Posts on gonz0's Blog

Feels good to drop a fork

Tue, 25 Feb 2014 00:00:00 +0000

Some time ago (yeah, I could have blogged about this. In fact, I should have…), we started using Apache Cassandra to store user sessions for our web applications. To do this, we used Tomcat-Cassandra, a drop-in replacement for the standard Tomcat Session Manager.

After a little while we stumbled upon two defects in the software, that were show-stoppers for us. It created Session objects always, even if the code used to process the request did not need a Session at all, and never evicted invalidated Sessions. I created issues #3 and #4 in their bugtracker to address each of them, respectively. Provided patches in both of them, but couldn’t wait for a new release, so we forked the project.

Leaving manual testing behind

Mon, 18 Jun 2012 00:00:00 +0000

Manual testing does not scale. Just like manual anything doesn’t. This is no news. However, for various reasons people keep doing manual work.

One of the reasons I hear the most is not knowing how. This is a valid motive, but a dreadful one as well. The team will enter a negative feedback loop:

I don’t know how to automate
I can’t learn how to automate because I have no time
I have no time because I have to test manually
I have to test manually because I don’t know how to automate

Working with web applications, Selenium IDE is an amazing tool to break this negative loop. Testers have to learn very few things to automate their work by recording a test session.

Checklist for comparing environments

Wed, 03 Nov 2010 00:00:00 +0000

I’ve spent the last days tracking down a bug in a Production environment, which I could not for the love of God reproduce locally. For future reference more than anything, I’m leaving here what I understand should be checked when trying to assertain environment differences affecting a Java Web application, sorted by (again in my opinion) relevance.

The obvious: JRE version and vendor, Application Server version;
Shared libraries versions;
Database vendor, version, character sets, collations, and so on;
Configuration for services that the application relies on;
Application Server startup parameters;
A long list of etc’s that may grow in time

The point is that, for this particular issue, I’ve completely overlooked the shared libraries. A buggy implementation of the JavaMail API was deployed in Production, introducing seemingly random encoding problems. It was almost a matter of luck finding this issue. Regarding shared libraries, and in particular those such as JAF and JavaMail, I tend to assume the JARs downloaded from ~~Sun~~Oracle Java are deployed. Big and time consuming mistake that I hope I won’t make again.

Testing with Stubs or testing with Mocks?

Tue, 24 Aug 2010 00:00:00 +0000

I’ve read Mocks Aren’t Stubs some time ago. However, it was not until recently, after having a discussion on TDD with a colleague, that I realized how strongly coupled a test is to the tested class’ implementation when using mocks.

Ever since I started using mocks, seeing how easy it is, I’ve been doing tests to archieve a high percentage of code coverage. Thinking the TDD way, this is plain wrong.

Taking a tour inside the Spring Framework

Wed, 10 Feb 2010 00:00:00 +0000

I’ll be attending SpringSource‘s Spring Core training this week. Two cool remarks from day one:

Infrastructure beans in its own bean definition file Link to heading

After having heard this suggestion, I can’t believe I didn’t think of it before. Having plumbing beans on a separate file makes all the sense in the world. It is expected to change for different environments, so data sources for instance can be defined as pools or JNDI lookups for a web environment, and as stub beans for testing. Building an application context then means having to specify more than one configuration file. No big deal, and much to gain!

Its that time of the year...

Fri, 18 Dec 2009 00:00:00 +0000

Our statesmen still don’t realize how important time is for IT systems. For the third time in a row, the rules for DST were changed less than a week before they would’ve been implemented.

There’s no way vendors (or maintainers for FLOSS) can keep up with this kind of mambo-jambo. I’m trying hard not to turn this into a political rant, but it seems clear to me that this matter is being handled as almost every other subject by the government. “Just in Time” can be a good concept for compilers, but not for politics.

Where did Spring Modules: Validation go?

Thu, 20 Aug 2009 00:00:00 +0000

Spring Modules has been marked deprecated. In favor of Spring Extensions, says the page.

Now Spring Extensions doesn’t have Annotations validation, a great feature of the former project. In fact, I couldn’t find these annotations or the necessary Validator Configuration Loader anywhere in Spring 2.5.

So, for the time being, I’m using Validation 0.8a from Spring Modules, ignoring its deprecated status. If you’re using Spring 2.5 and Maven, do remember to exclude Spring from its dependencies. Your POM snippet should look somehow like this:

The problem is in the mandatory algorithm. Now what?

