[jug-discussion] test -- ignore me

2006-01-17 Thread Andrew Huntwork
testing subscription problems


[jug-discussion] storing blobs on file system or in db

2005-03-16 Thread Andrew Huntwork
I'm writing this web app that allows users to upload documents, such as 
word docs, images, etc, and then to download those documents again on 
request.  the documents are not searched, interpretted, processed, 
version controlled, or anything else.  just upload and download.  i 
wonder if there's a general rule on whether one should stick such things 
into a db or onto the file system.

i currently favor sticking them in the db.  putting them on the fs seems 
to interfere with clustering (different files would be on different 
filesystems).  it's also another thing to back up and generally 
maintain.  on the other hand putting them in the db puts extra load on 
the db and the network.  there are a bunch of other issues too.

Any ideas?  Thanks for any help.
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


Re: [jug-discussion] storing blobs on file system or in db

2005-03-16 Thread Andrew Huntwork
it looks like the clear consensus is file system.  that's what 2 of my 
co-workers said before i asked here, but now i actually basically 
believe them.

I still have my doubts though...if someone has done this the db way and 
actually seen real scalability problems, i'd love to hear about it.

Thanks for the responses.
Andrew Huntwork wrote:
I'm writing this web app that allows users to upload documents, such as 
word docs, images, etc, and then to download those documents again on 
request.  the documents are not searched, interpretted, processed, 
version controlled, or anything else.  just upload and download.  i 
wonder if there's a general rule on whether one should stick such things 
into a db or onto the file system.

i currently favor sticking them in the db.  putting them on the fs seems 
to interfere with clustering (different files would be on different 
filesystems).  it's also another thing to back up and generally 
maintain.  on the other hand putting them in the db puts extra load on 
the db and the network.  there are a bunch of other issues too.

Any ideas?  Thanks for any help.
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


Re: [jug-discussion] the languages that we create....

2005-02-24 Thread Andrew Huntwork
i'm saying, comparing communities of projects to genes is interesting 
and provides some insight into why the injection of (varying numbers of) 
new projects of varying quality into a community is necessary and 
useful.  I explicitly do not judge the quality of any project and 
indicate that the quality of a project changes over time as a result of 
environmental changes, changes within  the project, or other reasons.  I 
also do not argue that individual projects evolve, just that groups of 
projects (communities) evolve by the addition of new projects and the 
increased or decreased popularity of existing projects.

I'm also saying that, while interesting, this analogy may be BS. 
certainly i didn't spend more than 5 minutes analyzing it before writing 
my original email.  feel free to tell me why it's BS.

that evolution may occur inside a project or that evolution is a 
necessary aspect of every open source project are premises that i'll 
leave it to you to argue.

Randolph Kahle wrote:
[...]
There are all kinds of problems with this analogy.  It assumes that 
the quality of a project is unknowable at the outset so mutations are 
in fact random.  This might actually be reasonable.  Groovy apparently 
looked for quite a while like a good project and has recently started 
sucking.  bcel started out looking very cool, but kind of died for a 
while (though it might be back again).  considering the many 
non-technical reasons an open source project may fail, judging project 
quality at any point in its evolution seems tricky enough to make 
randomness reasonable.

I am not sure what point you are trying to make. Are you arguing for or 
against an evolutionary analogy?

 From your description of these open-source projects (and the general 
context of this thread) it sounds like they are mostly ego trips. 
Someone thought of an idea that might be cool, didn't take the time to 
think deeply about the subject area, started coding, hyped the project ...

I have to ask: why does an open-source project take an evolutionary path 
as you describe? To me that indicates the project had unclear goals, 
confused objectives, insufficient research and/or knowledge applied to it.

Randy
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


Re: [jug-discussion] the languages that we create....

