Developer Central Blog

Use Case Driven is out there (finally!)

Tue, 30 Jan 2007 08:00:00 GMT

And just one other thing...

It took a while to reach me in the UK; and it seemed as if lots of people in the States had already seen it, but I finally saw a copy of Use Case Driven Object Modeling with UML – Theory and Practice today. Got to say, just seeing the book in actual book form was well worth the 2 years of writing and rewriting that I and my co-author Doug have put into it.

It’s hardcover, and printed in 2 colors (black and red); we’re using red to highlight UML modeling errors, and the printed version looks much better than I’d imagined.

The central premise behind the book is: how to get from requirements (use cases) to source code and unit tests, using a core subset of the UML. The book’s central example uses Spring Framework and JUnit; so, while it isn’t specifically a book about Spring or JUnit, it can be used as a tutorial on how to create a rigorous, object-oriented, fully unit tested design for a Spring web application, from an initial set of use cases and a high-level domain model. There are loads of example diagrams and exercises, and fictional conversations between programmers and reviewers, to get you there.

In other news, this is to be my final ‘Developer Central’ blog entry; I’ve been updating the blog on a regular basis since April 2005. It’s been fun! In case you’re interested, you can find out what I’ll be doing next (in fact what I’ve already started doing) at my regular website. Ciao!

Reducing Bottlenecks in the JEE Stack

Sun, 28 Jan 2007 08:00:00 GMT

Network overhead and how to cope with it

This article at JavaLobby provides some good insight into the issues faced when creating distributed enterprise applications. The article focuses on Java technologies, but the issues faced are primarily about network overhead using any platform.

These days, it’s almost a “given” that communication between enterprise server nodes will involve an Object Request Broker (ORB) of some sort for remote method invocation (e.g. Java's built-in RMI mechanism). An ORB handles marshalling and de-marshalling of objects being sent between nodes. The ORB acronym even seems old-fashioned now, as their use has become ubiquitous in the enterprise. It’s a bit like saying “I’m going to fly in a mono-wing jetliner”: hardly worth making the distinction. Well duhh, of course you’re going to use an ORB, so why even specify it?

So if some (not all!) enterprise architects virtually take for granted that an ORB will be used, then the question of network performance tends to get brushed over, or even ignored altogether. As the JavaLobby article suggests, though, network traffic (specifically, remote method invocations) can be a major bottleneck in a distributed application. All those objects flying back & forth can bring the network to its knees.

One possible solution (as suggested in the article) is to use the quasi-open source Terracotta library in place of Java’s built-in RMI. Terracotta uses a clustering approach, which sets it apart from the traditional ORB approach (more about that in a moment).

The messages following the article, while threatening to degrade into a battle of open-source license pedantry, do pose some interesting questions. But the nature of the questions also highlights the point that distributed objects are so common nowadays that architects almost don’t question the wisdom of distributing objects at all. It’s worth remembering Martin Fowler’s (in)famous law of distributed object design: don’t distribute your objects!

Luckily though, Terracotta is a step in the right direction, as it’s primarily a clustering solution: it works by maintaining a separate copy of the same object graph on each server node. So, crucially, method invocations are local. (This is also what Fowler recommends as a superior alternative to distributed objects). If an object changes within the context of a lock, the delta (not the whole object) is propagated across the cluster.

This is an altogether more sensible solution than the traditional and naïve ORB approach of having remote objects “talk” to each other via method invocations across a network, in which every object parameter must be serialized and sent. “ORB-happy” enterprise developers still in doubt should devour the JavaLobby article and take a peek at Terracotta.

An Agile Development Environment

Sat, 27 Jan 2007 08:00:00 GMT

A fuss-free starting-point for agile Java web projects.

Open source developer John Gilbert provides a recommended agile development setup, using open source software. The assumption is that you’re developing a server-side app with Java (a reasonable assumption to make these days).

For example, he recommends Subversion (SVN) for version control; and in particular the SVN 1 Click Setup utility. For running JUnit tests, he suggests using Hypersonic, an in-memory database. Because it’s in-memory, it’s super-fast therefore ideal for a test-driven development cycle, which requires unit tests to complete in a matter of seconds.

Incidentally, the open-source HSQL database is the successor to Hypersonic (it's based on Hypersonic's code base), and therefore also has an in-memory database mode; we use HSQL for unit-testing the example web/Spring project in the just-released Use Case Driven Object Modeling (i.e. the project is “agile-friendly”!).

