Michael Vorburger's Blog

This blog has moved

2012-07-14T03:25:00.001+02:00

This blog is now located at http://blog1.vorburger.ch/.
You will be automatically redirected in 30 seconds or you may click here.

For feed subscribers, please update your feed subscriptions to
http://blog1.vorburger.ch/feeds/posts/default.

This blog has moved

2012-07-14T03:21:00.001+02:00

Pranav Mistry's SixthSense - on an Android-based wearable projector+webcam platform?

2010-03-07T01:56:00.001+01:00

A visiting family friend of ours pointed me to Pranav Mistry's SixthSense. If you haven't seen this already, do watch the Videos - it's really Pretty Cool Stuff.

A few days later I still can't stop thinking about this. I've started pondering about how far out in the future this amazing concept may be (in a commercialized consumer available variant) - or how close actually? What you need to make this happen is, probably: 1. a "reasonably powerful" portable computing platform, 2. wearable projector, 3. wearable capturing thing (something which senses where your finger / foot whatever points to / moves around on the projected image), 4. software with touch interface, and more.

The 1. portable computing platform could be e.g. an Android-powered device. It occurred to me to Google for "android projector", and doing that you'll discover e.g. the upcoming Samsung Beam, a small Android-based device from Samsung with a built-in projector/beamer (using a "DLP pico projector", whatever that is). I doubt it has capturing of what it projects.

Pranav's "current prototype system" which "costs approximate $350 to build" seems to be using a standard off-the-shelve webcam (and some "magic" software, or is this easier to do than I realize?). Hook that up to an Android... isn't quite possible yet, from what I found in
Android's Issue 738 about "missing support for the USB host feature", but that's surely just a question of a little bit more time? (Or directly using an Android's device built-in camera? But wouldn't the projector and the cam have to be calibrated together so the capturing works?)

And then some smart software, certainly. A touch-based platform seems a good foundation?

So this could actually be made possible in a closer future than some may think.

Wouldn't this be... "neat", or what? I would love to be able to look more into this...

JPA Id/Object References always, with Null Objects, a Pattern?

2009-11-26T22:02:00.000+01:00

An object has references to other objects. A row in a relational database table has foreign keys (FK) to rows in other tables.

While this basic "impedence mismatch" between the model used in the relational datastores prevalent in the enterprise today (RDBMS) and an object model (OO) is well understood and addressed by today's Object Relational Mapping (ORM) technologies, there is a specific use case which (AFAIK) is typically not easily addressed by how today's ORMs are used: What if, sometimes, you need that FK directly?

Imagine, in pseudo code (you get the idea) : class A { long id; B b; ... } & class B { long id; ... }. In certain situations, it would be handy, and feel natural from the OO point of view, if you could just ask for a.b.id. Alas this typically leads to "lazy loading", a delayed access with a SELECT FROM b ... in an ORM. If you really just want the b.id, this deferred RDBMS access makes no sense of course.

The "problem" why normally this doesn't work when using e.g. a Java Persistence API (JPA) implementation ORM is that relation fields in entity instances returned by a query (or an EM's "get one" find() method) are normally either fully initialized because the field was actually annotated as FetchType.EAGER, or because a JOIN FETCH in a JPQL Query (standardized by the specification, not implementation specific) requested it to be, or due to some JPA implementation specific API such as the OpenJPA FetchPlan API which asked for that (all of which leads to table JOINs and/or additional SELECT queries), or null if none of that is used.

The JPA specification must have had use cases like these in mind, and offers a concept of interest in this context, namely the probably less well known T getReference(Class<T> entityClass, Object primaryKey) method of an EntityManager.

Furthermore, it turns out that e.g. B's id is in fact typically already available to the ORM internally after it read an A, even if the A's b field is still null. This makes sense, and is how the lazy loading stuff normally works behind the scenes in all ORMs AFAIK (that's how they do one and not two SELECT statements when lazy loading).

It occurred to me that it would be really handy if all relationship fields of an Entity were always initialized, either with a full blown real object if the field really was eagerly fetched, or with whatever kind of "hollow" object getReference() created efficiently (typically only the object's id fields composing the oid). This would make the a.b.id example from above work for both the "eager" and the "lazy" scenario homogeneously, efficiently & very naturally!

With a little bit of unfortunately unavoidable hacking to access one JPA implementation's internals (OpenJPA in my example), needed because the JPA public API (both v1 and v2) does not allow direct access to that internal A's B id, the loaded state, and a getReference() from within a @PostLoad without access to an EntityManager, this idea does work indeed, as demonstrated in my example project's test case. (Other JPA implementations likely would allow similar direct access to its data structures? The only thing in the example that would need to be "ported" to another ORM such as e.g. EclipseLink and Hibernate is factored in the JPAHelper class... if anybody is interested in trying this out?)

One interesting side effect I ran into while looking at this and trying to get a running sample was the case of e.g. A's b really having to be null - because the say b_id FK in the A table IS actually NULL in the DB (if it's optional / nullable). I thought it would be good if you could STILL do a.b.id (always), with that expression (access path) simply returning null (or 0 if the id field is of an e.g. primitive int or long type instead of a Integer or Long object) in that case, but never causing a NullPointerException.

