Interview with Brian Chess from Fortify Software

Fully formatted shownotes can always be found at http://javaposse.com

Brian is Chief Scientist and co-founder of Fortify Software and gave us an interview all about internet security, and the possibility of using static analysis to catch security problems only.

• Fortify Software homepage
• http://www.fortifysoftware.com/
• http://www.fortifysoftware.com/products/
• Brian's personal homepage
• http://www.vantuyl.com/chess/
• The book - Secure Programming with Static Analysis
• http://www.amazon.com/dp/0321424778
• Static Analysis
• http://en.wikipedia.org/wiki/Static_code_analysis
• Findbugs
• http://findbugs.sourceforge.net/
• Other static analysis tools
• http://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis
• Buffer Overflow exploit
• http://en.wikipedia.org/wiki/Buffer_overflow
• Cross Site Scripting (XSS)
• http://en.wikipedia.org/wiki/Cross_site_scripting
• SQL Injection
• http://en.wikipedia.org/wiki/SQL_injection
• Wikipedia list of common vulnerabilities
• http://en.wikipedia.org/wiki/Security_vulnerability

Thanks

• Libsyn.com - http://www.libsyn.com - for hosting and bandwidth
• Brice Ruth and Webprojkt.com - http://webprojkt.com - for our archives site - http://archives.javaposse.com
• Feedburner.com - http://www.feedburner.com - for feed redirect
• Kirsty Doherty, Oliver Widder and Amy Ehmann for Java Posse artwork
• Brian Ehmann - the Java Posse intern
• Craig Muth for maintaining the Java Posse Memorizable site - http://memorizable.org/Java_Posse
• Theme Music:
  • Opening - "Java" the parody song Copyright 1997 Broken Records and Marjorie Music Publ. (BMI), written and performed by Loose Bruce Kerr of the Dr. Demento Show and Sun Microsystems attorney. Based on the WWI popular song, "Ja-da." Ukelele style on the recording taught to Bruce by his dad. Re-produced with kind permission from "Loose" Bruce Kerr - http://loosebrucekerr.libsyn.com
  • Closing - Juan Carlos Jimenez - In the House (Intro No. 1)
    

• To contact us:
  • Visit our homepage - http://javaposse.com
  • Post on our Google Group - http://groups.google.com/group/javaposse
  • Or send us email - javaposse@gmail.com

Newscast for September 21st 2007

Fully formatted shownotes can always be found at http://javaposse.com

• Glassfish v2 and NetBeans 6.0 Beta 1 have been released
• http://blogs.sun.com/pelegri/entry/overview_of_glassfish_v2
• http://weblogs.java.net/blog/ludo/archive/
  2007/09/glassfish_v2_in.html
• http://weblogs.java.net/blog/jfarcand/archive/
  2007/09/whats_really_co_1.html
• http://weblogs.java.net/blog/sdo/archive/
  2007/09/sun_ships_glass.html
• http://www.netbeans.org/servlets/NewsItemView?
  newsItemID=1109
• And, netbeans has just won a Bossie award from InfoWorld
• http://www.infoworld.com/archives/t.jsp?N=s&V=91650
• http://www.eclipsezone.com/eclipse/forums/t101384.html

• OpenOffice.org 2.3 has been released
• http://www.openoffice.org/
• http://extensions.services.openoffice.org/project
• http://download.openoffice.org/2.3.0/index.html
• http://developers.slashdot.org/article.pl?
  sid=07/09/19/1455240&from=rss

• Jens Eckels asks "Do we need an IDE 2.0 revolution"
• http://www.theserverside.com/news/thread.tss?
  thread_id=46941

• SCO declares Chapter 11 bankruptcy
• http://yro.slashdot.org/article.pl?
  sid=07/09/14/1948257&from=rss
• http://yro.slashdot.org/article.pl?
  sid=07/09/18/175259

• Java application of the week jIRCii
• Use it on our new Java Posse IRC channel - #javaposse on irc.freenode.net
  
