Slashdot Mirror

...included a BSD-licensed open source utility I worked on - PMD. I recall getting some nice emails and phone calls from them saying they were packaging it up, and they sent in some bugfixes and new rules and whatnot. They bought a couple of copies of my PMD book, too, which was nice.

Generally, I thought they were a good example of how a software company could bundle up and enhance open source software, contribute back, and still turn a profit. Selling that part of the business for $58M, sounds like it worked out OK for them...

A while back I worked on a program to find duplicated code - CPD (copy/paste detector). It discards comments and whitespace and (optionally) normalizes variable names... but probably wouldn't deal well with tokens being moved around. There's a chapter on it in my PMD book, too.

What was interesting were some of the performance optimizations that folks came up with. My first version used JavaSpaces to distribute the computation - but subsequent versions (thanks to Brian Ewins and Steve Hawkins) were fast enough to run on one just machine. Good times.

...which, in a 500K LOC program, there may be a bit of, try the copy/paste detector, CPD. There's a chapter on CPD in my PMD book, too...

> Do what I do - download the books as ebooks from some illegal ebook site.

Fortunately, enough people feel this is wrong to keep book publishers in business, even for niche markets. Also, ebooks are still a pain. I'm not sure which is the more significant factor...

> as a big corporation, you can leech the efforts of
> thousands of unpaid but experienced contractors and
> never once feel the need to give back. (e.g., Thanks Apache!)

True, but an open source project doesn't take much to run - just a server and some bandwidth, and the bandwidth needs can be minimized via judicious mirroring.

But I agree that corporations should support the developers of the open source projects they're using.... +1 on that.

If you've got a reasonably recent JVM installed you can run CPD via Java Web Start here.

There are some examples of CPD output there too - like the duplicate code chunks that it found in the JDK source code and in the Apache httpd source code.

For much more on CPD, see chapter 5!

Your plug-fu is strong, master, you must teach me.

> [...] sales "closely track Billboard."

Right, but isn't that the point of the long tail? If Dan Brown sells a bazillion copies of "Da Vinci Code" and I sell 500 copies of PMD Applied, we're both happy since we're meeting the expectations that we budgeted for. Of course, he's then a billionaire, whereas I've still got my office in the laundry room, but, er, anyhow.

As the lead guy on a "competing" static analysis framework - PMD - I can say that FindBugs is definitely a great piece of work. It catches all sorts of complicated problems with concurrency, does forwards/backwards data flow analysis, etc, etc. It's pretty sweet. Dr Pugh, who runs the project at the University of Maryland, did a JavaPosse interview that's some more good info on the project and where it's going.

Of course, if you really want to do source code analysis (vs bytecode analysis, which is what FindBugs does), then go for PMD, and [plug] get the book! [/plug]

Static analysis is great stuff. I've worked on an open source Java static analysis tool, PMD, for the past few years and I've gotten lots of feedback from folks who have used it to find all sorts of things in their code. Just a quick scan for unused variables can yield some excellent results, and the copy/paste detector works quite nicely too. And there's a book, too!

Coverity's doing a nice job with their tech marketing, too - l think a couple of open source projects are using the stuff they found to clean things up. At least, there's been a fair amount of traffic on the Ruby core list about some things Coverity's scan found. Good times...

> How corporate involvement affects real open source projects

I dunno. PMD has certainly benefitted greatly from corporate involvement; the reason that the most recent release included support for checking JSP/JSF code was that a corporate-sponsored developer put together a nice JavaCC grammar and did all the integration work.

As the project lead, I'm happy that PMD has new functionality and a larger audience, not least of all because that may lead to more book sales! One can but hope, anyhow.

> Finally, support options are limited for most open source software.

But if the author has written a book about the product - or even anything vaguely related - then buy it! For example, DenyHosts is an excellent tool, and the online documentation is good enough that I can use it without any more docs. But if the author were to put together a book, I would certainly pick it up in appreciation for his time spent in developing and supporting that fine utility. In the meantime, I PayPal'd him a few bucks.

Of course, I'm biased...

Gnome's got a great library in GLib. I wrote a tutorial for IBM last year on the GLib collections; there are so many useful utilities and data structures in there. If you're writing a C app on Linux it's definitely worth a look, and if you're already using the GLib collections, take a look at that tutorial to see if you can optimize anything, like using g_list_prepend vs g_list_append.

And if it helps you, please buy my completely unrelated book!

public boolean foo(int x) {
  if (x>2) {
    return true;
  } else {
    return false;
  }
}

Lots more on all that in my book - there's a downloadable free chapter there on using static analysis to improve JUnit tests if you want to get a feel for things.

...is Linux Server Hacks. Just to "turbo mode ssh logins" hack (#67) is worth the price alone.

Oh, and, book plug!

> I bet you could easily hire aware the developers of that project.

Right, that comes up occasionally: the "what if someone hires Tom Lane" (*) question. It's a legitimate concern. But it'd be hard to hire all the PG core developers since they don't all work for one company.

Also, what's the chance of a core guy taking a job that requires him to stop working on PG? On a much smaller scale, I wouldn't take a job that required me to stop working on PMD; there are lots of other jobs out there. Don't want to damage my book sales, either!

(*) Tom Lane is a PostgreSQL uber-guru

One nice thing about Rails is that the unit tests are built in. Rather than having to go out and use JUnitWebTest or whatever, once you start writing Rails code the basic tests are generated for you and writing new tests involves fairly readable code, like this:

assert_redirected_to :action => "thanks_for_applying"
follow_redirect
assert_res ponse :success

It seems like the folks who are writing Rails are aware of the whole web development picture; not just getting a web app up but also making sure it's well tested. It's certainly making RubyForge much busier...

Oh, and, book plug!

