Things I Want to Remember

What You May Not Know about Amazon Web Services Security

2012-02-21T09:05:00.000-08:00

I have started some early experiments in building applications using free tier services in Amazon EC2. I studied Amazon's security white paper, but wondered what I should know, and what I may not know about amazon web services (AWS) security. I've done some research:

Identity - AWS's identity is based on email address and a pair of credentials (secret key and access key). In earlier AWS implementation, they allow 2 identities for the same email address if you have 2 different passwords. My email address / identity falls in this category. AWS has made changes to prevent multiple identities now.

How to hack identities http://www.youtube.com/watch?v=9IxM9_8ucZM

Data and Storage - S3 by default is world readable.
API -all AWS apis are signed with HMAC-SHA1 signature with private key. However, by design, AWS does not expose any security-related api (e.g. unused ports, vulnerability findings)
Environment - AWS will protect data/stack below the hypervisor, not above.

What about security tools for AWS?

Rootkit. Contrary to public knowledge, many security subject matter experts believe that hypervisor rootkits (e.g. Blue Pill, Subvirt) are not really practical or applicable for AWS
Cloud data encryption. If you are using NoSQL data in the cloud, there are emerging data encryption products, e.g. Gazzang ezNcrypt.

TO BE UPDATED

Why I Am Happy About Saving $1

2012-02-21T08:49:00.000-08:00

I enjoy saving small amount money after bargains. I feel like a victory if I can save a dollar or two when buying blu-ray movies, say, return a movie to Best Buy (retail) store, and re-order the same movie from amazon just because I can save $1. In reality, the gasoline and effort I consumed may be more expensive than the savings I earn.

Why am I so happy about such a small little thing?

It's perhaps the self-esteem that I have (or want to have), such that I make a big deal (e.g. 30% savings from a $7 dollar movie). I probably won't get that at work, or for other episodes in my family life. But it has such a big impact that I enjoy it - small, little things.

In Chinese subculture, we often describe this is a trait of a "small man" - a personality trait of an anti-hero, who always enjoys small little things in life.

Starting with Amazon EC2 Development/Hosting

2012-02-13T00:45:00.000-08:00

I need to start a new initiative to define cloud security strategy and build cloud security tools/solutions. I read a couple of cloud security books in the market but most of them cover high level concepts. There are some gaps in the actual implementation, particularly with Amazon AWS/EC2 hosting services.

The vision of cloud application security is for developers to write cloud-ready applications without worrying specific cloud security controls that need to be in place. For example, if a developer needs to upload a picture to the AMZ S3 storage, he/she should not even worry if they have to encrypt/decrypt (which depends on a strong key management infrastructure) the picture, and which cloud database to use. Thus, a cloud storage proxy will be handy if it will detect the data type, and determine if encryption is needed before storing it.

Here are a few cloud security features:

Access management - a simple, automated way to provision user identities in AMZ IAM, and all the ssh setup (with public/private keys) in each instance of the target cluster. Tools, e.g. CloudBerry (http://blog.cloudberrylab.com/2010/09/how-to-manage-amazon-identity-and.html), 2-factor authentication via ylastic (http://ylastic.com/).
Audit logging - log all IAM and system changes. Tools, e.g. splunk adapter for AMZ (http://serverfault.com/questions/304642/using-ubuntu-cloud-init-to-setup-logging-to-splunk), flume server with rsyslog re-directing syslog to a central server (http://www.sharethrough.com/2011/02/configuring-clouderas-flume-with-an-s3-sink-on-ec2/), scribe server on EC2 (http://stackoverflow.com/questions/6462873/anyone-have-details-steps-for-installing-facebooks-scribe-on-an-ec2-instance)
Vulnerability management - scan by whitehat, appscan etc. Need to notify AMZ first. You can also use different vulnerability scanners (e.g. nexus)
Anti-virus scanning
Data security - you can use S3 storage with encryption, your own encryption/decryption with your own key management infrastructure but store using S3 (or dynamo), encryption proxy service, e.g. https://forums.aws.amazon.com/thread.jspa?threadID=76866
Forensics
Key management / storage
Patch management and security update

List of Amazon EC2 Tools
S3 backup tools http://jeremy.zawodny.com/blog/archives/007641.html
S3 tools http://www.aboutonlinetips.com/amazon-s3-tools/
Developer tools http://aws.typepad.com/aws/developer_tools/
Security tools http://www.globalindustrynews.com/news/secludit-to-deploy-detection-tool-for-amazon-ec2-i.html and http://www.thewhir.com/web-hosting-news/security-firm-secludit-releases-detection-tool-for-amazon-ec2
Monitoring http://elastic-security.com/2011/08/04/monitoring-tool-amazon-ec2-plugins-for-nagios/
Bitnami

Resources
http://gigaom.com/2009/11/06/10-top-open-source-resources-for-cloud-computing/

Rewatchnig Movies

2012-02-04T23:38:00.000-08:00

There are a few movies I watched a few years back, and thought I liked them, but I don't really like them at all when re-watched.

Bad Experience

Serendipity. The actress Katie was quite surprised to learn that most male fans like this movie than her Underworld movies. I thought I like it a lot since it's a very romantic movie. I recently bought the bluray movie, and rewatched it. I actually dislike the female character - the way she treated relationship, her perspective about fate, her casual relationship about sex and love, etc. The entire plot development is weak, though my brain tends to re-create a different romantic story from my memory fragments.
Crouching Tiger. When I heard that Ang's movie got Academy Award, I was thrilled to watch this movie. Many local Chinese reviewers criticize that this movie is not really a good wuxia movie. In 2000, I found the movie too slow and a bit boring. 11+ years later, I forgot about my first impression entirely and re-watched the bluray movie. I find the prelude very boring. The plot development is unattractive and weak. The fight scenes, however, are intriguing - I feel like it's a product demo for non-Chinese. I do like most of the background music, particularly Ma's cello.

Good Experience

There are a few movies that I re-watch many times over the years, and each time I have a different perspective.

My Sassy Girl. Every time I am depressed, I love re-watching this movie My Sassy Girl. Each time I have a different emotional experience. I tend to catch different details too.
When Harry Meets Sally. It's probably 10+ years ago since I watched this movie. I feel like understanding your spouse or your friend is a challenging journey.

jQuery Mobile glitch - Disappearing option value

2012-01-13T08:28:00.000-08:00

I spent almost a few days to debug a jQuery Mobile feature, and finally validate that it's likely a bug.

OBJECTIVE
What I want to achieve is to do a quick fill (data entry) by "bulk push" a specific option of each of the items in the same page (e.g. select all option 2 for all questions), and I can also change some options in some of the items at will.

WHAT'S THE PROBLEM
jQueryMobile allows you to "check" an option by setting the property value (aka attribute value for jQueryMobile 1.6 or before), and refresh the radio button (or object). However, if you manually change the radio button again, and inspect the radio button value, you'll notice the radio button value has not been changed internally - unless you explicitly refresh the radio button value again.

Example:

$('input:radio[name=radio-choice-1]').val("radio-choice-1");
$("#radio-choice-1").prop("checked", true).checkboxradio("refresh");

this will set the value of a radio button (with the name radio-choice-1) to "radio-choice-1", which should be the same (in functionality) as pushing the first radio button manually on the screen. Of course, you need to refresh the screen object by '.checkboxradio("refresh")'.

However, if you check another radio button (e.g. radio-choice-3) manually from the screen, and inspect the value of the radio button by "$('input:radio[name=radio-choice-1]:checked').val()", you'll find the radio button value is still "radio-choice-1" not "radio-choice-3". You won't have the problem if you don't set the radio button value property programmatically.

Discussion
This does not make sense since I have to refresh each radio button even after I change the value from the UI (not programmatically)? I don't have to do that before I programmatically set the radio button value, and refresh the radio button! It looks like selecting or pushing a radio button does NOT necessarily change the property or attribute of the radio button value, in the same way you do that programmatically.

Full Code Example

You select "Set Choice 1" and then "What's up - pet" to inspect the value. You should see option 1 value is displayed. Then you check another radio button, and select "What's up - pet" again, you'll notice the internal value is not changed, despite the new radio button is checked.

You can cut-n-paste the following codes to http://jsfiddle.net/. (Please note that due to encoding issue in blogspot, some of the HTML syntax may be stripped out, or not behaving normally as in my original codes).

<!DOCTYPE html>
<html>
    <head>
    <title>Page Title</title>

        <meta name="viewport" content="width=device-width, initial-scale=1"/>
    <meta name="apple-mobile-web-app-capable" content="yes" />

    <link href="http://code.jquery.com/mobile/latest/jquery.mobile.min.css" rel="stylesheet" type="text/css" />
    <script src="http://code.jquery.com/jquery-1.6.2.min.js"></script>
    <script src="http://code.jquery.com/mobile/latest/jquery.mobile.min.js"></script>
<script>

    $(document).ready(function() {

       $("#movies").find("input[type='radio']").bind("change", function(){
          alert('you have changed option 2 in MOVIES ' + $('input[name=movies1]:checked').val());
       });
    });

    function whatsuppet() {
       var ans = $('input:radio[name=radio-choice-1]:checked').val();
       var ans2 = $('input:radio[name=movies1]:checked').val();
       alert(ans + " " + ans2);
    };

    function whatsupmovie() {
       var ans = $('input:radio[name=movies1]:checked').val();
       alert(ans);
    };

    function cleanup() {
       $("#radio-choice-1").prop("checked", false).checkboxradio("refresh");
       $("#radio-choice-2").prop("checked", false).checkboxradio("refresh");
       $("#radio-choice-3").prop("checked", false).checkboxradio("refresh");
       $("#radio-choice-4").prop("checked", false).checkboxradio("refresh");
       $("#movies2a").prop("checked", false).checkboxradio("refresh");
       $("#movies2b").prop("checked", false).checkboxradio("refresh");
       $("#movies2c").prop("checked", false).checkboxradio("refresh");
       $("#movies2d").prop("checked", false).checkboxradio("refresh");
    }

    function refreshme() {
       $("#radio-choice-1").checkboxradio("refresh");
       $("#radio-choice-2").checkboxradio("refresh");
       $("#radio-choice-3").checkboxradio("refresh");
       $("#radio-choice-4").checkboxradio("refresh");
       $("#movies2a").checkboxradio("refresh");
       $("#movies2b").checkboxradio("refresh");
       $("#movies2c").checkboxradio("refresh");
       $("#movies2d").checkboxradio("refresh");
    }

    function setfoo1() {
       cleanup();
       $('input:radio[name=radio-choice-1]').val("radio-choice-1");
       $("#radio-choice-1").prop("checked", true).checkboxradio("refresh");
       $('input:radio[name=movies1]').val("Serendipity");
       $("#movies2a").prop("checked", true).checkboxradio("refresh");
       whatsuppet();
    }

    function setfoo2() {
       cleanup();
       $('input:radio[name=radio-choice-1]').val("radio-choice-2");
       $("#radio-choice-2").attr("checked", true).checkboxradio("refresh");
       $('input:radio[name=movies1]').val("TrumanShow");
       $("#movies2b").attr("checked", true).checkboxradio("refresh");
       whatsuppet();
    }

    function setfoo3() {
       cleanup();
       $('input:radio[name=radio-choice-1]').val("radio-choice-3");
       $("#radio-choice-3").prop("checked", true).checkboxradio("refresh");
       $('input:radio[name=movies1]').val("Inception");
       $("#movies2c").prop("checked", true).checkboxradio("refresh");
       whatsuppet();
    }

    function setfoo4() {
      cleanup();
      $('input:radio[name=radio-choice-1]').val("radio-choice-4");
      $("#radio-choice-4").prop("checked", true).checkboxradio("refresh");
      $('input:radio[name=movies1]').val("9");
      $("#movies2d").prop("checked", true).checkboxradio("refresh");
      whatsuppet();
    }


</script>
</head>
<body>

    <div data-role="page" id="tasks" data-title="Tasks">
    <div data-role="header" data-position="fixed">
        <h1>Title</h1>
    </div>
    <div data-role="content">

<fieldset data-role="controlgroup" id="pets">
    <legend>Choose a pet to ADOPT:</legend>
    <input type="radio" name="radio-choice-1" id="radio-choice-1" value="choice-1" checked="true" />
    <label for="radio-choice-1">Cat</label>
    <input type="radio" name="radio-choice-1" id="radio-choice-2" value="choice-2" />
    <label for="radio-choice-2">Dog</label>
    <input type="radio" name="radio-choice-1" id="radio-choice-3" value="choice-3" />
    <label for="radio-choice-3">Hamster</label>
    <input type="radio" name="radio-choice-1" id="radio-choice-4" value="choice-4" />
    <label for="radio-choice-4">Lizard</label>
</fieldset>

<p />
<fieldset data-role="controlgroup" id="movies">
    <legend>Choose a movie you HATE:</legend>
    <input type="radio" name="movies1" id="movies2a" value="Serendipity" checked="true" />
    <label for="movies2a">Serendipity</label>
    <input type="radio" name="movies1" id="movies2b" value="TrumanShow" />
    <label for="movies2b">Truman Show</label>
    <input type="radio" name="movies1" id="movies2c" value="Inception" />
    <label for="movies2c">Inception</label>
    <input type="radio" name="movies1" id="movies2d" value="9" />
    <label for="movies2d">9</label>
</fieldset>

        <input type="button" onClick="whatsuppet();" value="What's up - pet"/>
        <input type="button" onClick="whatsupmovie();" value="What's up - movie"/>
        <input type="button" onClick="setfoo1();" value="Set choice 1"/>
        <input type="button" onClick="setfoo2();" value="Set choice 2"/>
        <input type="button" onClick="setfoo3();" value="Set choice 3"/>
        <input type="button" onClick="setfoo4();" value="Set choice 4"/>
        <input type="button" onClick="cleanup();" value="Clean up"/>
        <input type="button" onClick="refreshme();" value="Refresh me"/>
</div>
</div>
</body>
</html>

My Favorite Anime in 2011

2012-01-06T11:54:00.000-08:00

Here're a few 2011 anime programs I remembered:

Gundam AGE - the first Gundam robotics series that cover 3 generations. It is intended to reclaim the young generation and create a demand for models franchise for the next 10 years. I got mixed feelings: the visual quality is decent; the storyline is a bit interesting but lame sometimes. I hope I don't see aliens (Gundam 00 movie has aliens. It sucks!)
Fate/ZERO - a prequel for a popular video game saga Fate/Stay Night. The storyline is more complex than the original Fate/Stay Night. The visual/audio is great but the pace is too slow.
Steins Gate - I am always fascinated by time travel. This story plot is intriguing since you do time travel using your microwave oven (but not too convincing too). I don't like the male protagonist's voice or character - does he have a split personality?
Blood C - another incarnation of Blood+. The story plot is so weak that I only discover how the vampire thingy is related to the female protagonist in episode 12 (out of a 13-episode season). The entire show is slow, and the characters are poorly developed. I don't like the art style (Gundam Seed art is much stylistic). Blood+ is much better.

2011 anime is the least impressed for me. There are many chicks anime (as expected for Japanese anime). At least I can recall Full Metal Alchemist Brotherhood, Macross Frontier movies or Gundam 00 for 2010.

What I would have loved to see in 2011 (and perhaps in 2012) are:

Shin Mazinger sequel
True Gundam Seed movie (sequel to the Destiny arc)
Evangelion movies 3 and 4
Gundam Unicorn OVA episodes 5 and 6
Full Metal Panic sequel (covering the finale?)
Blood C movie

What I don't like or anticipate in 2012:

Yet another Full Metal Alchemist movie
Remake any sister anime other than Mazinger or getta robots
Add aliens to Gundam series

Cross-domain policy and api calls in JavaScript: solutions and issues

2012-01-05T17:24:00.000-08:00

I'm struggling with cross-domain calls when writing JavaScript with my HTML 5 / jQuery Mobile application. There are a few options:

Rename your own laptop or desktop machines, e.g. edit /etc/hosts and rename 127.0.0.1 with FQDN so that you cheat your Web browser that any calls are from the same origin. [does this solve my cross-domain problem?]
Use JSONP - your browser uses HTTP GET to serialize data in plain text. This gets around the cross-domain policy security protection (or restriction). There are a few solution variants, e.g. JSONP plugin for jQuery, Yahoo JSONP, PHP proxy. [i have security concerns about JSON]
Facebook has a JSONP like proxy [do i trust facebook?]
Deploy a shell (e.g. empty .war file) to a host with FQDN. Write and test on that machine. Then retrofit your source codes to source control system. [very cumbersome]

Cross-domain policy is a security protection and control mechanism. Cross-site request forgery is a common way to send (or steal) data from your browser and local storage to a remote malicious site. Another example is cross-frame attack (e.g. transfer data between iFrames). One possible mitigation is to create a token (e.g. nonce) in your browser (from the server side) so that it makes CSRF more difficult.

One colleague suggests CORS (cross-domain access control in HTML 5), but I also found one interesting article that warns of the CSRF or Man-in-the-middle attacks. The emergence of CORS from HTML 5 specification is to make life much easier for making cross-domain api calls in JavaScript. I'm sure some young engineers don't quite agree that security is a concern for cross-domain api call issues.

http://shreeraj.blogspot.com/2011/11/csrf-with-json-leveraging-xhr-and-cors_28.html

I'm still learning the issues and solutions. I'll update this blog entry when I have more experience.