The initial inspiration for that was how the new Scala programming language appears to (normally? from what I understood so far; I'm only half way through my Scala book!) prevent NullPointerExceptions altogether. Then a good colleague pointed out that conceptually this is of course nothing new, and not specific to Scala - it's the Null Object pattern at work. So I threw in a bit of Null JPA Entity objects, and the interplay of my Reference object idea above with the application of the null object pattern here seems really neat.

Download the "JPA Id/Object References always, with Null Objects" example project to have a closer look at running code demonstrating this idea. - Do you like this approach? Is this a "pattern"? Could & should future JPA specification standardize support for such a usage?

Acknowledgments: Thanks to Yann Andenmatten for always inspiring feedback & discussions, and the dynamic/runtime AOP-ish NullEntityFactory contribution to the example project.

Customer Loyalty (KISSfp)

2009-10-21T22:17:00.006+02:00

Recently I received one of the more fascinating emails in quite a while. Quite an experience, really. With Bill's permission, here it is:

Hi, Mike,

Sorry to bother you at this email, but I keep getting rejection notices from sending this to your KISSfp email address.

I have a dying PC with KISSfp installed on it and I need to reinstall it on another computer.

Unfortunately, the only copy of an install program I have is the trial version (2MB). Can I download the live version somewhere? The link from my original order confirmation is no longer valid.

Thanks!
Bill

Here's a copy of my order confirmation:

> Subject: Order #1234567 Purchase Information
> Date: 23 Sep 2000
>
> Your order has been approved - thank you for your purchase!

> Order SUMMARY
> =============
> Order #:          1234567
> Purchase Date:    9/23/00
> Purchase Amount: USD 49.95
> Last Name:        XXX
> Nighttime Phone: 123.123.1234
>
>   (1)   KISSfp Microsoft FrontPage FTP Add-On - Business Edition for Commercial Webs

Now, if you don't understand why "fascinating experience", just check out the dates... Bill purchased a KISSfp license in 2000, and is contacting me today (October 2009) asking for support - 9 years on! Quite a lesson in Customer Loyalty, isn't it? Nine years is an eternity... since I created my KISSfp "Microsoft FrontPage FTP Add-On" tool. So many things have happened since: I have moved from Switzerland to Italy to Switzerland to California/USA to Switzerland... got married to an amazing wife... had two wonderful kids... wrote a book... not to speak about four great day jobs, .. and much more of course. Man. Man!

As I just got quite nostalgic, I dug into my "rummaging old, moldy files" (Bill in our email exchange following his request), and here is the full disclosure history of KISSfp: It all started in April 1998 (the pure C/CLI version), with some work done during my exchange year in Torino (thank you, Massimo, and Daniele!). Around Summer/September 1998, I appear to have started with the Borland C++ Builder-based GUI, coding away at least partly during the nights while interning during the day at the IPB in Geneva (thank you Jo & Adam for proof-reading the help!), with what eventually became the 2.0 (initially "professionally" packaged & released in February 1999; see also KISSfp Version History). Further developments during the summer of 1999, and if I recall right from then on more time spent on stuff like online marketing, the whole Digital River / NetSales story, my referral program, the MenuPlus partnership with Jeff (where are you, Jeff?), the inclusion in the Microsoft Office Update Vendor Program in April/May 1999 (yeah!), at least one FrontPage book ("Master Visually FrontPage 2002") but probably others with CDs including KISSfp, that PreviewSystems VBox thing (now apparently Aladdin.com HASP; how ridiculous all that seems in retrospect from today's day and age where I live daily using open source Java enterprise components), with increasingly fairly intensive daily technical support (thank you, Divvya!), well into 2000... and ultimately priorities in life starting to shift significantly about 2001 I think, with rapidly less time available for KISSfp.

For Bill and anybody else who may still be out there, I have finally made available a free/non-VBoxed/unlocked version of KISSfp publicly ... To use it, first run the KISSFP21.EXE which is that classic setup installer, and then run kissfp20-pvtkey.exe or kissfp20-buskey.exe once and it will be "registered" - you'll have the same app that you could purchase in the those golden days, and it seems to still run just fine on XP today! - PS: The installer EXE doesn't seem to quit and hand around (I think it always was like that), so you should may be log out and re-login to be clean.

Hey, ya all out there, loyal KISSfp users (if there are any others than Bill left?!), starting with the enthusiastic early ones and the at least many hundreds if not (probably) few thousands total along the road - it was a great time! Thank you.

KISSfp, forever!

Take care.

Privacy, Firefox Geolocation, Google Location Service

2009-10-20T00:05:00.003+02:00

I vaguely knew there was something like a W3C Geolocation API, had earlier read about the Google Gears Geolocation API, figured Yahoo had some Geo Technologies.

I had heard this works on recent mobile devices with built-in GPS, or exploiting cellphone network antenna/network triangulation, with the built-in browsers hooking into the mobile OS and exposing this information, but had always assumed that at home on a lapotp with a classic browser this wouldn't apply - how could it?

Then I stumbled upon the Geolocation support built-into Firefox 3.5, and unsuspectingly clicked "Give it a try!" on the Mozilla.com test page, and... WTF, HOW DO THEY KNOW MY EXACT ADDRESS?? I live on a small street, and just looking at the map there is no doubt that "they" know the exact street - not just the area. (They being Google here, as "Firefox gathers information about nearby wireless access points and your computer’s IP address. Then Firefox sends this information to the default geolocation service provider, Google Location Services, to get an estimate of your location.")

