion piece without some controversy?)

Your data plan costs $1.6 million per GB

2010-03-03T10:57:00.002+10:00

If I was to offer you a data plan that cost the low, low price of $1.6 million per Gigabyte, would you take me up on it?

No?

How about if I offered you the same service, but this time it only costs 22 cents per 160 Bytes?

As you have no doubt figured out, it is the same pricing, and this is what we are being charged for SMS.

SMS is great, but it costs too much. I think with Twitter and mobile push technology, we can finally abandon SMS. A twitter client on your smartphone with push enabled is a complete replacement for SMS, and has the exact same "feel" as SMS on your phone too.

If you already have a data connection on your phone, and your family/friends have (or can get) a twitter account, there is no downside to this system.

An almost overwhelming uneasiness

2010-02-23T17:20:00.005+10:00

Have you ever had this feeling when coding?

Maybe there's a better name for it than "almost overwhelming uneasiness", but it has happened twice to me in the past week. It only lasts for a split second but the feeling is very distinct.

The first time

I tried to do a Google Search and got an error page. Then I glanced down at my phone and saw that my 3G data connection had dropped out.

In that split second, these thoughts went through my head:

"Oh no, it has finally happened - some hacker has finally unleashed the ultimate virus on the internet. It has destroyed the DNS system or some vital part of infrastructure that no-one thought about and the entire internet is broken. What am I gonna do - I'll lose my job as a programmer, I've got no other marketable skills - I've been programming ever since I left Uni - how am I gonna feed my family..."

Then I ran the search again and it turned out the internet was fine.

The second time

The second time was when I was working on a Java codebase and came across this:

t1 = t2;

Again that same "almost overwhelming uneasiness", only for a split second:

"t1 = t2? What on earth does that mean? I don't understand what's going on here... I'm looking at the code above it and below it and getting more confused - how can you assign a...? I don't understand it, am I not as good a programmer as I thought?"

Then I remembered that yes, it is possible to re-assign a local variable in Java. I guess I've been hanging around these Functional Programming nutcases for so long and my programming style has become so functional that for a split second I had forgotten that variables are mutable.

How to force HTTPS on the login page with Spring Authentication and a soy bean musing

2010-02-09T14:52:00.003+10:00

The Easy Way

Just use the Spring Security Namespace. It makes security configuration so easy that it's not worth me writing anything further about it.

The Hard Way

Ok, so like me you are working in a huge enterprise or government department somewhere, and they think they can do security better than Spring.

For whatever reason, if you need to configure this stuff explicitly by wiring up your own beans, here's what you'll need to do:

You probably have something like this:

<bean id="security.local.AuthenticationEntryPoint" class="org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint">
    <property name="loginFormUrl" value="/public/login.html"/>
    <property name="forceHttps" value="false"/>
</bean>

You need to change it to this:

<bean id="security.local.AuthenticationEntryPoint" class="org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint">
   <property name="loginFormUrl" value="/public/login.html"/>
   <property name="forceHttps" value="true"/>
   <property name="serverSideRedirect" value="false"/>
   <property name="portMapper" ref="portMapperImpl"/>
   <property name="portResolver" ref="portResolverImpl"/>
</bean>

Then you need to define portMapperImpl and portResolverImpl like this:

<bean id="portResolverImpl" class="org.springframework.security.util.PortResolverImpl">
    <property name="portMapper" ref="portMapperImpl"/>
</bean>
 
<bean id="portMapperImpl" class="org.springframework.security.util.PortMapperImpl">
    <property name="portMappings">
        <map>
            <!--Mappings for all servers can be listed here - Spring just wants to know how which HTTPS port belongs to each HTTP port -->
            <entry key="8080" value="8443"/>
            <entry key="80" value="443"/>
            <!--SysTest-->
            <entry key="7001" value="7002"/>
            <!--Prod-->
            <entry key="8001" value="8002"/>
            <!--Sandpit-->
            <entry key="8051" value="8052"/>
        </map>
    </property>
</bean>