Looking for jQuery Mobile Listview Full Example with Add/Change/Delete Rows

2011-12-28T22:24:00.001-08:00

I'm looking for full example source codes. After 2 weeks' research and prototyping, here's what I learn:

Create a listview dynamically via AJAX call (cross-domain or same domain)
Add a sparkline (dynamic or real-time graph in a row)
Add colorful solid bullet in a row (a visual way to show status)

Examples
In your bullet list, add this color solid bullet

Code snippet:■ ■ ■ ■ ■

Visual example
"■ ■ ■ ■ ■ "

Resources
http://www.mobjectify.com/tutorials/HTML_5_mobile_web_app_from_start_to_finish/

http://www.packtpub.com/article/jquery-mobile-organizing-information-with-list-views

http://omarello.com/2010/10/mobile-web-apps-with-jquery-mobile-and-grails/
(sample codes @ http://omarello.com/wp-content/uploads/2010/10/expenses-mobile.zip)

http://mobile.tutsplus.com/tutorials/mobile-web-apps/build-a-contacts-application-with-jquery-mobile-the-android-sdk-part-1/

This has an add listview example:
http://msdn.microsoft.com/en-us/scriptjunkie/hh144955

A similar listview:
http://msdn.microsoft.com/en-us/scriptjunkie/hh377172

List of tutorials
http://miamicoder.com/2011/interesting-jquery-mobile-tutorials/
survey http://mobile.tutsplus.com/tutorials/mobile-web-apps/build-a-jquery-mobile-survey-app-app-logic-interface/
http://web.dtuts.com/tutorials/how-to-write-a-simple-application-on-jquery-mobile/
http://css.dzone.com/articles/building-jquery-mobile-0
http://jsfiddle.net/olli/kuLN2/
http://www.elated.com/articles/jquery-mobile-what-can-it-do-for-you/
http://mobile.tutsplus.com/tutorials/mobile-web-apps/jquery-mobile-forms/

very useful code snippets
http://obsforandroid.wordpress.com/category/gsoc11/jquery/

Tech notes
this discusses parameter passing techniques
http://www.a2zdotnet.com/View.aspx?Id=196
http://forum.jquery.com/topic/passing-parameters-between-pages
http://andymatthews.net/code/jquerymobile/

Dynamic generated listview
http://forum.jquery.com/topic/dynamically-generated-listview

json and jsonp to resolve cross-domain policy restriction
http://api.jquery.com/jQuery.getJSON/ and JSONP proxy solution
http://www.ibm.com/developerworks/library/wa-aj-jsonp1/
W3C CORS specification
Facebook cross-domain solution
Yahoo has a JSON proxy
modify your /etc/hosts or 127.0.0.1 (localhost) hostname so that you have the same domain name

Where to look for icons
http://www.iconarchive.com/

Looking for Tomcat/JBoss LDAP Integration

2011-12-26T10:59:00.000-08:00

I'm looking for how to add LDAP (e.g. Active Directory) authentication to tomcat or jboss.
http://blog.mc-thias.org/?title=tomcat_ldap_authentication&more=1&c=1&tb=1&pb=1

Edit server.xml under CATALINA_HOME/conf/server.xml
specify in the "realm" tag with classname org.apache.catalina.realm.JNDIRealm
add your uid string to "connectionname", e.g. uid=bindingproxyname,ou=profile,dc=domain,dc=com
specify your ldap server, e.g. connectionurl="ldap://ldap.domain.com:389"
and your rolebase details, e.g. rolebase="ou=group,dc=domain,dc=com" rolename="cn" rolesearch="memberUid={1}" userpattern="uid={0},ou=people,dc=domain,dc=com"

How do i verify the ldap contents? by ldapsearch, e.g../ldapsearch -u myuserid -h myldapservername -b "OU=XXX,OU=Servers,DC=XXX,DC=mydomain,DC=com" -s one "dn" -x | grep "^dn:

Interview Questions for Application Security

2011-12-23T17:15:00.000-08:00

If you're preparing for a job interview (either conduct, or attend), or you just want to refresh your security concepts:

Application Security
http://www.webappsec.org/documents/web_security_interview_question.shtml
http://it.toolbox.com/blogs/managing-infosec/interview-questions-for-your-next-security-engineer-18472
http://www.coolinterview.com/type.asp?iType=678
http://www.secgeeks.com/security_interview_questions.html
http://6hacker66.blogspot.com/2011/09/interview-questions.html

Network Security
http://www.geekinterview.com/Interview-Questions/Networking/Networks-and-Security
http://www.techinterviews.com/security-interview-questions-for-network-admin
http://www.bestsampleresume.com/interview/networks-and-security-interview-questions.html
http://www.glassdoor.com/Interview/network-security-devices-interview-questions-SRCH_II1095.0,24.htm
http://interviews.slashdot.org/story/03/05/30/1148235/fyodor-answers-your-network-security-questions

Cloud Security @ AWS-EC2 - A Primer

2011-12-22T23:36:00.000-08:00

I embark on a project to define security best practices, app design / deployment patterns on Web 2.0 apps on Amazon Web services (EC2+). My colleague shares with me a few areas to familiarize with:

Security model (e.g. compared to Windows 7 and Linux security model, fine-grained permission)
Super-account and subaccount identity design
Network security administration and design
Storage security
Reliability (HA/DR) - database centric approach

Resources
Here're a few links to start with:

official aws security paper
http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=9&sqi=2&ved=0CGQQFjAI&url=http%3A%2F%2Fs3.amazonaws.com%2Faws_blog%2FAWS_Security_Whitepaper_2008_09.pdf&ei=mCz0TvmYIIaQiQKpyKHSDg&usg=AFQjCNHXTVWE91jbtVV8oDRw4zvgBT34Yw

http://support.rightscale.com/12-Guides/Dashboard_Users_Guide/Clouds/AWS_Region/EC2_Security_Groups/Concepts/About_EC2_Security_Groups

security groups http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&sqi=2&ved=0CJMBEBYwDg&url=http%3A%2F%2Fsupport.rightscale.com%2F12-Guides%2FDashboard_Users_Guide%2FClouds%2FAWS_Region%2FEC2_Security_Groups%2FConcepts%2FAbout_EC2_Security_Groups&ei=rin0TurbFuXmiALrwNGYDQ&usg=AFQjCNEX3KWIjTileJBoS0dgRcw2WewYRA

http://newtech.about.com/od/cloudcomputing/a/How-To-Setup-Amazon-Identity-And-Access-Management-Iam-With-S3-And-Cloudfront.htm

http://clouddb.info/2009/05/17/using-and-managing-aws-part-3-aws-security/

Cloud Security Tools
https://www.corecloudinspect.com/microsite/why-core-inspect.html

http://elastic-security.com/category/internals/

http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=22&ved=0CHQQFjABOBQ&url=http%3A%2F%2Fwww.dome9.com%2Fwp-content%2Fuploads%2F2011%2F10%2FWP_SecuringAWS_Dome9_FINAL.pdf&ei=Ji70TsfFMcSsiQL4y83IDg&usg=AFQjCNFKzbtI2mBt0WJjesUr7pagsF_cmQ

http://www.ciphercloud.com/ciphercloud-extends-cloud-data-encryption-capabilities.php

http://blog.cloudflare.com/?tag=dns

Known Cloud Security AttacksK
XML signature wrapping (rewriting)
http://www.csoonline.com/article/692547/researchers-demo-cloud-security-issue-with-amazon-aws-attack
http://www.pcworld.com/businesscenter/article/242405/widely_used_encryption_standard_is_insecure_say_experts.html
http://searchcloudsecurity.techtarget.com/news/2240103444/Researchers-uncover-AWS-security-vulnerabilities

Is Facebook Connect Authentication Secure?

2011-12-15T10:32:00.000-08:00

A colleague of mine asked me if it's secure to use Facebook to login and then access your bank account, or your tax preparation software. I'll tempt to say no, but determine to do some research first.

Facebook allows a user to re-use Facebook login (aka single sign-on) to another application, which does not necessarily run on Facebook platform. First, you need to set up and register a Facebook application first, and then configure it to allow single sign-on with another application. In effect, this is a 3-legged OAuth authentication set-up.

Next, your third party application (e.g. banking, tax preparation software) web pages need to add Facebook Connect JavaScript api for login. In effect, you access your third party application (e.g. banking account), but use Facebook login. How it actually works behind the scene is: Facebook Connect JavaScript will present a login form (I hope it's in HTTPS, though the default Facebook has been HTTP). Facebook Connect will capture your cookies and send to the third party application.

What's wrong with this security model? I can see a few threats which may or may not be valid:

I Hate Cookies. It's a poor practice to play with cookies, particularly with JavaScript. A Man-in-the-Middle attack will capture the cookies and playback attacks. Stealing cookies will also mean that your privacy data, session key, session information and personal/business data could be stolen. A Cross-site Scripting, if a hacker knows you're using Facebook Connect JavaScript and banking application, may be able to steal your privacy data.
JavaScript May Mutate. A DOM-based cross-site scripting attack can modify your Web pages contents, or JavaScript on the fly, without attacking your server-side Web pages. An email lure or phishing can trigger such DOM-based cross-site scripting, particularly from mobile devices (you see, sometimes careless clicking from a long list of email messages may yield that). Anyway, your Facebook Connect JavaScript (e.g. how they subscribe, how they connect) is so visible. A malicious hacker can create a fake Website with an iFrame that looks exactly like your banking application, and perform a cross-frame attack (e.g. present a Facebook-like login using JavaScript).
Technology Limitation. 3-legged OAuth 1.x (don't think 2.x has resolved that issue) has an inherent weakness of man-in-the-middle attacks. You can google the story about Twitter and OAuth a few years back.
Compliance Concerns. It may not be compliant with government bodies to use Facebook Connect JavaScript to access banking or sensitive IRS data, despite some innovative products want to pilot that in early 2012. It is possible that these companies can get around with certain interpretation of the compliance and regulatory requirements (I'm not a legal expert). It's best to check with your attorney and legal counsel.

Resources
http://thinkdiff.net/facebook/graph-api-javascript-base-facebook-connect-tutorial/
http://www.slideshare.net/prateek.dayal/facebook-connect-tutorial

Cross-site Scripting Filter Code Sample

2011-12-11T16:36:00.001-08:00

After writing Jersey for JAX-WS REST Web services, you should add XSS prevention. A couple of things to do:

Add a servlet filter http://greatwebguy.com/programming/java/simple-cross-site-scripting-xss-servlet-filter/. Please note the comments that describe how to handle case sensitivity (e.g. value = value.replaceAll(”(?i)script”, “”);)
Consider URL encoding or clean the escape characters. Remember Apache's StringEscapeUtils.escapeHtml is NOT sufficient (the article assumes it's ok, but it's not)

You may want to take a look of OWASP's XSS prevention article that describes what escape or special characters to clean. Not all laundry list in public articles are comprehensive enough.
https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet

HP Fortify team has recently presented a few cases regarding reflected XSS vulnerabilities, and explains that different browser and platform implementation will behave differently. Refer to https://www.owasp.org/images/5/56/AbrahamKang-DOMBasedXSS.pptx for details.

Revisit Jersey-Spring-JPA-Hibernate again

2011-12-10T14:36:00.001-08:00

Need to do some development with REST Web services using Jersey. My last touch was March 2011. Didn't realize again the Jersey world has changed. Now it's Jersey 1.10 (it was Jersey 1.0.2), Spring 3.0.5. Looks like my old codes are not compatible (Eclipse Indigo flags errors)...

Dec 14, 2011 update - still resolving the dependencies issues. can compile but different types of errors.

What's Changed
The version of dependencies need to be matched. This is usually the key challenge - finding the right combination of version compatibility usually takes the longest time, e.g. Spring 2.5.x to 3.0.5 is not compatible with Jersey 1.8 to 1.10 unless you exclude the spring, spring-core, spring-web, spring-beans and spring-context when using jersey-spring. In Jersey 1.0.2, you would include spring and spring-test with jersey-spring 1.0.2. Even with Spring 3.0.x, you'll notice some forums discuss the incompatibility with Hibernate 3.6.0 (e.g. https://jira.springsource.org/browse/SPR-7701).

Known List of Compatible Dependencies
In my early experiment, I find these dependencies work well when doing a "maven clean install" (need to further validate once I build complete REST web services):

Spring 3.0.5.RELEASE
Hibernate 3.6.8.Final (hibernate-entitymanager)
Jersey 1.10 (jersey-server, jersey-client)
Jersey-Spring 1.10
MySQL Connector 5.1.6
commons-dbcp 1.2.2
commons-logging 1.0.4
cglib-nodep 2.1_3

Hibernate entity manager needs to exclude asm, asm-attrs and cglib.
Jersey-Spring to exclude spring, spring-web, spring-core, spring-beans, spring-context.

I realize NOT to include persistence api since hibernate will include it transitively.

I'm using the maven repository url http://download.java.net/maven/2/ with id maven2-repository.java.net.

Known (but Unknown to me) Compatibility Issues
Hibernate won't execute query with Spring 3.x due to compatibility issues. You encounter the error

java.lang.NoSuchFieldError: NONE

What this means is that Spring 3.5 uses JPA 2.0 which conflicts with hibernate-commons-annotations which uses transitively JPA 1.0. Resolution - just use hibernateentitymanager.

http://stackoverflow.com/questions/5727463/java-lang-nosuchfielderror-none-in-hibernate-with-spring-3-maven-jpa-c3p0
http://community.jboss.org/wiki/HibernateCompatibilityMatrix

Resource
I couldn't find any blog, wiki or article that shows the latest compatible set of pom.xml dependencies. I'll revise this blog when the errors are completely resolved. Here're a few pointers:

tutorial
http://www.mkyong.com/webservices/jax-rs/jersey-spring-integration-example/
this is outdated, but i like this a lot
http://persistentdesigns.com/wp/jersey-spring-and-jpa/

search for pom.xml and latest versions
http://search.maven.org/#browse

sun's wiki but suspect it's also obsolete
http://wikis.sun.com/display/Jersey/Main
http://jersey.java.net/nonav/documentation/latest/chapter_deps.html

spring pom.xml dependencies?
http://forum.springsource.org/showthread.php?109649-pom.xml-for-org.springframework.security.oauth-references-outdated-dependencies

Jersey 1.5 tutorial
http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=3&ved=0CDMQFjAC&url=http%3A%2F%2Fmatthewturland.com%2Fslides%2Fjersey%2F&ei=aW7nTpbpD4SiiQKBtu2ZBw&usg=AFQjCNFPCO0y2QJmzufGzXYFc0ngixLIuQ

Mobile device management - what the heck

2011-12-08T08:36:00.001-08:00

You may easily find these mobile device management (MDM) vendors from internet search:

Mobile Iron
Sybase Afaria
Airwatch
Tangoe
RIM's Blackberry Mobile Fusion

Sophos Mobile Control?

MDM is a neat product concept - you can remotely refresh the mobile device, if it runs "rogue", or is exploited. Mobile Iron, just like any startup trying to standardize and normalize their architecture in the cloud, tries very hard to learn how to define and migrate to a multi-tenancy cloud application architecture. Maintaining and selling appliances may not be scalable and maintainable as their business accelerates, particularly when your business is global 24x7x365. The challenge is to stop customizing schema for each client (e.g. add custom data fields using a field/value pair in a database table), simplify their architecture stack and optimize their efficiency.

MDM tends to address enterprise users need, more than mobile applications, e.g.

Provision user accounts
Set up emails
Network access to internal resources
Reinforce network security policies
Manage different mobile devices differently! (e.g. management profiles, configurations)
Integrate with Active Directory or other enterprise solutions
Identify which mobile device needs a patch (e.g. for security update)

More specific to mobile applications, not necessarily enterprise management:

Device information monitoring, e.g. if the mobile device is jailbroken, what device IMEI number is

Examples of mobile device management policies may include:

Complete lock-down, e.g. no right to add new applications
Purchase restricted
Pre-configured settings
Restrict call/messaging/roaming
Pre-installed applications
Restricted sync - prevent external backup of sensitive company data
Enable secure access, e.g. VPN connectivity
Enable "dedicated corporate container" - encrypt sensitive company data, but this may require on-application such as Good or Accellion, or your custom crypto technology. This prevents compromised device contents to be copied remotely
Enable access to private cloud
Limit or restrict access to personal cloud, if needed
Create a whitelist of allowed location-based service applications
Enable virtual desktop application, e.g. Citrix
Work with users, e.g. diagnosis, repair

Resources
http://www.computerworld.com/s/article/9222484/Mobile_device_management_what_you_should_know

Detecting and Mitigating DDOS or Botnet

2011-12-07T22:23:00.001-08:00

I went to Radware reception event today. Radware is one notable Distributed Denial of Service (DDOS) vendor who claims to have a mitigation solution. Arbor is another competing solution. I asked Radware's Vice President to explain how the DDOS technology works, and how does Arbor differentiate from theirs.

I don't really understand the gist of DDOS attack details. Here's my layman's summary. Please bear with me for any misunderstanding, and perhaps correct me with details.

DDOS Challenges
Malicious network attacks from Botnet or DDOS usually take over a victim's computer to launch attacks. A variety of techniques includes slow attack or launching mass number of SYN flood or DOS attacks. The challenge is that you couldn't tell they come from the real hacker's IP address, or the victim's. Some well-known DDOS attacks using tools like LOIC (Low Orbit Ion Canon) or #RefRef will exhibit their network signature, but in real life, you may not find any network signature from DDOS attack. If the DDOS attack comes with massive number of network packets, which causes system resource depletion, then you may easily notice this is a DDOS. However, if the DDOS attack is slow, disperse and does not have a consistent pattern, then you will have a hard time to detect this is a DDOS attack.

DDOS Detection
So how does Radware detect and mitigate DDOS or botnet? Radware will take a baseline when the system is normal. It has a learning engine (artificial intelligence) that creates signature from network packets. If the incoming network traffic demonstrates certain (suspicious) pattern, it will send a 302 request to the sender. If the sender is a bot, then it will not reply. Thus, Radware is capable of flagging this is a DDOS attack. This is the DDOS detection phase.

DDOS Mitigation
For DDOS mitigation, Radware can isolate or re-route some of the network traffic so that it can "scrub" the network contents. With Cavium chip (custom industry-strength SSL hardware chip that can decrypt 254-bit encryption speedily, assuming you have the private key), Radware can decrypt the Layer 7 content to examine if the incoming network traffic has a DDOS signature, or demonstrates suspicious DDOS attack. An example of this mitigation is Hong Kong Stock Exchange DDOS attack (Aug 14, 2011), which Radware re-directs the incoming network traffic (botnet/DDOS attacks) for scrubbing (decrypt contents, examine signature and block contents), while leaving the "good guys" (non-DDOS, normal stock trading requests) in the fat pipe. Radware also engages the upstream and downstream service providers who carry the network traffic to trace and isolate the source of DDOS attacks, and even scrub them.

What about Mobile DDOS
Radware can distinguish network traffic from native mobile devices, mobile browsers or non-mobile network traffic. This suggests that Radware can also identify if the DDOS attacks are from mobile devices or not.