2005-02-24 Thread Andrew Huntwork
John D. Mitchell wrote:
Andrew == Andrew Huntwork [EMAIL PROTECTED] writes:
[...]
Really?  You work in a place where it's *not* dictated that you use them
(or, contrapositively, you e.g., can't afford e.g., good solutions)?  Or
do you only use them on your own pet projects but not at work?  Or what?
i have used alternatives to each of those projects at work.  (jrun, 
IIS, some POS custom servlets-based framework, make, BLOAT, and others)

On pet projects, well, free is good.  but there are a lot of free 
alternatives these days, and free vs. non-free is not the subject of my 
post.  lack of lockin was the subject of this part of my post.

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


Re: [jug-discussion] the languages that we create....

2005-02-23 Thread Andrew Huntwork
Various People said:
 [various things i don't care about]
tomcat,apache httpd, tapestry, struts, ant, and bcel have all made my 
job or my hobby easier at one time or another.  i'm sure other 
apache.org projects have made other people's work easier.  i care oh so 
very little about whether these or other projects are evil or 
disfunctional.  no one forces me to use any of them.

on an unrelated note, ASF and other communities could be thought of in 
genetic terms.  a project is an allele.  popular projects are high 
frequency alleles.  useless and sucky projects become extinct. 
mutation, i.e., letting new projects into the community, is, in this 
model, very important.  it allows the community to adapt to a changing 
environment, etc, read your genetics textbook.

An interesting thing about mutation is that the rate of mutation in a 
species is an evolved trait.  different species have different mutation 
rates, and mutation rate affects fitness.  if ASF allows too many new 
projects and for example codehaus has a better (lower) mutation rate, 
then eventually ASF might die or something.

There are all kinds of problems with this analogy.  It assumes that the 
quality of a project is unknowable at the outset so mutations are in 
fact random.  This might actually be reasonable.  Groovy apparently 
looked for quite a while like a good project and has recently started 
sucking.  bcel started out looking very cool, but kind of died for a 
while (though it might be back again).  considering the many 
non-technical reasons an open source project may fail, judging project 
quality at any point in its evolution seems tricky enough to make 
randomness reasonable.

Another problem with my analogy might be that it's been a while since i 
took a genetics class and didn't exactly ace that one.  And maybe this 
is all just BS.  who knows.

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


Re: [jug-discussion] java xpcom is alive!

2004-12-03 Thread Andrew Huntwork
XPCOM is a cross-platform (X-P) implementation of COM.  (Are you 
enlightened now?)  I'm no expert on COM, but I think it's a 
language-neutral way of writing and accessing software modules.  It's 
built on interfaces (expressed in idl) and reference counting.  Before i 
make more of an idiot of myself, let me defer to
http://www.mozilla.org/projects/xpcom/

The point is, mozilla exposes a lot of functionality through 
XPCOM-accessible objects and interfaces [*], and now that this guy has 
written java bindings, java developers should be able to a) consume this 
 functionality and b) extend mozilla by writing java classes.  That's 
the high level answer to your question.  The reason I said I'd like to 
do a preso is to force myself to provide a low-level answer...

* though less than before.  it turns out that over-using COM leads to 
slow, bloated code that requires memory bloat, prevents compiler 
optimization, and plays havoc with current hardware branch predictors. 
But it's not all bad, as far as i know.

Warner Onstine wrote:
What is XPCOM again? What is it used for? (Or I guess better, what can  
it be used for?)

-warner
On Dec 2, 2004, at 11:08 AM, Andrew Huntwork wrote:
http://lxr.mozilla.org/seamonkey/source/extensions/java/xpcom/tests/ 
TestArray.java

maybe it wouldn't be too hard to write some java code that uses  
mozilla's networking library (asynchronous, multithreaded, supports  
many protocols) (I hope that's a correct characterization), or screws  
around with a DOM from a web page (or the mozilla UI), or any number  
of other things.  I'm going to play around with this and hopefully do  
a preso at some point, unless there is widespread disinterest...

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


Re: [jug-discussion] Ant and Anthill Spawn o' the Devil

2004-11-04 Thread Andrew Huntwork
To the extent that i understand the problem here, my favorite solution 
is to use linux.