John also has recommendations for server hardware minimum setup, continuous integration build software. Interestingly there’s no mention of Ant for automated builds, even though Ant is the standard du jour these days; this suggests that John’s recommendations are based more on personal experience than considerations such as developer familiarity/availability. Still a nice, brief list though, and a useful “fluff-free” starting-point if you’re just getting started on a new Java web project.

Also check out John’s “model driven architecture on rails”, Taylor. The project’s goal is to make creating J2EE applications as easy as Ruby on Rails, by utilizing the OMG’s Model Driven Architecture (MDA).

Book Review: The Design of Sites

Sat, 20 Jan 2007 08:00:00 GMT

Design patterns finally reach the shores of Website Design Land.

The Design of Sites: Patterns for Creating Winning Web Sites (2nd Edition)
by Douglas K. van Duyne, James A. Landay, Jason I. Hong
Prentice Hall, December 2006

These days, blogging software and content management systems allow users with hardly an ounce of design sense to create professional-looking websites, using pre-fabbed “off-the-shelf” templates. But there’ll always be circumstances when you need to do it the old-fashioned way, and create a website design from scratch. And, even for off-the-shelf "armchair web designers", it's still important to have at least a basic understanding of web usability principles.

Luckily, for website design DIYers and professionals alike, there’s now a way to pick a pre-fabbed design off the shelf: the trend for patterns has reached the shores of Website Design Land.

The Design of Sites is a huge (1,000-page) book packed with website design patterns, all presented in full color. The thin pages and bold, color-coded presentation give the book a sort of Sears catalog feel; thumbing through the book searching for the right pattern is rather like searching for a PERMA-PREST(TM) wool-look jumper or a bonded-polyester Knit Pants set. But don’t let that put you off!

It would be an understatement to say that the web is a free-form medium. With so many different solutions for an ever wider range of problems, the world needs some systematic cataloging and pigeon-holing of all the disparate designs out there. And this book does an admirable job of doing just that. Patterns are grouped conceptually, starting with a high-level look at site genres: personal e-commerce, news mosaics, educational forums, blogs, and so on. Other pattern groups include: writing and managing content, building trust and credibility, basic e-commerce, advanced e-commerce, making navigation easy, speeding up your site, and so on.

There’s also a group of three patterns related to the mobile web: increasingly important, as more people access the web over 3G (or 3.5G now) mobile networks.

Within each group, the patterns are mostly task-oriented: so within the Making Navigation Easy group there’s a navigation bar pattern; and further patterns called Unified Browsing Hierarchy, Tab Rows, Obvious Links, Site Map etc.

When you drill down to the individual patterns, each one is presented in the traditional design pattern format: first some background info; then an exposition of the problem that this pattern solves; then the solution; and finally a discussion of some other patterns to consider. This cross-referencing is important, as no individual pattern represents a complete website design. Rather, they’re more like building blocks and cross-cutting aspects.

Each pattern includes a deliberately hand-sketched wireframe diagram, to illustrate the solution. For example, the Multiple Ways to Navigate pattern provides techniques that support how customers navigate sites. The Problem section introduces the burning issue: that customers navigate web sites in many ways; and if any of the key navigation tools are hard to find or missing, visitors will find the site tedious to use. The Problem section also introduces some motivators for applying this pattern; e.g. impulse (seeing an unexpected link) sometimes drives customers to act: witness all those “If you liked this, you’ll also like...” and “Other customers also purchased...” links on amazon.com.

The Browsable Content pattern (problem: “Browsing content on a site can be difficult if the information is not organized”) includes a screenshot of Walmart.com, illustrating its easy navigation and clear signals for users to find their way back to where they started. In fact, nearly every pattern includes a full-color screenshot of a real website to demonstrate proposed solution.

I can’t stress enough the huge amount of information available in this book: it’s something of a website designer’s dream. It’s written in an information-packed style: great for absorbing details quickly. The concise, dry style might become rather trying after a while, but luckily, the easy-on-the-eye layout and the accessible pattern format keep the book readable. Go get it, it’s a good one.

Nasty Oracle/Java 5 Bug

Mon, 15 Jan 2007 08:00:00 GMT

Innocent bug lops off trailing zeroes

Users of Oracle (via Oracle’s JDBC driver) who are considering moving their development to Java 5 – or 6, for that matter – should think carefully before doing so. As reported on JavaLobby, a driver bug was recently discovered which lops a zero off the end of any values returned from a NUMBER column. The bug was discovered in Oracle 9, but also appears to be present in 10.

Initially, it looked as if there wouldn’t be a fix until the release of Oracle 11g – which given the glacial speed with which companies tend to upgrade their databases (a good thing, in and of itself), would have meant it would be 2010 at least before the fix would be out there in the field. Luckily though, Oracle’s product management team has confirmed that this issue will be fixed in the upcoming 10.2.0.4 and 10.1.0.x patchsets. (Specifically, they’ve logged it as bug # 5527479).