Arbor - How It Works
Arbor and Juniper Networks are another two reputable DDOS solution competitors. However, Juniper Networks seems to be a traditional network provider but does not have compelling DDOS solution similar to Radware or Arbor (according to the Radware person I spoke to, which may not be true).

Arbor uses netflow (ftp://ftp.tik.ee.ethz.ch/pub/students/2003-So/SA-2003-35.pdf) to detect and identify DDOS. It does not use (or create) signature for DDOS, as in Radware. It "copies" the flow into a special area, notifies the DMZ (demilitarized zone), but does not have mitigation measure. This could be a challenge if your company has a limited network bandwidth because copying to DMZ will throttle your network.

Radware thinks it could be complementary to use both Arbor and Radware together in real life, since Arbor is better in detecting DDOS, and Radware is better in mitigating the DDOS attack. Well, this is of course not official.

Post-blog Notes

My co-worker says you can add an optional 302 detection module in Arbor

Resources
I search internet and find some other DDOS detection and mitigation solutions:

DDOS prevention toolkit
http://www.topwebhosts.org/tools/apf-bfd-ddos-rootkit.php

Riverhead detector
http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=3&ved=0CF4QFjAC&url=https%3A%2F%2Fwebspace.utexas.edu%2Faam426%2Fwww%2FTech_Note_Detection_8-03.pdf&ei=fV3gTvXfFYTO2AWUpJH2Ag&usg=AFQjCNEfJ6d9EQwm3XIbKCvauk7XnclH6g

LADS
http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&ved=0CFMQFjAB&url=http%3A%2F%2Fwww2.research.att.com%2F~duffield%2Fpapers%2FSDSVZ-lads.pdf&ei=fV3gTvXfFYTO2AWUpJH2Ag&usg=AFQjCNGOEM52zpENI5plB8l8ktYweAHIXQ

Cisco Traffic Anomaly Detector
http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/anomaly_detector/v6.0/configuration/guide/Intro.html

What the Heck - Location based Security

2011-11-19T14:28:00.001-08:00

This will be a long article. let me start with a few linkshttp://www.informationweek.com/blog/smb/229214024http://www.sbir.gov/sbirsearch/detail/286602

Location-based Security Tools

http://www.networkworld.com/community/node/43155
Trapeze LA-200E appliance

LocPriS
http://swansea.academia.edu/RashidMehmood/Papers/630579/LocPriS_a_security_and_privacy_preserving_location_based_services_development_framework
http://code.google.com/p/locpris/issues/searchtips

http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=21&ved=0CB0QFjAAOBQ&url=http%3A%2F%2Fwww-cs-students.stanford.edu%2F~dbfaria%2Ffiles%2Ffaria-dissertation.pdf&ei=V5zITp6oMYSaiQLp--nMDw&usg=AFQjCNEQxHxWxrtj1YegkQkGafBvSMpWVQ

Framework
http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?arnumber=5644999
http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=48&ved=0CFIQFjAHOCg&url=http%3A%2F%2Fwww.ece.ubc.ca%2F~vincentw%2FC%2FSWLc04.pdf&ei=1ZzITu66DIShiALp-qXCDw&usg=AFQjCNFYcCMUfrxgx3DCADDfUOcXrngWmg

Ubuntu on Acer Aspire One 722 Netbook with USB Flash Drive

2011-11-16T23:43:00.001-08:00

If you run into netbook deals, consider buying a dirt cheap netbook where you can use it for Linux or for security penetration testing.

This article shows you how to install Ubuntu on Acer Aspire One 722 netbook (I bought it for US$199++).
http://ubuntuforums.org/showthread.php?t=1811178

Although the installation procedure appears to be simple, your Linux may freeze. After some research, I notice that Acer has incompatible drivers that cause hardware panic (freeze). One quick fix is to apply the latest BIOS firmware, but I still see freeze. But I find out if you plug in the power supply, and boot into Linux with USB drive, you should be okay. then you can unplug, and go anywhere.

If your Acer freezes, you need to reboot into Windows, perform a proper shut down, plug in the power supply, and reboot into Linux with USB flash. I read from amazon customer review that in earlier BIOS, the windows partition was corrupted when your Acer is frozen. I don't have any proof, but it's safer to reboot into windows first to make sure your netbook is okay.

Hybrid Cloud Players

2011-11-15T10:17:00.001-08:00

Riverbed Cloud Solution identifies a few public and private cloud solutions (aka content delivery network) in 2011:

Public

Cloud Steelhead
Whitewater
Zeus
Aptimize
Akamai

Private

Steelhead
Steelhead QoS
Virtual Steelhead
Steelhead Mobile
Cascade
Shark

It's good to know what the new cloud (CDN) players are in 2011.
Why Steelhead is mentioned a few times under Private cloud? It's because Steelhead is offered by Riverbed. http://www.riverbed.com/us/products/steelhead_appliance/

Want to be a Hacker

2011-11-14T22:00:00.001-08:00

I wanna be an ethical hacker. How do I get started?http://ehsandipatel.blogspot.com/search/label/Ethical%20Hacking

To learn to be an ethical hacker, you need tools for the trade. There are a few open source penetration testing kits (Linux distribution):
http://www.darknet.org.uk/2006/03/10-best-security-live-cd-distros-pen-test-forensics-recovery/

How to create a mobile pen test toolkit? I bought a ~US$200 netbook (Acer Aspire One 722), a 32GB USB thumb drive and a thumb size bluetooth USB adapter. Download the Linux iso image and use http://unetbootin.sourceforge.net/ to create a bootable USB drive (aka "live cd" on a USB flash drive). You boot up your security toolkit from your netbook when needed, but you can use your netbook for normal office work or leisure using Windows 7.

10 Security Pen Testing Toolkit:
1. Backtrack
2. Operator
3. PHLACK
4. Auditor
5. L.A.S. Linux
6. Knoppix STD
7. Helix
8. F.I.R.E.
9. nUbuntu
10. Insert Rescue Security Toolkit

There are other new toolkits, e.g.
Arudius
The Gentoo Forensic Toolkit
Anonym-OS

Old ones:
Get Knoppix Here
Other Useful Resources:
SecurityDistros
FrozenTech LiveCD List
DistroWatch
Others to consider (Out of date or very new):
SlackPen
ThePacketMaster
Trinux
WarLinux
Network Security Toolkit
BrutalWare
KCPentrix
Plan-B
PENToo

Now you have a powerful Swiss Knife kit, but you don't want to try out with live production systems. Else you'll be arrested or sued. You can set up your playground by using near real systems at home, say, using VMWare images below, e.g. http://bailey.st/blog/2010/09/14/pentest-lab-vulnerable-servers-applications-list/

UltimateLAMP http://ronaldbradford.com/tmp/UltimateLAMP-0.2.zip
webgoat http://www.owasp.org
Holynix http://pynstrom.net/index.php?page=holynix.php
WackoPicko http://cs.ucsb.edu/~adoupe/static/black-box-scanners-dimva2010.pdf
https://github.com/adamdoupe/WackoPicko
De-ICE PenTest LiveCDs http://de-ice.net/hackerpedia/index.php/De-ICE.net_PenTest_Disks
Metasploitable http://blog.metasploit.com/2010/05/introducing-metasploitable.html
Owaspbwa http://code.google.com/p/owaspbwa/
Web Security Dojo http://www.mavensecurity.com/web_security_dojo/
Lampsecurity http://sourceforge.net/projects/lampsecurity/files/
Damn Vulnerable Web App (DVWA) www.dvwa.co.uk
Hacking-Lab http://www.hacking-lab.com/hl_livecd/
Moth http://www.bonsai-sec.com/en/research/moth.php
Exploit kb vulnerable web app http://sourceforge.net/projects/exploitcoilvuln/
Gruyere http://google-gruyere.appspot.com/
Damn Vulnerable Linux (DVL) http://www.damnvulnerablelinux.org
pWnOS http://www.krash.in/bond00/pWnOS%20v1.0.zip
Virtual Hacking Lab http://sourceforge.net/projects/virtualhacking/files/
Badstore http://www.badstore.net/
BodgeIt Store http://code.google.com/p/bodgeit/
Hackademic Challenges www.hackademic.eu
OWASP Vicnum Project https://sourceforge.net/projects/vicnum/
Stanford SecuriBench http://suif.stanford.edu/~livshits/securibench/
Kioptrix http://www.kioptrix.com/blog/?page_id=135
hackxor http://hackxor.sourceforge.net

More Resources about Hackinghttp://vishnuvalentino.comhttp://carnal0wnage.attackresearch.com/2011/11/common-mobile-app-vulnerabilities.htmlSearch the keywords backtrack tutorial

Please Listen to the Aircraft Announcement

2011-10-20T11:32:00.000-07:00

I was on a Southwest flight to San Diego this week. As usual, I didn't pay attention to the announcement while the aircraft took off. By chance, I caught the announcement from the air steward that:

You'll notice a "Call Attendant" button. Don't press it. Otherwise, your luggage will be ejected out of the aircraft.

I began to pay attention, since this is weird.

If you're lucky to land safely in San Diego, ...

Oh my, what a day to start with.

Mobile app security - what's new

2011-10-10T22:16:00.001-07:00

Code review - decompile binaries, examine local storage, extract iOS phone app, etchttp://www.isecpartners.com/storage/docs/presentations/Secure_Development_on_iOS.pdf

iOS app security - parametize SQL, denial of service etc
http://www.isecpartners.com/storage/docs/presentations/Secure_Development_on_iOS.pdf

Websecurity - test js security
http://blog.websecurify.com/

Top 10 mobile app security vulnerabilities
http://www.veracode.com/blog/2010/12/mobile-app-top-10-list/http://www.veracode.com/products/mobile-application-security.html

http://labs.securitycompass.com/articles/common-mobile-application-security-pitfalls/

Android security
http://www.blackhat.com/presentations/bh-usa-09/BURNS/BHUSA09-Burns-AndroidSurgery-PAPER.pdf

Mobile app security testing

http://www.google.com/url?sa=t&source=web&cd=6&ved=0CGYQFjAF&url=http%3A%2F%2Fwww.mcafee.com%2Fus%2Fresources%2Fwhite-papers%2Ffoundstone%2Fwp-mobile-app-security-testing.pdf&rct=j&q=mobile%20application%20security&ei=7m-kTpfxGuSQiQL5-72AAQ&usg=AFQjCNE4jSY5XT1PcXUIkbCCpXgIMIN7Ag

http://blog.infostretch.com/mobile-application-security-testing-–-part-i

http://pentestmag.com/category/articles/

Code review case study
http://blog.denimgroup.com/denim_group/2011/08/mobile-application-security-code-reviews-bsides-last-vegas-materials-online.html

http://www.ehacking.net/2011/09/owasp-goatdroid-android-mobile.htmlhttp://clubhack.com/2009/files/Gursev_Kalra__Mobile_Application_Security_Testing.pdf

General mobile app security resources
http://www.extendcode.com/Resources/article-mobile-application-security.aspx

http://www.csoonline.com/article/679818/8-security-questions-to-ask-before-building-mobile-applications

http://www.linkedin.com/groups/Mobile-Application-Security-3829637

https://www.owasp.org/index.php/OWASP_Mobile_Security_Projecthttp://www.matasano.com/research/mobile/http://palisade.plynt.com/issues/2009Apr/mobile-application-security-testing/

http://www.ibm.com/developerworks/xml/tutorials/x-jquerymobilesecuritytut/index.html

http://nsd.org.in/web/nsd-specialty-groups/mobile-application-security/

http://www.hteinkmin.com/article-on-mobile-application-security.html

http://www.plaveb.com/blog/how-developers-ensure-secure-mobile-application-development

http://news.yahoo.com/mobile-apps-android-ios-flunk-security-test-172853198.html

IOS security
http://www.nulledscripts.it/2011/03/30/mobile-application-security.html

Android security
http://hakers.info/site/2011/10/android-penetration-testing-pentesting-android-apps

Wifi security
http://triwinet.com/wifi-security-test/.php

Mobile security framework
https://buildsecurityin.us-cert.gov/swa/presentations_032011/DanCornell-MobileAppSecOverview.pdf

Mobile security pen testing tutorial
http://labs.securitycompass.com/category/mobile/
http://labs.securitycompass.com/mobile/mobile-security-presentations-from-toorcon-and-misti/
http://securitycompass.com/conferences/downloads/pentesting_android_iphone.pdf

Penetration test tools
https://addons.mozilla.org/en-US/firefox/collections/Anonymous-4764404/wapt/

http://security.stackexchange.com/questions/2307/pen-test-cell-phones

http://geeknizer.com/iphone-pen-testing/

General Purpose Web Security Testing Tools
http://www.softwareqatest.com/qatweb1.html#SECURITY

How to Go to Hell

2011-09-29T14:06:00.001-07:00

I download (free) Dragon Go voice recognition search application on my iPad. I spoke the words "amazon kindle", and it shows me the amazon page to buy. I asked "show me how to go to hell", and it displayed a (Google) map driving to Detroit.

SMS Gateway Provider

2011-09-19T11:11:00.000-07:00

I'm conducting some tests on a few SMS gateway providers, which push SMS texts to the carriers, which then deliver the actual SMS to mobile handsets.

Before this project, I have no prior knowledge of how SMS works.

Here're a few interesting data points I learn:

Average response time 0.1 to 0.2 sec. Simple SMS send (e.g. a plain text message in SMS) can take 0.1 to 2 sec from the client to the SMS gateway. The end-to-end user experience may vary from 2 to 5 seconds, or more.
Average 40 TPS: A reasonable SMS gateway throughput would be 40 to 60 TPS (transactions per second), i.e. an SMS gateway vendor can push 40 to 60 SMS texts (actually a mix of simple text and binary message [such as jpg]) to a local carrier.
Optimal throughput. Despite SMS vendors may complete > 60 TPS, the average response time may take > 2 sec to send an SMS message under load. Thus, a stepwise load test can tell a better picture of scalability throughput. I would expect a reasonable optimal throughput would be: 40 TPS or less per single server instance.
Bulk Send. SMS vendors tend to publish (if they are willing) larger TPS such as 200 TPS since they use bulk send. In other words, you can put a list of SMS simple texts in one single file (e.g. for marketing promotion messages). In one SMS vendor I tested, I notice 0.7 to 10 seconds to complete a send with 1,000 SMS messages per batch, or even 5,000 SMS messages per batch.

When testing SMS gateway vendor performance and scalability, you may want to include test scenarios:

Transaction mix of simple text, binary message, vcard, encoded text. If you can't replicate all message types, include at least simple text and binary message (e.g. jpg).
Bulk send of messages in 1000, 2000, 3000, 4000 and 5000 messages per batch

Beware of constraints and limits for each SMS provider, e.g.

Some SMS vendors place an arbitrary max TPS per tenant, e.g. 30 TPS per service provider
Some SMS vendors have max number of characters for message type, e.g. 160 characters for simple text
Some SMS vendors have max number of bulk send messages, e.g. minimum 10 messages per bulk send

Although the norm is to use SMPP protocol (this format looks like a telex or fax to me), it's very common to use HTTP REST web service, e.g. HTTP GET or HTTP POST. Sending SOAP versus sending REST may have 20% difference in performance per simple text message. This may be rationalized by the SOAP payload marshal/unmarshal overhead.

This link depicts a higher comparison (remark: not technical) of different SMS vendors:
http://www.developershome.com/sms/smsGatewayProvComp.asp

Using SOAPUI for performance testing

2011-09-15T15:55:00.001-07:00

some interesting discussion about load http://www.myhomepageindia.com/index.php/2009/11/02/performance-testing-web-service-using-soapui.html

What's New about Mobile UI Framework

2011-09-09T11:32:00.000-07:00

I am piloting jQueryMobile to build HTML 5 applications as a UI framework. Brian LeRoux from Nitobi shares his experience and recommendation:

PhoneGap uses xui from the start. Brian is looking into chrome.js recently. But he recommends tyring zepto.js.

What's Cool about PhoneGap

2011-09-09T10:48:00.000-07:00

Nitobi's Chief Architect (Brian LeRoux) shares an interesting session on PhoneGap. They download iOS applications from app store periodically, and de-compile the codes to see if the market uses PhoneGap to build. As of Sep 9, 2011, 5% iOS applications use PhoneGap, ~15,000 users and 33,216 applications created.

PhoneGap is a framework that builds native mobile applications without using iOS SDK or Android.
https://build.phonegap.com/. You only maintain one single code base, and can deploy to multiple phone platforms and handsets.

You can check out more cool stuff from http://github.com/phonegap

3 years ago Apple rejects PhoneGap. You need to rename plist in order to be compliant with Appstore submission principles (so that you won't be rejected).

Startup overhead for PhoneGap. Brian benchmarks it for 1-2 sec (10kb footprint). This means your iOS starts up a PhoneGap application in 1 sec with no contents. The rest of the performance overhead is your applications.

If you need help, try google group or IRC.

Kill a Watt

2011-09-09T06:53:00.000-07:00

I bought a gadget Kill-a-Watt to measure my electricity usage of household appliance. I saw this gadget at Frys store a few years ago, and finally got the motivation to buy one.

My surprisesmare:

Hot water heater - $70 / year
Micro-USB charger (e.g. Kindle, Bluetooth headset) - $7 / year
Sony Hifi home theater set (Idle, plugged in but not used) - $50 / year

A Few Mobile Performance Tools

2011-09-08T17:14:00.000-07:00

JDrop (http://jdrop.org/) - store JSON data (performance data from mobile device) in the cloud

pcap (http://pcapperf.appspot.com/) - (profiling) you capture the actual network/data traffic from a mobile device in PCAP format, and import into pcap in order to generate a HAR file (performance data in waterfall chart format)

A long list of mobile performance testing tools http://www.softwareqatest.com/qatweb1.html

32 Old Family Video Tapes Digitized

2011-09-07T16:14:00.000-07:00

I finally digitized 32 hours of video tapes into Quicktime MOV format in 3 days over the past long weekend. They are the memory from my son's birth to recent years. My Sony PC-115 camcorder is very sick, and I'm not sure when it stops functioning.

I'm very pleased for the achievement, and am surprised I have the patience for the conversion. (I had another great achievement to scan thousands of photos manually last year).

A few years back, I used a firewire adapter to capture the old videos in .avi format using Windows Movie (and also Nero) on a Windows laptop. The quality is marginally acceptable. I now switch to Quicktime on a Macbook. The quality seems to be sharper with more vibrant color, and rightly exposed (when the camcorder LCD screen shows overexposed).