Now, IP-based Geolocation is old news, you could figure out "geolocation" years ago by looking at the DNS names of the router hops shown by a traceroute, but unless my ISP in Switzerland shares details about their network topology with Google, how did this now get to street-level granularity?!

I know more recently there is this WiFi and cellphone tower triangulation stuff, but unless I'm totally not getting it, Firefox could only know my home WiFi SSID, so what? Or I guess may be it can ask the OS for the names of all access points currently being picked up, but still, it's a residential area, they're just neighbors, "they" couldn't have geolocation data on all of them?! And even so, WiFi SSIDs aren't exactly GUIDs..

Now generally speaking I am not a privacy maniac (e.g. I didn't quite "get" the surprising reactions in Switzerland when Google Street View came online recently; that's all already in public anyways!), but here I got... I don't know. Yeah yeah, Firefox respects my privacy and there is this toolbar thingie asking every time if I really do want to share my location... but isn't it still a bit... you know, scary?

PS: Curiously, the German version of that same Mozilla page thinks I'm in "Zurich" (I'm actually about 200km away from it!), and once I visited that even the English page forgot what it first knew, and also said Zurich. But a browser restart and visiting the English page again returns its 007 insight I first noticed. For a moment I suspected that may be Google is simply exploiting my account cookie (which wouldn't be very "location" aware at all), but a test where I logged out of Google and then went to the Mozilla page showed that probably it's got nothing to do with that.

PPS: After having already posted the above, a test/idea occurred to me: I completely switched off the WiFi on the laptop that I'm trying/writing all this from, and got a good old ethernet cable out of the drawer and plugged that into the ADSL router at home. Interestingly, it thought I was in Zurich again! (I noticed you have to best restart the browser for such tests, but then it's definitely repeatable.) So apparently this IS based on WiFi names then (really just SSID names, or do "they" have any other more GUID-like info available??), not simple IP-based location tracking. So "somebody" presumably drove by here, detected/measured and mapped out my and our neighbours access points, and recorded all this in one fr%*#ing global DB?? This is crazy!

Links for kids, learning websites & software

2009-10-12T10:31:00.004+02:00

Here is a list of some links to learning websites & software for kids which others may find useful, from my delicious.com bookmarks. Most I've them I have myself used with my son Dév:

http://www.starfall.com - Great Spelling site (English)
http://www.literacycenter.net - Spelling (English, French, German, Spanish), but not as cool as Starfall
http://www.home-2009.com - Movie Nature
http://fr.vikidia.org - Wikipedia pour Enfants (French)
http://fr.wikimini.org - Wikipedia pour Enfants (French)
http://www.bbc.co.uk/cbeebies/ - BBC CBeebies (great also for smaller kids)
http://pbskids.org/caillou/ - Caillou Dinos from http://pbskids.org
http://www.sdnhm.org/kids/dinosaur/ - Dinos
http://www.cotf.edu/ete/modules/msese/dinosaur.html - Dinos

And the following are some great (free) learning software to download, not websites:

http://scratch.mit.edu - Great! (I teach Scratch classes in the local community myself)
http://www.phunland.com - A cool physics simulator which is quite easy
http://www.planet-plopp.com - Plopp, easy 3d painting
http://gcompris.net - GCompris various Fun Games
http://www.schoolsplay.org - Childsplay and others various games
http://www.bbc.co.uk/sn/prehistoric_life/ - Dinosaur World

Lastly here are some thing that look interesting but that we haven't looked much at yet, and which are probably of interest for slightly older kids than the above:

http://www.alice.org - Looks VERY interesting, hoping to look at this more later, with the idea to build a post-Scratch courses?
http://wiki.laptop.org/go/DrGeo - Dr. Geo, Geometry
http://www.geogebra.org - Geometry as well
http://www.greenfoot.org - Programming, another one
http://www.microworlds.com & http://mia.openworldlearning.org - More programming
http://www.simplecodeworks.com - More programming

xText Standalone Setup Parsing a DSL from a String without EMF Resource

2009-08-24T10:34:00.004+02:00

I have been playing with xText, a very interesting framework for development of textual domain specific languages (DSLs).

My interest is around an (existing, legacy) expression language, and twofold: a) build a strong Eclipse editor, b) build an interpreter for a non-Eclipse application runtime. XText is really great for the first. Here is how to use the xText generated parser in a "standalone" non-Eclipse application, based on their generated Google Guice setup infrastructure, without having to go through the EMF ECore Resource XtextResource:

String t = "...";
Injector guiceInjector = new MyDSLStandaloneSetup().createInjectorAndDoEMFRegistration();
IParser parser = guiceInjector.getInstance(IAntlrParser.class);
IParseResult result = parser.parse(new StringInputStream(t));
List<SyntaxError> errors = result.getParseErrors();
Assert.assertTrue(errors.size() == 0);
EObject eRoot = result.getRootASTElement();
MyDSLRoot root = (MyDSLRoot) eRoot;

Filed a minor item on https://bugs.eclipse.org/bugs/show_bug.cgi?id=287413 to may be have them include something like this in the official xText documentation.