It sounds like the problem is that undeploying an app from tomcat 
doesn't work.  I'm pretty sure that's becuase on windows you can't 
delete open files.

On linux, there's no problem deleting open files, so undeploy/redeploy 
just works.

maybe i've totally missed the point though.  i've never even heard of 
anthillpro, so that seems pretty likely.

Drew Davidson wrote:
Tim Colson wrote:
I'm going nuts. I've been trying to get ANT to re-deploy a webapp to 
Tomcat 5 via AnthillPro. Works from command line, but hangs AnthillPro.
 
A little background... I first tried the ant-tomcat tasks to simply 
undeploy/deploy but the Flex app (inside util.war) has problems 
undeploying - there is a directory filled with jars that cannot be 
removed.  
So I decided to just stop tomcat, wipe out the directory and redeploy...
 
It all works... the build is a success... but Anthillpro hangs at the 
end. :-(
 
I just don't get it. (I've tried exec with startup and 
startup-using-launcher... with and without spawn. It really does need 
spawn, otherwise it understandibly does not finish the build process.

A hint:  the Tomcat tasks are more trouble than they are worth.  They 
don't work.

I just run tomcat in a console window and restart it whenever I 
redeploy.  Slower, but it's consistently correct.  If you installed the 
Tomcat service you can use the control panel to start/stop (but I prefer 
the console so that I can see what's going on).
Better yet use Resin (http://www.caucho.com) which is faster to start 
and stop.  It has a control panel also (no service install, however).

- Drew
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


Re: [jug-discussion] Investigating Flex

2004-10-13 Thread Andrew Huntwork
one of my hobbies is watching what gets checked in to mozilla cvs:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=defaultmodule=SeaMonkeyAllbranch=branchtype=matchdir=file=filetype=matchwho=whotype=matchsortby=Datehours=2date=daymindate=maxdate=cvsroot=/cvsroot
One interesting thing i've seen recently is this:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=defaultmodule=SeaMonkeyAllbranch=branchtype=matchdir=file=filetype=matchwho=pedemontwhotype=regexpsortby=Datehours=2date=monthmindate=maxdate=cvsroot=%2Fcvsroot
or maybe this is better:
http://bonsai.mozilla.org/rview.cgi?cvsroot=/cvsrootdir=mozilla/extensions/java/xpcom
this all looks like xpcom bindings for java, which would allow major 
portions of mozilla to be implemented in java and java to use lots of 
mozilla functionality.  i couldn't find a bug describing this work, so 
who knows what it is for sure.  could be a lot of fun though.

Erik Hatcher wrote:
Have you considered XUL?
I'm building a prototype system currently using XUL and a Mozilla 
extension.  Powerful stuff!  Very well done architecture under the 
covers of Mozilla.

Erik
On Oct 13, 2004, at 6:35 PM, Thomas Hicks wrote:
I can't speak for others but I'm just investigating some cool
 ways to build web-based front ends onto the database stuff
 I normally do. I haven't committed to anything at this
 point, especially given the high cost and the frugal nature
 of the company I work with.
 I must say however that, having developed a couple
 of Java-based GUIs in the past, Java was tedious and
 time-consuming compared to this system. But, that
 may be unfair since I haven't gotten that far into Flex yet.
-tom
 At 03:15 PM 10/13/2004, you wrote:
To those investigating Flex,
 I'm curious as to the reason(s) your business analyst
 gave you for dumping Java clients in favor of Flash.
 The two I hear the most are, Most PC's don't have a
 workable JRE and the JRE is to time expensive (10+ MB
 on a dial-up), and Cool effects such as motion
 graphics and tweening have be programmed by hand in
 Java, as opposed to being built in to Flash.
 I'm trying to get a feeling for which way the wind is
 blowing and how hard.
 Ray
 --- Thomas Hicks [EMAIL PROTECTED] wrote:
  For Timo (and anyone else investigating Flex),
 
  I recently bought a copy of the first Flex book
  I've seen in print:
 
  Developing Rich Clients with Macromedia Flex
  by Steven Webster and Alistair McLeod.
 