Mon, 11 May 2009 00:00:00 +0000

Just in case you haven’t heard of it, there’s a new attack vector on the SHA-1 hash algorithm. This is causing all kinds of havoc in communities that use PGP signatures, since signatures are created with this hash function by default. As an accessory to this, GnuPG’s defaults for a key result in a key such that you cannot use the SHA-2 family of functions (you cannot use anything with more than 160 bits, or, more precisely, you can but it gets truncated), so you’re basically stuck with SHA-1 or RIPEMD/160.

The Earth Hour 2009

Sat, 28 Mar 2009 00:00:00 +0000

As it is about to begin here in Argentina, I’ll be shutting down not only the lights at home, but also my computer and as much electrical stuff as I can. This means, everything except:

One TV set, as Argentina is playing for the FIFA World Cup 2010;
My fishing tank’s filter and air pump;
A minimal set of inter-networking devices, as I’m not sure if every family member is willing to join the effort;
Freezers.

On the other hand, I’ve tried the Earth Hour wordpress plugin, and decided not to use it. The blog will be available, and my “online effort” will just be to spread the word by hand.

Identity and online communities

Sat, 14 Mar 2009 00:00:00 +0000

In the many, many, discussions I had with almost every human being since the creation of Facebook, I’ve stated my strong opposition for this kind of sites.

I consider them a huge invasion of one-self’s privacy. People tagging pictures with your name, without your authorization? C’mon! And this happens even if you don’t have an account created? This has to be illegal.

Yet, I’ve managed to keep myself out of this circles until today. Last weekend, a friend threatened me (kidding, of course, but still got me to think) with creating an account on my behalf. Then I realized I’m forced to register and make my profile as public as possible! If there is something worse than having my name on pictures of which existence I’m unaware of, is to have them tagged to a fake profile of myself, where every single piece of data might be accurate but it is not me.

Debian Lenny is here!

Sun, 15 Feb 2009 00:00:00 +0000

I’d like to congratulate all Debian folks out there. Lenny is finally stable, Squeeze is born and everyone is happy.

More details are available at the official announcement.

One key to rule them all

Sun, 18 Jan 2009 00:00:00 +0000

I have to admit this is not rocket science, but this idea hadn’t crossed my mind until recently.

My SSH public key has been hosted on the net for a while now, and I’ve been using Off-the-Record messaging for my Instant Messaging communications for ages. However, for a third party to trust that those keys were actually mine has been a painful process most of the time.

The tool to make my life easier has always been at the palm of my hand: PGP. I already exchange PGP signatures with almost all those who, like me, are concerned about privacy enough to use OTR, or may be willing to allow me SSH logins but keep my account password locked.

The blog is back, many thanks to all those who taught me to backup regularly!

Sat, 15 Nov 2008 00:00:00 +0000

I’ve completely destroyed my Blog on Thursday. Not only I overwrote the directory where it’s held, but also dropped the entire database. I even think I temporarily lost the sub-domain in which it’s hosted. This, added to the fact that I’m having a stressful workweek led for it to be off-line for about 48 hours.

When I realized the huge mistake I’ve done, I tried to get it back online the wrong way: reinstalled everything from scratch, and searched through caches and stuff to get all posts back, which I then pasted as new ones, editing the publishing date. This would’ve let me without comments, of course, but at least the posts would’ve been back.

A really cool tool to share large pieces of text on real time messaging

Wed, 22 Oct 2008 00:00:00 +0000

I’ve recently read on an IRC channel’s topic about this nice tool to avoid flooding by pasting some large file’s contents or the like. Instead, it allows you to paste the whole stuff into an html text box, and gives you a unique URL to access it for 24 hours. It even provides highlighting for several known languages.

Since I first saw this, I’ve been using it not only for IRC, but for all other IM solutions. It is, at least, polite. And I would be very thankful if you used it when chatting with me.

Wireless security, once again defied

Mon, 13 Oct 2008 00:00:00 +0000

Some russian researchers have published this new software which uses NVIDIA GPUs to crack a WPA password about 100 times faster than it was possible until now, so they say.

I’ve done some reading in this regard, and I think it’s not so much of an issue. A simple password is already easy to break. This application will make it easier. On the other hand, a complex passphrase is hard to decipher, and all this does is make it a little easier, but it seems, still not viable.

Once again, DST is a problem in Argentina

Mon, 06 Oct 2008 00:00:00 +0000

Dear maintainers of tz-data across the world: Argentina is not as predictable as anyone may think.

To deal with us, you shouldn’t make assumptions such as “if they said that DST applies on the first Sunday of October last year, it will happen again this year”.

This is not something I particularly enjoy. In fact, I hope you all read this as a critic on our stupid government.

I now find myself exactly as last year, only this time my computers’ time is one hour ahead from the official argentinian time.

GNOME 2.24 is out!