PS: I am not entirely sure that StringInputStream properly always converts all (Unicode) characters into bytes for an InputStream? (But that's another topic... the whole StringBufferInputStream deprecated story, the StringReader alternative which I guess would require that xText can feed the the Antlr Lexer a Reader instead of an InputStream... could it? That org.eclipse.xtext.util.StringInputStream is just a String.getBytes(), which "uses the platform's default encoding", is that safe?)

GetterMethodsReflectionToStringBuilder

2009-05-14T20:18:00.002+02:00

Apache Commons Lang has a ToStringBuilder which is sometimes handy.

The other day I needed something like this which "reflects" on public getters() instead of on private fields, so I hacked one; I call it the GetterMethodsReflectionToStringBuilder.

Uploaded to https://issues.apache.org/jira/browse/LANG-503 as suggestion for Commons Lang 3.0.

Testing OpenJPA SQL statements using a JDBCListener

2008-08-07T01:24:00.002+02:00

I am currently designing something around FetchGroups in OpenJPA, and being a good Agile / Test Driven architect, I wanted to write a JUnit which asserts the actual SQL statement generated by this ORM (the purpose is to test the FROM/WHERE, the SQL should not include unncessary JOIN and columns, if that framework I'm building around FetchGroups works).

Initially I went off looking into e.g. good ol' P6spy (that's STILL around?). Then I mused around some (Spring?) AOP Interceptor for a JDBC Connection, this article on DW seemed a good starting point... But finally I realized that the following (OpenJPA specific; this is obviously not standard JPA) does the job perfectly (and may be useful to others, so posted here):

public class RememberingLastStatementJDBCListener extends AbstractJDBCListener {

private String lastSQL;

@Override
protected void eventOccurred(JDBCEvent event) {
  if (event.getSQL() != null) {
      // Note: This will be called several times, for different event.getType(); but it doesn't matter for this use.
      this.lastSQL = event.getSQL();
  }
}

public String getLastSQL() {
  return this.lastSQL;
}

and then in the JUnit you can do like:


RememberingLastStatementJDBCListener rememberingLastStatementJDBCListener;

openJPAConnectionProperties.setProperty("openjpa.jdbc.JDBCListeners", RememberingLastStatementJDBCListener.class.getName());

OpenJPAEntityManager oem = OpenJPAPersistence.cast(em);
OpenJPAEntityManagerSPI oems = (OpenJPAEntityManagerSPI) oem;
OpenJPAConfiguration configuration = oems.getConfiguration();
JDBCConfiguration jdbcConfiguration = (JDBCConfiguration)configuration;
JDBCListener[] jdbcListeners = jdbcConfiguration.getJDBCListenerInstances();
for (JDBCListener listener : jdbcListeners) {
if (listener instanceof RememberingLastStatementJDBCListener) {
      rememberingLastStatementJDBCListener = (RememberingLastStatementJDBCListener) listener;          
}
}

SomeEntity e = new SomeEntity();
e.setName("Hallo World!");
em.persist(e);

// We *HAVE* to flush() at this point, otherwise the Listener won't (yet) have seen the Statement(s)
em.flush();

Assert.assertEquals("INSERT INTO APP.SOMEENTITY (ID, NAME) VALUES (?, ?)",
rememberingLastStatementJDBCListener.getLastSQL());

Don't you love Open Source frameworks, where you can dig into the code and figure this kind of stuff out? ;-)

liftConference Venture Night

2008-02-06T19:40:00.001+01:00

I am at the Venture Night of the lift conference in Geneva this evening. It's an interesting change from the sort of things I think about in my current day job. Some thoughts about the companies that are presenting their startups on stage while I write this:

cocomment, UK: Bof. Some negative comments from audience and panel. Claims to be "leading web commenting platform". Can stuff that requires an IE/FF plug-in really make it truly big? Doesn't it overlap too much with existing blogging platforms?
Holistis: Track-your-sites-visitors. Haven't we seen this before? But, uhm - I came late, didn't look closely enough. Maybe interesting... I probably missed where the innovation lies.
iO naturalinteraction.org, Italy: Something else, not yet another Web 2.0. Very cool video of like a kiosk for a shopping mall where you can look at e.g. product catalog like in ... that SciFi movie, with the police that can see the future? Where they move stuff with fingers on a table. Looks neat. Wasn't Microsoft showing off stuff very much like this about a year or so ago? It somehow looks very familiar. Maybe it's actually the same.
Mixin, Switzerland: Calendaring for Web2.0... match up free slots with your friends for fixing up time for a movie or something. People mention doppler and twitter. I wouldn't use it - but I don't use (nor at a personal level really "get") e.g. Facebook either... Still: Thumbs up!
Pixelux, Geneva: Innovative gaming graphics engine, something about new algorithms for simulating material physics or something. More f*# stupid war games. Oh well. Will be used in next StarWars game. Made it!
Viewdle: Face recognition for Videos! Can I get this for Flickr and as an iPhoto plug-in, to tag family photos with who is on it? (I know it exists, saw some other Flickr-like online photo sharing thingie with face recognition stuff a while ago.) Kewl.
Wuala, Zurich: Interesting! Online disk stuff, with a P2P twist. From Zurich, out of ETHZ guys. Maybe I just like it because it actually responds to a need I currently have - I really need to start backing up my files somewhere online. Idea: You share local disk space for others against getting the same space from their P2P network. You seem to know what your doing, I liked the speed of the guy's presentation. Classical business model - advertising and paying power users. - "We want to become the Skype of online storage". Well, good luck, guys!
Clipperz, Italy: Nah. Mixes basically interesting underlying "encryption for Web2.0" technology (something like this should be available in lower-level toolkits?) with not-so-exciting "password manager for all your Web acounts" - tried before, too niche.