• http://jirc.hick.org/

• Java Site of the Week: Mint
• http://www.mint.com

Quick News Items

• The eclipse project has released eclipse PHP development tools 1.0
  
• http://www.news.com/8301-10784_3-9780700-7.html
• http://www.eclipse.org/pdt/
• http://www.zend.com

• The Nimbus Look and Feel is nearing completion
  
• http://www.breakitdownblog.com/
  2007/09/07/nimbus-lnf-almost-done/
• http://www.jasperpotts.com/blog/
  2007/09/nimbus-almost-done/

• Chet Haase and the timing framework project have announced version 1.0 of the timing framework
•  https://timingframework.dev.java.net/
• http://weblogs.java.net/blog/chet/archive/
  2007/09/aversion_10_its.html

• Version 1.0 of JSR 295 - the Beans Binding API, is now available for download
  
• http://weblogs.java.net/blog/shan_man/archive/
  2007/09/beans_binding_1.html
• http://forums.java.net/jive/thread.jspa?
  messageID=234190&tstart=0#234190

• iced-tea.org is the home of the IcedTea project providing a completely unencumbered open source Java
• http://iced-tea.org/wiki/Main_Page

• Microsoft have released version 1.0 of Silverlight
• http://developers.slashdot.org/article.pl?
  sid=07/09/05/1442254&from=rss

• Adobe has released the first public beta of Flex 3.0
  
• http://labs.adobe.com/technologies/flex/
• http://flexwiki.adobe.com/confluence/display/
  ADOBE/Home

• Kirill Grouchnikov has announced version 4.0 of the Substance look and feel for Java
• https://substance.dev.java.net/

• A Ccomparison between the Java and .NET way of handling generics
• http://www.jprl.com/Blog/archive/development/
  2007/Aug-31.html

• The Aquarium has a guide to the ReST initiatives for Java
  
• http://blogs.sun.com/alexismp/entry/
  restful_sun_putting_it_all
• http://blogs.sun.com/teera/entry/
  jaxb_for_simple_java_xml

• Apache Tuscany version 0.99 has been released
• http://www.theserverside.com/news/
  thread.tss?thread_id=46746

• The open source Java server Glassfish now has a wiki/user faq site
  
• http://wiki.glassfish.java.net/Wiki.jsp?
  page=GlassFishUserFAQ

• J/Invoke 1.0 has been released
• http://www.jinvoke.com/

• IBM developerworks has a new article describing how to invoke dynamic languages
• http://www.ibm.com/developerworks/java/
  library/j-javascripting1/?ca=dgr-btw01javaapi
  &S_TACT=105AGX59&S_CMP=GR

• The new Cajo java.net project provides a simple and very small library to enable distributed computing using just three simple methods in the API: export, lookup and proxy
• https://cajo.dev.java.net/
• http://weblogs.java.net/blog/cajo/
  archive/2007/09/simple_interjvm.html

• NetBeans has a new module integrating the Google Checkout API through a new open source Google Checkout Java SDK project
  
• http://code.google.com/p/google-checkout-java-sdk/
• http://weblogs.java.net/blog/inder/archive/
  2007/08/netbeans_module.html

• Netbeans.tv now has Tor's video interview about and demo of the new NetBeans 6 rails features for constructing web applications
• http://www.netbeans.tv/interviews/Tor-Norbye-mixes-
  Ruby-and-Java-development-using-NetBeans-151/

• Version 1.6 of project Grizzly has been released
• http://weblogs.java.net/blog/jfarcand/archive/
  2007/08/project_grizzly_3.html

• Lance Anderson blogs that JDBC 4.0 is catching on with ever more companies and organizations offering JDBC 4.0 compliant drivers for their database
• http://weblogs.java.net/blog/lancea/archive/
  2007/09/updated_list_of.html

• If you do a lot of JNI development you may be interested in the Intel integrated Java/JNI debugger
• http://softwarecommunity.intel.com/
  articles/eng/1435.htm

• EclipseZone reports that a new milestone of the Whole Platform, 1.0.0.v20070912-1454
• http://whole.sourceforge.net/Overview.html
• http://www.eclipsezone.com/eclipse/
  forums/t101496.rhtml