  I've only read a couple of chapters but it looks
  good so far.
-tom
 
 
  ServerSide newsthread:
 
http://www.theserverside.com/news/thread.tss?thread_id=25418
 
  ServerSide article:
 
http://www.theserverside.com/articles/article.tss?l=Flex
 
  Direct download link to Chapter 20:
 
http://www.theserverside.com/articles/content/Flex/Flex_Chapter20.pdf
 
  Link to the authors' consulting firm, which has
  other interesting
  links to rich client development sites:
  http://www.iterationtwo.com/index.html
 
 
 
 
 -
  To unsubscribe, e-mail:
  [EMAIL PROTECTED]
  For additional commands, e-mail:
  [EMAIL PROTECTED]
 
 

 
 __
 Do you Yahoo!?
 Yahoo! Mail Address AutoComplete - You start. We finish.
http://promotions.yahoo.com/new_mail

 -
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


Re: [jug-discussion] Eclipse: find usages?

2004-09-09 Thread Andrew Huntwork
select an object, like a class, method, field, or local variable, 
right click on it, references-project.

i just got one of my co-workers started with eclipse, and he says, Wow, 
it's powerful!  And then it chews up all his ram and simple operations 
take 30 seconds or more.  But i think his machine is a little hosed anyway.

Tim Colson wrote:
Disclaimer: I'll get this out of the way first... I use Intellij IDEA 
and like it. There I said it. ;-) 
I use it because it makes me happy, but I'm not here to bash other IDE's 
or debate the value of emacs versus Netbeans versus Eclipse and how it 
will Rule The World, or whatever else.
 
I'm using Eclipse to work on an Eclipse plug-in (seems the logical 
path), so I probably will have questions for a while to help me 
understand how to use Eclipse. Simple as that.
 
Okay, that said... is there a find usages feature? In other words, you 
click on an object, and the IDE shows you all the places that object is 
used, in the current class, or project.
 
Tim
 
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


Re: [jug-discussion] Eclipse question

2004-09-01 Thread Andrew Huntwork
[EMAIL PROTECTED] wrote:
For your CVS issue, you might try the Filters option on Package
Explorer title bar pull down menu (the little down arrow).  It has a
bunch of options to control the types of resources that display.  I
have searched my configuration and don't see anything special that I
have set up to exclude the CVS files, but they do not show on my
system.
I think as long as the project is shared, eclipse won't show .CVS.  The 
only time you'll see them if i'm right is if you check out a project 
from cvs using a cvs client other than eclipse and create an eclipse 
project based on those files.  Tim, if that's basically how you ended up 
with your project, you'll probably want to right click on your project, 
team - sharing and enter your cvs information or something along those 
lines.

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


Re: [jug-discussion] classDefNotFound

2004-06-17 Thread Andrew Huntwork
the -verbose command line arg to sun's jvm shows you what jars are being 
loaded and what classes from each jar are loaded.  the same flag to 
bea's jvm (distributed with redhat el 3) causes an excrutiatingly 
verbose log.  I guess you could give that a try.

Michael Oliver wrote:
I know this august group can help.
 

I am befuddled (not unusual) because I have a class that runs fine in my 
JUnit test within Eclipse but when I deploy it to my Tomcat application 
it throws a lang.classDefNotFound exception.   I know that the classpath 
in Eclipse (that works) and the jars in that classpath need to be in the 
Tomcat classpath and I have gone jar by jar through those in the Eclipse 
classpath and the Tomcat Web-Inf/lib/ for my WebApp, yet when I try to 
instantiate my class it throws the exception.

 

There are more jars in the Tomcat classpath than are in my Eclipse 
project classpath, but the class it cant find is 
javax.xml.rpc.ServiceException and that is in the j2ee.jar and I have 
verified it is the same in both paths.

 

Anyone think of anything else I can try?
 