Google Maps Street View

2007-06-23T02:07:00.000+02:00

I had heard about the new "Street View" in Google Maps earlier but just tried it for real tonight...

To "walk" from my previous life office on 11 John Street over to Ground Zero and Battery Park, then zoom over to the west coast and drive around Sunnyvale (less pics) and Stanford's Palm drive -- it's freak' cool! Try it.

Now let's mash this up with SecondLife somehow... (BTW, off-topic but still: OpenCroquet and maybe more so lg3d-wonderland are kind of interesting; it's not about SL, it's the big picture behind of what is emerging with these...)

PS, added after initial post of the above: Second Earth...

JUnit in Ant Classpath Hell

2006-12-30T00:18:00.000+01:00

Running JUnit tests from an Ant build script - piece of cake? Welcome to Classpath Hell. Read the Ant FAQ for a taste of what to expect... (NOTE: Ant 1.7, which just came up, finally "solves" this, but most project are on Ant v1.6.5 not 1.7 yet.)

Essentially, you have to either add the junit.jar to your global CLASSPATH system environment variable (very bad) or copy junit.jar to your %ANT_HOME%/lib or remove ant-junit.jar from %ANT_HOME%/lib (and have both ant-junit.jar and junit.jar in your project and then use an ant taskdef with classpath) - bad too.

The best I could think of to make this less painful is at least have a build script semi-transparently take care of this, by itself automatically copying a junit.jar to your %HOME%/.ant/lib (slightly better than %ANT_HOME%/lib probably) if it is not there yet... not perfect, as the build of a project thus "pollutes" a globally installed application - but apparently the best you can do?

Such an ant build script would look like this:

Propagating Acegi's Security Context in a WSS UsernameToken SOAP Header via XFire using wss4j

2006-10-31T22:25:00.000+01:00

XFire includes a ws-security example, which demonstrates how a SOAP Header with a Web Service Security (WSS) UsernameToken can be inserted into an outgoing request message, using Apache's wss4j library. (The XFire ws-security example also demonstrates how to sign and/or encrypt a SOAP message, and how to use the WSS timestamp mechanism.)

I needed this functionality to be available more easily for Java service consumers, in the sense of an implicit security context passing transparent to the programmer when invoking a service. As Java API to set up a security context, Acegi from the Spring Framework should be used.

Maybe first some brief background on WSS: A WSS UsernameToken is really just a username and password, in principle similar to HTTP BASIC authentication. However HTTP BASIC delivers the credential at the transport level, whereas a WSS Header has the advantage of propagating a credential at the (SOAP) message level, thus allowing it to travel forward through several intermediaries. For example, a message could move from a service consumer to a XML security gateway, to an ESB and then into a message queue, out of which it would go into another ESB, which would route it to a service provider. With transport-level instead of message level propagation each intermediary would have to ensure forwarding, or out-of-message storage (queue) of the credential.

The WSS standard standardizes the SOAP headers used for such message level credentials; in addition to a UsernameToken, it could also be a X.509 certificate or a Kerberos ticket or a SAML token.

As a UsernameToken contains a cleartext password, the message would typically be protected either through transport level point-to-point encryption via SSL, just as would be advisable when using HTTP BASIC. Additionally, the SOAP message could also be protected through message level XML encryption.

So, back Java/Acegi/XFire: What I really wanted was to be able to do the following at the service consumer (client):

import org.acegisecurity.context.SecurityContextHolder;
import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;

SecurityContextHolder.getContext().setAuthentication(
new UsernamePasswordAuthenticationToken("uid", "pwd"));

myServiceStub.myOperation(myRequest);

SecurityContextHolder.clearContext();

and have the uid/pwd end up "transparently" in the outgoing message produced by XFire. The actual service provider (server) might or might not receive that header, e.g. if an intermediary (actual SOAP intermediary or just an in-process incoming message filter) authenticated and authorized the message, potentially stripping the WSS header. If however it did receive the SOAP header, it might have a need to get the credential back, again easily and using the same Acegi API, without having to deal with SOAP headers etc. directly, by doing:

Authentication auth = SecurityContextHolder.getContext().getAuthentication();
assert auth != null; // Is null if no WSS Header present in SOAP message!
String uid = auth.getName();
String pwd = auth.getCredentials();

The acegi-ws-security-xfire-example contains a working example implementing just that. (I built it by extending the XFire jaxws-spring example I have contributed earlier to the project; but the Acegi/WSS integration itself is unrelated to that, and the Handler etc. infrastructure should be easily reusable in other uses of XFire, e.g. POJO without WSDL).

SWSDL - Simple WSDL format, and my swsdl2wsdl

2006-10-15T23:51:00.000+02:00

Hand writing WSDL (Web Service Description Language, stop reading here if that doesn't mean much to you?) is a pain. The GUIs I have seen (whether XML Spy or Eclipse WTP or...) don't really change the fact that typing (or clicking, same thing) type and message and then a portType and then binding again and then finally a service... jeez!