• Hudson continuous build engine continues to go from strength to strength
• http://weblogs.java.net/blog/kohsuke/archive/
  2007/09/more_hudson_ado.html
• http://blogs.sun.com/theaquarium/entry/
  hudson_plugins_for_net

• Azul systems, makers of the very scalable Java hardware solutions with the ability to run hundreds of concurrent Java threads is in trouble
• http://www.theserverside.com/news/
  thread.tss?thread_id=46884
• http://www.theregister.co.uk/2007/
  09/12/azul_hurt/

• IBM DeveloperWorks has made another handy little developer tool available. The Lock Analyzer allows you to examine how Java locks are performing in a live application
  
• http://www.alphaworks.ibm.com/tech/jla?
  open&S_TACT=105AGX59&S_CMP=GRsite-
  jw22&ca=dgr-jw22awjla

Thanks

• Libsyn.com - http://www.libsyn.com - for hosting and bandwidth
• Brice Ruth and Webprojkt.com - http://webprojkt.com - for our archives site - http://archives.javaposse.com
• Feedburner.com - http://www.feedburner.com - for feed redirect
• Kirsty Doherty, Oliver Widder and Amy Ehmann for Java Posse artwork
• Brian Ehmann - the Java Posse intern
• Craig Muth for maintaining the Java Posse Memorizable site - http://memorizable.org/Java_Posse
• Theme Music:
  • Opening - "Java" the parody song Copyright 1997 Broken Records and Marjorie Music Publ. (BMI), written and performed by Loose Bruce Kerr of the Dr. Demento Show and Sun Microsystems attorney. Based on the WWI popular song, "Ja-da." Ukelele style on the recording taught to Bruce by his dad. Re-produced with kind permission from "Loose" Bruce Kerr - http://loosebrucekerr.libsyn.com
  • Closing - Juan Carlos Jimenez - In the House (Intro No. 1)
    

• To contact us:
  • Visit our homepage - http://javaposse.com
  • Post on our Google Group - http://groups.google.com/group/javaposse
  • Or send us email - javaposse@gmail.com

Meet up details for Oslo and Amsterdam

If anyone is interested, Carl and Dick will be in front of the Spektrum in Oslo (where the JavaZone conference was held) at the entrance where the rocket ship was (still is?) tonight (Friday 14th) at 8pm local time. We are intending to go looking for beer and possibly lutefisk. Anyone who wants to is welcome to meet up with us.

Also, tomorrow (Saturday 15th) Dick is aiming to be in Molly Malone's Irish Pub close to the Amsterdam Centraal station at around 8.30pm to 9pm (very roughly - depends on flight, time to find baggage, etc.) so if anyone would like to meet me there, please do.

Molly Malones Irish Pub
Oudezijds Kolk 9
1012 AL Amsterdam, Netherlands

Java Posse Episode 142 - Special from JavaZone 2007

Velkommen til Episode 142 av Java Posse - Ekstrasending fra JavaZone 2007!

Top reasons indicating you might be on a Broken Project:

• It takes three months to add one checkbox to a web UI
• Everything starts to look like it would be quicker to rewrite
• Everyone on the project has "Architect" on their business card, and yet they never agree on anything!
• Conversations start with "Oh, that, that's really simple, you just...." followed by a 30 minute description on what to do
• You time your life around "the build"
• The GUI is written in AWT... or HTML 3.2
• Or! The GUI is written in something you wrote yourself
• The project .... is a home grown web framework
• Someone just added 5 more hours of meetings to your work week because "it's late"
• The guy who is supposed to train you, throws a folder of notes at you and runs away cackling gleefully
• The lines of XML outnumber the lines of Java 10:1
• You ask about unit tests and get blank stares from everyone, or a "yeah, we should do that really"

• Silicon Valley Code camp - October 27-28
• http://www.siliconvalley-codecamp.com/SubmitSession.aspx

• NetBeans 6.0 Beta 1 getting close...
• http://wiki.netbeans.info/wiki/view/NewAndNoteWorthy#
  section-NewAndNoteWorthy-Beta1

