Slashdot Mirror

• SMS reminders for events - ok, a few others have this, but it's integrated all over the place
• Pure CSS layout - no AJAX, so all pages can be bookmarked. However that means you'll want to use Firefox
• Print envelopes directly from the website - I have never seen another site with this feature
• Timezone integration everywhere - today's meetings are spread around timezones, so it is important to be able to print a calendar or make meetings in any timezone
• A whole bunch of stuff coming in the future which I won't even go into right now.

-------------------
Phone backup, contact management

I hope so!

--------------------
Free SMS

------------
Contact management, calendar management, phone backup

Then I looked at the solutions. Two of them involved a loop with something like while(a = b) instead of while(a == b). Yes that is just one character difference, that's something that doesn't look malicious, but in fact, it's obvious. Anyone who is familiar with C knows that that is a common type of bug. I think some syntax checkers and code viewers even flag warnings on stuff like that (as they should).

Of course there were the predictable buffer overflows and stack underflow type of attacks.

Second trick, some of them mis-interpreted data from the stat structure. Good job again! That's harder to spot.

Finally, and most tricky, some of them managed to sneak in some assembly. If you have a bunch of constants: byte foo = 49; byte bar = 93; etc you can actually get a little bit of assembly language in there, and then by messing up a function pointer or something similar you can get that to execute.

One thing that struck me in all these is how hard all these attacks would be in Java.

First, buffer overflows are right out. Java doesn't allow mem access. Second, back-door assembly is right out. There's no way to execute assembly in Java. The while(a = b) trick is out; Java won't compile that. The stat attack is mostly out. Correctly-written Java objects used named accessor methods so you can't mistake-on-purpose flub which member you're accessing. So what does that leave? There are still some things that could be done in Java but I think it's a lot harder and I don't want to give away any tricks on it!

Maybe I need to start a Java competition like this to see what (if anything) we can shake out. Interesting that no one has an "obfuscated Java" competition either; it just wouldn't be fun or interesting.

------------
Contact management, schedule management

It is a shame that Sun has not released a free Java. All their arguments against it are hollow. Forks are good. Forks do not mean changes to the language specification. Most of the forks people want in Java are things like "Swing that uses Qt peers" or that kind of thing. Doesn't change a thing about the language, but it is a fork.

But it doesn't matter; some excellent free Java implementations are in progress.

They all rely on GNU Classpath (http://www.classpath.org/ which is getting closer to completion every day. In fact once they switch to their Generics branch I would be able to use it for most of what I do. And it works well with gcj, and I am quite impressed by what gcj does. It will let me write an application ONCE and then distribute binaries for Qt, GTK, and (presumably) MS Windows, and all these binaries will use the native toolkits. This is cool. One body of code, no ifdefs, no unholy makefiles, and I can support all the major platforms.

I realize that that day isn't here right now but it's getting close. I'm very excited about gcj and I am just about to start using it for some production tasks, like a background daemon that does some database updates, for example. No big deal, but it is "real world" use. Contempo.biz will use that for doing its calendar updates.

-----------
Contact management, scheduling, reminders, tasks, calendar, sales

Actually that was quite an amazing article. On a tangentially related subject, a mosquito researcher once explained to me how mozzies find blood: when they get a wiff of CO2, they simply angle themselves into the wind and go forward.

Bugs are pretty smart for things without brains.

---------
Contact management, phone backup, sales automation

Good points all. But all the anti-Java people don't even understand what all that you said means there. Yeah I'm enthusiastic about Mustang also; in fact Contempo.biz will rely on some of Mustang's features.

I currently use Netbeans under Java 5 and it does occasionally have GC pauses. To me that's the worst thing about Java as a desktop language. It's a lot better than it was before, and of course non-Java apps also have pauses for various reasons, but still.

I don't really understand the subtleties of how GC works but I guess they are improving them. I have always wondered if Java could somehow benefit from GC hinting. Very often, I'll use some code where my function uses a StringBuilder and it needs to return a String. I know that the StringBuilder is unreferenced as soon as the function returns. If I could hint the GC about this, would that help it out maybe?

The other cool thing in the future of Java is GCJ. We will be able to compile Java apps to native code which starts FAST and uses native widgets (including Qt widgets, for example). I'm looking forward to being able to distribute compiled Swing apps. Right now GCJ-compiled binaries are small and start and run fast. It just doesn't yet have support for reasonably complete Swing and for generics, two features I can't do without at the moment.

I think you probably don't understand how Java server stuff works. Your reference to Apache being part of a Java server deployment shows that. It used to be, back in the old days a few years ago, that people often installed Tomcat and Apache together using a connector. I don't know anyone who still does this. Tomcat 5 servers static content about as fast as Apache.

As for threading: If you're writing a web application, you don't need to write any threads. You need to give a little bit of thought to threads, because your Servlets are objects and they can be used by multiple threads at the same time. Handling this is quite trivial: you just don't touch any instance variables from methods in your servlet. If you don't want to try to figure out threading, that's all you need to know. Tomcat will do all the rest.