Let's not go into the Contract First (writing WSDL and XSD) versus Code First (e.g. Java first and then generating WSDL and XSD from it) debate here. Let's assume you think doing SOA with Contract First makes sense, describing a service interface in XML Schema is sensible, but what bothers you too is having to write that WSDL, because you are lazy, and like me you think that might be a Good Thing.

Now, of course, there is WSDL 2.0 which promises some (!) simplification on the horizon, or maybe not (on the horizon even, or simplification)... whatever, it's not here today. Other ideas and tools which float around include e.g. WSCF (and jWSCF), but all I really wanted is a simple, platform/language-neutral form to describe a "service", referencing an XSD file for the Schema -like how hard is that? If "extensibility" is really needed, that "form" could allow extensions, but the normal most common use case should be simple.

So I designed SWSDL - Simple WSDL, a swsdl.xsd and a little converter (swsdl2wsdl) that generates WSDL 1.1 from my SWSDL. Here is a page where I compare hand-written SWSDL (Simple-WSDL) and the auto-generated standard WSDL by wsdl2swdl. Interested? Download swsdl-distribution-0.5.zip and give it a shot!

If you find this useful, let me know (post a comment on the blog) what you think. I might put this thingie on Sourceforge or Java.net or somewhere. For now, the src is in the swsdl-project-0.5.zip, but do try the swsdl-distribution-0.5.zip first as it has an example and launch script.

soapUI

2006-10-10T15:16:00.000+02:00

If you develop SOAP-based Web Services, there is a tool that you will not want to miss once you have tried it. It's soapUI, an open-source GUI for easily and very quickly creating and firing off SOAP requests. (So basically, you feed it WSDL, it creates sample SOAP requests for you, you edit those in a simple but functional XML editor, and Send it to see the response.)

This is one of the advantages of an SOA using XML as platform neutral lingua franca of message exchange for integration purposes: A machine readable representation (XML schema and WSDL) to describe services and make them discoverable and easily invokable by tools, such as soapUI. And no JAR files like for RMI services, no IDL compilers... it's a data format, there is a commonly agreed description of it, and tools can construct and consume messages - easily, and even "simple" tools.

Even technical business analysts can perform functional testing of services, as suggested and successfully happened in one project I was coaching. (SOAPui also has performance and stress testing features, I haven't actually used those yet, but recently recommend it to somebody who was looking for a tool to model such test scenarios on a few web services.)

Of course, some commercial tools offer similiar features (e.g. XMLSpy, Mindreef SOAPscope; probably others) but soapUI is free, simple - and works really well, something is just "right" about it.

BTW: SOAPui just got better (what will probably end up being v1.7), with added support for automatic forced validation of request/response messages in editors - an additional new useful SOAPui feature suggested and discussed with the SOAPui team by your humble author of this blog! ;-)

Machine translation progress

2006-10-06T13:38:00.000+02:00

Machine translation seems to have made impressive progress in the last few years. Running e.g. a Wikipedia Article article through Google Language Tools or Systranbox.com (which produces the almost identical translation) actually creates a more than just rough translation (as I think they did maybe 5-6 years ago); it's not really "correct" of course (as a human written equivalent article), but... "reasonably understandable" definitely, I'd say.

Now, I always thought of MT as an end-user tool; one would consciously use it, knowing fully well that it's a machine translation. Apparently not everybody agrees though... For example, I came across an article on Microsoft MSDN in German, which at first glance got me thinking, wow, these guys translate MSDN content? Very kind. Then I read more carefully... and somehow it didn't sound right (we don't say "seit wir uns Ihnen in der ...-Kolumne MITGETEILT haben" -- do we??). Hey, wouldn't some statement like "This is machine translated content. We hope the content is of interest and use to you in this form. (And maybe also:) Click here to order a high-quality human translation of this page" - using some Service Façade to a translation services company.

GMail offline - via Google Desktop

2006-08-31T08:59:00.000+02:00

I just realized that you CAN read Gmail offline... via Google Desktop! (You have to enable that "Search Gmail [X] Index and search email in my Gmail account" thingie; if you do, full copies of all Gmail Messages appear to be stored locally.)

XFire Example: Contract First & Spring

2006-08-25T15:03:00.000+02:00

From: Michael Vorburger
Subject: Proposed new XFire example: Use of wsgen/xfire (contract first), and Spring
To: user@xfire.codehaus.org

Hello,

The XFire distribution includes only one simple example of a "contract first" design (write WSDL/XSD and generate Java from it), the 'geoip-client'. There is also a simple 'spring' example in the current distribution.

I put together another, more complete such example, which runs wsgen with the JAXWSProfile. In addition, my example also ties the former together with Spring, showing both the XFireExporter as well as the XFireClientFactoryBean (which the 'spring' example does not).

ZIP is on http://www.vorburger.ch/blog1/xfire-examples-wsgen-jaxws-spring12.zip

Regards.

PS: If the ZIP does not work for you, you might have to follow the instructions that mvn prints, to locally install the the modules/xfire-jaxws-1.2-RC.jar found in the xfire-1.2-RC distribution, as that does not appear to be on the Codehaus repository today.

Electronic Passports - done all wrong?

