I am starting to get to the point in the conference where I just want to lock myself in my office at home and experiment with all of the things I have been exposed.  This inevitably makes it a bit difficult to pay close attention to the presentations.

Practical ColdFusion Security

with Justin Mclean

Justin’s talk was split into two parts.  First he talked about risk assessment then applying it to a practical example.

Risk assessment is balancing the business objectives and security requirements.  This process should not be done only once.  Risk should be assessed before the project is implemented, after it has been implemented and any time it is changed.  Keep in mind that treats are not always external.  Once threats have been identified they should be rated for both frequency (how likely the treat is to occur) and consequence.  The level of risked is determined by f x c.  After level of risk is determined each threat can be prioritized.

Risk Assessment Process

1. Identify Assets (anything that has risk. staff, software, hardware, information)
2. Identify and Quantify the possible threats (include unlikely threats, don’t ignore the obvious)
3. Determine the consequences of each threat
4. Evaluate the current risk (What level of risk are they based on frequency and consequence. What is acceptable.)
5. Decide acceptable level of risk
6. Treat each risk

The simpler a system is the more secure it is.

For the second half of his presentation Justin talked about how he applied this process to a Student Election System he helped develop.

Developing APIs: Dos and Donts

with Simon Free

An API (Application Programming Interface) is an interface to an application that has documentation for what functionality is available and exposes functionality of an application to outside use.  Whether that be another internal application or an external application.  They are good for sharing content and functionality, centralizing functionality, and allowing other technologies and code to interact with your code.  There are two major types of APIs, RESTful and RPC.  RESTful is a much more flexible API a base URI that exposes multiple URLs that have different functionality.  When developing an API you should write and test your documentation before writing any code.  This will ensure you have a solid road map for the code you are developing.

Once you have a solid, tested set of documentation write your code strictly from that documentation.  If you discover revisions it is best to update the documentation and have it tested again before continuing to your coding.  After coding the API you need rigorous testing (obviously) and attempt to hack it.  This is important because you can be certain that once it is available to your end user they will try to break and hack it.

Simon had a lot of great information in this presentation and it was very compelling.  He did a good job of taking a high level approach and then giving multiple examples.  Part of the way through his talk he brought up three people onto the stage and had them test some documentation.  He came back to them after a while and went over the results.  The API they where testing documentation for was actually the Flickr API.  He gave one person no documentation, one person a single page of documentation, and the third person the entire Flickr API documentation.  Person one could not complete the task at all.  Person two was very close but not perfect.  Person three had it perfect but had to sort through all of the 30+ functions to find the few he needed.

A Brief Introduction to Cryptography

with Jason Dean

I was going to go to the session on using ColdFusion for creating workflows but because of my personal interest in Cryptography I decided to go to Jason’s presentation.  I asked Jason if he had read the book that got me interested “The Code Book” by Simon Singh.  He told me it was on his list of books to read.

Jason started off the presentation by giving a very brief overview of cryptography, cryptanalysis, and cryptology.  I am not going to write much about this part of the presentation.  I would encourage you to check out any number of books on the subject such as the one I mentioned above.  I must say that book was a very enjoyable read.  It even inspired me to write a couple simple CF apps that handle some basic well known ciphers.

After his overview he started using examples that we as programs would be familiar with just as Digitally Sign Certificates, SSL, and TLS.

Some encryption technologies available in CF include CFMX_COMPAT, Blowfish, DES (Data Encryption Standard), Triple-DES, AES, PBEWithMD5AndDES (Password Based Encryption), PBEWithMD5AndTripleDES.  DES is the old standard but is not anymore.  Triple-DES is much stronger and can be effective is used correctly (C = E_k3(D_k2(E_k1(plaintext))). The new standard algorithm is Rijndael (rain-doll).  It is a 128 bit encryption that can accept either 128, 256, or 512 bit keys.

