securing java

Filed under: security, java, software, technology — Harshal at 7:21 am on Monday, May 28, 2007

http://today.java.net/pub/a/today/2004/10/22/obfuscation.html

http://www.javaworld.com/cgi-bin/mailto/x_java.cgi

closeable and flushable interfaces in Java 5

Filed under: java, software, technology — Harshal at 8:54 am on Tuesday, May 22, 2007

Java 5 has two separate interfaces in java.io package.

  • Closeable
    • A Closeable is a source or destination of data that can be closed. The close method is invoked to release resources that the object is holding (such as open files).
  • Flushable
    • A Flushable is a destination of data that can be flushed. The flush method is invoked to write any buffered output to the underlying stream.

Java : Final is not constant ?

Filed under: java, software, technology — Harshal at 9:03 am on Monday, May 21, 2007

Java doesn’t have anything like C++ const. You might think that final is like const, but it’s not:

  • A final variable in Java can be assigned to only once, but if the variable is a reference-type, you can still change what it refers to. Fun!
  • A const variable in C++ can be assigned to only once, where it’s declared, and nothing is allowed to change about the value, whether it’s an object or not. Now that is a nice feature!

This is what Java Language Specification talks about the final variable.

A variable can be declared final. A final variable may only be assigned to once. It is a compile time error if a final variable is assigned to unless it is definitely unassigned (§16) immediately prior to the assignment.

A blank final is a final variable whose declaration lacks an initializer.

Once a final variable has been assigned, it always contains the same value. If a final variable holds a reference to an object, then the state of the object may be changed by operations on the object, but the variable will always refer to the same object. This applies also to arrays, because arrays are objects; if a final variable holds a reference to an array, then the components of the array may be changed by operations on the array, but the variable will always refer to the same array.

Declaring a variable final can serve as useful documentation that its value will not change and can help avoid programming errors.

In the example:

class Point { int x, y; int useCount; Point(int x, int y) { this.x = x; this.y = y; } final static Point origin = new Point(0, 0);}

the class Point declares a final class variable origin. The origin variable holds a reference to an object that is an instance of class Point whose coordinates are (0, 0). The value of the variable Point.origin can never change, so it always refers to the same Point object, the one created by its initializer. However, an operation on this Point object might change its state-for example, modifying its useCount or even, misleadingly, its x or y coordinate.

Garbage Collection Report

Filed under: java, software, technology — Harshal at 5:15 am on Tuesday, May 15, 2007

The new -Xloggc:file option reports on each garbage-collection event, as with -verbose:gc, but logs this data to file. In addition to the information -verbose:gc provides, each reported event is preceeded by the time (in seconds) since the first garbage-collection event.

XCheck:jni - Additional checks for JNI

Filed under: java, software, technology — Harshal at 5:14 am on Tuesday, May 15, 2007

The new -Xcheck:jni command-line option performs additional checks for Java Native Interface (JNI) functions. Specifically, the Java Virtual Machine validates the parameters passed to the JNI function as well as the runtime environment data before processing the JNI request. Any invalid data encountered indicates a problem in the native code, and the Java Virtual Machine will terminate with a fatal error in such cases. Expect a performance degradation when this option is used.

Deadlock Detection in Java

Filed under: java, software, technology — Harshal at 5:13 am on Tuesday, May 15, 2007

A deadlock detection utility has been added to the Java HotSpot VM. The utility is invoked by a Ctrl+\ on the command line while an application is running. The utility detects Java-platform-level deadlocks, including locking done from the Java Native Interface (JNI), the Java Virtual Machine Profiler Interface (JVMPI), and Java Virtual Machine Debug Interface (JVMDI).

Multiple VM’s in Java

Filed under: java, software, technology — Harshal at 5:05 am on Tuesday, May 15, 2007

The Java 2 SDK, Standard Edition, contains two implementations of the Java virtual machine (VM).

  • Java HotSpot Client VM
  • The Java HotSpot Client VM is the default virtual machine of the Java 2 SDK and Java 2 Runtime Environment. As its name implies, it is tuned for best performance when running applications in a client environment by reducing application start-up time and memory footprint.
  • Java HotSpot Server VM
  • The Java HotSpot Server VM is designed for maximum program execution speed for applications running in a server environment. The Java HotSpot Server VM is invoked by using the -server command-line option when launching an application, as in
  • java -server MyApp

 

XML Namespace and QName Explained

Filed under: java, software, technology — Harshal at 7:26 am on Thursday, May 10, 2007

The XML Namespaces specification defines a way to group element and attribute names so that schemas created by one organization will not conflict with those created by another. Just as two Java classes can have the same name as long as they are defined in separate packages, two XML elements can have the same name as long as they belong to different namespaces.

Each namespace defined in an XML document must be associated with a distinct uniform resource identifier (URI), which is usually a URL. These URIs have no semantic meaning and do not refer to actual web resources. You should define namespace URIs using domains that you control to prevent naming conflicts for the same reason that you should follow the URL naming convention for Java packages.

Two URIs are considered distinct if they are distinct character strings, regardless of whether they would resolve to the same physical resource (i.e. http://localhost and http://george are distinct URIs in the context of XML namespaces even on the host george).

Namespaces are associated with a prefix when they are declared and this prefix is used along with a local name to represent an element in an XML document. A namespace declaration looks like this:

The namespace http://url1 is bound to the prefix “a” and the namespace http://url2 is bound to the prefix “b” in this example. Three child elements of

: , , and , would have no namespace, a namespace of “http://url1″, and a namespace of “http://url2″, respectively, and all would have the local name “child”.

Namespaces have a scope associated with them. A namespace declared in a parent element is bound to a given prefix for that element as well as for all of its child elements, unless that prefix is “overridden” in a child element by being assigned to a different namespace. The association between the namespace and prefix declared in an element do not apply to the siblings of that element. This is equivalent to the scope of variable names within the Java programming language.

A default namespace can be defined by omitting the prefix mapping in the declaration as in “xmlns=’http://url3′”. At most one default namespace is in effect at any given point in an XML document. The default namespace is scoped just as the prefix mappings are. If a default namespace is in scope and an element appears with no prefix then it is associated with that default namespace.

Attribute names never inherit the default namespace and must be explicitly mapped to a namespace.

The “qName”, or qualified name, argument contains the element name exactly as it appears in the XML document, including the prefix and colon, if appropriate