Leo Lewis posted some code to restart a Java app.
Boo
8. July, 2011TNBT – Avoiding Common Errors
7. July, 2011Writing secure code is ever more important. There are lots of examples: HBGary, Sony, Google.
Even if you’re not one of the biggest companies out there, security starts to become important as soon as your code can be accessed from the Internet. And frankly, which code today can’t?
What’s worse, the problems are always the same: SQL injections, not validating input, using code from somewhere else which is vulnerable. These problems are neither hard to find nor hard to fix. It’s only too much effort to add the necessary checking and warning code to the existing compilers.
So here is my assumption for my “The Next Best Thing” series of articles: The programming language will allow to define patterns like FindBugs and PMD that the compiler will check at compile time and which the VM checks at runtime to fix or at least warn about such security problems.
With tools like MoDisco and Moose, it’s possible to go one step further: It could analyze and display the code in ways that you haven’t seen before (think Code City) to find patterns in the code automatically and warn you about something that you might not have realized, yet.
For example, if you use a certain call sequence everywhere in your code but one place, it’s probably worth a look.
Of course, this begs for a way to add lots of additional information to source code. As I said before, we probably want better editors than the plain text editors we have today. It should be possible to include images and formulas in code. Wiki documentation. And things like “yeah, I know, this is different from the 365 other places!”
Sounds a bit like annotations but frankly, Java source code can just get you so far. DSLs come to mind but they don’t allow to extend them with arbitrary extra bits of information. It should be possible to overlay a DSL with another DSL so you can mix various information in one place.
Related Articles:
- The Next Best Thing – Series in my blog where I dream about the future of software development
Java Finalizer Exploit
6. July, 2011Did you know that your Java code may be vulnerable to an exploit based on finalization? I didn’t.
This article from IBM’s developerWorks explains how it works.
Basically, you can safe a reference to an object in the finalize() method. At this time, the object may even be in an inconsistent state (the finalizer will be called when the constructor threw an exception).
As for the solution: I don’t like it very much. It adds even more clutter to the existing code and doesn’t relay its purpose very well. Someone refactoring the code might feel tempted to remove the “useless additional constructor.” Worse, you need to do this in all your classes which check their parameters.
I would prefer a solution where the compiler or some other tool fixes these issues by generating the necessary code. Especially if you look at more complex cases: What happens if an exception is thrown at a later stage of object creation? Your code is still vulnerable but it seems to be safe. How would you know?
Maybe a better solution would be to check the heap for references to any finalized objects and throw an error “finalization failed”. But that’s probably impossible without breaking backwards compatibility.
Or Oracle could invent a better solution for the finalization problem (which is basically garbage collection for non-memory-resources) so we would not need finalizers anymore.
Israel Added to List Of Countries That Tend To ‘Promote, Produce, or Protect’ Terrorists
4. July, 2011A couple of days ago, “U.S. Designates Israel as Country That Tends ‘To Promote, Produce, or Protect’ Terrorists; Also Calls Israel Anti-Terror Partner”
Well … keeping more than two million people in the world’s largest prison was bound to “pay off” one day.
Makes me wonder: When will the US add itself to this list? Illegal prisons like Guantanamo are a perfect excuse to turn some frustrated soul into a terrorist.
I wish the fools in government would have let Obama close this revolting institution. But as usual, they hope the mess will explode in someone else’s face.
Good Food From the Roof
3. July, 2011UrbanFarmers is a small company that has developed a simple way to grow food on the roof: Take a standard cargo container, put some plants in a greenhouse on top of it and fishes in huge water tank inside the container. Meet the UrbanFarmers BOX.
The water is pumped to the plants for irrigation. It contains the wastes from the fishes which fertilize the plants. The plants clean the water which goes back into the fish tank.
Unlike other irrigation systems, this one has only a small loss of water. It needs no artificial fertilizers. There is no need for pesticides or fungicides because of the greenhouse. The fishes don’t need antibiotics.
How Hollywood Loses Money
29. June, 2011Apparently, making big feature films is a risky business. Let’s take unsuccessful movies like “Harry Potter and The Order of the Phoenix.”
“Wait a minute,” I hear you say, “Potter is a loss?”
Sure. It grossed only $1B so far. What a sad failure! Now, the corporate entity responsible for this blunder is $167M in the reds. Which means that no one in the “net-participation” list will see any money.
Cory Doctorow posted more details in his blog.
Apparently, this is just an example of creative money moving. All participants in the game are parts of Warner Bros. For example, the movie needs advertisement. Luckily, they have a subsidiary for that. But, oh bother, they are expensive. So what, we only want the best. So money goes round and round and round until everyone is spin dizzy.
Think again when the content industry blames losses on “piracy.”
But wait … isn’t that … yes … it kinda is piracy! Just not by the people at which Hollywood is pointing.
What was the old saying? “When you point your finger at someone, three fingers are pointing back at you.” So true.
Xtext2: Missing NAMED_BUILDER_SCOPE
29. June, 2011The constant NAMED_BUILDER_SCOPE has been moved from org.eclipse.xtext.scoping.impl.AbstractGlobalScopeProvider to org.eclipse.xtext.resource.impl.ResourceDescriptionsProvider.
Software Patents – More Harm Than Help
28. June, 2011James Bessen did another study which shows again that software patents harm more than they help. Abstract:
This report examines changes in the patenting behavior of the software industry since the 1990s. It finds that most software firms still do not patent, most software patents are obtained by a few large firms in the software industry or in other industries, and the risk of litigation from software patents continues to increase dramatically. Given these findings, it is hard to conclude that software patents have provided a net social benefit in the software industry.
Links:
- Research on Innovation
- Patent Failure (book on flaws in software patents). The first chapter (PDF) contains a lot of insight what might be wrong with software patents and why patents in other industries do work.
Missing m2e?
28. June, 2011If you downloaded the JEE edition of Eclipse 3.7, you’ll find that m2eclipse is missing.
Don’t worry, it’s part of the Indigo release train. Just install it manually from the Indigo p2 repository: http://download.eclipse.org/releases/indigo
Links: Oh my god, but where is m2e?
Posted by digulla