Software Development

Up to now, I’ve always declined to set up security questions on my Yahoo Mail account, simply because I have no fears of forgetting my password.  I’ve never really thought much about the whole thing. But to my annoyance, today I was forced to select two security questions and answers, before I could even log into my account.  Through pure annoyance I nearly lapsed into parody (Question: “Do I really give a F—?”) but then realised this would leave my account wide open for somebody to easily recover my password! This caused me to realise just how big a loophole the security question model is.  Upon reflection, I felt was being forced to provide an additional - and less secure - means of access to my account.  Even if I selected one of the provided questions (”What was the name of the hospital you were born in?”), this could be easily learned through a little social engineering.  Most likely, family members and those in close relationships would have a good chance at correctly answering the security questions for each other. But a further gap exists where it is possible to provide your own question and answer, which may not be chosen with security in mind.  How many people will opt for “What is my favourite colour?” (even a stranger could guess that after a few tries), or even worse “Do I really give a f—” as I nearly set up in my annoyance (the answer to this rhetorical question is obvious). Ideally, we would all set up our own question which only we can answer, but in practice a lot of people will be lax on this. I wonder why Yahoo made security questions mandatory all of a sudden? Presumably I did not choose any when I registered, and perhaps Yahoo are spending a lot of money manually recovering accounts. Although there needs to be a way to recover lost email accounts, the security question model seems far from ideal.  Is there a better way to recover lost email accounts without invoking a manual process?  To answer this, we are really asking the question of “what alternatives are there to passwords - which I can easily forget”?

I was greeted this morning with a big error page when I checked this site was running. Good morning to you too Apache!

So I checked the logs, expecting something I’ve seen before, like MySQL shutting itself down spontaneously, but for the life of me I couldn’t find anything helpful in the logs. Server down, no errors in the usual logs - this is obviously a new experience! Also a very confusing experience.

I’ve wanted to do this for a while …

After tracking where people are finding links to this site for for several months, I’ve included a page with a live update with these figures.

What’s this useful for? Absolutely nothing. Except, I now have the makings of a homegrown stats package, written in Java, so I can reuse it for other things.

One idea is to also track the browsers people are using. Maybe operating systems too. So anyone who’s actually coming to this site by clicking a link from somewhere else … you can feel privileged to add to my stats ;)

IBM are promoting their Cloudscape relational database with a Java Challenge … download the product and the tables and find the hidden word using your coding skills!

It seems only US/Canadian citizens can enter, no good for me but I’ll have a go at it anyway.

Deadline is January 31st so better get going …

OK so it’s a rather grandiose title, but this site describes one of those brainteasers that is tricky to get your head around logically, but pretty simple empirically.

Here is a ‘quick and dirty’ program I wrote to demonstrate that indeed, your chances are doubled if you change from your first choice!

Output:

Without swapping doors:

After 1000000 runs, the prize was won 333686 times.

With swapping doors:

After 1000000 runs, the prize was won 666606 times.

For those with broadband, you can enable pipelining to increase the speed of page loading as follows.

BBC News have an article suggesting that this year will be memorable for mobile technology, namely 3G.

I have to admit, I feel like a Luddite in that I have no interest in 3G. How many people really need to make video calls? OK it’s great technology, but if you strip out all the marketing, I think very few people would really improve their quality of life with one of these handsets.

Well I’ve spent the last couple of days learning Struts, and I found the best way to solidify my understanding: re-write this site using it!

So we’re up and running again, with an even better MVC framework.

What are my thoughts so far on Struts?

Pros

• It’s much more pleasing to have page-flows that are all connected somehow, to be tied up into an action. I also like the idea that I can re-use actions. For example, I have a login action. So far I only have that in one place, but if I needed to I could simply drop it in as a forward from another admin action, say. It’s nice to be able to see all my page-flows in an xml configuration file, rather than littered throughout lines of code.
• The tag libraries are very useful. I’ve noticed that Struts automatically re-writes URLs with the jsessionid when it needs to. That’s one big chore taken care of. Also my JSPs look even tidier now, with logic:iterate tags - I can access collections without having to cast, get Iterators etc. Previously, I was putting an Iterator into the pageContext. And that meant casting/while loops etc. I’d like to use JSTL, I really would, but this server is not up to JSP 2.0 and even with the jar files I don’t think I’d get away with it.
• ApplicationResources.properties - now all my error messages and labels are in a configuration file, rather than tied up in code.
• More generally, I really like the fact that you get more of a birds-eye view of your application. I can step back a bit from lines of code and think in terms of Actions, Use-Cases really.

Cons

The XHTML 1.0 specification is basically an attempt by W3C to provide a new standard of http markup, with much greater compatibility over various ‘user agents’, without breaking anything.

The Web Developers’ Virtual Library says it well:

Portability: By the year 2002 as much as 75% of Internet access could be carried out on non-PC platforms such as palm computers, televisions, fridges, automobiles, telephones, etc. In most cases these devices will not have the computing power of a desktop computer, and will not be designed to accommodate ill-formed HTML as do current browsers (bloated with code to handle sloppy or proprietary HTML).

The results of a very interesting study are out, where The Middleware Company compared these two Enterprise-class technologies by unleashing developers of each platform, working head-to-head to fulfil a (complex) specification.  Link here.

The (enormous) caveats are that:

1. The J2EE product used was IBM Websphere, not always the most-loved app server.

2. The study was sponsored by Microsoft!

Now this study is interesting because these two technologies are aiming to solve the same problems, namely how to develop, deploy and maintain organisation-wide systems that are scalable and maintainable. For example, what if a company decides to re-invent one of its key policies? Does that mean re-writing thousands of programs, testing them, then rolling out the changes over a period of months, or can you simply dig out the ONE module that holds that bit of business logic, and rewrite that?