2006-08-08T16:08:00.000+02:00

Yesterday the morning newspaper carried a (very short) article about new Electronic Passports being hacked or something like that. I wanted to know what that was about, and some Googling revealed that the article must have been talking about a demonstration at the BlackHat conference, as e.g. mentioned on Bruce Schneier's blog.

After having read up on this, I am a bit perplexed - what are they actually trying to achieve with this electronic passport?? More "throughput" at border controls because of contactless machine reading? Nice, but the OCR readable text at the bottom of new passports should already achieve that, doesn't it? More "security" - like what? Just prevent changing data in a passport (what's the scenario)? Granted, that appears to be achieved by digitally signing the data in an RFID chip on the passport. But prevent forging passports? Not really... in fact, after having read up on the architecture, it appears terribly EASY to read the digital information (contactless, from a distance!!) in one passport and copy it into another (stolen or not) one, electronically not distinguishable. This is little better than the rechargable card for the washing machine!

If you do want to have a reliable system to track and prevent abuse, why not do it right, with a hardware PKI chip thing, that securely stores a private key (ideally generated on the chip HW itself; NOT generated externally and transferred into it)? Probably not impossible to read & copy from either, but certainly much much more secure, from what I understand. A HW chip like in the SmartCard I now to carry to work for one client, or like my ThinkPad laptop has built-in (BTW: I didn't get that working with Thunderbrid/Firefox; do I need a special PKCS#11 module or something - somebody knows where to find that??).

Or is there picture or some properly reliably biometric information in the RFID chip data that could used to match the person presenting the passport to the person it was originally meant to be issued to? That would be an idea I guess... would that work & help? Haven't read anything in that direction though.

Or is it a cost problem? I can't imagine a small proper HW crypto chip to be that expensive, certainly not if purchased in volumes as this would be about.

PS: The actual form factor, i.e. whether it really is a credit-card size SmartCard, or that kind of chip embedded in the cover of a plastic passport, seems like an orthogonal issue to me; although it may be interesting to note that many countries in Europe have credit-card size "identity cards" that we use to travel within Europe, instead of the full-blown passports. Equally orthogonal to the chip itself is the access technology - although I admit being equally or even more stunned on that aspect.. contactless and remotely readable... the practical reasons are (somewhat) plausible, but imagine the implications - what are they thinking?? If at least it had a big red on/off button or something like that! This is off course just the tip of "non-technical" aspect of this entire topic... I won't go into that here.

Setting up two-way (mutual) SSL with Tomcat on Java5 is easy!

2006-08-08T15:13:00.000+02:00

I recently wanted to set up Tomcat for two-way (mutual) SSL. It turns out this is fairly easy, particularly with Java5 since it now provides writes, and not just reads, of PKCS#12 keystores directly, so you don't actually need to use openssl anymore, as most of the instructions I found online about this suggest. I needed this for a test of something, and wasn't interested in using a Certificate Authority (CA) etc. All I wanted was an easy set up with Tomcat (v5.5.15/17 used) for testing; other people were going to worry about CA and issuing procedures and all later. Here is how:

1) Create the key & cert for the Tomcat server:

%JAVA_HOME%\bin\keytool -genkey -v -alias tomcat -keyalg RSA -validity 3650 -keystore /path/to/my/tomcat.keystore -dname "CN=localhost, OU=MYOU, O=MYORG, L=MYCITY, ST=MYSTATE, C=MY" -storepass=password -keypass=password

Note that the storepass and keypass *HAS* to be the same here. The CN should be the host/machine name that will appear in the HTTPS URL when accessing this Tomcat, so e.g. localhost, or also *.domain.com I believe.

2) Enable the SSL connector in Tomcat's conf/server.xml:

<connector port="8443" maxhttpheadersize="8192" maxthreads="150" minsparethreads="25" maxsparethreads="75" enablelookups="false" disableuploadtimeout="true" acceptcount="100" scheme="https" secure="true" sslprotocol="TLS" clientauth="true" keystorefile="path/to/my/tomcat.keystore" keystorepass="password" truststorefile="path/to/my/tomcat.keystore" truststorepass="password">

In keystoreFile you can specify an absolute pathname, or a relative pathname that is resolved against the Tomcat root installation directory. You also have to specify the truststore. (The stores don't have to be in a user home directory.)

If all you wanted is well-known one-way SSL with no client certificate, you would have to change the above to clientAuth="false" and stop here, else do as above and keep reading for the interesting part.

3) Create the client (yours, or a machine's) key & cert:

keytool -genkey -v -alias vorburgerKey -keyalg RSA -storetype PKCS12 -keystore vorburger.p12 -dname "CN=Michael Vorburger NEU, OU=DerTest, O=DieOrg, L=Lausanne, ST=VD, C=CH" -storepass mypassword -keypass mypassword

This looks and is similar to 1) above, but we are storing this into a different keystore (because the server/Tomcat doesn't have your private key) of storetype PKCS12. On Windows, you can double-click and import this *.p12 file into IE, or add it to Firefox via Tools / Options, Security, Certificates, View Certificates, Import. You'll have to type in the mypassword (above). BTW, again the storepass and keypass *HAS* to be the same here, else Windows/IE or Mozilla Certificate importing will fail.