To use encryption in ColdFusion you would use the Encrypt function:

encrypt(str, key, [cipher, encoding, IV or salt, iterations])

<cfset plaintext = "My plain text message" >
<cfset key = "mykey" >
<cfset cipertext = encrypt(plaintext, key, "AES'/CBC/PKCS5Padding", "key") >
<cfoutput>#cipertext#</cfoutput>
<cfset decipertext = decrypt(cipertext, key, "AES'/CBC/PKCS5Padding", "key") >
<cfoutput>#decipertext#</cfoutput>

Making Bad Code Good

with Dan Wilson

This was a pretty basic session with a lot of code examples.  Dan just went through about nine real world code examples he has encountered during his career and showed how they could have been written in a more efficient way.  I can basically summarize it by saying use proper standards, name variables and functions with context and avoid taking shortcuts.

If you have any questions about what went on at the conference don’t hesitate to contact me or better yet leave a comment.

ColdFusion & jQuery: Two Great Tastes That Go Great Together

with Jeff Coughlin

I came a few minutes late to this session so I missed the introduction.

When I walked in Jeff was talking about the cfmediaplayer tag in CF9 and how you can hook into it with JavaScript.  Specifically he was using jQuery to control the flash video player that ColdFusion was outputting to the screen.  So he had it set up so that when the user clicks on any one of a specific set of links jQuery takes the value of the href attribute of that anchor tag and updates the source attribute of the media player then plays the new video.

Then he showed an example of using CF9’s built in cfmap & cfmapitem which use the Google Maps API to output a map that can be interacted with.  The cfmapitem take is used to defined 1…* points on the map.  He then used jQuery to add a link the each map item’s detail view which opened a video in a jQuery pop-up window.

Jeff’s final demo was a slideshow with rotating images, cross fade transition, and a semi-transparent caption bar at the bottom of each image.  This seemed to me to be a pretty simple demo but I am pretty familiar with JavaScript and have played around a bit with jQuery.  One simple but neat feature was that when the user hovers over the slideshow with the mouse it pauses the image rotation.  He had other features that seemed pretty standard for that kind of widget.

Flex 4 for Flex 3 Developers

with Jeff Tapper

First note for this presentation is that it was not intended for people who have never used Flex before.  It was truly for people who have been developing with Flex 3 and want to move to Flex 4.  Pretty specific subject matter so the numbers were pretty thin.  That being said I wasn’t sure I would get much out of it.  I have been playing with Flex 4 a bit using the command line SDK but I am coming more from Flex 2 not Flex 3.

The most jarring difference is that there are new libraries (new namespaces).  No longer do define all of your components using the ‘mx’ namespace.  Jeff pointed out that one reason for this is a shift from favoring inheritance for a composition approach.  He cited the example of most components in F3 inherit a ton of layout specific properties such as scrollable (default true).  Which you inevitably spend time overwriting.

He demonstrated how easy it is to create custom layout types in F4, rather than creating a custom container component.  If you need a layout other than vertical, horizontal, or tile you can just create it.

Instead of using repeaters you provide a group with a dataProvider and an itemRenderer and that’s it.  It works like a list.  All the list class does now is manage selection.  Virtualization has been moved outside of the list class and into the layout.  This opens up virtualization to almost everything.  On top of that, virtualization now works much smoother.  Rather than waiting until the item renderer at the top is off the screen to recycle it for the new item appearing at the bottom, now it creates new renderers and junks the one at the top.

The states model in F4 has been simplified.  You can define inline state properties when you define a component.  The example I have below shows how the Button component has a label of ‘Register’ when the state is ‘register’ and a label of ‘Login’ when the state is ‘login’.

	<s:States>
		<s:State name="register" />
		<s:State name="login" />
	</s:States>

	<s:Button label.login="Login" label.register="Register" />

Containers not only do not inherit layout functionality they do not inherit style functionality which is not delegated to the skin component.  One key to this concept that I didn’t understand at first is that you need to think of a skin as not just the colors and styles of a component but also the structure.

Something to note about F4 is that there are several more complicated components from F3 that are not available in F4.  However you can still use the MX library version in F4 but there are a few special components you need to use with them like MXDataProvider.