However, I can't play back Quicktime MOV files on my Samsung LED TV. I convert the MOV files into MP4 using MKVTOOLS, but the MP4 (or MKV) files can't play on my htc wildfire S Android cell phone.

How to Hack Your Kindle 3

2011-09-03T07:21:00.001-07:00

http://www.mobileread.com/forums/showthread.php?t=128704

Writing JavaScript and jQuery Mobile on the Fly

2011-09-01T11:30:00.001-07:00

Not confident about writing JavaScript on the fly?Try http://jsfiddle.net/gpHNb/26/ to see the actual result right away. Good if you're using jQuery mobile too.

Read a Book in 20 Years

2011-09-01T08:26:00.000-07:00

I have a bad habit of collecting books instead of reading books. At first, I tried to read the first few pages, particularly the Preface, and the first chapter. Books (and movies) are placed on the shelf for years, and if they are lucky enough to be re-sold.

I had the honor yesterday that I read a book called Visual Dictionary almost page by page after 20 years. I probably read a few pages when I first purchased it. For dictionaries, I tried to read from A to Z when I was in 13 or 14 (which I always stop in the middle of A section.

Most people may not have the problem I had. But this is a big deal for me. And I feel great - being able to do something even after 20 years.

Google Market Problem on Android Tablet

2011-08-31T08:44:00.001-07:00

i found an article describing how to resolve the google market issue. http://www.slatedroid.com/wiki/index.php/Fix_Market_For_Slates

I need an android id...

The symptom is: Google market starts, showing the message "downloading..." and then "download unsuccessful".

Top 25 Security Products in 2011

2011-08-30T13:41:00.000-07:00

CRN (http://www.crn.com/slide-shows/security/231600449/25-hot-security-products-to-watch.htm?pgno=2) identifies top 25 security products to watch:

Astaro security gateway - unified threat management
BeyondTrust PowerBroker database - monitor privileged user database access
Checkpoint 21400 - consolidate several appliances (vpn, firewall, mobile access, IPS, anti-virus, anti-spam, etc)
Checkpiont 61000 - scalability with 70 million concurrent connections and 600,000 sessions per second
Checkpoint R75.20 - comprehensive SSL inspection technology, new URL Filtering Software Blade that provides granular control for web surfing in real-time and uniquely integrates with Application Control for unified enforcement of web controls
Fortinet FortiWeb 4.0 MR3 - improve bandwidth utilization and user response times, as well as the overall performance of application delivery
Kaspersky Internet Security 2012- what's new, e.g. cloud based protection
McAfee Mobile Security
M86 MailMarshal Email Content Manager - emails
M86 Security Reporter - virtual appliance
M86 Secure Web Gateway - comprehensive, multi-layered Web security and reporting capabilities designed to increase productivity, address compliance guidelines and control bandwidth
PacketSure DLP - comprehensive data loss prevention
Palo Alto network 5060 - protect data centers, large enterprise Internet gateways, and service provider environments where traffic demands dictate predictable firewall and threat prevention throughput
Palo Alto Networks GlobalProtect - ties application-, user-, and content-based policies to roaming users through a persistent thin client
RSA NetWitness Panorama - collect and analyze log information along with content of network capture to give users a powerful advantage during an overall security investigation
RSA Authentication Manager Express - provides multi-factor authentication optimized for SMBs
Skybox Network Assurance - take the network context – the network devices and settings, access paths, and policies – into account when looking for network security gaps or considering if an attacker can exploit vulnerabilities
Sophos Mobile Control - central configure mobile device security settings and enforce them
Sophos SafeGuard Enterprise - provides multi-layered, centrally managed endpoint data security combining encryption and data loss prevention (DLP) on laptops, desktops, and removable media
Symantec Endpoint Protection - offers comprehensive defense against all types of attacks for both physical and virtual system
Symantec Endpoint Protection 12 Small Business Edition
Total Defense Internet Security Suite Plus
Trend Micro Mobile Security - extends protection beyond traditional PCs to secure mobile devices and data
Tripwire Enterprise -configuration control and file integrity monitoring solution offers comprehensive compliance policy management that protects critical infrastructure, detects changes in real time and corrects noncompliant configurations

A Spy Story of Printers

2011-08-25T17:00:00.000-07:00

A church friend of mine shared with me an innovative story of how spies could capture information from a printer. Back in the old days of daisy wheel printers, you could bring a big dish-like magnet outside a target location (e.g. outside an embassy) to capture sound wave signature (sorry, I'm illiterate about physics) generated by daisy wheel printers. Early design of daisy wheel printer yields different sound wave length signatures since typists don't use the same force for every letter or number. You can actually reverse engineer the actual letter or number typed by inferring from the sound wave signature. To add to the complexity, a daisy wheel design was supposed to find the shortest distance to turn the wheel left or right for the hammer to hit/print the letter/number. These clues could help you map the sound wave signature to the right letter/number.

As a result, the government agency asked my friend to modify the daisy wheel printer so that the typewriter inside had a coating that absorbed the sound (making this more difficult to capture the signature), and the daisy wheel to randomly turn to the next letter/number (instead of the shortest distance). A year later, they came to my friend for assistance again. The government agency customized the "motherboard" but ran into several unknown "system crashes". They asked my friend some peripheral questions with some unrelated items so that they could resolve the issues. When my friend asked specific questions, they wouldn't tell a thing.

My friend is indeed a smart scientist (he had a patent invention for foldable keyboard). This story sounds like a scene with Q in a James Bond movie to me.

Mobile Security Penetration Testing

2011-08-25T16:41:00.000-07:00

I attended a Core Security (Core Impact v12, http://www.coresecurity.com/content/core-impact-overview) webcast about penetration testing for mobile this morning. My recent experience with penetration testing is to use IBM Watchfire AppScan, Cenzic Hailstorm or some open source application scanning or proxy tools to look for vulnerabilities. That startup product opens my eyes with a demo of the following scenarios:

Scenario #1: How to Exploit a Mobile Device

Start with one email address, say, from searching linkedin, facebook or even sniff from a wifi access point
Scan for your local wifi access point, SMS gateway or SMTP gateway, and hack into it to launch a man-in-the-middle attack (of course, with some expensive sniffing or hacking tools)
Once you notice the mobile user sends a request, intercept it, and reply with a manipulated email that lures him/her to click
Upon clicking, he/she may install a trojan or script that steals their identities or privacy data

Scenario #2: Exploit Using a Victim

Once you access a wifi subnet, scan for hosts with open ports. Then look for system information that you can exploit with metasploit
With a known port, break into the port and install your Python scripts (trojan!)
From your exploited script, you can launch scan or attack just like within a "vpn" (this sounds like a botnet to me)

These scenarios are fairly high level, and I was not familiar with the approach or details at all. Without a powerful (and expensive) hacking/pen testing tool, I (yes, my assumptions) need to use a mixture of hacking or pen testing tools to achieve the same result. Even so, I wouldn't know how to connect the dots. These scenarios are excellent examples of how vulnerable most of our mobile devices/applications are today.

In real life scenarios, the hacking and pen testing would be more difficult, and won't be that dramatic as depicted here. I don't think I know a bit, or can perform any of the above tasks. But I'm very impressed by the product manager (speaker).

Playing with Android tablet - refresh ROMs

2011-08-25T10:50:00.000-07:00

I bought a 7" android tablet (aka aPad) a year ago for US$200. It has the best features that time, including multi-point gesture, camera and memory card support. It ran Android 2.1 (a bit old now), and the Android market is not working for some unknown reasons.

I was unfortunate to get US$99 HP Touchpad recently. All my orders got canceled. Hate it.

I determine to refresh my 7" aPad to Android 2.3.x or perhaps 3.0 this coming weekend.
http://www.androidtablets.net/forum/telechips-tcc8902-development/13471-haipad-m701-latest-firmaware-android-2-3-2g-samsung-micron-4g.html

I'll update if this is successful.

Some Airline Domain Knowledge

2011-08-21T22:21:00.000-07:00

I used to work in an airline. I uncovered some of my oldest notes about airline. See if you know these:

Crew
2 types of Crew - cabin crew and cockpit crew.\

Cockpit crew categories

Captain CN
First officer FO
First engineer FE
Second officer SO

Cabin crew categories

Chief purser CP
Senior purser SP
Purser PR
Purser in first class PF
Junior purser FJ
Junior C/A bar BC
Junior C/A EY

Heavy cabin crew

Chief purser CP
Senior purser SP
Purser PR
Purser in first class
Junior purser JF
Junior C/A bar JB
Junior C/A JR

Seniority of crew

Senior check S
Check C
Training or instructor T
Senior E
Normal line N
Under conversion training V
Probationary P
On probation L
Under command training D
Under induction training I
Familiarization X

Crew administration includes license info, address info, language info, visa info and medical info

Personal info of crew

crew id, employee reference no, crew ICAO no, mailbox no
crew type (CO/CA), status, crew category
name, sex, nationality, country
training info
Base port, travel document details
Non-swap period details

Flight types

Normal flight - normal schedule flight, extra sector, re-routed flight, rescheduled flight, aircraft type change, charter flight
Ferry flight - delivery flight, one-engine inoperative, position flight, diversion of ferry flight
Diversion flight - diversion of normal flight, technical stop
Special flight - spare engine pod carriage, spare engine carriage, landing gear extended, return flight (including flight returns to ramp), diversion of special flights, flight to destination or alternate with fuel dumped, flight returns to origin with fuel dumped
Cancellation - flight cancelled: general, due diversion, due re-route
Others - training flight, test flight

Flight change types - sector change, aircraft type change, schedule flight time change, telex time update, actual flight time update

A crew roster includes

roster date
crew class
last 12 months block-hours total
monthly and weekly totals
a series of pattern code and pattern daily totals
a series of training / qualification details, if any
exception indicators

Mutual exchange duty details of crew includes reference no, swap month, approval, crew involved and a series of duties exchanged

Basic flight pattern includes (basis for crew assignment):

effective period
Pattern frequency for the period in terms of week day, number indicator
List of crew requirement
one or more flight sector
one or more ground duty code
processing indicators

Apple appstore code signing issue resolved

2011-08-19T16:39:00.000-07:00

My co-workers have been struggling for months to automate code signing before publishing an iOS app to Apple appstore. We have been manually building, re-compiling, and signing apps. We heard that eBay implements an automated build and deploy process, and why not us?

Apple documentation says one thing but we can't use it as said. Now with iOS 4.2 SDK, we can add a file called entitlement.plist, then we start code signing with the build automation without manual intervention.

I have not tried out myself yet.

How to Read Throughput and Performance Numbers

2011-08-10T15:29:00.000-07:00

About a year ago, I was a performance architect for a cloud-based small business financial service application. The Web application can sustain a total of 35,000 REST api calls per second. A friend asks if this is mediocre or extremely well in the field. What does this number means?

Sample Scenario

Domain: Small business accounting application with business data hosted in a private cloud
Population: 68,000 customer base (active) with 1% concurrent users (assuming 20% buffer for growth)
Infrastructure: 1 load balancer, 2 JBoss app servers and 4 Oracle database servers (each server has 16GB memory with 8-core 2.66GHz xeon processor)
We measure the throughput by simulating 816 concurrent users (1% of 68,000 plus 20% growth factor)

Each user logins and accesses the landing page. There are 41 REST api calls on the landing page.

Scalability Test Findings

The test objective is to verify if the application can sustain 33,456 calls/sec (816 users x 41 calls per page)
Test results show 140,000+ calls per second can be sustained with 260 concurrent users and 1.1 sec response time [@90 percentile]. (Remark: our objective is to verify the # of calls per sec, not the concurrent users. The performance engineer changes the execution method by generating the # of concurrent requests, but tuning down the # of users due to technical issues).

How Good or How Bad?

35,000 REST read api calls/sec is mediocre for 2 to 4 high-end app server instances. Of course, we can't assess good or bad based on the number alone since we need to consider the # of app servers, and the complexity of the read api calls. For example, if we have 35,000 reads/sec with 100 servers and 20 seconds response time per call, this would be an extremely poor design/implementation.
Database benchmarking reports show that 100,000 to 2.5M reads/sec is an achievable range, e.g.

http://www.orafaq.com/forum/t/145633/2/ mentions 135,580 reads per sec on an oracle server (not the capacity but one case study)
http://www.dbms2.com/2011/04/04/the-mongodb-story/ mongo db 100,000 reads/sec on 8-12 cores, 16-64GB memory machine
http://forums.mysql.com/read.php?25,235889,235889 claims mysql can achieve 950,000 reads per sec on a single node

Please note that this REST read api/sec is not identical to transactions per second. For financial sector, one transaction per second (TPS) is likely to include multiple reads or REST api calls. 20 to 100 TPS is rather common, compared to 10,000 to 35,000 calls / sec.

Some Extreme Numbers

Facebook has 13M queries/sec with 4 ms reads and 5 ms writes response time running from their 30,000 servers http://highscalability.com/blog/2010/11/4/facebook-at-13-million-queries-per-second-recommends-minimiz.html and http://www.datacenterknowledge.com/archives/2009/10/13/facebook-now-has-30000-servers/
New Relic processes 180,000+ requests/sec with 9 MySQL cluster (+ app servers) for website performance monitoring (heartbeats and data collection) http://highscalability.com/blog/2011/7/18/new-relic-architecture-collecting-20-billion-metrics-a-day.html
Twitter handles 1.6B queries/day (or 11,574 search queries/sec) http://en.wikipedia.org/wiki/Twitter

Appearance versus Reality

Is the reality (in production) close to the ideal (projected or simulated capacity, as found in performance and scalability test)? My past project now has significantly shrinked the throughput to 1.1M reads/day (or 13.3 reads/sec) as the number of users decrease drastically after 1 year. This number reflects the actual usage, not the capacity.
Inferring from Facebook statistics above, they handle 433 queries/sec per server instance

How to Install Android Apps with a 32Mb Android Phone

2011-07-26T10:29:00.000-07:00

Just bought an Android 2.3 phone (htc Wildfire S) with 512Mb internal memory. However, with the system apps, I only have 50-120Mb left. After installing two to three apps, I have 32Mb left. With Android 2.3, you can move installed apps to SD card (say, you have 16Gb SD card). However, most existing Android apps don't support apps2sd, which means that those legacy apps can't be moved to SD card.

Here's a get-around. I'll try out soon.
http://www.bongizmo.com/blog/moving-all-android-apps-to-sdcard-apps2sd-froyo/

How to Deal with an Aggressive Waiter

2011-07-08T08:41:00.000-07:00

Yesterday is my son's birthday. I went to a local American restaurant for dinner. The receptionist waiter was very aggressive. He seemed very bored by playing with you (unilaterally), say, gave you the menu but suddenly took it back a few times. While he was seating us, he came up with a few idiosyncratic jokes that we were not ready for them.

He introduced the waitress' name a couple of times - Kendle. I got a bad ear and repeated Kindle to him twice: "You meant Kindle as in Amazon Kindle?" He was caught by surprise that his customer fought back to his jokes. The name Kendle has nothing to do with Amazon Kindle. What the heck. He backed off since he's sensing his customer began to speak nonsense. He did not know how to respond. He did not want to speak to a crazy customer. He silently left.

My family were very amused by the way I sent him back.

dTrace for Linux download

2011-06-16T15:53:00.000-07:00

ftp://crisp.dyndns-server.com/pub/release/website/dtrace/

I happen to attend O'Reilly Velocity Conference 2011, and listen to a session delivered by Bryan Cantrill, one of the authors of dTrace. He's very young and energetic (lots of foul language, not to expect from him). His speech is tuned in probably four quad-core speed. I find it breath-taking to understand what Robinson Project is about (real time world map contest). If you don't know he's one of the authors of dTrace, you wouldn't expect he's so amazing.

Losing a Good Friend

2011-06-14T06:55:00.000-07:00

I had a trustworthy friend in South Korea from work. I was consulting for several financial clients in Service Oriented Architecture in Seoul between 2003 and 2005. Since 2007, there were lots of shake-ups, and I learned that my friend Seonghoon had left the company. I sent him an email but he did not reply. The following year, I sent another email but without reply. I wondered whether he held grumble against the company.

Finally, I had contact with my previous Seoul office. An ex-colleague told me Seonghoon has passed away. He was struggling with cancer for some time. I was so shocked and depressed. I did miss Seonghoon. I should have kept in touch more frequently.

Rundeck - Can it be the Cloud Execution Engine?

2011-06-08T14:15:00.000-07:00

I love CenterRun (N1 Service Provisioning System), which is a cool application provisioning tool which can be used for multiple purposes, from provisioning, configuration management to remote execution. Recently, I evaluated BMC Blade and Rundeck.

Rundeck (http://rundeck.org) is really interestingly simple. It uses SSH for remote execution, and has a simple HTML front-end. You can define simple steps as workflow too.

Here're some simple commands to get started:

# Add the Rundeck repo
sudo rpm -Uvh http://rundeck.org/latest.rpm

# Install Rundeck
sudo yum install rundeck

# Create a "rundeck" user on the remote host
## The remote host being the host that you'll be using your 
## Rundeck server to affect

# Install the rundeck pub key on the remote host
## /home/rundeck/.ssh/rundeck.id_rsa.pub
## Double check that you can ssh to that host as "rundeck" 
## without a password

# Start the rundeck daemon
sudo /etc/init.d/rundeckd start

# Point your browser to http://:4440/user/login
## user: admin
## passwd: admin

# Add a project
rd-project -p nonproduction --action create

# Add your remote host
## edit /var/rundeck/projects/nonproduction/etc/resources.xml
## Add an additional node line similar to

# Test
## As the rundeck user on the Rundeck server run:
dispatch -I name=examplenode -p nonproduction --noqueue -- hostname

Source: http://bustleandflurry.com/test

http://groups.google.com/group/rundeck-discuss/browse_thread/thread/da677ba99e4eb4dd/307899572feda5fd?lnk=raot

you can try out deploying selenium to test out the concept

http://www.skillrack.com/tutorial/11_Integrating_Selenium_environment_with_Maven

Testing REST Web Services with curl

2011-05-26T10:16:00.000-07:00

I built REST web services with JAX-RS (Jersey), Spring and Hibernate using maven template. I find curl is a quick way to generate client tests.
http://stackoverflow.com/questions/1087185/http-testing-tool-easily-send-post-get-put

Assumptions

Your local web server set-up assumes:

http://localhost:8080/PiggyBank02/x/ with the context "/x/*" defined in your web.xml
and by defining the REST api (under /services/...) in your codes:

@Path("/services")
@Component
@Scope("request")
public class RestDemo {

Thus, you invoke the REST Web service by "http://localhost:8080/PiggyBank02/x/services/..."