But in the meantime, of course, the bug exists for any users of Oracle 9 upwards using Java 5 or 6, who are using the default Oracle drivers. So tread carefully!

Astound your Users: Fade to Yellow

Mon, 08 Jan 2007 08:00:00 GMT

A user-friendly Ajax technique that’s surprisingly easy to implement.

37signals, the paragon of Web2.0 UI spiffiness and creators of Ruby on Rails, took great advantage of Ajax when they created Basecamp, a project management and collaboration product. In many ways it's a showcase user-friendly web application.

An especially nice effect in Basecamp is the “attention-grabbing yellow fade”, in which a component flashes to yellow and then fades slowly away. The user’s attention is thus drawn towards the flashing component.

As this blog entry illustrates, adding the same effect to your own web applications is surprisingly easy. In fact, strictly speaking this isn’t even a true “Ajax” technique as such; it just uses some nifty JavaScript/DHTML.

Of course, it’s possible to overuse the effect, and end up with components flashing yellow (or whatever color you choose) all over the page. Naturally, this would lessen the technique’s impact, turning your page into one of those epileptic fit-inducing “congratulations you’ve won, click here!” flashing banner ads. The technique’s value is in its ability to stand out from an otherwise static background, so should be used with caution.

XML Parsing: The “What”s and the “Why”s

Thu, 04 Jan 2007 08:00:00 GMT

An article on IBM’s DeveloperWorks site describes the three main options you have available when choosing how to parse an XML document. It’s a neat summing-up.

The first choice, using an object model API such as the portable and W3C-standard DOM, will be intuitive to most programmers: your code queries the document and gets one or more XML nodes back.

The second choice, using an event API such as SAX, is less intuitive because it turns the tables. In effect, your code is pinged via an event/callback mechanism while the parser traverses the document. Although more difficult to understand and trickier to get working initially (more code to write), event APIs prove useful under certain circumstances: e.g. when streaming large documents where you don’t have the whole document in memory at once to be able to query it.

The third alternative is to generate an object model from the XML schema, resulting in a custom parser. This should result in less manually written code that you have to write and maintain, as all the boilerplate parsing stuff is done in the generated parser.

The decision of which parser type to use depends, of course, on the nature of the problem. Go check out the DeveloperWorks article to work out which one is best suited to your project!

Developing and Testing Web Services

Sun, 31 Dec 2006 08:00:00 GMT

soapUI: a nice, free SOAP client.

If you’re developing or testing web services, you’ll be wanting a nice, free SOAP client: and soapUI fits the bill nicely. It’s a desktop application for inspecting, invoking, and developing web services over HTTP. It’s also a testing tool, so you can do functional, load and compliance testing of your web services.

For web service inspection and invocation, the product shows imported WSDLs as a hierarchical view of interfaces and their operations. It can generate requests from associated schema, and supports Basic, Digest, WS-Security and NTLM authentication.

If you’re developing and validating web services, soapUI can generate both server and client code for many target SOAP APIs, including JBossWS, JAX-RPC, JWSDP, JAXB, Axis, XFire and .NET 2.0. It can also generate WSDLs from existing Java code; and generate XML Binding classes. For Ant and Maven aficionados, there’s good command-line support, so it’s pretty easy to integrate soapUI into your continuous integration/build environment.

Finally, if you’re doing functional or load testing, soapUI will create test suites/test cases containing requests to imported web services; and can create any number of load tests for a test case. Customising generated code can be problematic, but soapUI gets around this by allowing you to add your own Groovy scripts for custom functionality.

Version 1.6 brings with it a number of improvements, including: WSDL caching and exporting; JUnit Reports for running functional tests from the command line; and support for importing secured WSDLs.

soapUI comes in various flavors: the traditional, downloadable application; as plug-ins for various IDEs (not just the obligatory Eclipse, refreshingly: there are also plug-in versions for NetBeans, IntelliJ and JBossWS – which is, admittedly, itself built on Eclipse).

As the client is written in Java, it’s also available from the soapUI website as a Java WebStart (JWS) app: just click to launch, no installation required. As long as you have the correct version of Java installed, of course. The JWS version is great for getting started quickly; or you could even use it solely, instead of an installed copy, and thus be guaranteed to be running an up-to-date version of the software. It’s possible to run the latest snapshot build via JWS, which is useful for checking the latest bleeding-edge copy. If you encounter a bug, you don’t need to uninstall to return to the previous version: just click on a different link.