One thing I asked Jeff about because I was curious, was if you could compile an only F3 app with the F4 SDK.  I assumed that because the F4 stuff is mostly in new libraries that this would not be an issue.  He said there is a option for F3 compatibility mode within the F4 SDK.  Also that the new SDK is faster in general.

Building RIAs with jQuery & jqGrid

with Ezra Parker

Ezra gave a quick elevator intro to jQuery, prefaced with the disclaimer that this was not a talk about how to use jQuery.  He pointed out several key features of jQuery including Utilities (which currently only consists of one, Position), themes, and widgets.

Generally I found this session a little too introductory for me.  He didn’t show how jQuery works but rather what it can do.  Which to be honest, I found even less useful.  If I want to know what properties are available for the accordion widget I can get all of the information in the available documentation online.  It seems a bit out of place for such an ‘advanced’ conference.  If it wasn’t for the fact that there where not any other sessions that I felt where more, relevant I would have left.  I am not at all suggesting that Ezra was a bad speaker or that the presentation was bad.  Just that for me personally it was not very compelling.  If you are interested in more specifics of the jQuery portion of his presentation seek it out for yourself.

The jqGrid information was a little more interesting to me because it is not something I have worked with before.  However, it was still information I could easily get from online documentation and experimentation.

Deploying ColdFusion Applications with Ant

with Doug Hughes

The idea behind deploying with Ant is to automate all of the things you do to get your code from development to production.  Automating these things helps to avoid user error, missed files, wrong environmental settings, etc.  Ant is an Apache product that was primarily built for doing Java build processes.  The way you primarily interact with it is by writing build files in xml, which are basically descriptions of what you want to have happen.

Doug briefly introduced Ant and then jumped right into examples.  His first example was pretty simple.  First he walks through his scenario without using Ant.  He throws in some pretty extreme ‘accidents’ but makes a good point.  The whole processes, with him explaining it, took at least 5 minutes (and it was a very simple example).  Then he did the whole thing using Ant and it probably took about 10 seconds.

CFAnt is a project Doug started that provides prebuilt Ant tasks to aid ColdFusion developers deploy applications.

… lapse of attention span … caught fragments of the talk on CF9 ORM with Hibernate … looked like a good presentation but I am really starting to crash at this point. One more session to go.  I think he got more in-depth with specific hibernate stuff than session I have seen about it before.

Don’t Let OO Drag You Down: A Pragmatic Look at OO Design and Development

with Brian Kotek

This session was not exactly what I expected.  Brian had a tendency to ramble a bit and I think he thought he was simplifying things more than he was.  But maybe I was just too tired.

What I think he was trying to do was break down some examples, each starting with a poor OO implementation and then gradually getting more complicated but being a better implementation.  I have to say I didn’t entirely agree with his reasoning or maybe just his examples.  Without actually using the terminology he was really talking about OO Patterns.  If you are interested in these patterns I have compiled a couple lists of Wikipedia articles that are relevant.

Comments?

I own an iPhone and for the most part I really like it.  I have few complaints, and most of them are a result of greedy mobile carriers.  iPad comes out and now I am really interested in developing apps for the iPhone and iPad.  I think it would be fun as well as a way for me to branch out from web development.  So I go to the Apple website and register as an Apple Developer.  It wasn’t until after I registered that I found Apple has made it virtually impossible for you to develop apps for the app store if you do not have a computer running OSX.  On top of that it has to be running on an Intel platform, so one of their newer model machines.

Screw you Apple.

OSX blows you elitist bastards.  You develop a great mobile platform, the iPhone OS, and then you tell me because I prefer *insert favorite not apple OS here* I am not worthy of developing applications for your platform.

As if that wasn’t enough they updated there App store terms of use to eliminate Adobes efforts of circumventing this proprietary BS.

I guess it is time for me to start looking at Android or the Win Mobile 7 OS.  I definitely wont be buying an iPad anytime soon.

In this post I am summarizing the sessions I attended on the first day.