And then the configuration that forces the login page to be SSL:

<bean id="channelProcessingFilter" class="org.springframework.security.securechannel.ChannelProcessingFilter">
    <property name="channelDecisionManager" ref="channelDecisionManager"/>
    <property name="filterInvocationDefinitionSource">
        <security:filter-invocation-definition-source path-type="ant">
            <!--You can configure further rules here about which pages should use SSL.-->
            <security:intercept-url pattern="/public/login.html" access="REQUIRES_SECURE_CHANNEL"/>
        </security:filter-invocation-definition-source>
    </property>
</bean>
 
<bean id="channelDecisionManager" class="org.springframework.security.securechannel.ChannelDecisionManagerImpl">
    <property name="channelProcessors">
        <list>
            <ref bean="secureChannelProcessor"/>
            <ref bean="insecureChannelProcessor"/>
        </list>
    </property>
</bean>
 
<bean id="secureChannelProcessor" class="org.springframework.security.securechannel.SecureChannelProcessor"/>
<bean id="insecureChannelProcessor" class="org.springframework.security.securechannel.InsecureChannelProcessor"/>

I've just realized that tofu is over-rated. It's just a curd to me.

2010 is the year developers take back the database?

2010-02-04T12:16:00.003+10:00

It's difficult for any web developer not to be excited by the prospect of developing with a NoSQL database.

What is even more amazing is that in the space of just a few months, three separate startups with three separate (competing?) NoSQL database products have been gaining significant traction with investor funding.

Relaxed Inc raises 2 Million (CouchDB Database)

Basho raises 4.7 million (Riak Database)

10gen raises 3.4 million (MongoDB Database)

Exciting times!

Enterprise Web Application Architecture 2.0 and kittens

2010-02-01T16:35:00.017+10:00

According to its homepage, CouchDB is a distributed, fault-tolerant and schema-free document-oriented database accessible via a RESTful HTTP/JSON API.

That is a boring bunch of words. Here is why it is interesting.

Typical enterprise web-application architectures that I've worked on in the past look something like this:

The grey boxes represent the data format used between each layer. As you can see, the data gets transformed many times in a typical web request from Database to Browser.

Ok now let's have some fun.

Imagine that our database was clever enough to do all of our form validation and authentication for us. Our diagram would change to look like this:

And what about if we split up the application layer - we can put all of our business validation logic in database, and push any other leftover application logic into the presentation layer.

As shown in the diagram, there are typically two methods used to produce HTML, and they are often used together:

1. Server side view templating - where HTML code is produced on the server and sent directly to the browser (e.g. server side MVC, JSP, Velocity, Freemarker)

2. AJAX - where only data is sent from the server via an XMLHttpRequest, and Javascript manipulates the DOM directly

Let's abandon server-side templating, and do all our templating on the client side in Javascript. In fact, let's use Javascript for all our presentation needs:

Then how about we give our Database an HTTP interface, make it speak JSON and store data in JSON format. This will allow us to remove the data access layer and that awful ORM to which we've been shackled for so long.

What kind of amazing magical database can do all this? Well it turns out that a distributed, fault-tolerant and schema-free document-oriented database accessible via a RESTful HTTP/JSON API can.

I'm not claiming any silver bullet here, in fact CouchDB is still relatively immature. But as a potential architecture for a typical Enterprise Web App - it makes you think about whether we really need all of those grey and blue boxes.

If you'd like to learn more - download CouchDB, try CouchApp, and try this demo.

Oh and as promised - here are some kittens:

GitHub for Windows (L)users

2010-01-19T14:05:00.000+10:00

GitHub is so hot right now, but if you are a windows user, you'll probably feel like a second class citizen amongst all the cool mac/linux people.

Here's a quick guide on how to get started with your own github repository, if you have been getting errors like these:

Permission Denied (publickey)
fatal: The remote end hung up unexpectedly
Could not create directory '//.ssh'.
Saving the key failed: //.ssh/id_rsa.