Michael Oliver
CTO
Matrix Intermedia Inc.
3325 N. Nellis Blvd, #1
Las Vegas, NV 89115
Phone:(702)643-7425
Fax:(520)844-1036
 

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


Re: [jug-discussion] classDefNotFound

2004-06-17 Thread Andrew Huntwork
The referenced section:
The classloader that a container uses to load a servlet in a WAR must 
allow the
developer to load any resources contained in library JARs within the WAR
following normal J2SE semantics using getResource. It must not allow 
theWAR to
override J2SE or Java servlet API classes. It is further recommended 
that the loader
not allow servlets in theWAR access to the web containers 
implementation classes.
It is recommended also that the application class loader be implemented so
that classes and resources packaged within the WAR are loaded in 
preference to
classes and resources residing in container-wide library JARs.

So it sounds like your container is unhappy because you're trying to 
override servlet api classes.  And it sounds like you won't get any 
farther by unzipping in your webapp's lib dir.  i bet somewhere in 
common or server is the way to go, but it looks like you're already 
tried that to no avail.  so i dunno.

Michael Oliver wrote:
Ok, that helped too.
I tried moving the j2ee.jar that contains the
javax.xml.rpc.ServiceException I need to the tomcat /common/
directories, /endorsed and /lib
When in the /endorsed the j2ee.jar showed in the logs as [opened],
however there was a NoClassDefFoundError for the
/com/sun/jmx/mbeanserver/GetPropertyAction and Tomcat didn't start.
So I moved j2ee.jar to /lib and got the same NoClassDefFoundError and
Tomcat didn't start.
So I moved j2ee.jar back to the Webapp /lib and restarted with my
JAVA_OPTS = -verbose and AHHA!
I find this in the logs:
Webapp Class Loader:
validateJarFile(/root/java/jakarta-tomcat-4.1.29/webapps/AJCS/WEB-INF/li
b/j2ee.jar) - jar not loaded. See Servlet Spec 2.3, section 9.7.2.
Offending class: javax/servlet/Servlet.class 

Webapp Class Loader:
validateJarFile(/root/java/jakarta-tomcat-4.1.29/webapps/AJCS/WEB-INF/li
b/servlet-2.3.jar) - jar not loaded. See Servlet Spec 2.3, section
9.7.2. Offending class: javax/servlet/Servlet.class
I am guessing the solution would be to unpack the jar into the
WEB-INF/classes/ directory so the individual classes needed can be
loaded without validateJarFile.  Or is there another way?
Michael Oliver
CTO
Matrix Intermedia Inc.
3325 N. Nellis Blvd, #1
Las Vegas, NV 89115
Phone:(702)643-7425
Fax:(520)844-1036
-Original Message-
From: Andrew Huntwork [mailto:[EMAIL PROTECTED] 
Sent: Thursday, June 17, 2004 8:37 AM
To: [EMAIL PROTECTED]
Subject: Re: [jug-discussion] classDefNotFound

the -verbose command line arg to sun's jvm shows you what jars are being
loaded and what classes from each jar are loaded.  the same flag to 
bea's jvm (distributed with redhat el 3) causes an excrutiatingly 
verbose log.  I guess you could give that a try.

Michael Oliver wrote:
I know this august group can help.

I am befuddled (not unusual) because I have a class that runs fine in
my 

JUnit test within Eclipse but when I deploy it to my Tomcat
application 

it throws a lang.classDefNotFound exception.   I know that the
classpath 

in Eclipse (that works) and the jars in that classpath need to be in
the 

Tomcat classpath and I have gone jar by jar through those in the
Eclipse 

classpath and the Tomcat Web-Inf/lib/ for my WebApp, yet when I try to

instantiate my class it throws the exception.

There are more jars in the Tomcat classpath than are in my Eclipse 
project classpath, but the class it can't find is 
javax.xml.rpc.ServiceException and that is in the j2ee.jar and I have 
verified it is the same in both paths.


Anyone think of anything else I can try?