• Java Applet of the week - Frozen bubble in an applet
• http://www.public.sytes.net/hoefs/games/frozenb.php?lang=en

• Mobile Java App of the week: Opera mini beta 2
• http://my.opera.com/operamini/blog/opera-mini-4-beta-2
• http://www.operamini.com/beta/simulator/

• Java Library of the Week: Quaere by Anders Noras
  
• http://quaere.org/
• http://andersnoras.com/
• http://andersnoras.com/blogs/anoras/archive/
  2007/09/04/next-wednesday.aspx

Thanks

• Libsyn.com - http://www.libsyn.com - for hosting and bandwidth
• Brice Ruth and Webprojkt.com - http://webprojkt.com - for our archives site - http://archives.javaposse.com
• Feedburner.com - http://www.feedburner.com - for feed redirect
• Kirsty Doherty, Oliver Widder and Amy Ehmann for Java Posse artwork
• Brian Ehmann - the Java Posse intern
• Craig Muth for maintaining the Java Posse Memorizable site - http://memorizable.org/Java_Posse
• Theme Music:
  • Opening - "Java" the parody song Copyright 1997 Broken Records and Marjorie Music Publ. (BMI), written and performed by Loose Bruce Kerr of the Dr. Demento Show and Sun Microsystems attorney. Based on the WWI popular song, "Ja-da." Ukelele style on the recording taught to Bruce by his dad. Re-produced with kind permission from "Loose" Bruce Kerr - http://loosebrucekerr.libsyn.com
  • Closing - Juan Carlos Jimenez - In the House (Intro No. 1)
    

• To contact us:
  • Visit our homepage - http://javaposse.com
  • Post on our Google Group - http://groups.google.com/group/javaposse
  • Or send us email - javaposse@gmail.com

Roundup 2007 Session - Desktop and Web

Fully formatted shownotes can always be found at http://javaposse.com

Recorded at the Java Posse Roundup 2007. Since this was recorded, the landscape has changed a bit, with Adobe Apollo being renamed to Adobe AIR, Java FX being launched at JavaOne, and Google Gears also being released. The audio quality is what you would expect from a recorder in the middle of the room with lots of people sitting around it.

• Google docs and spreadsheets, GMail
• http://docs.google.com
• https://gmail.google.com
• JavaFX
• http://java.sun.com/javafx/
• Adobe Flash, Flex and AIR
• http://www.adobe.com/products/flash/
• http://www.adobe.com/products/flex/
• http://labs.adobe.com/technologies/air/
• Google Gears
• http://gears.google.com/
• Google Web Toolkit (GWT)
• http://code.google.com/webtoolkit/
• Dojo
• http://dojotoolkit.org/
• DWR and Reverse AJAX
• http://getahead.org/dwr
• http://getahead.org/dwr/reverse-ajax
• JINI
• http://www.jini.org/wiki/Main_Page
• Military mesh networking
• http://www.govtech.com/gt/96814
• Protein folding
• http://folding.stanford.edu/
• Human Genome project
• http://www.ornl.gov/sci/techresources/
  Human_Genome/home.shtml
• Semantic Web
• http://en.wikipedia.org/wiki/Semantic_Web
• IPv6
• http://www.ipv6.org/
• Apache Derby Database
• http://db.apache.org/derby/
• Firefox 2 local storage
• http://ajaxian.com/archives/
  firefox-2-client-side-storage-and-a-lot-more
• Comet for AJAX
• http://en.wikipedia.org/wiki/Comet_(programming)
• LiveConnect
• http://en.wikipedia.org/wiki/LiveConnect
• http://developer.mozilla.org/en/docs/
  Core_JavaScript_1.5_Guide:LiveConnect_Overview
  :JavaScript_to_Java_Communication
• Canvas, SVG, VRML
• http://en.wikipedia.org/wiki/Canvas_(HTML_element)
• http://www.w3.org/Graphics/SVG/
• http://en.wikipedia.org/wiki/VRML
• Desktop apps we use
• iTunes - http://www.apple.com/itunes/download/
• Google Earth - http://earth.google.com/
• iChat - http://www.apple.com/macosx/features/ichat/
• Eclipse - http://www.eclipse.org/
• NetBeans - http://www.netbeans.org/
• Audacity - http://audacity.sourceforge.net/