Again, I have no clue where you got that 256mb per user, but I'll clarify a few points. In a typical Java Servlet application, which would use Tomcat (or similar) to serve an application where users log in, do stuff, and data are stored in a DB, this is how resource use will work:

• Threads: Tomcat can be configured to create however many threads you want. A few dozen to a few hundred is typical. It certainly does NOT create a new thread per request. Just like Apache 2 in threaded mode (which is not its default mode btw) it creates these threads and has them hanging around until they are needed. Just like Apache 2 in threaded mode, these are plain old operating system threads
• Threads again: Your reference to threads, and developers not knowing that Java is threaded, and again this 256mb per user makes me think that you are assuming that every user needs a separate JVM. This is not the case on any server-based app that is correctly written. Yes I can imagine some bozo creating a web app where Apache forks off a ne JVM for each user session... but wow, that is an inconceivably bad way to design a web app, ie, using a JVM for doing CGI. That's fighting hard against the design and the right way to do it, so of course it won't work. You do not Java for doing CGI servers! One web application = one JVM per machine = one JVM overhead per machine. If you are looking at any deployment where that is NOT the case, it was done by someone who is incompetent.
• Memory: Sessions are created with a simple session map. A session itself takes up about 1k of memory. If you're smart, you store a user ID in the session and then the servlets can use that to interact with the database. So you're still storing less than 2k per user in memory in the session. It's no different from how PHP is often used. If you're really clever you use Hibernate and store a lightweight user object in the session, and have Hibernate do all its magic caching and proxying. You still have only a few K per user session to store.
• CPU: Any real-world benchmarks Java just isn't slower. I would expect that a Java web app would use less CPU than a PHP app, because PHP has to parse and compile some large subset of the application with every single request. In Java, the whole thing is compiled to bytecode, which has probably been compiled to native assembly, and it's all loaded in the thread, in memory, ready to go when a request hits it.
• Garbage collection: This is a problem that Java has. The GC does have to use a global lock and stop every thread (I believe) at certain times to do GC. In practice, this isn't so bad on web server apps. It's worse on desktop apps, which do in fact freeze up for a few seconds at a time occasionally.

I really don't think you understand how these things work, and if you have real-world experience with Java webapps, then the ones you are thinking of were written by clowns.

Oh and on this subject, there should be a built-in simple way to convert a byte[] into a plain old hexadecimal string. They have ways of doing pretty much everything, including manipulating zip files, URL-encoding, on and on, but no built-in way to convert a string to hex.

Don't get me wrong, Java really is an excellent language for low-level network coding, and in fact a DNS server I wrote in pure Java was able to out-perform BIND, so it is a great language for this stuff. It's just that I always find myself getting stuck occasionally on bit twiddling.

Anyway, one of things that hurt Java was there was too much hype for running it on the desktop, when the reality was... AWT. At this point, with Java 6, Swing is getting quite excellent. I now think that Java is also a first-class desktop app development language. ----------
Contact management, sales automation, time zones, mobile alerts

Ah, I can already see the flaming responses this will get from people who don't understand what security is, or what a server is, or what a port is.

Anyway, if you want to patch your kernel so you can run your server procs as arbitrary users, this is it:

Edit the file /usr/src/linux/include/net/sock.h and change PROT_SOCK from 1024 to 0 and recompile.

This should have been done in the standard kernel YEARS ago. If we ran all of our daemons as separate, non-prived users, daemon buffer overflows would be a lot less of a problem, especially now that local user access is finally getting quite secure in Linux.

---------------
Calendar, contact management, multiple timezones, sales automation

It seems like a problem that we should solve by not solving, that is, we should just not try to put a base on the moon. They are really solving the wrong problems here.

-----------
Contact management, calendar, timezones

We aren't going to find life on the moon. We're probably never going to colonize it because it's pretty useless. We would probably find some cool old meteors on the moon but is it worth it to do that for a permenant colony?

Manned space exploration in general is a questionable undertaking. Building a perm. base on the moon?

The only thing about it that might make sense is for "defense" purposes, but gee, the cold war is long over at this point.

--------
Contact management, calendar management, timezones, sales automation

But now RICO gets used and abused for many other things. It is used to go after political groups (anti-abortion groups is one case I'm aware of). In this case it sounds like it is being used in a business dispute.

I swear, if Congress keeps on passing laws that inadvertently (or otherwise) lets law enforcement get involved in what are civil business disputes, this country will be ruined. I was talking with an attorney a while ago who said that these days anyone who is a business leader should have a crim. def. attorney retained or available. There's no way law enforcement can help achieve a fair resolution of a business dispute by getting involved in it.

------------
Contact management, calendar mangement, multiple timezones, sales automation

• Selling drugs based on bogus perscriptions (I assume the doc will lose his license)
• Charging cards without delivering drugs. Even the libertarians will agree, if you charge it, you gotta ship it.
• Spamming the universe
• Blowing the proceeds on a stable of vehicles so exotic and expensive... How many quarter million dollar plus vehicles does one man need?
• And to cap it all, trying to have witnesses killed
• Oh and I forgot, being so utterly stupid as to talk about having witnesses killed on a JAIL PHONE

Some how he just didn't think that the laws of our system, and maybe even the laws of physics didn't apply to him.

---------
Free web calendaring and contact management system