1. Install mSysGit Full Installer

Make sure to select "Use Unix Style Line Endings" instead of the default "Use DOS style line endings".
Also choose the option that allows you to run git commands from the windows command prompt.

2. Generate ssh public key

Run "Git GUI" from the start menu
Help -> Show SSL Key -> Generate Key
Accept all the defaults when generating a key

3. Add the key to your GitHub account

Account Settings -> Add another public key
Paste the key that msysGit generated into here

That should be it - you can now clone your own github repository. Use your favourite IDE that has Git support and you'll be cruising.

Automated testing of Javascript as part of your build

2009-12-15T09:03:00.005+10:00

Have you got 100% test coverage on your Java code? That is very commendable.

But perhaps you still get the feeling that there is a lot of functionality in all that front end Javascript you have been writing that really should be tested too?

Well here's how to setup automated testing of your Javascript functions that runs as part of your build along with all your other unit and integration tests. (It is based on the QUnit library, which is the best option I have evaluated.)

The Maven Dependencies you'll need:

<dependency>
    <groupId>net.sourceforge.htmlunit</groupId>
    <artifactId>htmlunit</artifactId>
    <version>2.5</version>
    <scope>test</scope>
</dependency>
<dependency>
    <groupId>org.w3c.css</groupId>
    <artifactId>sac</artifactId>
    <version>1.3</version>
    <scope>test</scope>
</dependency>

Create a new JUnit test that will run the Javascript test:

import com.gargoylesoftware.htmlunit.WebClient;
import com.gargoylesoftware.htmlunit.html.HtmlPage;
import junit.framework.TestCase;

import java.io.File;

public class MyJavascriptUnitTest extends TestCase {
    private static final String JAVASCRIPT_TESTS_HTML = new File("src/test/javascript/assert/javascriptTests.html").getAbsolutePath();

    public void testJavascriptTestResults() throws Exception {
        final WebClient webClient = new WebClient();
        final HtmlPage page = webClient.getPage("file://" + JAVASCRIPT_TESTS_HTML);
        assertEquals("pass", page.getElementById("banner").getAttribute("class"));
    }
}

Here's what javascriptTests.html looks like:

<html>
<head>
    <script src="jquery-latest.js"></script>
    <link media="screen" href="testsuite.css" type="text/css" rel="stylesheet">
    <script src="testrunner.js"></script>
    <script type="text/javascript" src="../../../main/webapp/javascripts/fileUnderTest.js"></script>

    <script>

        $(document).ready(function() {
            //  **** Add tests here ****
            module("Currency Formatting");

            test("formatCurrency", function() {
                equals(formatCurrency("1"), "$1");
                equals(formatCurrency("123"), "$123");
            });

        });

    </script>
</head>

<body>

<h1>JavaScript Tests</h1>

<h2 id="banner"></h2>

<h2 id="userAgent"></h2>
<ol id="tests"></ol>
<div id="main"></div>
</body>
</html>

In this example, fileUnderTest.js is your file that you want to test, in this case it contains a function called formatCurrency().

module() is just a way to group related javascript tests for reporting purposes.

If you have IntelliJ, you can use WebPreview to open javascriptTests.html - and get instant feedback! And I mean instant - no reloading of anything needs to happen, just modify your Javascript and the WebPreview will instantly show you if it passes or fails.

Listed below are the other files referred to, for your convenience. You don't need to use these exact files, but it will help get you started:

testsuite.css
testrunner.js
jquery-latest.js

Project estimates are hilarious...

2009-12-14T08:31:00.005+10:00

Taken from a publicly available August 2005 newsletter:

In early 2005, the QFRS undertook the development and implementation of the Operations Management System (OMS)...

The implementation of OMS is being staged over three phases with a scheduled completion date of mid 2006.

Despite being in full active development since that newsletter, OMS is currently scheduled for an initial deployment with a cut-down number of features to a small subset of users in March 2010.