Thanks

• Libsyn.com - http://www.libsyn.com - for hosting and bandwidth
• Brice Ruth and Webprojkt.com - http://webprojkt.com - for our archives site - http://archives.javaposse.com
• Feedburner.com - http://www.feedburner.com - for feed redirect
• Kirsty Doherty, Oliver Widder and Amy Ehmann for Java Posse artwork
• Brian Ehmann - the Java Posse intern
• Craig Muth for maintaining the Java Posse Memorizable site - http://memorizable.org/Java_Posse
• Theme Music:
  • Opening - "Java" the parody song Copyright 1997 Broken Records and Marjorie Music Publ. (BMI), written and performed by Loose Bruce Kerr of the Dr. Demento Show and Sun Microsystems attorney. Based on the WWI popular song, "Ja-da." Ukelele style on the recording taught to Bruce by his dad. Re-produced with kind permission from "Loose" Bruce Kerr - http://loosebrucekerr.libsyn.com
  • Closing - Juan Carlos Jimenez - In the House (Intro No. 1)
    

• To contact us:
  • Visit our homepage - http://javaposse.com
  • Post on our Google Group - http://groups.google.com/group/javaposse
  • Or send us email - javaposse@gmail.com

Newscast for August 30th 2007

Fully formatted shownotes can always be found at http://javaposse.com

• Paramount defects from doing both Blu-ray and HD-DVD to doing just HD-DVD, CEO blames Java, but what is the whole story?
• http://www.pcworld.com/article/
  id,136253/article.html
• One of the better discussion forums - the avsforum - lays out some pretty interesting facts from both camps
• http://www.avsforum.com/avs-vb/
  showthread.php?p=11456607

• Google Web Toolkit is now out of Beta with the release of the new version 1.4
  
• http://googleblog.blogspot.com/2007/08/
  google-web-toolkit-towards-better-web.html
• http://googlewebtoolkit.blogspot.com/2007/08/
  gwt-14-release-and-out-of-beta.html
• http://blogs.zdnet.com/Google/?p=706

• Jython 2.2 has been released!
  
• http://www.theserverside.com/news/
  thread.tss?thread_id=46661
• http://www.jython.org/Project/index.html
• http://arstechnica.com/journals/linux.ars/
  2007/08/23/jython-2-2-officially-released

• NetBeans Roundup - lots of things happening in the NetBeans camp this week
• The Life on Rails blog has a comparison of Ruby IDEs including the ever popular TextMate, Eclipse (using plugins like RadRails) and NetBeans
• http://test.lifeonrails.org/2007/8/27/
  netbeans-the-best-ruby-on-rails-ide
• NetBeans.tv has been launched
• http://www.netbeans.tv/
• http://www.netbeans.tv/community/join-in/
• And, Tim Boudreau is taking NetBeans on the road
• http://weblogs.java.net/blog/timboudreau/archive/
  2007/08/the_netbeansmob.html
• Geertjan blogs about his adventures writing a Groovy editor for NetBeans
• http://blogs.sun.com/geertjan/entry/
  how_to_write_a_groovy2

• Sun roundup
• Sun has announced their financials, and they made a profit in the last fiscal quarter of 2007 and overall made a profit for the whole fiscal year too
• http://www.cafeaulait.org/#August_24_2007_80581
• Also, Sun has just changed their stock ticker from SUNW to JAVA
• http://blogs.sun.com/jonathan/entry/java_is_everywhere
• http://itmanagement.earthweb.com/mowi/
  article.php/3696361
• And the news caused OpenJDKs David Heron to dig into the archives from 10 years ago, when the naysayers were saying that Java was already dead or doomed to failure...
• http://weblogs.java.net/blog/robogeek/archive/
  2007/08/java_is_doomed.html

• Java site of the week - Quicken Online, in JSF
• http://news.com.com/8301-10784_3-9759443-7.html