4) Now we need to add the certificate (containing the public key) to the Tomcat keystore so that it recognizes this client certificate, by first exporting it from the keystore from step 3 and then importing it into the keystore from step 1: (Typically you probably would not import each client cert but a CA root cert and then sign each client cert with that one, but as said, I am showing a simple setup for tests here.)

keytool -export -alias vorburgerCert -keystore vorburger.p12 -storetype PKCS12 -storepass mypassword -rfc -file vorburger.cer

keytool -import -v -file vorburger.cer -keystore tomcat.keystore -storepass password

On Windows, you can double-click and see the vorburger.cer. You may also would like to list the contents of the tomcat.keystore via this command, and notice how the entry for the 'tomcat' alias is a keyEntry, but the entry for the 'vorburgerCert' is a trustedCertEntry here - makes sense?

keytool -list -keystore ..\tomcat-server.keystore -storepass password

5) Just like with BASIC authentication, you still have to add this user to the usual conf/tomcat-users.xml, by specifying that dname from step 3) as username, and any password (will be ignored) and the roles you'd like that user to have:

<user username="CN=Michael Vorburger NEU, OU=DerTest, O=DieOrg, L=Lausanne, ST=VD, C=CH" password="null" roles="admin">

That's it! You should now be able to access e.g. https://localhost:8443, the browser should ask you for, or automatically send, the client certificate which the server used to 'strongly' authenticate you - done!

Some instructions also suggest to set <login-config><auth-method>CLIENT-CERT</auth-method> in web.xml, but apparently that's not actually needed on Tomcat with clientAuth="true" in server.xml.

Some notes for testing/debugging/trying that may be useful if you would like to try this too: IE just says "Cannot find server" if the server does not accept the client cert - not very helpful! Firefox says "Could not establish an encrypted connection because your certificate was rejected by localhost.", better. Also, if for test you remove a cert from IE again, you have to close it, all windows, shut it down - else it's still in memory although it does not appear in respective dialog anymore.

PS: Some copy/pasted background information that may be of interest... "The PKCS#12 (Personal Information Exchange Syntax Standard, specifies a portable format for storage and/or transport of a user's private keys, certificates, miscellaneous secrets, and other items. The SunJSSE provider supplies a complete implementation of the PKCS12 java.security.KeyStore format for reading and write pkcs12 files. This format is also supported by other toolkits and applications for importing and exporting keys and certificates, such as Netscape/Mozilla, Microsoft's Internet Explorer, and OpenSSL. For example, these implementations can export client certificates and keys into a file using the ".p12" filename extension.

J2SE 1.4.x provided read-only support for PKCS#12 keystores, and a small number of protection algorithms. The enhanced PKCS#12 keystore in J2SE 5 supports reads and writes of PKCS#12 keystores, and provides more protection algorithms (such as those supported by popular browsers). This improves interoperability of PKCS#12 keystores imported/exported by J2SE, browsers, and other security applications."

Lego

2006-08-06T23:55:00.000+02:00

Posted snaps of some LEGO constructions I made with Dév...

WSDL Validation with wsdl4j

2006-07-17T16:09:00.000+02:00

Imagine a set up where a team A provides Web Services to Team B. The service team A uses a "contract first" SOA approach, so they hand-write WSDL (more on that another time) and generate Java from it (not the other way around). Team A then implements these services using XFire as their SOAP stack. Now Team B takes these WSDL documents and generates client code from it, using Axis1.

Now WSDL being a standard format, this is a painless no-brainer, right? Right. Turns out Axis1 has a small but annoying bug which leads to it generating invalid Java code, which does not compile, from technically perfectly valid WSDL (if the 'name' of a <wsdl:message> used for a Fault has the same name as the actual <xsd:element> referenced by the <wsdl:part> in the <wsdl:message>). Easy to slightly adapt the original WSDL - once you have figured this out.

Of course, being "agile", I don't want this problem to come back haunting the team every so often, and thought about how to enforce/test the hand-written WSDL, which is perfectly valid technically, for this specific condition, during the automated build.

Turns out that thanks to JSR 110 & wsdl4j, this is pretty painless! The little WSDLValidationTask for ant (download WSDLValidationTask.java source) that I ended up hacking together is used like this:

<taskdef name="wsdl-validation" classname="wsdlvalidation.wsdl.WSDLValidationTask" />
<wsdl-validation>
<wsdl dir="wsdldir" includes="my.wsdl" />
</wsdl-validation>

Making Movies

2006-06-07T01:15:00.000+02:00

The other week-end Dév and I made an animated movie of his current favourite toys, including soundtrack. He loved it - almost as much as "real" Thomas the Engine episodes.

PS: Thanks Google Video for hosting; neat! I wonder if the link above will still work in a few years?

Simple HTTP Server in Java

2006-06-07T00:47:00.000+02:00

Just for fun (well, almost), I wrote my very own simple HTTP server in Java (download 100 KB ZIP) the other night. It uses Java5 features, and requires no external libraries. While it certainly does work and can serve a static website HTML+image site, it is of course NOT meant as a "real" web server, so do NOT use it - it's instructional, and it sure was fun to code!

PS: Almost eight years ago, I put online a Proxy Server written in C on my website, and to my big surprise, during all the years since, every now and then a CS student (presumably asked to write one for class, just like I had at the time), emails some questions... So just in case folks, if you found this page because you are looking for a cheap way out for your homework, by all means download and look at it - but then fix/improve it, and quoting the source and explaining your enhancements! And put a quick comment to this post below.