Toolin' around with web applications (Part 2)

2009-12-10T07:50:00.003+10:00

The site below describes the technique that I think makes more sense than our current crop of server side web frameworks (at least for building a reasonably-sized modern web application):

Thin Server Architecture

Also google "SOFEA" if this appeals to you.

Australia Post requires the www?

2009-12-07T11:46:00.003+10:00

It has been like this as long as I can remember:

post.com.au <- doesn't resolve
www.post.com.au <- resolves

How could this go unnoticed for so long by such a huge company with such a good (short) domain name?

Toolin' around with web applications

2009-11-25T06:37:00.004+10:00

I'm currently on holidays. My job around the house for yesterday was to replace the hinges on the pool fence that had rusted. According to Laurie Lawrence, pool fences should be auto closing - Kids alive do the five!

Anyway I spent almost two hours on this task over two separate days trying to install the hinges. The problem was, I was trying to use the screws that came with the hinges which were clearly not designed for use with a metal gate.

My toolkit looked like this:
- Wood screws
- Cordless drill
- Drill bits
- Screwdrivers

But I still had a lot of trouble getting these darned screws to go in. So instead I tracked down an extension cord and pulled out a corded drill, thinking that the underpowered cordless drill wasn't do me any favours.

The added power of the corded drill certainly made things faster, but ultimately didn't help me succeed. I would either destroy the threads on the screws or end up drilling a hole that was too big for the screws.

Finally I got hold of some screws designed for metal, and the whole job was done properly in literally less than five minutes.

The lesson that was reinforced to me is that using a whole bunch of good tools doesn't come anywhere near the efficiency of choosing the one correct tool for the job.

I get this feeling when writing web applications too. For a basic Java Enterprise Web App, I typically choose a set of technologies like this:

- A templating language (e.g. Freemarker, Velocity)
- Javascript
- HTML
- A Javascript framework (e.g. jQuery, Prototype)
- Some sort of Widget Library (e.g. jQueryUI, Scriptaculous)
- CSS
- Spring MVC

This list is extremely abbreviated of course, as anyone involved with Java Web Development will know. The entire list of technologies is probably triple or quadruple that length.

But these are the core technologies used to display a web page. What bothers me is that the first FIVE of these end up in one file! I end up using 5 tools to accomplish the single goal of displaying the web page.

This is incredibly difficult to read and understand, especially considering that the technologies are fundamentally different. Some of the code is evaluated on the server side, and some on the client side, some before the page loads and some after the page loads, and yet the code is all mashed up together. Code generating code that generates code that generates code for multiple browsera to interpret.

Even though this approach works, it still feels like I'm trying to use woodscrews in a metal gate.

Server side templating seems like the wrong way to do things. I think we need to focus more on client side development toolkits - RESTful services and some better Javascript and Ajax Tools could completely replace our current web frameworks, but I just don't think the tools exist yet. Maybe the entire MVC model could be pushed down into javascript on the client side. Or maybe we could have some better abstractions or DSLs for browser control beyond HTML and javascript.

Dumb analogies in the news

2009-11-17T12:33:00.002+10:00

This just in:

IBM has created the world's largest business computing "cloud" capable of holding the equivalent of 250 billion iTunes songs.
...
If that amount of information were in the form of text stuffed into four-drawer file cabinets, there would be enough of them to ring the planet, according to IBM.

Are those analogies really useful? Does IBM really think we are impressed by such a nonsensical comparison?

I enjoyed x646d63's take on it:

Storage capacity: 250 billion iTunes songs
Computing capacity: 800M Chimp-Mensa Candidates
Physical size of network: 300,000 slightly above average elephant toes
Electric consumption: 3.6M 60Hz gerbil wheels

It's funny cause it's true

2009-11-02T17:05:00.002+10:00

“The problem with object-oriented languages is they’ve got all this implicit environment that they carry around with them. You wanted a banana but what you got was a gorilla holding the banana and the entire jungle.”—Joe Armstrong