Michael Oliver
CTO
Matrix Intermedia Inc.
3325 N. Nellis Blvd, #1
Las Vegas, NV 89115
Phone:(702)643-7425
Fax:(520)844-1036


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


Re: [jug-discussion] WindowsXP help?

2004-04-16 Thread Andrew Huntwork
tfug.org would be very enthusiastic about solving these problems permanently, I 
think...but on a possibly more useful note, I think best buy and compusa will be able to 
fix the problem in a less drastic manner.

Randolph Kahle wrote:
Sorry, this is off-topic...

I have a friend in Tucson who is having trouble with his WindowsXP 
machine. (Freezes, etc.)

Any recommendations for a store/shop/consultant that could help him?

Thanks -- Randy

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
--
I say to you that the VCR is to the American film
producer and the American public as the Boston
strangler is to the woman home alone.
-Jack Valenti, President, Motion Picture
 Association of America, Inc., before
 The House Subcommittee on Courts, Civil
 Liberties, and The Administration of
 Justice, August, 1982,
 http://cryptome.org/hrcw-hear.htm
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


Re: [jug-discussion] enumerated constants in Java and Oracle?

2004-03-22 Thread Andrew Huntwork
yes, 1.5 has enumerated types:
http://java.sun.com/developer/technicalArticles/releases/j2se15/
It works like this:

  public enum StopLight { red, amber, green };



Tim Colson wrote:
Hey gang -

  Javaworld article from 1997 talks about the good/bad of static
finals compared to enumerated constants and provides a template for the
latter. Other JW articles expand on that theme over the years. 
http://www.javaworld.com/javaworld/jw-07-1997/jw-07-enumerated_p.html

Found another ONJava article on similar topic:
http://www.onjava.com/pub/a/onjava/2003/04/23/jenum.html
  I'm wondering if JDK 1.5 adds this feature? Also wondering if Oracle
has a datatype that does the same kind of thing?
Cheers,
Timo
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
--
I say to you that the VCR is to the American film
producer and the American public as the Boston
strangler is to the woman home alone.
-Jack Valenti, President, Motion Picture
 Association of America, Inc., before
 The House Subcommittee on Courts, Civil
 Liberties, and The Administration of
 Justice, August, 1982,
 http://cryptome.org/hrcw-hear.htm
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


Re: [jug-discussion] HttpSession question...

2004-02-20 Thread Andrew Huntwork
Not to diverge too far from the topic, but...

Even with encryption you have to careful, as the WEP (Wired Equivalent 
Privacy, part of the 802.11 spec) folks found out the hard way.  I don't 
recall what the relevant data were, but some part of WEP involved 
sending some bytes and a crc-32 checksum of those bytes encrypted with 
some kind of stream cipher (RC-4?).  The checksum was intended to allow 
the recipient to verify the integrity of the data.  However, an attacker 
could modify the encrypted message so that the bytes were modified and 
the checksum was changed appropriately.  This was only one of several 
attacks on WEP related to bad crypto usage.

So depending on the kind of cipher you use, it is possible to make 
directed changes to the ciphertext without having any knowledge of the 
key.  Therefore, it's sometimes crucial to use a cryptographically 
secure message authentication code, like SHA-1, before trusting your 
plaintext.  In fact, it seems  to be enough in the case we're talking 
about here to use only a MAC, without encryption.  You just have to hash 
in something the client doesn't know, like a 128 bit random number, or 
else the client can just recompute the hash...

Michael Oliver wrote:
Embedding encrypted info about things like the domain, ip address, and
user credentials in the cookie as well as a timeout for the cookie can
make it very difficult to spoof though.
Ollie
 
On Thu, 2004-02-19 at 23:46, Nicholas Lesiecki wrote:

I second Andy.

BTW, It is possible to spoof someone else's session id cookie, posing a 
security risk. An application with serious security concerns (banking, 
ecommerce) would need to pay attention to this vulnerability.
Nick

On Feb 19, 2004, at 10:41 PM, Andrew Barton wrote:


Hi Robert,

Your understanding is the same as mine. But, the security question you 
pose
is interesting. I wonder if it would be possible to change your 
session ID
and access someone else's session. Depending on the application, this 
could
be a security risk.