Example 1:

To test @PUT

curl -v -X PUT -HContent-type:application/xml -H"Accept: application/xml" --data-binary "1Johanan05/25/201123.6" http://localhost:8080/PiggyBank02/x/services/update

Assuming your code writes:

    @Path("/{bar}")
    @PUT
    @Consumes("application/xml")
    public JAXBElement demo2(@PathParam("bar") String action, JAXBElement account) {
        System.out.println("*** Inserting username=" + account.getValue().getUserName().toString());
        return account;
    }

Example 2:

To test @POST

curl -v -X POST -HContent-type:application/xml -H"Accept: application/xml" --data-binary "1Johanan05/25/201123.6" http://localhost:8080/PiggyBank02/x/services/demo2a/insert

Assuming your code writes:

    @Path("/demo2a/{bar}")
    @POST
    @Consumes("application/xml")
    public Response demo2a(@PathParam("bar") String action, JAXBElement account) {
        if (action.equals("insert")) {
            System.out.println("*** Inserting username=" + account.getValue().getUserName().toString());
        } else if (action.equals("update")) {
            System.out.println("*** Updating username=" + account.getValue().getUserName().toString());
        } else {
            System.out.println("*** ignored due to invalid request");
        }
        // sample actions
        URI uri = uriInfo.getAbsolutePathBuilder().
                path(account.getValue().getUserName().toString()).
                build();
        return Response.created(uri).build();
    }

Example 3:

To test @DELETE

curl -v -X DELETE -HContent-type:application/xml -H"Accept: application/xml" --data-binary "11Johanan05/24/2011388.3" http://localhost:8080/PiggyBank02/x/services/delete

Assuming your code writes:

    @Path("/delete")
    @DELETE
    @Consumes("application/xml")
    public Response deleteAccount(JAXBElement account) {
        try {
            MasterAccount ac = new MasterAccount();
            ac.setAccountNumber(account.getValue().getAccountNumber());
            ac.setUserName(account.getValue().getUserName());
            ac.setUpdateDate(account.getValue().getUpdateDate());
            ac.setCurrentBalance(account.getValue().getCurrentBalance());
            masterAccountDAO.delete(ac);

            System.out.println("@DELETE *** Deleting username="
                    + account.getValue().getUserName().toString());

            URI uri = uriInfo.getAbsolutePathBuilder()
                    .path(account.getValue().getUserName().toString()).build();
            return Response.ok().build();
        } catch (Exception ex) {
            return Response.notModified().build();
        }
    }

Example 4:

To delete by id

curl -v -X DELETE -HContent-type:application/xml -H"Accept: application/xml" http://localhost:8080/PiggyBank02/x/services/delete/9

Assuming your code writes:

    @Path("/delete/{acNumber}")
    @DELETE
    @Consumes("application/xml")
    public Response deleteAccountByNumber(@PathParam("acNumber") String accountNumber) {
        try {
            MasterAccount ac = new MasterAccount();
            ac.setAccountNumber(Long.valueOf(accountNumber));
            masterAccountDAO.delete(ac);

            System.out.println("@DELETE by accountNumber *** Deleting username="
                    + accountNumber);
            return Response.ok().build();
        } catch (Exception ex) {
            return Response.notModified().build();
        }
    }

How CDN Content Delivery Network is Configured

2011-05-25T14:17:00.000-07:00

With CDN setup, you are supposed to access your web contents faster using your nearest geographical locations. However, I went to a couple of technical presentation but got the impression that CDN setup is a mystery (no information).

From this link
http://www.cyberciti.biz/tips/wordpress-cdn-content-delivery-network-configuration.html, it looks like once you purchased for CDN service, it'll be a simple DNS and Apache configuration to point to the CDN server:

Update your DNS CNAME to refer to your CDN server FQDN
Instruct your apache web to pull both your original server and CDN server - this will allow you to upload and map files to your CDN server (e.g. in your apache httpd.conf, specify your CDN server under ServerName and ServerAlias of the block)
Configure your app to upload files to the CDN server

JAX-RS: Difference between RESTeasy and Jersey

2011-05-24T11:59:00.000-07:00

My colleague Vijay shared with me 2 differences between JBoss RESTasy and Oracle Jersey that matter to him:

RESTeasy has a proprietary @Form that binds form parameters (e.g. [BuildVersion]&[BuildVersion]... in the HTTP body) to Java objects. If you are handling form contents, you will save considerable efforts to bind the @formparam to Java objects
RESTeasy's proprietary cache for the URL or query

From what I read from Internet, RESTeasy is easier for EJB 3.0 and SEAM integration, whereas Jersey is easier for Spring and JSON integration.

Simple Spring-Hibernate-REST Tutorial

2011-05-12T09:48:00.000-07:00

I want to write a simple backend application to expose (cloud) data as REST web service api (REST-RS) using Spring-Hibernate-Maven.

Pre-requisites

MySQL database (e.g. default setup)
Maven 3.0 to create application templates for eclipse
Tomcat app server for deployment (we can set up jetty plugin in maven too)

Creating an Application Template with maven

create a basic maven template for web app

e.g.
mvn archetype:generate --batch-mode -DarchetypeArtifactId=maven-archetype-quickstart -DgroupId=com.twoturningpoints -DartifactId=Hib3

Update pom.xml to include dependencies (e.g. jar files you need for Spring, Hibernate, Java EE persistence / JPA)

e.g. add these to your pom.xml


            JBoss repository
            http://repository.jboss.com/maven2/


            JavaEE repository
            http://download.java.net/maven/2/





            junit
            junit
            3.8.1
            test



            mysql
            mysql-connector-java
            5.1.9




            hibernate
            hibernate3
            3.2.3.GA




            hibernate-annotations
            hibernate-annotations
            3.3.0.GA



            hibernate-commons-annotations
            hibernate-commons-annotations
            3.0.0.GA




            dom4j
            dom4j
            1.6.1



            commons-logging
            commons-logging
            1.1.1



            commons-collections
            commons-collections
            3.2.1



            cglib
            cglib
            2.2




            javaee
            javaee-api
            5
            provided



            javax.transaction
            jta
            1.1



            javax.persistence
            persistence-api
            1.0

Add Hibernate template (pretty standard)

public class HibernateUtil {

   private static final SessionFactory sessionFactory = buildSessionFactory();

   private static SessionFactory buildSessionFactory() {
       try {
           // Create the SessionFactory from hibernate.cfg.xml
           return new AnnotationConfiguration().configure()
                   .buildSessionFactory();

       } catch (Throwable ex) {
           // Make sure you log the exception, as it might be swallowed
           System.err.println("Initial SessionFactory creation failed." + ex);
           throw new ExceptionInInitializerError(ex);
       }
   }

   public static SessionFactory getSessionFactory() {
       return sessionFactory;
   }

   public static void shutdown() {
       // Close caches and connection pools
       getSessionFactory().close();
   }

}

Update hibernate.cfg.xml under resources

e.g.

"-//Hibernate/Hibernate Configuration DTD 3.0//EN"
"http://hibernate.sourceforge.net/hibernate-configuration-3.0.dtd">

        false
        com.mysql.jdbc.Driver

        jdbc:mysql://localhost/yourdatabase
        root
        org.hibernate.dialect.MySQLDialect
        true
        true
        create

run "mvn eclipse:eclipse" and "mvn clean install"

To run from maven without deploying

e.g.
mvn clean compile exec:java -Dexec.mainClass=com.twoturningpoints.App

Story about Giant Finger Nail Cutter

2011-05-10T22:26:00.000-07:00

It's Mother Day's last weekend. It reminds me of a story about finger nail cutter.

I was about to leave for a flight to study in Scotland. My mom was very nervous if I forgot to bring essential personal items. She never traveled aboard, and didn't know if I can get anything. She wanted me to take her new giant size finger nail cutter with me. We had a gentle fight, just like you bargained in the Chinese market.

I was so reluctant, partly because of the (giant and perhaps embarrassing) size, and also I had already packed. I finally took hers. Without my notice, my (ex-)girl friend quietly placed a second finger nail cutter (backup!) in my luggage. When I unpacked my luggage, I found 2 giant size finger nail cutters.

In retrospect (23 years later), I really loved my mom being so thoughtful. My heart feels warm whenever I recall the story. I begin to like those giant size finger nail cutters, although it's quite rare to find them. And I miss my mom a lot.

Onboarding with Spring-Hibernate-REST (Jersey)

2011-05-10T10:01:00.001-07:00

these tutorials show you how to create a maven-eclipse template:

http://persistentdesigns.com/wp/jersey-spring-and-jpa/
http://javapulutan.blogspot.com/2009/08/maven-2-jpa-and-spring-3-first-attempt.html
http://blogs.oracle.com/enterprisetechtips/entry/jersey_and_spring

this article provides good examples of returning different responses or xml payload types:

http://java.dzone.com/articles/xml-bindings-jaxb-and-jax-rs?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+javalobby%2Ffrontpage+%28Javalobby+%2F+Java+Zone%29

http://www.webtide.com/resources/maven.jsp

http://java-x.blogspot.com/2007/04/native-queries-with-hibernate.html

http://glassfish.java.net/javaee5/persistence/persistence-example.html

http://www.roseindia.net/maven2/JPA-example.shtml

Install OpenLDAP on Linux

2011-05-08T12:02:00.000-07:00

To install openldap on ubuntu:

http://ubuntuforums.org/showthread.php?t=900920
http://www.howtoforge.com/install-and-configure-openldap-on-ubuntu-karmic-koala

To install openldap on redhat or centos:

http://mayank03.wordpress.com/2010/02/11/install-and-configure-openldap/

PS. I can't add 3 dc components, e.g. dc=corp,dc=xxx,dc=net but i can do 2 dc, e.g.

dn: dc=xxx,dc=net
dc: xxx
objectClass: top
objectClass: domain

Remark
http://www.cyberciti.biz/faq/howto-delete-remove-software-using-apt-get-command/
in case you need to clean up packages

http://tldp.org/HOWTO/LDAP-HOWTO/utilities.html
useful ldap commands

Installing mysql on Linux/Mac

2011-05-08T12:00:00.000-07:00

On CentOS or Redhat Linux:

yum install mysql
yum install mysql-server
yum install mysql-devel
chgrp -R mysql /var/lib/mysql

(it's already been set up in my Linux)

chmod -R 770 /var/lib/mysql
service mysqld start

(no, i need to use "/sbin/services mysqld start")

/usr/bin/mysqladmin -u root password 'new-password'

http://forums.mysql.com/read.php?11,153632

To install on Mac

There is a dmg to install, which will install to /usr/local/mysql.
There is a built-in user id _mysqld

sudo mysqld_safe
this will restart your mysql automatically

To remove from automatic restart, you need to turn off the mysql in /etc/hostconfig, e.g.
MYSQLCOM=-NO-

MySQL 5.x on Ubuntu

By default, mysql port 3306 is blocked. So you need to:

Disable iptables
Open port 3306 in mysql my.conf
Restart mysql

To disable iptables, flush it by "sudo iptables -F"

To open port 3306 in mysql, edit /etc/mysql/my.conf and change the entry "bind-address = 127.0.0.1" to "bind-address = 0.0.0.0" (allow port 3306 to be accessed remotely by any ip address"

To restart mysql on ubuntu, sudo /usr/sbin/service mysql restart

You need to create a non-root mysql user to access remotely, e.g.
grant all on *.* to 'userid'@'%' identified by 'password' with grant options;

What Makes a Difference

2011-05-02T11:14:00.000-07:00

Here's what I learned from Sing Tao radio this morning. A famous Chinese writer Hu Shih (胡適) once wrote:

How you spend your time after your 8-hour work makes a difference.

Some couples or parents (especially myself) stop learning. There are lots of chores after work. I find my sofa and TV (oh my beloved HD movies!) very comfortable after a long day of stress. Indeed, my day starts after I return home from office. That's quite an enlightenment for me - this sounds very familiar, doesn't it?

Install java on Synology NAS via ipkg

2011-04-28T09:45:00.000-07:00

you can install java or other popular packages on Synology NAS (practically busybox):

1. install ipkg
http://forum.synology.com/wiki/index.php/How_to_Install_Bootstrap

2. install jamvm

You can also install tomcat
http://www.openfsg.com/index.php/Install_Tomcat

Appendix

http://www.dpembo.ukfsn.org/2008/08/28/java-compiler-vm-on-the-nslu2/
To start with you need to install the following packages with ipkg:

ipkg install classpath
ipkg install jamvm
ipkg install jikes
ipkg install zlib
ipkg install file

Once these have installed then you are almost ready to go. Being a java developer, I was used to using javac and java to compile and execute programs, so jikes and jamvm didn’t sit well with me! To get around this I created a symbolic link and a shell script in /opt/bin
These are as follows:
/opt/bin/java

ln -s /opt/bin/jamvm /opt/bin/java

/opt/bin/javac

/opt/bin/jikes -classpath /opt/share/jamvm/classes.zip:/opt/share/classpath/glibj.zip $*

Remember to change the permissions on the shells scripts to add the execute flag!

SSL Certificate for Synology NAS

2011-04-26T15:46:00.000-07:00

http://forum.synology.com/enu/viewtopic.php?f=36&t=21704

I bought a few network storage appliances from Synology a while ago. Pretty neat. However, when i configure them with SSL, they have a self-signed certificate from Synology, which web browsers will treat them as suspicious Certificate Authority (e.g. malicious website).

This wiki link explains how to get a free SSL certificate. i have not tried that yet but it's attractive.

to install startcom SSL using java keytool
https://forum.startcom.org/viewtopic.php?t=1390

restore (regenerate synology keys)
http://forum.synology.com/wiki/index.php/How_to_generate_custom_SSL_certificates

ROI for Joining a Startup

2011-04-14T11:54:00.000-07:00

An ex-colleague recommended me to join a startup at least once in your life time. After exploring a few serious opportunities, here's what I find:

DILEMMA

There are success stories that young engineers get $1M+ after their startup go IPO (or being acquired). Should we jump on the bandwagon of promising startups?

RECOMMENDATION

If you have a stable job with high compensation (e.g. > $150K with bonus), joining a startup with the aspiration to get $1M after IPO may not be your best choice. This blog depicts the rationale with a scenario for illustration.

SCENARIO

A promising startup with a target (typical) asset value of US$200M with 50 employees (example only) could easily "burn" $16M expenses (example only) per year (assuming $120K-$140K compensation per person per year). If it's doing extremely well, they may generate $10M (example only) gross revenue annually. If the startup already got seed funding, A, B and C round funding, it may have already issued 10M+ shares. The startup could show off how much funding they get, e.g. B round gets $20M. All these highlights sound attractive and very tempting - you could become a millionaire if you join the startup with lots of funding and promising revenue.

Say, if you join this startup in their third year with $120K pay after C round funding, and you are awarded 20,000 shares option @ 15% discount (with estimated share value $1 per share), do you think you can be a millionaire after the startup flies (e.g. IPO or being acquired)?

Nope, I doubt it. Your $120K is your base salary. Most startup does not have bonus and much employee benefits. With your 20,000 shares out of 10M shares (after C round funding) could yield $6K (example only) if the value is appreciated to $2@ from $1 estimated value. Mind you that some startups don't want to disclose the total number of shares issued, and thus you can't assess your potential value from share options easily. But in some cases, a successful acquisition could yield $0 value since the purchase price only covers the debt from the previous rounds of funding, and deficit from operating expenses.   This is the case for my wife's company.

CALCULATING YOUR OPPORTUNITY COST

Here's how I would calculate my opportunity cost from a pure compensation perspective (not from a career development perspective):

Base compensation package:                           $x1 (e.g. $120,000)
Potential value from share options                   $x2 (e.g. $6,000)
Number of years the startup expects success:   y years (e.g. 5 years)
(or the expected time the startup could go IPO or being acquired)

By the end of y years, you'll have $x1 * y years + $x2. Say, if your current compensation is $140,000 base plus 15% bonus and benefits, you'll probably get $805K by end of year 5 (not considering pay raise or inflation). Your startup compensation could be $600K salary plus share option gain $6,000 (not including the additional share options you may get over the years). If you're not one of the founders, and if your startup goes IPO or being acquired, you may get extra bonus from share options such as $120K (assuming you're top performer). Thus, your total take-home package in 5 years' time is $726K in the best case. If you're unlucky, you'll then get $600K base pay. In such a case, is it a good bet to join the startup? Please bear in mind, financial factor is only one of the consideration (e.g. career development, value system, morale), not the only one.

What about if you're one of the founders who may get 0.3% to 0.5% equity holding? For a $200M asset, this will correspond to $600K to $1M if IPO or acquired. Since the successful rate of startup is extremely low (1% perhaps), it's unlikely that you can get $1M easily in 2 to 5 years. If your current total (not base) compensation is $100K to $120K more than the startup offer (e.g. your current pay is $160K with 20% bonus, and your startup offer is $120K), you'd better stay with your current job over a 5-year period.

Capturing Happy Moments with High Definition Home Video

2011-04-04T08:59:00.000-07:00

I have a fancy Sony HD camcorder but it saves video files in .mts format (technically AVCHD). I can capture happy moments (my son has a honors recital after taking Certificate of Merits piano level 8 recently). It does not play on typical Windows or mac laptop unless you install players such as VLC or Sony's own camcorder tool, or editing tools like Adobe Premiere Elements 9.
What can you do with your happy moments video clips?

Share and post them in youtube or facebook
Distribute in small iPhone format (mp4 h.264 format), ~30MB size for ~2 minutes video
Store in your iPad like a slide show or video show
Extract the audio track in .mp3, or use it as ringtone
Store them in a USB thumb drive to replay back on your big home TV

I google and couldn't find any free tools from Internet. That's disappointing. I used Premiere Elements 9 on macbook pro but it took me almost 5 hours to convert .mts to .mp4 (it has a funny file extension which I'm not sure it can be played on Windows or mac). By chance, I can use MKVTools (on mac) to import .mts (practically h.264) into .mp4 or .mkv, and use Handbrake (on mac) to shrink it to iPhone/iPad format for sharing. Wow, now I can store these video clips (.mkv) in a USB thumb drive and play them back on my Samsung TV.