Wed, 24 Sep 2008 00:00:00 +0000

From their release notes, I can see some cool improvements, such as Ekiga 3.0, which has a very nice new look; or the enhancements to the Deskbar applet. However, the most expected feature, at least for myself, would be the screen resolution controls. If only I hadn’t bought an NVIDIA card…

On the downside, either I don’t understand or I dislike the idea of Empathy. It is pretty much like Pidgin except… it isn’t named Pidgin?

My thoughts on Google Chrome

Wed, 03 Sep 2008 00:00:00 +0000

I’ve been reading some stuff about Google’s Chrome, their new web browser. Now, the browser looks cool. It is also developed with some really cool features, also.

But the thing that really surprised me the most was the way they decided to publish all of these news: via a comicbook on Google Books. It turned out to be quite didactic. I even showed it to some people who have no clue whatsoever of what a computer is, beyond their email client and web browser of choice, and they understood most of it.

Friday at DebConf

Sat, 16 Aug 2008 00:00:00 +0000

Ok, we’re closing on the end of DebConf8. Quite some cool debates for today.

For starters, LessWatts packaging is surely something most welcome by all us laptop users. Sulamita García, an Intel representative, said in very convincing words that these tools allow Linux to greatly increase its energy efficiency. I’m looking forward to trying them.

The OpenSSL BoF was not what I expected. It all went around how to track Debian patches to upstream, and I have to agree with Martin Krafft, this is exactly what he was talking about when he gave the vcs-pkg.org speech.

DebConf, fifth day

Thu, 14 Aug 2008 00:00:00 +0000

No post yesterday, I know. I couldn’t attend any of the events, that’s why.

Today, on the other hand, has been great. The talk about Debian’s OpenSSL issue was a very complete one (though I learned almost nothing new), and the Keysigning Party went excellent. Jacobo Tarrío even brought a blacklight and everything!

Also, we took the group photo. Hundreds of geeks on a beach, inside a carefully delimited frame, with a pirate flag waving at the wind. Quite funny indeed, not to mention Andrew McMillan’s amazing job taking the picture, for which he configured the autoshooting, ran all the way down the dock, and then again all the way to the frame to appear on it in time. I hope someone recorded that.

Day Three at DebConf

Tue, 12 Aug 2008 00:00:00 +0000

Well, I definately must start shortening up these entries. This does not look like me anymore.

So, I’ll stick to the highlights from now on.

Debian and Ubuntu was one of, if not the most expected event. Proof of that is that the room was crowded, and there were more than two hundred people watching the streaming video.

Mark Shuttleworth shared with us his view on the Debian/Ubuntu issue. Of course, a conciliatory one. Sort of “Ubuntu complements Debian” and stuff. I sort of bought it. It wasn’t that hard to convince me anyways, I will always prefer a computer running Ubuntu over Windows.

DebConf Update: Day One

Mon, 11 Aug 2008 00:00:00 +0000

Quite an interesting start. Intense, indeed.

Breakfast Link to heading

Got up, had a breakfast, and headed to the conference room.

The Welcome Talk Link to heading

Margarita Manterola and the local DebConf team gave us a brief description of how much effort it means to assemble a DebConf event in one’s country. I don’t recall having heard this from her, but I guess it’s also as rewarding: this is going really well so far.

Second day at DebConf

Mon, 11 Aug 2008 00:00:00 +0000

Back online. Awake, I mean.

I had this article half-written and just saw that the DebConf team has published the proceedings. So, I’ll shorten the summaries and focus on my opinions about each of the events. This will apply for the remaining days of course, but I’m tired enough not to edit yesterday’s article (at least yet).

Breakfast Link to heading

This breakfast was quite more interesting, since I sat with some other Debian guys. Talked about i18n and the Debian philosophy. Cool.

DebConf Begins

Sat, 09 Aug 2008 00:00:00 +0000

Quite some time since my last post huh.

After an uneventful trip, I got to Mar del Plata. Wait, I’ve got something to say about it: there’s an YPF gas station in the 91th Km. of route 2 which has the tastiest croissants I’ve ever eaten. You cannot miss them if you go by it.

Back to business. I’ve checked into the hotel and the conference. In a really fast process, I got my room, a really nice Debian bag, a T-Shirt, and quite a lot of brochures about the city, the country and a sponsor. Oh, and a certificate stating that I was here since today and until next Sunday.

Adobe unveiled the Flash specification

Thu, 01 May 2008 00:00:00 +0000

Adobe surprised me today with a step on what I believe is the right way: they opened the tech specs for SWF and FLV formats.