I'll have to look into that...

Andy

On 2/19/04 8:55 PM, Robert Zeigler [EMAIL PROTECTED] wrote:


Recently, somebody proposed an interesting question to me which, 
though
I'm pretty sure I know the answer, I've been unable to verify.
So, I decided to turn here to see if someone with more wisdom than I 
had
an answer. ;)
My understanding of HttpSessions is that, unless you specifically 
write
something to a cookie, the only thing stored on the client side is the
sessionID (either via a cookie or via URL rewriting). However, if I 
do a
session.setAttribute(someattr,someobject), that object is simply
stored (typically in memory, though not necessarily) server side,
available in the web application context.
Correct so far?
In other words, session attributes are not directly editable client
side... right? I mean, this makes complete sense to me, as the client 
in
a web app really doesn't give a hoot about foo or bar, it just wants
html. However, someone made a claim to me recently that some 
information
stored as a session attribute could be alterred directly by the user,
client side, and therefore posed a security risk to a particular
application.
Any thoughts?
Thanks for the help on this... I've looked over the javadocs, etc., 
and
while they don't say anything to negate my viewpoint, they also don't
say anything specifically to validate it.

Robert

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
--
Andrew Barton
eBlox, Inc.
520.903.2541 x102 voice
520.903.2542 fax
Discover storeBlox and webBlox at the new eBlox.com!
http://www.eblox.com
mailto:[EMAIL PROTECTED]


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
--
I say to you that the VCR is to the American film
producer and the American public as the Boston
strangler is to the woman home alone.
-Jack Valenti, President, Motion Picture
 Association of America, Inc., before
 The House Subcommittee on Courts, Civil
 Liberties, and The Administration of
 Justice, August, 1982,
 http://cryptome.org/hrcw-hear.htm
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


Re: [jug-discussion] Testing

2004-02-12 Thread Andrew Huntwork
My presentation is now available at http://files.huntwork.net:8000/bcel/ 
(it seems that files.huntwork.net/bcel/ also works for now until comcast 
goes back to filtering port 80.)

images in BCEL.pdf have been degraded a bit and may not be legible.

Drew Davidson wrote:
A coworker at Scientific Technologies was very interested in the 
presentations given on Tuesday.  He's the manager of our Quality Control 
people.

Is there any way that the presenters could make their powerpoint 
presentations available in some form that he could look at?

Thanks!

- Drew

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


Re: [jug-discussion] February Meeting

2004-02-09 Thread Andrew Huntwork
i would like to do a 15 min presentation on Java Bytecode Inspection, 
Manipulation, and Generation Using BCEL.

Simon Ritchie wrote:
[...]
Any volunteers for a 15 min presentation would be welcome.

Simon.
--
I say to you that the VCR is to the American film
producer and the American public as the Boston
strangler is to the woman home alone.
-Jack Valenti, President, Motion Picture
 Association of America, Inc., before
 The House Subcommittee on Courts, Civil
 Liberties, and The Administration of
 Justice, August, 1982,
 http://cryptome.org/hrcw-hear.htm
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


Re: [jug-discussion] February Meeting

2004-02-09 Thread Andrew Huntwork
i have no problem with that sequence

Simon Ritchie wrote:
Wow, two volunteers within 10 minutes.

Ok, this sounds pretty good. What sequence is going to work best? I'm 
guessing:

1. Andrew - BCEL (15min)
2. Chad - Bytecode manipulation as related to Aspect (5-10min)
3. Nick - Mock Objects using Aspect (1hr)
Simon.

--
I say to you that the VCR is to the American film
producer and the American public as the Boston
strangler is to the woman home alone.
-Jack Valenti, President, Motion Picture
 Association of America, Inc., before
 The House Subcommittee on Courts, Civil
 Liberties, and The Administration of
 Justice, August, 1982,
 http://cryptome.org/hrcw-hear.htm
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]