Automated Unit Test or Stress Tools for Android

2011-03-31T10:42:00.000-07:00

Android SDK has Monkey for stress test.
MonkeyRunner
Robotium
Robolectric

References
http://java-mines.blogspot.com/2010/12/monkeyrunner-testing-on-android.html
http://www.google.com/url?sa=t&source=web&cd=9&ved=0CFkQFjAI&url=http%3A%2F%2Fwww.lntinfotech.com%2FBrochure%2FAndroid_Test_Automation_Framework.pdf&rct=j&q=android%20testing%20tools%20framework&ei=F7yUTfbbJ7CK0QGOtYGKDA&usg=AFQjCNFC5oIoJeuzHDsyy-6QeS-QhovWeg&cad=rja

http://www.slideshare.net/tylerschultz/robolectric-android-unit-testing-framework

Robotium http://blog.codecentric.de/en/2011/03/android-testing-in-brief/

How to Automate Screenshots as Test Output for iPhone/iPad

2011-03-30T00:09:00.000-07:00

There are at least 2 approaches how you can capture screenshots from your iPhone/iPad unit tests.

1. Screenshot capture background tasks
http://stackoverflow.com/questions/1360552/automate-screenshots-on-iphone-simulator/1579182#1579182
http://www.curioustimes.de/iphonesimulatorcropper/index.html

2. Automated unit test with screen capture feature
http://www.kaomte.com/blog/?p=46
http://code.google.com/p/google-toolbox-for-mac/wiki/iPhoneUnitTesting

Use case scenario
You have a code base that is customized for different companies with their custom logos and custom fields. This is a typical private label (or white label) business. Each custom build app needs to be submitted to appstore individually. This requires proof of unit tests with screenshots.

How it works
How do I automatically take screen shots of the iOS simulator while running automated unit test?
This article uses a tool called iOS simulator cropper. your test script will output a tag using NSLog indicating the screen shot should be taken. You write a python script to read the tail of the NSLog, and captures the iOS simulator screenshots.

Variations
You could invoke the screencapture command line utility to capture the screen at certain points in your testing. The most straight-forward option would be to capture the entire screen. Here's a bit of AppleScript that will bring the Simulator to the front, hide all other applications, and take a full-screen capture:

tell application "iPhone Simulator"
activate
end tell

tell application "System Events"
tell process "iOS Simulator"
tell menu bar 1
tell menu bar item "iOS Simulator"
tell menu "iOS Simulator"
click menu item "Hide Others"
end tell
end tell
end tell
end tell
end tell

do shell script "screencapture -m /tmp/screencapture.png"

Reference
http://dlinsin.blogspot.com/2011/01/ui-test-automation-with-instruments.html

Thanks to Ranch iPhone google group members for their input.

Google core-plot SDK Learning Experience

2011-03-29T11:13:00.000-07:00

I have recent experience in learning core-plot for iOS application development to plot graphs for iPhone/iPad. My learning curve is long and slow because most learning materials are either outdated or incomplete.

INSTALLATION

Once you download the latest core-plot SDK from google, follow the installation instructions under http://code.google.com/p/core-plot/wiki/UsingCorePlotInApplications or http://code.google.com/p/core-plot/w/list
http://www.switchonthecode.com/tutorials/using-core-plot-in-an-iphone-application is a good write-up, with more details and helpful than the google instructions

(1) Drag and drop core-plot project to your existing (target) project. I find using Right Click at the current project, and select Add Files option is better. Don't copy physical files. Older XCode allows reverse subfolders but XCode 4.2 does not.
(2) Under Target Project's Build Phases option, add core-plot as dependencies. If you don't see any dependencies listed, you may want to restart XCode, or retry drag-and-drop step above. I find a bug in XCode 4.2 where the list of dependencies does not show consistently
(3) Specify header search path with the core-plot framework subfolder
(4) Add linker flag with the value -ObjC -all_load -lCorePlot-CocoaTouch. Make sure the last value CorePlat-CocoaTouch must match the core-plot project name. Some wikis use CorePlot but my project does not compile due to 386 architecture errors.
(5) I choose GCC 4.2 compiler. Some wikis use LLVM GCC 4.2 for C/C++ compiler option. It looks like both will work.

Some tricky steps not elaborated in the installation instructions.

(1) Make sure you do NOT copy the files to your project because you'll encounter file location reference issues during compilation if you copy the physical files.
(2) Add -ObjC -all_load -lCorePlot-CocoaTouch to "Other Linker Flags" where the last "-l" name must match your core-plot project name.
(3) specify Header search paths to the path of your core-plot framework subfolder, e.g. ../core-plot/framework/** if your core-plot and your project share the same parent folder. this is better than specifying the absolute path. Some wikis say enter the user header search path but their screen sets N to "Use user search paths" - this is inaccurate and that's why i use header search path.

LEARNING POINTS

Core-plot plot space and axis title disappearing - a common problem is some graph areas are either clipped or the axis title disappears.

You need to understand how the plot space, padding space are axis title offset/location are computed. The main cause for clipped graph or disappearing axis title is due to the location or offset values outside the plot space.

For an iPhone screen, the graph size will be automatically computed and rendered based on the data points. The plot space will be overlayed with the padding. The padding space denotes the pixel. It's safe to assume 20 for padding space, except that if you use a tab view controller, you need to assign more padding space (e.g. 60).

In order to view the entire x-axis and y-axis title (caption), you want to display data from (0, 0) because the x.titleLocation and y.titleLocation values refer to the relative (0, 0) point. For example, if your x.titleLocation = CPDecimalFromFloat(5.0f);

Example 1:
you have 10 data points for x and y.
Your Y data set ranges from 150 to 600, and X data set ranges from 0 to 9 (10 data points).
Your second data line (one data point) has a y-value of 160.
You may want to define a plot range with x (-3 to +3) and y (-120 to +720) so that you can see the x-axis and y-axis labels

Then your x.titleLocation should be 5 (i.e. (10 - 0)/2 = 5, meaning your x.title will be in the middle), and y.titleLocation should be something like the mid-point plus the offset yAxisStart (e.g. 225 + 150 = 375 where 225 is the mid-point of your intended displayable data range [ (600 - 150)/2 = 225 and 150 is your yAxisStart ] because the titleLocation starts from (0, 0). If you set y.titleLocation = 225, then the y-axis won't be shown.

    double xAxisStart = 0;
    double xAxisLength = 10;

    double maxY = [[mySamples valueForKeyPath:@"@max.Y_VAL"] doubleValue];
    double minY = [[mySamples valueForKeyPath:@"@min.Y_VAL"] doubleValue];
    double minY1 = [[curSamples valueForKeyPath:@"@min.Y_VAL"] doubleValue];
    double yAxisStart = minY;

    if (minY > minY1) {
        yAxisStart = minY1;
    }
    double yAxisLength = maxY - yAxisStart;
    double idealInterval = yAxisLength / 10;
    ...
    CPXYPlotSpace *plotSpace = (CPXYPlotSpace *)graph.defaultPlotSpace;
    plotSpace.xRange = [CPPlotRange plotRangeWithLocation:CPDecimalFromDouble(xAxisStart - 3)
                                                   length:CPDecimalFromDouble(xAxisLength + 3)];

    plotSpace.yRange = [CPPlotRange plotRangeWithLocation:CPDecimalFromDouble(yAxisStart - idealInterval*3)
                                                   length:CPDecimalFromDouble(yAxisLength + idealInterval*3)];

    CPXYAxisSet *axisSet = (CPXYAxisSet *)graph.axisSet;

    CPXYAxis *x = axisSet.xAxis;
    x.majorIntervalLength = CPDecimalFromString(@"5");
    x.orthogonalCoordinateDecimal = CPDecimalFromString(@"0");
    x.title = @"Last 10 Builds"; // X-Axis
    x.titleOffset = -1 * yAxisStart;
    x.titleLocation = CPDecimalFromFloat((xAxisLength - xAxisStart)/2);

    CPXYAxis *y = axisSet.yAxis;
    y.majorIntervalLength = CPDecimalFromString(@"50");
    y.orthogonalCoordinateDecimal = CPDecimalFromString(@"0");
    y.title = @"# Issues";
    y.titleOffset = 40.0f;
    y.titleLocation = CPDecimalFromFloat((yAxisLength - yAxisStart)/2 + yAxisStart);


Example 2:
   CPXYGraph *graph = [[CPXYGraph alloc] initWithFrame:self.view.bounds];
    graph.paddingTop = 10;
    graph.paddingRight = 20;
    graph.paddingLeft = 20;
    graph.paddingBottom = 60;

To specify the axis title location, the location value actually corresponds to the data points value. Say, x-axis has 10 data points, and x-axis title location = 5.0f will be shown in the middle of the axis since 5 out of 10 (data points) denotes the middle.

The axis title offset will be the pixel offset relative to the axis starting / anchor point. 20 (pixels) may be an appropriate value for small x-axis value (caption or axis major interval, e.g. 1 liner text with value 5.0), and 30 (pixels) may be good for small y-axis value (3 digits on Y-axis such as 125.0).

Example: (x-axis has 10 data points, y-axis has range from 30 to 140)

    CPXYAxis *x = axisSet.xAxis;
    x.majorIntervalLength = CPDecimalFromString(@"5");
    x.orthogonalCoordinateDecimal = CPDecimalFromString(@"0");
    x.title = @"Last 10 Builds"; // X-Axis
    x.titleOffset = 20.0f;
    x.titleLocation = CPDecimalFromFloat(5.0f);

    CPXYAxis *y = axisSet.yAxis;
    y.majorIntervalLength = CPDecimalFromString(@"25");
    y.orthogonalCoordinateDecimal = CPDecimalFromString(@"0");
    y.title = @"# Issues";
    y.titleOffset = 30.0f;
    y.titleLocation = CPDecimalFromFloat(50.0f);

The axis majorIntervalLength is for clarity in the display (not to overwhelm users with fine-grained details), and is not related to the plot space and size. The orthogonalCoordinateDecimal is used if you want slanted label (e.g. 5 = 5 degree).

You can consider applying a theme. Take a look at the example app from core-plot. Customize a copy of the theme file (e.g. XYGraphTheme.m and .h). Remember to include the theme file's .h in the header. The benefit is that you can change the background color easily by updating the theme without changing your business logic. A word of caution is that the theme file may alter your plot space positioning (e.g. shrink). Example:

   CPTheme *theme = [[XYGraphTheme alloc] init] ;
    [graph applyTheme:theme];
    [theme release];

How to Distribute Your iOS App Without AppStore

2011-03-29T09:35:00.000-07:00

Typically you pay US$99 per year to Apple AppStore for a certificate, then you submit (build, deploy) your app to AppStore. Upon approval, voila, end-users can download your app via AppStore. However, if you want to deploy your iOS apps internally, or distribute to a control group of beta testers, life could be difficult.

You can of course purchase tools such as TestFlight or Hockey. Here's an alternative:

http://nachbaur.com/blog/building-ios-apps-for-over-the-air-adhoc-distribution

http://stackoverflow.com/questions/1004443/can-i-develop-an-iphone-application-that-my-company-can-use-for-internal-employee

http://iphonecto.com/2009/09/09/deploying-internal-enterprise-application-iphone/

Full Metal Panic Novel Summary

2011-03-28T23:18:00.001-07:00

http://forums.animesuki.com/showpost.php?p=594231&postcount=7

Mobile Application Lifecycle Management

2011-03-28T17:59:00.000-07:00

As a novice mobile developer, I'm interested to know which tools can help me to be productive, and what other challenges I'll encounter during various application development stages. I wrote a short mobile application lifecycle management paper recently to discuss how to address these challenges, and recommend some best practices, and a few pilot projects/solutions. Here is a summary:

WHAT'S NEW
Mobile application lifecycle management is NOT a re-brand of application lifecycle management because:

Mobile app development requires in-depth network (e.g. bandwidth optimization in codes, bandwidth simulation) and mobile deployment knowledge, which is very different from traditional application lifecycle management. Traditional Java/.NET app may not care about these areas
Build/deployment is very specific to the appstore, e.g. AppStore has very unique application submission rules, which traditional application lifecycle management don't care, or don't have such constraints. These rules dictate or influence the way you write mobile app, and how you deploy
Diagnostic and troubleshooting paradigm is very different for mobile app. In traditional application lifecycle management, you have JVM or kernel level troubleshooting on the server side. In mobile app, the diagnostic approach is very challenging due to the diversity of devices, and also feasibility (e.g. you won't be able to remote control the mobile device, or emit diagnostic information remotely).
Performance monitoring and analysis in traditional application lifecycle management can rely on JVM or CLR-centric performance tools (e.g. CA Introscope, dynaTrace). But mobile app performance is not mature to have end-to-end or front-end monitoring yet. Most performance areas in mobile app are focused on memory management (due to the footprint).
User provisioning, mobile component merging, re-use and upgrade are unique device management issues for build/deployment/support, and not prominant in application lifecycle management.

PROTOTYPING
Prototypes (and pictures) speak stronger than words. Many product managers, XD developers or architects like to build a quick prototype to show a strawman of the next release. Ideally, they would like a prototyping tool that can render both iOS, Android and Blackberry platform. This could be a HTML 5 application that uploads hand-drawn pictures of the prototype, or a native iPhone application that creates sequence of screen shots and UI object/layout.

If you embed api for each navigation flow (e.g. screen) to generate a test case, you can easily drive a test-driven development model by creating an artifact of the prototype, as well as a suite of test-driven api framework.

The prototyping lifecycle consists of:

Wireframe, e.g. a set of storyboard or navigation workflow of the application. http://iphoneized.com/2009/11/21-prototyping-mockup-wireframing-tools-iphone-app-development/ lists some prototyping tools, and http://mashable.com/2010/08/11/cross-platform-mobile-development-tools/ identifies 5 cross-platform mobile prototyping tools.
Test-driven api development, e.g. a list of REST web service that each navigation workflow will use
Test case management, e.g. a set of test cases (or user stories) that corresponds to the wireframe. Microfocus's SilkCentral Test Case Manager provides SOAP api to define test cases.

DESIGN / DEVELOPMENT

Apart from cross-platform mobile development tools (e.g. http://mashable.com/2010/08/11/cross-platform-mobile-development-tools/), mobile developers may opt to build native applications (e.g. Objective C using XCode for iPhone/iPad), or HTML5-based applications that can run across different platforms. However, HTML5 is still evolving, and there are lots of browser compatibility issues which could be barriers. As an alternative, you may use jQuery mobile framework (http://jquerymobile.com/) , or HTML5-friendly framework such as Sencha (http://www.sencha.com/).

One specific challenge during development stage is device detection. How do we know which device, and which resolution should be used. You can have lots of IF-THEN JavaScript in the HTML codes to handle different resolution or device types. However, there are some device types which cannot be easily detected without additional help. There are device detection tools which emit the device information in the header, and transmit back to the server, e.g. http://detectmobilebrowsers.mobi/ and http://mobiforge.com/developing/story/lightweight-device-detection-php.

Another challenge is which open source or third-party frameworks to use. You may have lots of internal mobile codes for re-use. If you're using third party frameworks or open source mobile projects, you need to make sure the licensing arrangement, and the logistics of how to incorporate them into your build process. Mobiforge and Google core-plot are examples.

Security is one important aspect that is ever changing. Although Apple appstore has rigid application submission process, this does not mean that iPhone applications are hacker-free. Flash-based Android codes could be exposed to Cross-site Flash attacks. Privacy is another security-related issue. Even Open security standard OAuth 1.0 has known vulnerabilities (http://blog.oauth.net/2009/04/22/acknowledgement-of-the-oauth-security-issue/). Misuse or poor implementation of OAuth and OpenID (for single sign-on) could lead to security issues.

Once you have these development challenges sorted out, you may want to make best use of marketing data and analytics. This is particularly important to know the user behavior or to get user feedback.

Under the design / development stages, the challenges are:

HTML 5 support and browser compatibility issues
Device detection approach
Use of mobile framework, third-party or open source components, e.g. http://mobiforge.com
Security and privacy issues, e.g. OAuth's session fixation issues
Use of marketing data for analytics and user feedback

TESTING

Mobile testing is an emerging area as testing tools are fragmented. Android platform has a built-in monkey testing framework, but iOS platform does not (note: not completely true. It has some limited automation capability using XCode and JavaScript). Automated unit testing tools such as FoneMonkey (http://www.gorillalogic.com/fonemonkey) for iPhone/iPad testing is emerging. How do we integrate with the SCM build process for iPhone/iPad pre-flight testing?

An ideal scenario would be: using self-service, you provision x number of MacOS VM instances, each will run a set of automated unit test (e.g. using FoneMonkey with XCode). The SCM build script administered by Hudson server will check out the source codes from your SCM system (e.g. Perforce), and inserts a few pre-flight tests using TestFlight (http://testflightapp.com/) and AppScanner (http://www.chimpstudios.com/appscanner/) to screen out any private api, chatty network service calls or privacy violation api. This will save lots of iterative repair efforts if rejected by Apple Appstore.

Using TestFlight or similar tools, you can also simplify the pre-flight and beta testing. You don't need to mess with certificates and beta code deployment to a large number of beta testers locally or globally. With cloud sourcing capability, you can invite your beta testers by email, and they can download the beta applications via a mouse click from the Web (in lieu of complicate certificate management logistics).

To realistically simulate real life user environment, you may opt to deploy and test on different devices. deviceAnywhere (http://www.deviceanywhere.com/) is a good tool to remote control, deploying and testing to different mobile devices. However, the automation scripting could take a learning curve, and the rental cost could be a barrier too. For global applications, you may want to simulate your network bandwidth during testing. Shunra has an interesting network bandwidth simulation appliance (http://www.shunra.com/ve-desktop-professional) though it's fairly expensive.

Sometimes, test environment issues could create noise to your test result. For example, network signal could be weak in your testing environment, which may not be a real network bandwidth problem. You may need to install network signal booster.