As Flash’s popularity grew on the online world, this was somehow required. A single company just can’t keep up to the Internet’s speed of motion. More and more devices are built with faster connections and bigger, better screens, which strive for rich content.

Now, having access to the way Flash works, Open Source projects such as Gnash will be able to evolve faster and better. New clients for all sorts of devices can be built without the effort of hacking a closed format.

SQL Injection is just bad coding

Thu, 17 Apr 2008 00:00:00 +0000

Rajesh Patel brought once again to my attention the fact that many developers assume an ORM framework protects you from SQL injection.

SQL or HQL or whatever injection, is just exploiting a bug whose source is String concatenation. It has nothing to do with which tool you use to get, store, delete or update data from some storage. It is related, instead, on how you build your statements.

Hibernate will protect you, if you use Criteria or named parameters to build your queries. JDBC will protect you too, if you use it correctly.

At last, network-manager-pptp on Debian

Tue, 08 Apr 2008 00:00:00 +0000

Hello!

In today’s networked world, it is unthinkable that a user should read a ton of documentation, and deal with plain text configuration files, to get online or reach the network at his home, work or college.

Enter Network Manager Link to heading

This application comes to the aid of common users, by providing a foolproof UI to handle network connections, be them wired or wireless, public or private. It is, even with the faults it may still have, a really fine tool.

So much effort for SEO

Wed, 02 Apr 2008 00:00:00 +0000

Lately, I’ve been working really hard to make Google, Yahoo! and Live Search happy with the sites I manage (such as this one).

I’ve been dealing with very nice plugins for those applications that do not have good native support for URL beautifying, and have no complains about them. But that was the easy part.

WordPress and DokuWiki Link to heading

These applications support native URL beautifying, and I consider them good enough for my requirements. I needed nothing else for this matter.

Assertions in Java

Sat, 29 Mar 2008 00:00:00 +0000

It was not until recently that I found this feature of the Java language. Runtime assertions, which can be enabled or disabled with JVM arguments, and derive in errors if failed.

Such a feature can be very helpful in building quality Classes. In some way, when enabled, every object built with assertions in its code is testing itself all the time.

Added to that, the way this feature is implemented seems the right one. Sun states that assert statements are costless when not enabled, so there’s no reason to skip an assertion. They also rise an Error when triggered, which will totally discourage even the boldest of coders from attempting to catch it.

DebConf8 at Mar del Plata

Sat, 29 Mar 2008 00:00:00 +0000

I just found out that the next annual Debian Conference will take place just 400km away from home. Mar del Plata, a coastal city in the province of Buenos Aires, will be hosting DebConf8.

This is the first DebConf I’ll be attending to, so I’m pretty excited about it.

There isn’t much I can say, that you won’t find on DebConf’s site. But I’d like to help spread the word, so here’re my two cents!

Hibernate: Scrolling through entities with lazy loaded child collections

Thu, 28 Feb 2008 00:00:00 +0000

While this should be a trivial thing, only consisting of mapping your entity and requesting a ScrollableResults from a Query object, it recently proved quite harder for me and my colleagues.

The symptoms you may see if ever using this approach are very confusing: child collections will most of the time have only one entity, the exception being apparently the first entity returned by the Query. In this regard, at least two bug reports were filed on Hibernate.org’s JIRA, #1283 and #1751.

Java and 64bit architectures

Fri, 25 Jan 2008 00:00:00 +0000

“Write once, run anywhere”

Or so they say.

Some time ago I decided to use a 64 bit OS since I have a 64 bit processor on my computer. Many people I consulted told me it would be a painful process, since lots of software do not work well outside the 32 bit world.

They prove themselves almost wrong. Debian has about every piece of software compiled for its amd64 version. The exception being Macromedia Flash. But lets leave Adobe out of this one.

Java's date and time APIs

Wed, 16 Jan 2008 00:00:00 +0000

Java provides two different APIs to deal with dates and times, java.util.Date and java.util.Calendar.

Both of these APIs are missing necessary operations that should be easily doable with dates and times, such as addition and substraction, They also lack several important classes such as time intervals, durations and periods. They don’t allow for the creation of time zone agnostic dates, either.

They have huge implementation failures, too: they are mutable. And they are not thread safe.

Argentina's DST: software vendors' reactions

Tue, 08 Jan 2008 00:00:00 +0000

Greetings!

As almost everyone must know by now, Argentinian government decided to implement Daylight Saving Time for this summer, starting on December 30th and ending on March 16th.

This decision was taken on December 27th, leaving only three days for everybody to take the appropriate action. Three days on December. Three days really close to the New Year. Three days on which most people are thinking on holidays and partying. This lack of foresight is the trigger for this article’s debate.