There’s an on-line user guide, and a Getting Started guide which uses the Amazon Web Service as an example. (Lucky they didn't use Google's SOAP Search API)...

Accelerate your Web apps by Tricking the Browser

Fri, 29 Dec 2006 08:00:00 GMT

Your users' ill-configured web browsers could be costing you money.

There’s a clever idea in this blog entry at Ajax Performance. Web browsers typically make 2 concurrent connections to any one web host. In fact, IE and Firefox by default restrict users to 6 connections total, and 2 connections per host. For users on a dial-up connection, this makes sense; but increasingly, your users will be connecting to your website over a broadband connection. Result? Lots of idle bandwidth while their browser trickles images down over those two socket connections, meaning slower page load times.

Should we care that our websites display slowly, when arguably it’s our users’ browsers that are mis-configured? Quite possibly. A recent survey by Akamai showed that Internet shoppers will only wait an average of four seconds for a web page to load before giving up. So ignoring this problem could be costing you money.

Of course, you could politely ask all your users to fiddle with their browser settings and increase the number of concurrent connections. But a far cleverer way is to trick the web browser into opening more connections to your server.

How? Simply configure your webserver to retrieve its images from more than one host, e.g. images1.mydomain.com, images2.mydomain.com and so on. The clever part is that all of these point back to the main host, so you’re not actually adding more servers. An example of this trickery in action can be found at Google Maps, which dispatches its image tiles from mt0.google.com through mt3.google.com.

A refinement of the technique (as pointed out in the blog comments) is to use wildcard DNS entries, and again make them all resolve to the same IP address. This approach has slightly less maintenance overhead than specifically listing certain CNAMEs. As also pointed out in the comments, you should consistently use the same host names/numbers for the same images, so that browsers can cache the results.

As demonstrated in the article, going from 2 connections to 6 concurrent connections resulted in an average 40% drop in page load times. This technique will work anywhere you've got a large block of resources served by one host: and it could just save your customers from wandering off in search of a faster e-commerce site.

Hack not this book

Thu, 21 Dec 2006 08:00:00 GMT

Thought-provoking essays on software development, in a free book.

I’m sure there’s a pun in there somewhere that combines Steal this Computer Book (a self-styled book about network hacking) with Hacknot (a website about software development, by the anonymous Mr Ed). But regardless, the Hacknot book, which should be available sometime this month (which means they’re cutting it a bit fine already) can be downloaded for free as a PDF from the author’s website.

The book contains essays on software development that have previously appeared on Hacknot, dating back to July 2003. It’s 200-ish pages of software wisdom: and whether you wait for the pulped-tree edition to be available, or download the free PDF – or simply read the articles on Mr Ed’s website, for that matter – these are all essays that deserve to be read.

The downloads are available in two page sizes: 6” x 9” (296 pages) and A4 (163 pages, with text in 2 columns). The second format is, of course, ideal for those who’d prefer to print the thing out and read it on the train (or in front of a roaring fireplace this Christmas; or by torchlight on the roof while Santa-spotting).

Example essays include: The A to Z of Programmer Predilections, The Hazards of Being Quality Guy, Corporate Pimps: Dealing with Technical Recruiters, and Extreme Deprogramming. These are all well written and thought-provoking essays.

Sensibly, Mr Ed has slapped a Creative Commons license on the book. This means you can read and distribute it for free, but doing unsavory things like modifying it and/or passing it off as your own work, is strictly verboten.

Highly recommended, whether you grab the free download or wait for the in-print version.

Plug and Play Database Clustering

Tue, 19 Dec 2006 08:00:00 GMT

Java-based Sequoia turns your JDBC app into a load-balanced enterprise app

It never ceases to amaze me what you can get for free these days (whether that’s free as in beer doilies or free as in freedom).

Sequoia is an open-source offering that, so its creators claim, can give your application clustering, load balancing and failover support without any modification of your existing applications or databases. The main requirement is that all database accesses are performed through JDBC.

Simply swap in the Sequoia JDBC driver, and point the server at your choice of databases (MySQL, PostgreSQL, Oracle, DB2 etc). The product gives you performance scalability, fault tolerance and high availability. It also offers additional features such as monitoring, logging, and SQL request caching.

It’s a Java implementation that makes use of the JMX (Java Management eXtensions) API. So you can use your favorite administration and monitoring tool – as long as it supports JMX, of course. Rather a nice JMX console which is seeing lots of active development currently is MC4J.

Although Sequoia is open-source, its creators Continuent, Inc. provide paid-for support, training and consulting, in addition to their database high availability and load balancing software.