Scalability test is still maturing. There are lots of application performance monitoring and diagnostic tools (e.g. CA Wily Introscope, JProbe, OPNET Panorama) but they are more suitable for server-side. dynaTrace (http://www.dynatrace.com) can provide an end-to-end performance monitoring, debugging/trace and diagnostics from a web browser to the server back-end. However, you can benefit this if you use IE or Firefox browser on Windows, not on any mobile platform - you can still use a browser to diagnose a HTML application though.

There are performance monitoring challenges not yet resolved nicely. How could you generate a load to mimic mobile devices? You can probably use a network proxy or sniffing tool to capture network traffic generated from a mobile device, and then replicate them on a massive load. I have not found a good commercial or open source tool yet.

In a nutshell, mobile testing may include:

Automated unit test that can be integrated in your build (aka continuous integration). Ideally, you want to provision a VM instance, and then kicks off a series of unit tests and pre-flight tests (e.g. to detect private api, chatty network calls or security issues).
Device test, e.g. deviceAnywhere
Bandwidth simulation, e.g. Shunra
Pre-flight and beta testing, e.g. TestFlight for iOS
Handling test environment issues, e.g. use network signal booster for weak signals

BUILD / DEPLOYMENT

The last lifecycle stage is the build and deployment processes. This assumes a typical SCM build process that manages source codes, build (e.g. Maven) and deployment (e.g. what about code signing and submission to Apple AppStore?).

A few challenges may arise:

How do you push software updates to the mobile devices? and the frequency of updates. Apple AppStore is a specific instance where end-users are notified to download an update. However, enterprise applications that are not delivered via AppStore will face the challenge. What about component level update (instead of a big band update)? This will be complicate if your application has lots of third party or open source components that need updates too.
Device management, e.g. how to administer a large list of mobile devices centrally? how to reset id/password on devices, or to re-provision them? Distributed mobile device management vendors (e.g. http://www.mobileiron.com/solutions/mobile-device-management) are emerging using Cloud and Software as a Service.
Diagnostics and Customer Care, e.g. how to diagnose faulty mobile device remotely or centrally, how to manage customer support and post-sales for mobile products if the mobile device does not contain any footprint to upload diagnostic information remotely

Which Korean Film to Watch

2011-03-28T16:56:00.000-07:00

I heard so much good things about Korean movies and TV drama, and want to know which film I should watch. I couldn't find a good list from wikipedia. I accidentally found the link http://koreanfilm.org/.

For example, The Man from Nowhere is the top 2010 grossing film in South Korea. I got the blu ray movie from WalMart at US$10+. http://koreanfilm.org/kfilm10.html has a review.

What Happens When Your Security Guru Has Been Hacked

2011-03-25T14:12:00.000-07:00

I always trust security gurus such as RSA who are much smarter than me in security. Recently, I read about RSA being hacked (http://www.networkworld.com/news/2011/031811-rsa-hack-faq.html), and Mozilla acknowledges SSL certificate theft (http://www.computerworld.com/s/article/9215077/Mozilla_regrets_keeping_quiet_on_SSL_certificate_theft?source=CTWNLE_nlt_pm_2011-03-25).

There is no public evidence that RSA secrets were stolen, or your business data will be endangered due to the RSA token problem. US Department of Homeland Security has joined the investigation. However, the notion that even RSA is hacked is scarry. Just like BlackHat conference a few years back show that you can hack SSL certificate not by decryption but by injecting a malicious common name.

What happens if Web browsers such as Mozilla are compromised? All my credentials are being watched or captured indirectly by the hackers while their SSL certificates are compromised. Who can I trust? My security gurus, can I continue to trust you?

Earlier on, I was so embarassed by clicking a stalker watch link in facebook, which I believe a trusted friend is sharing a facebook tool that detects who's stalking you. Upon clicking the link, I was re-directed to user registration, which I suspect something's wrong. But it's too late. That suspicious stalker watch propagates the link using my identity to all my friends under facebook. I cannot even trust myself anymore.

iOS 4.2 / iPhone Programming Learning Experience

2011-03-25T11:28:00.000-07:00

Here're a few learning points while programming iOS 4.2 for the past 2 weeks:

TableView to show a disclosure button (button to show detail view)

From iOS 3, the implementation method is obsolete. My class textbook still uses the old one (textbook suggests adding the line "return UITableViewCellAccessoryDetailDisclosureButton" but XCode 4.2 suggests "return UITableViewCellAccessoryDetailDisclosureButton"), and XCode 4.2 gives a deprecation warning.

Resolution:

Remove the implementation method from your view controller:

- (UITableViewCellAccessoryType)tableView:(UITableView *)tableView accessoryTypeForRowWithIndexPath:(NSIndexPath *)indexPath {

    return UITableViewCellAccessoryDetailDisclosureButton;
    //return UITableViewCellAccessoryDisclosureIndicator;
}

Under the method cellForRowAtIndexPath of your view controller:

// handle accessory type for IOS 4
    cell.accessoryType = UITableViewCellAccessoryDisclosureIndicator;

How to show programmatic UI objects or a graph in your current view controller

Assume you cut-and-paste a graph demo or a few programmatic UI objects, and want to display in your current view controller. Your sample codes may use a navigation or tab view controller, which references the display in another xib screen. Thus, you won't see your desired screen after build/run.

Lesson learned: how to reference the UI object in your current view (self.view) by addSubview.

Symptom: runtime crash, no build error. system dump complains invalid selector in your view.

Existing:

(barChart is defined in the .h file as CPXYGraph *barChart;)

    barChart = [[CPXYGraph alloc] initWithFrame:CGRectZero];
    CPGraphHostingView *hostingView = (CPGraphHostingView *)self.view;
    hostingView.hostedGraph = barChart;

Resolution:
    CPGraphHostingView *hostingView = [[CPGraphHostingView alloc] initWithFrame:self.view.bounds];
    [self.view addSubview:hostingView];

* hide keyboard when done

By default, your data entry field (UITextField) will show a virtual keyboard but it won't hide or disappear when done (e.g. return, done). One easy way to hide the keyboard is:
1. connect your UITextField via Interface Builder first
2. add this method to hide the virtual keyboard

- (void)touchesEnded: (NSSet *)touches withEvent: (UIEvent *)event {
    for (UIView* view in self.view.subviews) {
        if ([view isKindOfClass:[UITextField class]])
            [view resignFirstResponder];
    }
}

Combining TabBarViewController, NavigationViewController and TableViewController

I want to create a tab bar view controller that has a few tabs (max 5 tabs allowed by Apple by default), one of which is a table view controller. This is one of my least understood item, and there are not good public materials with complete examples.

How it works? Your root (or top) view controller must be a tab bar view controller, not a navigation view controller (an important concept). Each tab can reference to a UIViewController, navigation view controller or even a table view controller. If your tab view controller directly points to a table view controller, then you won't be able to navigate to a detail view (without a navigation view controller - this is another important concept).

So in your tab view controller, each tab references to a UIViewController or NavigationViewController. In your navigation view controller, you attach a table view controller. In your table view controller, you can navigate to a detail view controller. What a layered approach. http://developer.apple.com/library/ios/#featuredarticles/ViewControllerPGforiPhoneOS/CombiningViewControllers/CombiningViewControllers.html explains very well with snippets of codes and Interface Builder instructions, but I don't fully understand how it works since I'm using XCode (iOS 4.2 SDK)'s tabbarviewcontroller template.

There are at least 2 approaches that I learn from ranch-iphone email alias:

For detail views from tab bar, I just present the detail view as a model controller. (ie: presentModal).
Put your table view controller under a navigation view controller, which is referenced by the tab view controller. Your table view controller can push the detail view to the tab bar controller. (This is the approach depicted above).

How do I do that using Interface Builder with tab bar view controller template?

Create a navigation view controller without xib
Create a table view controller.
Create a detail view (UI view controller)
From MainWindow.xib, drag a navigation view controller under the existing tab bar view controller. Update the class name to be your navigation view controller (from attribute window). But don't add or update the xib name yet.
From MainWindow.xib, drag a table view controller under the navigation view controller under the previous navigation view controller (which parent is tab bar view controller). Make sure you update the class name to reflect the table view controller class you created earlier (don't add or update the xib name yet).
From your table view controller .m file, push the detail view in the method didSelectRowAtIndexPath, something like:

    DetailViewController *detailViewController = [[DetailViewController alloc] initWithNibName:@"DetailViewController" bundle:[NSBundle mainBundle]];
    detailViewController.custFirstName = [currentCustomer firstName];
    detailViewController.myBalance = [currentCustomer balance];
    [self.navigationController pushViewController:detailViewController animated:YES];
    [detailViewController release];
    detailViewController = nil;

I previously misunderstand the view hierarchy concept, and attempt to add the navigation controller programmatically to the viewcontrollers array, something like (which is overly complicate):

MyNavViewController *navViewController = [[[MyNavViewController alloc] init] autorelease];
NSArray *viewControllers = [[self tabBarController] viewControllers];
[viewControllers insertObject:navViewController];
...

but i don't have a complete example how to add a table view controller to the navigation view controller, and the insertObject syntax does not work.

http://www.youtube.com/watch?v=LBnPfAtswgw (Elizabeth/O'Reilly Books) shows a good example but it uses XCode 3.x which you'll find some functions or Interface Builder behavior are changed in iOS 4.x.

Convert data between NSInteger, NSNumber, int, double

When I use core-plot library, the graphic function uses an array of NSNumber but not int or double. I try to debug by writing the numbers to NSLog but I often get the pointer address, not the data contents.

Example 1: the array dataSet contains a pointer to NSNumber. To print the data contents, you need to use "intValue" to return the integer value, and cast it to "int" for NSLog to print out.

NSNumber *foo1 = (NSNumber *)[dataSet objectAtIndex:j];
        NSLog(@"...dataSet[%d]=%d", i, (int)[foo1 intValue]);

Example 2: initialize a NSNumber with a NSInteger, you need to cast the data contents into NSInteger. Remember not to use a (NSInteger *).
        NSNumber *foo = [[[NSNumber alloc] autorelease] initWithInteger:(NSInteger)(random() % 600)];

Example 3: to add a double to NSDictionary which expects a NSNumber value. Use a NSNumber with a function "numberWithDouble" to convert a double x to NSNumber.

        NSDictionary *curSample = [NSDictionary
                                   dictionaryWithObjectsAndKeys:[NSNumber numberWithDouble:x],
                                   X_VAL,
                                   [NSNumber numberWithDouble:y1],
                                   Y_VAL, nil];

Array assignment and copy - don't release an array pointer unless it's a copy

Example:

NSMutableArray *tmpDataSet = [[NSMutableArray alloc] initWithCapacity:10];
NSNumber *foo2 = [[[NSNumber alloc] autorelease] initWithInteger:(NSInteger)(random() % 1200)];[tmpDataSet insertObject:foo2 atIndex:9];
dataSet = tmpDataSet; // this will crash at run time
//dataSet = [tmpDataSet copy];
[tmpDataSet release]; // don't release tmpDataSet unless dataSet is a mutable copy of tmpDataSet

I'd assume that once you "copy" tmpDataSet to dataSet, you can release the tmp data set tmpDataSet. No, in fact dataSet and tmpDataSet share the same pointer to the same data content. If tmpDataSet is released, so is the data content and the pointer address (which is also dataSet). To remediate the issue, you a=can make a mutable copy of tmpDataSet, and then you can release tmpDataSet without impacting dataSet.
During execution

Defect Density - Knowing the Health of Your System

2011-03-25T08:00:00.000-07:00

How do you know if your software has more bugs than other competitors?
In quality engineering, there's a metric called defect density which measures the number of bugs per thousand line of codes. Say, if an accounting software has 1 million line of codes, and the security defects total 10,000, then the defect density for security is 10,000/1,000,000, which is 0.1%.

Is 0.1% within normal range of financial services software, or C++-based desktop application?

Take a look at the statistis published for defect density by domain or application type
http://docs.google.com/viewer?a=v&q=cache:kTZMTfPc8NwJ:www.softrel.com/Current%2520defect%2520density%2520statistics.pdf+defect+per+kloc+by+application+type+domain&hl=en&gl=us&pid=bl&srcid=ADGEESgu_mzQEgfrk0I0aZJN7715MdlI5TlzRckgjRvcZCGuXz599qI55Dp47dvHBTtAXCoC-0BIEGBWnihVFIAfq51VA595-DlmuVEImFhA3PaGil1yffg3YOL03tZu4f9vm6DrSHmD&sig=AHIEtbTD256BhbORoyGYItIkVb6mhBiHuw

Client-server or multi-tasking applications have a defect density around 0.4 in a 2007 survey. Applications related to monetary risks has 0.476. World class applications have 0.011 average.

If you are using static code analysis tools such as Fortify, Fortify has different severity levels (e.g. hot for priority 1 critical issues). The counting formula will be tricky since there are lots of false positives. In this case, you may want to count only the "Hot" or P1 items (ideally after the triage).

What Have I Found After Re-watching the Same Movie

2011-03-21T22:12:00.000-07:00

I often re-watch the same movie twice or more if I really like it, or I don't really remember what I saw before. Here're the movies that I watched more than once:

My Sassy Girl (Korean) - I love the twists, and the happy ending. It's so depressing and sad to watch it. I love to recall the details.
Love Concerto (Korean) - I don't fully understand the subtlety in the details, which motivates me to re-watch once after the other. It's one of my favorite movies when I'm depressed.

iOS Programming Learning Resources

2011-03-17T09:14:00.001-07:00

parsing json
http://www.xprogress.com/post-44-how-to-parse-json-files-on-iphone-in-objective-c-into-nsarray-and-nsdictionary/

http://www.iphonedevx.com/?p=56

Tab view icons
http://blog.twg.ca/2009/09/free-iphone-toolbar-icons/

Tsunami and Nuclear Disaster in Japan

2011-03-17T07:57:00.000-07:00

March 11 marked the 9.0 quake caused by Tsunami, and the nuclear disaster in Japan. My heart is very heavy every day when I heard stories about the cooling efforts for nuclear reactors are getting out of control.

Pray that the nuclear disaster will soon get controlled and the damage is limited.

First iPhone Program - is it that easy?

2011-03-14T09:06:00.000-07:00

I took an iPhone class 3 weeks ago and determined to write my first iPhone program without help. I want to be able to write iPhone program without copying codes from the textbook. That's not easy. My instructor spent 3 months learning the basics.

In my first iPhone program, I'd like to create a simple form where I can click a button, stretch a slider which will show a numeric value in a separate data field. This is better than just printing a hello world.

Using Xcode 4.2, I've at least 2 ways to create my first iPhone program:
1. Window program

Create a new window program. XCode will generate a delegate. You can create your form in the default MainWindow with the button and slider controls.
Window program is simpler to create because you just need to define your UI controls in the only form MainWindow.xib, and your business logic in the delegate.m. You don't need to worry about how to create a UIView, or differentiate which is a view controller or delegate.
The trick is that you need to connect the UISlider value change event (not the Touch Up Inside event) to the UISlider control.
In your delegate implementation, customize your IBAction event for the UISlider with the return type UISlider, not id, e.g. (IBAction) sliderValueChanged:(UISlider *)sender, not (id)sender.

2. UIViewController

Create a view controller (view-based app, not window app). This will create a new view controller (not UIView) and the associated (new) xib on top of the existing set of delegate, MainWindow.xib. It sets the view controller to root view controller.
However, you need to connect the MainWindow.xib to the new view controller xib so that Xcode knows the root view controller (default screen) is the new view controller xib. Otherwise, you'll see a blank page. I find that many textbooks assume you understand that process well (i.e. you need to connect the IBOutlet, UI controls to the relevant file owner in the Interface Builder), and I can't find much instruction.
Similar to the previous approach, you define your button and slider in the new view controller xib, and the business logic in the view controller .m file.
Some textbooks won't use this approach, as a view controller could be too complex for the first iPhone program.

Deep Dive - Understanding the First iPhone Program

View Controller

Once you create a new ViewController from XCode, you'll see the basic template of XXXAppDelegate and MainWindow, in addition to new XXXViewController files (XXX is the program name you created).
The didFinishLaunchingWithOptions in the XXXAppDelegate.m contains instructions which to initialize or load once the program is started. By default, it will add your view controller as a subview, e.g. [window addSubview:viewController.view];. You may want to check the Window object shows Outlet connection from rootViewController to your XXXViewController. From Interface Builder, select MainWindow.xib and click control over the Window object (under Objects). You should see the connection (if not, you can create the connection here).
Edit the XXXViewController.h, add the instance variables. You can add the UI controls with IBOutlet statement (which allows you to connect them from the Interface Builder with the UI objects in the xib / UI form) and the property statements. The property statement denotes setter/getter for the UI control.

Example:

This program will show a button and a slider on the screen with the form XXXViewController.xib. You need to connect the IOOutlet and IBAction with the UI controls of the xib in the Interface Builder:

Click control key over the File Owner item of the file XXXViewController.xib
Outlets: connect myTextField and mySlider IBOutlets with the screen objects
Received actions: connect the IBAction methods with the actual actions you desire (button changed, touch up inside).
Verify your root view controller is connected to your XXXViewController: click control key over the item XXX App Delegate in the file MainWindow.xib. Make sure the viewController from the Outlet is connected to the XXXViewController, and the window too. (I find this item is not explained well in textbooks).

XXXViewController.h:

#import 

@interface XXXViewController : UIViewController {
    IBOutlet UISlider *mySlider;
    IBOutlet UITextField *myTextField;
}

@property (nonatomic, retain) IBOutlet UISlider *mySlider;
@property (nonatomic, retain) IBOutlet UITextField *myTextField;

- (IBAction) sliderValueChanged:(id)sender;
- (IBAction) changeButtonPressed:(id)sender;

@end

XXXViewController.m:

#import "XXXViewController.h"

@implementation XXXViewController

@synthesize mySlider, myTextField;

- (IBAction) sliderValueChanged:(UISlider *)sender {
    myTextField.text = [NSString stringWithFormat:@" %.1f", [sender value]];
}

- (IBAction) changeButtonPressed:(id)sender {
    ...
}

- (void)dealloc
{
    [mySlider release];
    [myTextField release];
    [super dealloc];
}

You also edit the attribute of mySlider object for min=0, max=100.

Is iPhone Programming Really Easy?
I heard stories of 13 years old genius writing games for AppStore that sells over 1M copies. But I don't think iPhone programming is easy to start with. The Objective C notation is odd, and it takes time to be familiar with.