Adobe Keynote (not really though)

Terry Ryan talked for a while about the new releases adobe has had in the last year (ColdFusion 9, ColdFusion Builder). He mentioned the updated ULA stating you can maintain full  Then he demoed some of the features in ColdFusion Builder.  He also showed a couple plugins/apps he is building for CF Builder.

• Code Assist
• Code Insight
• SQL Insight
• ORM Insight
• CF Builder Plugins with CF
  • Instant Code Review (peer code review over instant messenger)
  • Aptactular (Code generator, not publicly available)

After CF Builder he went over the process of using Catalyst the to create a Flex app and skin starting with a Photoshop mockup.

Overall there was not any new information released.  They did preface this presentation with this information.

ColdFusion 9: A New Way of Building Applications

with Daniel Vega

Dan talked about some new features that make development easier in ColdFusion 9.

• Implicit Arrays – MyArray = { ‘value1’, ‘value2’, ‘value3’ }
• ArrayFind() – returns the key of a value in an array (0 if does not exist)
• ArrayContains() – returns a true/false if value exists in an array
• Script Components – including full language support in script
• Inline If Statements – # (condition) ? true result : false result #
• Implicit Structures
• Components
  • creating an object with ‘new’ operator instead of CreateObject()
  • define a constructor method with ‘initmethod’ component attribute
  • implicit getters and setters with ‘accessors’ component attribute

After his overview of new features he likes he talked about architecting applications (using CF9) features.  He went over several examples of bad architecture like “God CFCs” or components that have all of the data and methods needed to interact with data in the database. Ex. Blog.cfc written by Ray Camden. He also mentioned the more recent pattern of creating too many CFCs. Then we get into the ‘new’ ways of doing things.

• Caching using cfcache
  • fragment caching available in CF9
  • timespan caching
  • idletime caching
  • dependant caching

Dan then demoed a commerce application he created written with the framework ‘ColdMVC’.  He urged us to focus not on the framework but on the concepts used to write the specific app.

… at this point I got distracted with ‘urgent’ work stuff.

Building High Performing Applications with ColdFusion 9

with Josh Adams

This was apparently a presentation that is given online at Adobe’s website all the time.  If you are interested https://www.adobe.com/cfusion/event/index.cfm?event=register_no_session&id=1577896&loc=en_us

Continuous Integration with MXUnit, Ant, and Hudson

with Marc Esher

This presentation was an introduction to CI with ColdFusion using MXUnit, Ant and Hudson, not an introduction to those individual technologies. The idea behind Continuous Integration is to automate tasks a programming does to package and/or deploy code.  This kind of automation is intended not only to make workflow faster but to prevent user error.

1. Programmer Commits Code to Source Control Repository
2. Hudson Pings the Source Code Repo for changes
3. Hudson finds a change and runs scripts including but not limited to Ant scripts and running unit test.

Hudson has a nice admin interface that tells you the status of projects and allows you to manually initiate builds.  It even provides data about the test results over time.  It is very configurable.

You don’t use CI to debug failed test. You use it to tell you want tests have failed.

This presentation mostly made me more excited to learn about unit testing and using ant.

Productive Work Practices

with Peter Bell

In this presentation Peter talked about being more efficient, have better work flow.  There were a lot of really good take-aways from this presentation.  I have to say it was the most inspiring session I had today.  I really hope Peter posts his slides.  He did a really good job of breaking things down into logical bullets.

• Multiple Clipboard Tools
• Pomodoro Technique
• Software Product Lines

I briefly spoke with Peter after his presentation because I wanted to make sure I could get to the slides, but also because I was interested in whether he had heard of and uses Getting Things Done (GTD) by David Allen.

Build a Better Search with Apache Solr

with Shannon Hicks

Solr is an open source search engine that runs on Java and is included in CF9.  It is made to search not just documents but all kinds of data.  It is also a java framework that can be extended to meet specific needs.  Solr is implemented in a very basic way with ColdFusion 9.

If you want to use Solr as a really fast version of Verity, you can use cfindex and cfsearch.