A Brief History of the Button

Tue, 05 Dec 2006 08:00:00 GMT

Destination elevators make dizzy passengers bump into walls, reportedly.

These days there’s a niche for everything. Within IT we have software development and system design; within system design we have interaction design (not at all limited to IT, of course); within interaction design we have specifics such as usability; and within usability, we now have… the button.

Or, more to the point, there is now a website dedicated to the history of the button, from an interaction design standpoint. That’s quite some niche. But it’s an illuminating website that teaches you about so much more. Buttons are merely the vehicle; a surprising number of interaction design principles center on the humble button.

Recent articles, courtesy of HistoryOfTheButton.com’s creator Bill DeRouchey, include: Pushbutton railroading in 1939; Toddlers love buttons; Pressing the Reset Button (3 guesses which movie that one discusses); and Kodak: You press the button.

But the article that caught my eye was to do with elevator buttons. Elevator design is an ancient(-ish) problem that is often used for the obligatory mind-warping example in systems design texts (both the IT sort and the UI design sort). It’s used so often because elevator design seems simple at first: deceptively so. After all, an elevator can only go up and down, right? People get in, choose the floor they want to go to, the elevator takes them there. But elevator design quickly presents some thorny and convoluted problems. What happens if a button is pressed more than once? Or if half the people want to go up, and the other half want to go down? Or if there’s some old grouch who just wants to stay on the same floor? (Unlikely, that last one). Can the queue be optimized beyond the simplistic “FIFO” to clear the backlog of punters faster? If the elevator is in a really tall building, the design had better be right, otherwise there’ll be queues stretching five times around the entrance lobby. Just like in the Empire State Building, last time I visited.

One of the main benefits of elevator UIs is that they’re familiar (aka intuitive): first you press the Up button or the Down button; when the door opens you walk into the elevator, then press the button labeled with the floor where you want to go. Change that, and the ingrained habits of several billion people get thrown into turmoil.

As if to demonstrate the chaos that can ensue from inverting a time-honored system, the Swiss company Schindler Group has installed nearly 3,000 so-called destination elevators, in which you must first type the floor number into a keypad located outside the elevator, then walk into the elevator. Inside, the walls are flush, minimalist; the kind of perfect, sheer design that can only be achieved through… no buttons. So if you dived into a crowded elevator just as the doors were closing, and forgot to choose your destination first, then you’re basically stuck. That elevator’s going wherever it’s going, like it or not.

The comments following the article are also worth a read, as they highlight another problem with the new elevator design: the keypad located outside the elevator just doesn’t look like the familiar elevator keypad, with its columns of floor buttons. This goes some way toward explaining why so many people reportedly just run into the elevator and then (too late) realize their mistake; and why users are having to be given training just to use a seemingly simple, one-dimensional device.

Book Review: Practical PHP and MySQL

Sun, 03 Dec 2006 08:00:00 GMT

Linux-style web development for Linux, Windows or Mac users

Practical PHP and MySQL: Building Eight Dynamic Web Applications
by Jono Bacon
Prentice Hall, November 2006

Want to learn to program using PHP? It would be tempting to pick up a PHP programming book, but you might be left with a profound feeling that you’ve learned lots of theory, without really having learnt how to apply any of it to a real-world web project. That’s where Practical PHP and MySQL comes in. The book teaches you PHP along with the open-source MySQL database; but it does so by walking you through no less than eight fully-functional web applications.

These are not trivial apps, either. They are: a generic website (okay that one’s a bit trivial, but it’s a good starter; sort of the “hello world” of complex webapps); a weblog; an auction site; a shopping cart (more of a component in an application, but I’m not quibbling); a discussion forum; a FAQ management site; a news site; an independent PHP application; and a simple AJAX calendar.

And the book doesn’t shy away from the technical details. For example, Chapter 7 (Building an Online Auction Site) deals with user registration and logging in; viewing auction items with pictures and placing bids (as you’d hope for an auction site); emailing the winning bidder; and designing the auction database. The chapter on creating a web-based calendar delves into various techniques for creating Ajax applications with PHP, naturally via XMLHttpRequest.

Given the number of applications presented, the book weighs in at a respectable 500 pages. I could imagine many authors making a meal of all that content and turning in a bloated 1500-page manuscript; so the author has done a good job of keeping the page-count down, without skimping on the details.

The first couple of chapters walk you through the technology being discussed, and describe how to set up PHP and MySQL; how to get started with each, and how to hook them up. Then each of the eight example applications gets its own 40-page chapter. Finally, there’s an appendix which provides some pointers on web site design using stylesheets.