...on developerWorks, not the least of which, if I may say so, is the GLib tutorial I wrote for them this past summer. If you wanted how to use various GLib collections and utilities - lists, tables, trees, quarks, relations, and all that - check it out. You can even download a nice PDF file for offline perusing.

Folks who are thinking about writing something technical - give dW a shot. The editors are savvy folks and there's lots of good stuff up there already.

Oh, and book plug!

....is Eric Rescorla's SSL and TLS: Building Secure Systems. It's got excellent descriptions of how SSL works, including a chapter on various attacks (million message, small-subgroup, etc). He's got some nice stuff in chapter six about SSL server performance, too - talks about hardware acceleration and whatnot.

Oh, and, plug!

Instead of charging an annual support service fee on a free product as many companies do, EnterpriseDB uses a "plain old software license," Astor said. The only difference with closed-source providers is that the EnterpriseDB database is based on PostgreSQL, an open-source product.

Java-related books are off 4% so far this year, while sales of books related to AJAX, a new Web site-building formula used predominantly with open-source software packages, are up 68%.

The first 30-40 pages of mine are fairly wrinkled... the last 500 pages are as fresh and as clean as the day they were purchases. Ah well.

Now here's a fine tome. I hear the author is a really cool guy, too.

...that is, a static analysis of a bunch of Java SourceForge projects. It does unused code and duplicate code detection... sometimes it finds some interesting things.

PMD home page is here, book site is here.

> This seems like another in a string of Escapist articles
> that tries too hard to think deep thoughts.

So true. As another fellow here said more eloquently a few days ago, I wish folks would just stick to writing about game experiences rather than trying to make games into a philosophy degree. For example, check out Cedric Otaku's blog entry on fighting hard instances in World of Warcraft. You can tell that (although he's no longer playing) he enjoyed the game and and he knows the issues involved in these monstrous battles. It's cool stuff, and a lot more fun to read than... well, other things.

Since no post is complete without a plug of some sort... here's my book!

...has been tracking the various Sun Java-related giveaways; you can hear them talk about the Java Studio Creator and Java Studio Enterprise giveaway in JavaPosse # 13.

I highly recommend the JavaPosse podcasts; it's a great way to keep up with the latest developments in Java. Haha, get it, developments! Anyhow. They do a nice job of tracking things that most Java developers may not be using but will be someday - i.e., the recent discussions of the Mustang Hotspot speed improvements and such.

Disclaimer: They just interviewed me about PMD and my book PMD Applied. But still!

> every dollar invested in OSS which leads to publicly released
> code is a dollar whose benefit will last long beyond any potential
> demise of the original VC group and/or development team.

Well said sir. And that's as opposed to those huge corporate systems on which armies slave for years - and then are unceremoniously dumped.

The beauty of it, too, is that a company can have a closed source product and still contribute to open projects. Running a backend database? Contribute something to PostgreSQL. Running a web server? Answer questions about Apache. Coding a propriety Java app? Buy a book on an open source Java code quality tool. :-)

...sounds more interesting to me. He proposes an "Artistic Freedom Voucher", whereby people would be provided with a voucher for, say, $100, which they could direct to a person engaged in creative work (like writing open source software). This sounds rather nifty, since it would allow folks to "pay" for the projects they find most useful personally.

Of course, another way for open source programmers to make money is to publish a book. Programming in Java? Give it a look! Think of it as sponsoring an artist :-)

Sometime this seems to work out well, sometimes not. I thought that the Pattern Languages of Program Design editors did a nice job on making that work, and the same goes for the excellent Game Programming Gems series.

On the other hand, sometime you can really tell that one author wrote a book and was interested in the topic - i.e., Component Development for the Java Platform by Stuart Halloway comes to mind. This was an excellent book for intermediate to advanced Java programmers and Stuart's interest in how things really work in Java serialization, classloaders, and so forth shines through.

And hopefully the same goes for PMD Applied :-)

Sun gets to use repackage PostgreSQL however they like, more people will be using PostgreSQL and finding bugs and adding features and writing utilities, more books will be sold, more consulting opportunities - everyone wins.

I've had people contribute code to PMD and say they were only contributing it because they felt the BSD license avoided any possible obligations on their part. And the products that are based on PMD? Just means more books sold. Good times!

Downsides: it's a lot of work and it doesn't make a ton of money; maybe just enough to keep one person going. But in my experience it's well worth the effort.

...is simply to write a book about your open source project. The project users get better documentation for your project, the managers feel a bit better about using a product that has some paper documentation, and while you're writing the book you'll run across all sorts of interesting nooks and crannies in your code which you can fix and document.

Downsides are that it's a lot of work and that it doesn't make a ton of money; maybe just enough to keep one person going. But in my experience it's well worth the effort.

there are an awful lot of explicit forward references,

Reducing the license count is good, but put those apps under the BSD license instead. That way folks can use your program without their hands being tied. They can even make a product out of it, make some money, and feed changes/improvements back into the program. I've had folks send in contributions to PMD and say that if it was GPL'd they wouldn't be contributing their code.

And the fact that Compuware wraps PMD and calls it OptimalAdvisor? More power to them! Maybe they'll contribute a bug fix or two, and maybe I'll sell a couple more copies of the book. A rising tide, as it were...

...will help prevent code like this, too. Removing useless code can't help but improve performance, not to mention readability...

[plug]
Support your local open source static code analysis utility!
[/plug]

> You could also consider "self-publishing"

Right on! You can get a run of 1000 copies of a soft cover book printed by someone like BookMasters for $5K or so, even for a monster like this one. Just stick with a 4 color cover and black/white in the text. And if you can charge $40 or so for this tome, you can cover your printing costs after selling only 150 copies.

[plug]
That's what I'm doing with PMD Applied; seems to be working out well so far.
[/plug]