Based on Shannon’s demo (which was not exactly simple, mostly because of the nature of the content) it is very clear that Solr is far more powerful than Verity.  Solr uses xml configuration files to define how solr acts, what data to index, and how to return the information when the index is queried.  The two major configuration files are solrconfig.xml and schema.xml.

One interesting feature he highlighted was Solr’s built in spell check functionality.  Which much like google, allows you to offer spelling corrections in your search results.

Someone asked about indexing collections of binary documents like PDFs and Shannon mentioned another apache project called Tika that performs such tasks.

• CFSolrLib
• Apache Lucene
  • Tika – indexing binary files
  • Nutch – web crawler
• Demo Project – Pintley.com

…

End of the day. Back to the office to complete some work.

In ColdFusion we use ColdSpring which is based on the Spring Framework for Java.  It actually does a lot more than just DI but I am not concerned about that.  What I really want is something that can handle the same kind of DI situations that ColdSpring does for PHP.  I am currently working on a WordPress plugin for a freelance client which has turned out to be the most heavily object oriented PHP project I have done so far.  I have trying to translate a lot the best practices I have learned while working with ColdFusion over to PHP and came across a need for DI.  What I ended up doing to creating an Factory that handles all of my object creation just like what is mentioned in the article by Ryan on PotStuck.  I pass an array with all of my classes, their paths, and their dependencies, like so:

$classes = array (
	'EventBean' => array (
		'path' => 'model/Event.php',
		'dependency' => array (
			'Venue' => 'VenueBean'
		)
	),
	'VenueBean' => array (
		'path' => 'model/Venue.php'
	)
);

So far it is working pretty well but I am thinking about making a more substantial DI framework that I can use on many projects to come.

Web Programming Introduction

Meet the Dell Latitude e6400.  Not as stylistic as the XPS series but much more practical.  After having a laptop for so long I have discovered that the power of a desktop is no match for the convenience of a laptop.  But what to do with the quality peripherals I have acquired over time like my 22 in Samsung monitors.  Well… I have always wanted a docking station, hence the business class Latitude equipped with a docking port.

• Intel Core 2 Duo T9900 3.06GHz
• 4Gb RAM
• Windows 7 Professional 64bit
• 250Gb 7200rpm HDD
• Nvidia Quadro NVS 160m, 256Mb

Now I can use my laptop as my primary machine while still getting the high productivity of having two monitors a full sized Keyboard and Mouse.

A Sequel

I wasn’t exactly jumping on the opportunity to play Mass Effect 2.  Surprising as that my be given how satisfied I was with the first installment I just didn’t feel compelled to go out and get it.  Maybe I didn’t feel like I could justify the time commitment with all of the other things going on in my life.  Though after listening to so many people get excited about playing it (including my cousin who pre-ordered it for his PC) I decided buy it for my Xbox.

Advancement or Regression

So far the game has been… Ok.  There is no question that BioWare has made improvements.  However, there are a number of changes they have made that seem to be steps backwards not only in game-play but also from a Sci-fi tech standpoint.  My first example of this would be the weaponry.  In Mass Effect the weapons seem to be a very sophisticated technology that do not use ammunition but a kind of energy.  Firing the weapon causes it to heat up, and after firing many shots in succession the gun can overheat and requires cool down time.  This eliminated the need to practice ammunition conservation and allowed you to play the game however you wanted.  It also created balance with the biotic abilities which also required time to recharge.  Completely shifting game-play and making the soldier class a slave to ammunition availability, they have changed this in ME2.  Now the weapons still use energy based projectiles but rather than building up heat and needing to cool down they expend the capacity of their ‘heat sink’ which then needs to be replaced.  So in the two years (game time) between the first and second games tech has changed in such a way that it is less efficient.  You now have to collect ‘heat sinks’ which for some reason fall out of enemy gun’s when they are killed.

to be continued…

I think a big part of my failure to create a site was I kept getting hung up on the big picture.  I wanted to develop something that I could build upon over time.  I would start with a simple design and a few pages and never really get much farther than that.  A few months later I would give it another go.  Now I am going to start with Word Press as a base and build upon it with my own Themes and Plugins.