There’s a huge amount of information in this book, and it’s all very practical and hands-on; so I’m tempted to overlook the occasional slip into “overly agile land” with lifecycle advice such as: “Just sit back, sketch an initial idea of how to code the feature, and hack it in.” Overall, though, the technical advice given in this book is sound.

The author, Jono Bacon, is an active member of the Linux community and an advocate of free software. He works for Canonical (sponsors of Ubuntu Linux) as the Ubuntu community manager, and contributes to a range of open source projects.

This book is part of Prentice-Hall’s new Negus Live Linux series. Although the series title suggests that this is Linux-only development, both MySQL and PHP are also available for Windows, Mac OS X and Solaris; so users of those OSes aren’t left out. Having said that, there’s quite a Linux flavor to the book, and (kind of the point of the Live Linux series) the bundled CD includes a bootable Linux live CD, set to run all eight example applications. The Live CD loads up a Linux environment and can be booted into from any PC, regardless of the OS already installed.

In fact, it’s unusual to see a book come bundled with a CD-ROM these days. But the CD included with this book is very well set up, and saves you from having to trawl the web downloading the exact versions of everything needed to develop and run the examples. It’s all basically there on the CD, set up and ready. This includes XAMPP for Linux: a preconfigured Apache distribution that includes MySQL, PHP and Perl; all the example source code, and a remastered Ubuntu Live CD.

If you want to learn PHP and MySQL and follow along with some useful real-world examples in the process, this is the book for you.

The Mysterious Case Of Analysis Paralysis

Tue, 28 Nov 2006 08:00:00 GMT

'Fully Dressed Use Cases, the Hallway Closet Approach' by Professor Moriarty

You know a book is nearly done when you're suddenly told you have to write an Introduction and get it back to the publisher within 24 hours. So I've been batting some ideas back and forth with my co-author Doug Rosenberg; in particular about how we should introduce the subject of analysis paralysis. Suddenly (a few minutes ago) Doug sent me this. This is definitely going in the Introduction!

The Mysterious Case Of Analysis Paralysis

It was a blustery cold rainy night at our flat on Baker Street. The howl of the wind whipping raindrops against the glass could be heard over Holmes' violin as I read the paper in front of the fireplace. Mrs. Hudson had just cleared away the dishes from our late supper of pork pie and beans, when Holmes suddenly paused in the aria he was playing, sat bolt upright in his chair, and exclaimed "Watson, the game's afoot!".

A few moments later, our good friend, Inspector Lestrade from Scotland Yard, clattered up the stairs and burst in the doorway, exclaiming "Thank goodness you're home, Mister Holmes, you've got to come quickly!". "Come in, Lestrade, pray take a seat by the fire and tell us every detail" said Holmes. "They're all dead, Mister Holmes, every one of them - the whole project's dead! And no signs of violence, not a mark on any of them!" said Lestrade. "Who's dead?" said I? "The entire staff of Scotland Yard's new automated fingerprint recognition system." said Lestrade. "The whole technical staff - sitting dead right in the conference room - as if they'd been frozen to their chairs!" said Lestrade.

"Has anything been touched?" asked Holmes. "No, I've left the strict instructions that the conference room be completely sealed off until you could inspect it." said Lestrade. "Most excellent" murmured Holmes. "You are learning, Lestrade. Come along, Watson" said he, and, grabbing our coats and hats, we hastened down to Lestrade's waiting hansom cab.

We shortly arrived at Scotland Yard and were escorted to the conference room, where we were confronted by a bizarre and grisly death scene. Still in their seats, but struck down by some mysterious assasin, was the entire staff of the new automated fingerprint recognition project. Holmes walked around the room excitedly, his highly trained senses alert for any sort of clue. He paused at the whiteboard, and again at a stack of UML books on the table. "You see, Mister Holmes, they're all dead, and not a mark on any of them. How could a whole project just die like that?", said Lestrade. "Elementary, my dear Lestrade...a clear case of that obscure poison from the Amazon jungle known as analysisparalysis. Perhaps you've seen my monograph on the topic? No? Tut, tut." murmured Holmes.

"But Holmes, how can you be sure?" I queried. "All I can see is these UML books scattered around the table. Here's one called 'Fully Dressed Use Cases, the Hallway Closet Approach' by a Professor Moriarty. It suggests you should stuff everything you can think of into your use cases, just like you do with the hallway closet", said I.

"You see Watson, but you do not observe...notice the three-day growth of beard on all the corpses, and the scrawls of <<includes>> and <<extends>> on the whiteboards?" said Holmes.

"Sure enough Mister Holmes, even the women have grown beards!" said Lestrade. "Great Scott!" said I, "Gives me the shivers."