Quick News

• JSR 264 - Order Management API, has been approved by the JCP
• http://jcp.org/en/jsr/detail?id=264

• Greg Stein, the director of the Apache Software Foundation was mugged outside his home, at the time he was on crutches from a broken leg injury a couple of weeks before. Kevin Burton is having a donation whip round to do something nice for Greg while he recovers
  
•  http://feedblog.org/2007/08/27/greg-stein-
  director-of-the-apache-software-foundation-
  was-mugged-accepting-donations/

• If you are interested in Java/.NET interoperability with WSIT, Arun Gupta has blogged a couple of useful links including a demo of using Excel with Glassfish
• http://weblogs.java.net/blog/arungupta/archive/
  2007/08/excel_using_wsi.html
• http://weblogs.java.net/blog/haroldcarr/archive/
  2007/08/metro_aka_jaxws_1.html

• The Mobile Phone/Smart Phone blog has a detailed review of the new Motorola ROKR E6 
• http://ggkandy.blogspot.com/2007/08/
  motorola-rokr-e6-review.html

• The glassfish team have posted up RC4 of glassfish v2 (and what they hope will be the final RC)
• http://blogs.sun.com/theaquarium/
  entry/glassfish_v2_rc4

• If you missed the very popular Java Puzzlers technical session at this year's JavaOne, or if you simply didn't make it to JavaOne, you can still see it
• http://video.google.com/videoplay?
  docid=9214177555401838409

• An InformIT article on HIJAX talks about how to plan for both JavaScript and non JavaScript browsers
• http://www.informit.com/articles/
  article.aspx?p=789762&rl=1

• A new site collects Java related videos. D TV Java has multiple views for selecting the video you might be interested in, including a blog like view, thumbnail view and random selection
• http://pankap.com/dtv/index.php?pt=all

• We have sat upon this news item for a couple of weeks due to problems accessing the site, but GridGain 1.5 offers an open source, java based grid computing solution built on top of spring and JBoss. As well as a 15 minute video demo of writing a grid application, and the download itself, the gridgain company offers training, consulting and support. They also seem to have a fondness for 2x2 rubiks cubes (which seem like they wouldn't be much of a challenge to solve)
• http://www.gridgain.com/

• ZDNet points out that a couple of security exploits found by a Google engineer in the Java Image parsing code back in October 2006 are still not fixed for Java on Mac OS 10
• http://blogs.zdnet.com/security/?p=469
• http://landonf.bikemonkey.org/code/macosx/
  CVE-2007-2788.20070814.html

• Sailfin, a SIPServlet communication application server based on glassfish and contributions from Ericsson has reached milestone one
• http://blogs.sun.com/theaquarium/
  entry/sailfin_milestone_1

Listener Feedback

• Neal Bartlett post to the Java Posse Google group about OSGi vs JSR 277
• http://groups.google.com/group/javaposse/
  browse_thread/thread/36df5d2547ce183e/#

Thanks

• Libsyn.com - http://www.libsyn.com - for hosting and bandwidth
• Brice Ruth and Webprojkt.com - http://webprojkt.com - for our archives site - http://archives.javaposse.com
• Feedburner.com - http://www.feedburner.com - for feed redirect
• Kirsty Doherty, Oliver Widder and Amy Ehmann for Java Posse artwork
• Brian Ehmann - the Java Posse intern
• Craig Muth for maintaining the Java Posse Memorizable site - http://memorizable.org/Java_Posse
• Theme Music:
  • Opening - "Java" the parody song Copyright 1997 Broken Records and Marjorie Music Publ. (BMI), written and performed by Loose Bruce Kerr of the Dr. Demento Show and Sun Microsystems attorney. Based on the WWI popular song, "Ja-da." Ukelele style on the recording taught to Bruce by his dad. Re-produced with kind permission from "Loose" Bruce Kerr - http://loosebrucekerr.libsyn.com
  • Closing - Juan Carlos Jimenez - In the House (Intro No. 1)
    

• To contact us:
  • Visit our homepage - http://javaposse.com
  • Post on our Google Group - http://groups.google.com/group/javaposse
  • Or send us email - javaposse@gmail.com