"Analysis Paralysis, Watson" said Holmes. "The second fastest killer of software projects, after doingthesimplestthingthatcanpossiblywork, and nearly as dangerous. It's caused by a lethal overdose of formality and strict adherence to the UML semantics documentation. Moriarty's been up to his evil tricks again. You see the hollow expressions on the victims faces, caused by interminable meetings spent debating topics of marginal uselessness. The despair and the anguish. The feverish search for a practical approach instead of highbrow theories." said Holmes. "And all so easily avoidable", he sighed. "Come along, Watson, we have arrived too late." said he, and we headed homeward towards Baker Street and the fireplace.

Predictably Random

Tue, 21 Nov 2006 08:00:00 GMT

Java’s random number generator isn’t so random… but it’s meant to be that way

At first glance, the linked article seems like a disturbing expose of the limitations of Java’s java.util.Random class. The problem (as claimed in the article): Random just ain’t that random.

The linked page showcases a visual test applet which demonstrates quite ably that the Random class is, in fact, merely pseudo-random (or perhaps more to the point, its random series loops round much sooner than it should). When in full flow, the applet’s checkered pattern reminds me of a spaced-out game of Frogger. Lines whiz to the left and to the right as if the poor frog is trying to cross the German Autobahn. If Random was truly random, you’d see “snow crash”-style random static instead.

The applet’s deterministic behavior basically illustrates that Random would be a completely inappropriate choice for cryptographically secure systems (or rather, for systems that need to be cryptographically secure); and as the article’s title suggests, Sun’s definition of randomness is completely broken.

(Pause for dramatic effect).

Except... java.util.Random isn’t a random number generator at all, it’s a pseudo-random number generator: and it’s supposed to work that way. So, despite the sensational title to the article ("Sun redefines randomness!"), they've basically got it right.

That said, there is a slight hiccup in the implementation. The problem (as described in the linked web page) is that the random number generator repeats itself every 10^N when it should have repeated a lot less often. But this is a fairly minor issue given the intended uses of this class.

Random’s “contract” states that, if you feed it the same seed, you’ll get the same series of “random-ish” numbers back. Developers sometimes use this feature for testing and debugging purposes. So if the behavior of java.util.Random was “fixed” (as the article’s author suggests), much code out there in Java-land would break.

It shouldn’t break, because relying on the internal behavior of a pseudo-random generator is a bad, bad thing. Even simply relying on a class called “Random” for predictable results seems like a bad idea. Just from a Responsibility-Driven Design (RDD) perspective, perhaps these developers should have created their own class called Determinable, that simply returns the same old stream of numbers every time.

Another issue with the linked-to applet is that it’s taking a flawed approach. It repeatedly plots the least significant bit (LSB) of the Random.nextLong() method once for each point in the grid. If the applet plotted the most significant bit (MSB) instead, you’d get something more like this applet. How about that, it’s random static!

But, unfortunately, the wrongness of the demo doesn’t change the fact that there is a lot of Java code out there that relies on the non-random behavior of Random – however misguided that reliance is. Luckily for the owners of this misguided code, backwards compatibility is something that Sun cares about rather a lot.

Perhaps they should gain inspiration for their randomization needs from the now-defunct Princeton Engineering Anomalies Research (PEAR) program.

Luckily, Sun has also provided us with a built-in solution. Developers who really want a cryptographically secure random number generator (or indeed, anyone who just wants a bit more randomness in their entropy pool) should use the much more robust SecureRandom class.

Book Review: JavaScript Phrasebook

Fri, 17 Nov 2006 08:00:00 GMT

Cut and paste web development

JavaScript Phrasebook
By Christian Wenz
Sams Publishing

$14.99

Pocket books have a certain appeal: If you’re traveling abroad, you can slip a phrasebook into your back pocket while trekking through a remote village. Then, quick as quick as a flash you can be flipping through it searching for the perfect phrase with which to ask a local for directions to the nearest art museum (for example).

Being pocket-size is one thing, but there’s also something compelling about the “quick fix” phrase translator. Saves having to learn an entire foreign language after all, when all you really want to do is say something approximating “My cat is stuck down a well, please send help.”

When you’re programming or doing web development, the “quick fix” can be just as compelling. Sometimes it’s exactly what you need: having identified a problem, e.g. “I need to download a remote library”, to be able to flip through a programming “phrasebook” and find exactly the code snippet, or a near approximation, to do what you need. It explains the popularity of the Java Developer’s Almanac (which could be thought of as a catalog of Java code snippets).

The subject of this review – the JavaScript Phrasebook – has a similar approach, but as the name suggests, its author Christian Wenz has taken the “phrasebook” metaphor literally, and produced an excellent pocket-book packed with JavaScript code snippets, or “phrases”, for all sorts of useful tasks. It's surprising how much information the author has managed to pack into such a small space.

The book starts with JavaScript basics: using external JS files, dynamically loading JS files, using event handlers etc; then it covers the more commonly needed phrases such as detecting the browser type, preventing caching, and reloading the page. Later, the book ranges into form-related phrases such as disabling form elements and validating selection lists.

But the book goes beyond just “monkey-see-monkey-do” code snippets, as it’s also instructional. Accompanying each phrase, there’s a half-page or so of text explaining the theory. It’s a good halfway-house between theory and pragmatism.

For example, say you need to access individual rules within a style sheet. The CSS chapter provides the perfect “phrase” for the job, but also explains how the behavior differs between browsers, and provides a couple of examples to illustrate the differences.

The result is a book that’s more than just skin-deep, i.e. you won’t just find the perfect code snippet to type in and solve the current problem... you’ll actually learn something new at the same time.

Underdog Linux Console Makes Waves

Sun, 12 Nov 2006 08:00:00 GMT

The GP2X handheld console demonstrates how to create a loyal following with zero marketing budget.

While the mainstream videogaming press will focus almost exclusively on the PSP and Nintendo DS Lite in the run-up to Christmas, the really savvy among us will be discovering the almost endless possibilities of the GP2X handheld console. Its tagline could quite easily have been: “So geeky it should be illegal.” For a “handheld games console”, it does rather a lot more. It’s an open system based on Linux, has twin CPUs, and can even be configured to run as an FTP or samba server. It also has a built-in web server that will run your PHP scripts.

What’s remarkable about the GP2X, though, is the vibrancy of its almost cult-like following. This plucky little gadget is an excellent lesson in how to create an on-line community of users and developers, with virtually zero marketing budget.

Just a quick glance around this community site reveals the amount of energy coursing through the veins of this “underdog” handheld console and its core following of fiercely loyal users. By contrast, Sony and Nintendo have ploughed millions of dollars into their global marketing efforts and created an army of mostly “take-it-or-leave-it” customers.

GP32/2X Ltd’s success could be attributed to word-of-mouth marketing; but there’s more to it than that. Initially they did get off to a shaky start: their initial effort with the earlier GP32 model was met with some controversy, especially among the Slashdot crowd, as they were distributing a modified version of the GNU/Linux codebase without making the modified version available as open-source, thus (unwittingly) violating the GPL. This time around though, they’ve got it so right that the geeks (me included) love ‘em and want to bring them breakfast every morning (figuratively speaking).

So, what exactly did they get right? For starters, they’ve demonstrated that they understand and care about their target audience. Those wanting to do some Linux development, or game development without needing a team of hundreds, can do so quite easily with this device. They’ve created a real meritocracy, where anyone with the time and the talent can take part in a buzzing community. It’s both modern and old-school at the same time.

Sony, by comparison, has done its best to kill the homebrew market, going out of its way to stop the ability to do your own development on the PSP.

I’ve written more about the GP2X and its possibilities over here.

JAMES Server 2.3.0 released

Tue, 07 Nov 2006 08:00:00 GMT

More than just a Java-based open source mail/news server...

If you want to set up a Java-based email server, the Apache Java Enterprise Mail Server (better known as Apache JAMES) is the daddy. JAMES is a Java SMTP and POP3 mail server, and is also (as an added bonus) an NNTP News server. In fact, it’s more than just those: it’s a set of open source projects based around the central JAMES server and API.

The API part is what makes JAMES really interesting, though. Dubbed the “mailet” API (presumably a play on the “servlet” API), it transforms what might have otherwise been a “Yet Another Mail Server” (YAMS) product into an extensible mail application platform. Currently there are four “incubated” sub-projects that make use of the mailet API. As you’d expect, they’re all somehow mail- and news-related.

The four projects are: jSPF (an implementation of the Sender Policy Framework [SPF] spec designed to detect email spoofing), Mime4J (a parser for email messages streams in rfc822 and MIME format), JSieve (an implementation of the Sieve mail filtering language), and Postage (essentially an email load-testing tool; useful for finding resource leaks and memory bottlenecks).

All four projects (plus the core server itself, of course) are pure Java implementations.

The best part about JAMES, though, is that it’s shown itself to be pretty stable. The latest release, 2.3.0, has some new features, but is primarily a bug-fix release. The features in the product are clearly delineated as being either Stable or Experimental (e.g. the product has LDAP support, which currently is experimental only). So if stability is a top concern for you, you can pick and choose which features to use.