I can understand the interface and implementation portions fairly easily, and also the property / synthesize (it's aka setter/getter). But I find the process of connecting objects using the Interface Builder not very intuitive - you need to know which object to connect with (e.g. file owner), which is hard for me.

Once you get over the initial learning curve, I was told that iPhone programming is easy because the UI framework is very tight and simple. Sometimes, limited choice and rigid structure makes implementation simple, and development fast. I'll verify that in my next programming exercises.

Resource
How to use UISlider
http://www.xprogress.com/post-35-uislider-tutorial-example-how-to-use-slider-in-iphone-sdk-xcode/

How to use UISwitch
http://www.xprogress.com/post-30-uiswitch-tutorial-example-how-to-use-the-switch-in-xcode-for-iphone-sample-included/

Flex 4 - I'm Back

2011-03-07T10:11:00.000-08:00

For some reasons, I'm back to Flex. A few years back, I got on board with Flex 2. Now Flex 4 has a number of changes (e.g. Spark control replacing the old mx).

My New Learning Experience in Flex 4

I write a RSS feed reader that shows the list of news items, summary and also opens a new window of contents. I can't embed the web page contents as I can't find a UI control that can render HTML page content.
I mimic a menu navigation workflow based on Quickbooks Connected Service (Web Access, which is the Flex version).

Observation

HTTP Service binding to Data Grid. I like the drag-and-drop binding to connect a HTTP service (e.g. RSS feed, REST api) to a data grid. However, it generates the intermediary codes that I can't customize to parameterize the URI. I end up writing the HTTP service from scratch, which is even simplier.
From Spark (Flex 4) to Halo (Flex 3). Flex 4 rewrites the UI control layer with spark components. Not all Flex 3 components have a replacement. I don't seem to get rid of all mx (Halo) controls such as ViewStack (for navigating pages).
Page navigation. One learning barrier is that Flex does not navigate between Web pages like typical HTML page. It uses viewstacks and states. Viewstack acts like a view controller with each mxml as a view. You can also create tabs for page navigation, with UI controls stored in states.

Things to Try Out, if I have time...

Page navigation control in data grid. This could be tricky for large volume result set (data provider), which the UI programming side seems to be easy. A variation will be fetch 25 rows at a time (which needs lots of time to customize)
Add / Change / Delete rows in data grid. This is not off-the-shelf.
Complete end-to-end program with database CRUD Web service. Lots of back-end work and database setup.
Processing JSON instead of XML in HTTPService.

Resources

http://sujitreddyg.wordpress.com/2009/10/06/building-flex-application-for-lcds-data-management-services-using-flash-builder-4/

http://www.javabeat.net/articles/253-invoking-soap-and-restful-web-services-using-flex-40-1.html

What's new in Flex 4
http://www.adobe.com/devnet/flex/articles/flex3and4_differences.html

Security Vulnerability Cost - $1 trillion globally per year (2010)

2011-03-01T18:34:00.000-08:00

According to Britain's Office of Cyber Security and Information Assurance, cyber crime costs UK $43.5 billion per year, and $1 trillion globally per year.

Source:
http://news.yahoo.com/s/nm/20110217/tc_nm/us_britain_security_cyber

Max Number of Schema per Database Instances

2011-03-01T18:31:00.000-08:00

Many cloud service providers host business data for numerous small (and large) companies. As startup, they just clone an existing customer schema and deploy, though they want to multi-tenancy is the ultimate goal.

Most database has a cap on the number of schemas (or databases) per database instance. Each schema consists of multiple tables. My DBA colleague reports 32,000 schemas on Oracle 10g running on a high end server (though the official pitch is "depending on hardware and storage"). I couldn't find a solid cap number for MySQL.

Sample scenario: I can host 32,000 companies on a single Oracle database instance in my cloud hosting website, even though I may run 3 Apache Web servers and 2 Tomcat servers (say, this configuration may be able to support 240 concurrent transaction users, or 2,000 simultaneous user logging in, or 24,000 SQL read requests per sec [these numbers are fictitious, as we know the throughput is dependent on the application design and infrastructure configuration]). However, if I need to host 32,001 companies, I need to host 2 database instances, assuming my application business logic knows which database instance to fetch data.

Movies Watched in 2011 Q1

2011-02-20T23:34:00.000-08:00

I stocked up a number of blu-ray movies purchased at discounts last Thanksgiving. I usually watch 2 to 3 movies every week:

Fantastic Mr. Fox - The plot is crooked (farmers are evil, thieves are protagonists), and the vocal artists are obviously good actors but not necessarily good vocal artists. After watching the Making of video, I begin to appreciate that's quite an impressive movie that is based on a children's novel. Good for family.
Green Zone - A war theme framed with the fictitious destructive weapon in Iraq. I'm never a fan of war or political thriller movie. I would have thought it's another Bourne sequel. What a good surprise.
Get Smart - It's a double dose of comedy comparable to Mr Bean. Hilarious and fun. I find my favorite quote that why your boss does not promote you.
Legion - A distortion of the popular fallen angel theme where Gabriel is the bad guy. Not too bad for a plot twist for a $5 movie.
Constantine - Another distortion of the popular fallen angel theme for a $5 movie.
Body of Lies - I don't usually like Dicapio and Crowe. After watching this movie, I continue to dislike Crowe, but I begin to appreciate Dicapio's acting skills.
Dances with Wolves - it takes lots of patience to watch a 4-hour movie. With today's filming practice, the pace of the movie with almost no action will probably drive people away.
Swordfish - Another neurotic and crazy movie from John Trovata that you won't forget.
Firewall - You won't believe a VP Security from a big conservative bank can code these days, and can make a scanner with an iPod touch.
Expendables - Stallone has the talent to bring in every action star you can remember, and tell a story that is profitable.
Apocalypse Now - If you read the book Heart of Darkness, and can't sleep due to the nightmare it creates, don't watch this film.
Inception - Don't try to watch or understand this film from streaming or video on demand. I watched it via Amazon video streaming. After watching the blu-ray movie, I feel like it's a new movie. I need loseless HD audio and subtitle.
Salt - Good plot twist about who's the actual spy. It's a smart choice to choose a heroine instead of casting Tom Cruise.
Journey to the center of earth - I did not read the original story book. My son told me twice that he won't watch it ('cos it's for kids?) but he ended up watching with me. This is certainly entertaining for family.
Inkheart - it's quite charming for a family movie. The plot (find my wife) is perhaps too simple but it's pleasant.
Avatar - the extended edition adds a contextual introduction. The visual effect is awesome even for a re-watch.
The Bank Job - you find the worst elements in this British-made Hollywood film: sex, curse words, violence, etc (these seem to be Statham's formula). I did not find any spoiler or warning in the film review, and regret to watch it. I thought it's based on a true story. I'll avoid Statham's film in future.
Shoot'em Up - you won't miss any scenes in the film that the protagonist won't use his gun to shoot. You won't miss the plot even if you skip to the end.

Lost and Found - 2

2011-02-17T07:39:00.000-08:00

I lost my gift card yesterday at BestBuy store. The saleslady forgot to return it to me, and I got used to walking away from the purchase immediately without checking my gift card or credit card. I called the store's customer relationship, and they could re-issue me the gift card. Though the gift card has a small value(~$20), I am very pleased.

Earlier I lost the scarf my wife hand-knitted for me. I exhausted every means to find it without success. Finally, I found it in my company's "lost and found" section in an envelope. I was over-joyed.

I lost my faith many years ago since I went to college. The "enlightenment" of existentialism, modernism and de-constructionism had been destructive. But I found it again on my way to a chapel on Sunday. Sheera Maesterton (a very old Scottish lady who retired from years of overseas missions) called me, "are you a lost sheep?" Over the next 2 decades in my life, I still have faith in God despite numerous shaky periods, and despite that I don't fully understand the science of faith.

I wish all who lost their faith in their life journey could pause and ponder if they are a lost sheep. The "lost and found" experience is amazing, and could change your life again.

Splashy HTML5, CSS3 and jQuery Examples

2011-02-16T21:36:00.000-08:00

I want to create a User Interface in plain HTML or jQuery with visual impact.

These demos inspire me a lot:
http://www.noupe.com/jquery/50-amazing-jquery-examples-part1.html
http://www.1stwebdesigner.com/freebies/drag-drop-jquery-plugins/

http://www.smartclient.com

GWT, jQuery, PHP - Which is Easier for Startup UI Projects?

2011-02-15T00:08:00.000-08:00

GWT and jQuery share similar Ajax UI framework. For a startup who needs quick development and results, which is more suitable in terms of ease of use, rich functionality, and shorter learning curve?

http://forum.jquery.com/topic/jquery-vs-gwt has an excellent summary table of feature comparison.

Which Movies Would I Like to Watch or Buy in 2011

2011-02-13T16:20:00.000-08:00

To Watch

King's speech
Black Swan
Up in the air

To Buy

Star Wars set
Lord of the Rings extended edition
Deja Vu
Baraka
Tomb raider
Time traveler's wife
Star Trek

Fraud! My Credit Card was Stolen

2011-02-11T10:29:00.000-08:00

I was greedy to purchase amazon gift card $20 for $10 from Living Social via credit card. I got another similar deal of Barnes and Noble $20 gift card for $10 from Groupon. Today, my bank called me for fraud charges (ranging from small amount to a big ticket item).

A colleague told me there are fraud cases with Living Social. (I found one news article from http://www.businessinsider.com/was-livingsocials-big-deal-a-big-bust-2011-1).

Sigh. I felt very bad since this is the first fraud experience. Some social networking startups don't have the security quality to protect consumers.

Why I Like Watching the Same Movie Multiple Times

2011-02-09T22:56:00.000-08:00

I did not like watch the same movie more than once. My friend Winnie once told me despite the fact that she watched the movie Sleepless in Seattle so many times. Each time she watched, she burst into tears. Children tend to watch the same movie numerous times without being bored. My son watched Tom and Jerry cartoon at least 10 times. These're stunning to me.

I began to watch some movies a few times when I became extremely depressed. (I only have a few titles, fortunately, e.g. My Sassy Girl, Winter Sonata). The other occasion is after I invested into a blu ray movie, I tended to watch some good titles at least twice, probably because I did not remember those details, or because the action scenes are excellent.

My wife never likes to watch movies twice. She enjoys movies with a story you can't predict the development.

Which movies I may want more than once?

Inception: I couldn't follow which level of sleep. It's so confusing.
Gone with the Wind: it's too long (sometimes boring since the pace is slow) that I was never able to finish the entire movie in one go.
Planet Earth: I never remember where I stopped, and where I should resume. Most episodes are alike to me.

Concurrency Design - Deadlock Prevention for Real-time Trading App

2011-02-08T00:28:00.000-08:00

Multi-threading using "synchronized" is a mechanism in Java (or C#) to handle concurrency. With the keyword "synchronized", the block within (e.g. statement, instance) will be locked to prevent deadlock by protecting the owner. There are some design techniques that I recently learn for deadlock prevention:

Lock ordering - same lock order for each thread
Lock timeout - put a timeout on lock attempts
Deadlock detection - use a hashmap or graph to capture the state of a thread taking the lock
Database level deadlock prevention, e.g. should we do a commit after each transaction request?

Use Cases
If you are designing a trading system, hedge fund or real-time application

Excellent Articles
http://tutorials.jenkov.com/java-concurrency/deadlock-prevention.html
http://code.hammerpig.com/simple-multithreading-java.html

Why You're Not Promoted

2011-02-04T18:48:00.000-08:00

From the movie "Get Smart", Steve Carrell is not promoted because:

Boss: I'm afraid I can't promote you
Employee: What?
Boss: I can't afford to give up my best analyst...(the in-depth analysis) go way beyond raw data.
Employee: so to be clear, you're not promoting me because I do such a great job.
...
Boss: I'm very proud of you. I need where you are

High 4

2011-02-02T09:42:00.000-08:00

Upon completing a critical milestone (a hellish project!), employees (distributed teams) greeted each other with high 5 via Instant Messaging. However, an employee only wanted to say "High 4." Manager asks him why. He replied that he would save one finger later with his "High 4" - his middle finger.

PS. Sorry for those who don't have the "culture background" about high 5 or middle finger.

Cheatsheet for Work

2011-02-02T09:37:00.001-08:00

http://www.java2s.com/Code/Oracle/SQLPlus/Timecommand.htm
or select your topics under http://www.java2s.com/

SQL: Use of NVL is Evil

2011-02-02T08:50:00.001-08:00

I'm practicing SQL fundamentals for my Oracle OCA examination, and learn from my colleague about NVL:

(Accidentally, we stumbled upon the fact that NVL does *not* allow short-circuiting. i.e., NVL an IF loop that just goes on processing every ELSE irrespective of the fact first IF matched. Just by removing this from our WHERE clauses got us almost 3x boost over large data set).

Since NVL is ANSI-SQL, it holds irrespective of the database you would use. So, while this is safe to use in SELECT, it’s dangerous to use in WHERE clause, particularly for large tables.

CASE is the new entrant in ANSI-SQL, and is the safest bet!

Proof –

Create a function that just sleeps 1 sec, and return 1
Run “NVL(1, Sleep_one_sec)” 1000 times
Compare the time with CASE. NVL executes the “else” part irrespective of value; CASE does not.

create or replace function one_sec_sleep return number as

begin

dbms_lock.sleep(1);

return 1;

end;

-- use NVL

declare

t number;

begin

for i in 1..20 loop

select nvl(1,one_sec_sleep) into t from dual;

end loop;

end;

Elapsed: 00:00:20.03

-- use CASE
declare

t number;

begin

for i in 1..20 loop

select (case when 1 is null then one_sec_sleep else 1 end) into t from dual;

end loop;

end;

Elapsed: 00:00:00.00

Troubleshooting My SMTP Server

2011-01-31T15:40:00.000-08:00

I switched to AT&T from Comcast for Internet access not by my choice due to expired promotion offer. My SMTP email server stops to work, and I can't send outgoing emails. Merde.

I studied Synology forum for troubleshooting hints without lucks:

1. Enable logging
%vi /volume1/@appstore/MailStation/roundcubemail/config/main.inc.php
edit:
$rcmail_config['imap_debug'] = true;
$rcmail_config['smtp_debug'] = true;

refresh server config (just in case)
%/usr/syno/mailstation/sbin/postfix reload

2. enable authorized smtp relay
(proved to be irrelevant, though the symptom is Relay Access Denied while doing HELO commands directly after telnet 25)

(Extracted from http://forum.synology.com/enu/viewtopic.php?f=132&t=22826#p93285)

I added this to the main.cf located /usr/syno/mailstation/etc

smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/usr/syno/mailstation/etc/sasl_passwd
smtp_sasl_security_options =

Then I created a password file here /usr/syno/mailstation/etc/

cat > sasl_passwd
asmtp.mail.dk username@yousee.dk:mypassword

Pressed Ctrl+D to save the file.

Then I created a DB file by entering the following command (I was in this directory /usr/syno/mailstation/etc/)
../sbin/postmap sasl_passwd

Then I reloaded the postfix settings by entering the following command

../sbin/postfix reload

3. Check for any error messages in email

Without Logging:
Check the contents under /var/logs/messages and
each file under /volume1/@appstore/MailStation/postfix/defer

With Logging:
Under /volume1/@appstore/MailStation/roundcubemail/logs, check for the file 'errors', etc.

Source
http://forum.synology.com/enu/viewtopic.php?f=132&t=23638
http://forum.synology.com/enu/viewtopic.php?f=132&t=22826#p93285
http://forum.synology.com/enu/viewtopic.php?f=132&t=20364

$50 Gift Card

2011-01-28T23:08:00.000-08:00

A friend sent me a restaurant gift card in return of a favor of $16.7. My wife noted the gift card has a label of $50 value, and thought we can have a nice dinner in the weekend. The waiter presented a bill of $57++. My wife intended to leave the gift card with another $10 note, but I thought I would use a credit card instead of the cash. The waiter came back with a bill after deducting the gift card balance $16.09...

10 Security Companies to Watch in 2011

2011-01-28T13:57:00.000-08:00

CRN identifies 10 emerging security companies to watch:

Avenda - vpn and wireless
CipherTex - data security for virtualization
CipherArk - vaulting data
Delfigo - multi-factor DSGateway
Logrhytm - log analysis
Palo Alto networks - re-invent firewall
Syferlock - invest a unique single password for SSO
Tufin Technologies - integrated security lifecycle management
Xceedium - extend access to third parties
Zscaler - security policies via cloud

http://www.crn.com/slide-shows/security/229100204/2011-need-to-know-emerging-security-vendors.htm?pgno=1

切了幾片芒果

2011-01-28T08:38:00.000-08:00

愛情是一個執着. 也是一個期望。
但是它是雙向的.
比如說：
你切了幾片芒果給愛人，但是她卻愛吃樀子。
生果人不明白為何她不愛芒果，（這不是很簡單嗎？）
這豈不是一個執着嗎？

Midlife Crisis

2011-01-24T22:40:00.000-08:00

My wife told me she's experiencing a midlife crisis.

From reading more about midlife crisis on the Internet, I realize men and women respond quite differently to our midlife crisis. I have series of reflection on what I want to achieve in life. I regress in many ways without noticing them.

How do others react to their midlife crisis? Some lose their faith, and some become believers. That reminds me of the Beatles' Imagine and existentialism - I find it very sad. Some underwent a big life change, which could be very shocking to the family, e.g. Wikipedia cites a story about a woman left her husband and children after her mother died. Years later, she was found to be a helper among orphans and homeless after her enlightenment.

Digitize my Music

2011-01-24T08:55:00.000-08:00

I'm so pleased to complete another home project. It took me 2-3 weeks to extract all my music cd collections into .mp3, and archive them in my network storage. My wife suggests Airport Express, which I can stream music from iPad (or iPhone) which is connected wirelessly with my hi fi receiver. That's very convenient for home consumption.

I roughly have 800 CDs with a total of 7,000 songs.

Web of Startup Companies

2011-01-11T09:44:00.000-08:00

You can start your journey to discover which startup companies are in your neighborhood
http://www.startuply.com/

then ask yourself, which company would I be interested in.

Oracle: How to Find High Watermark

2011-01-07T11:12:00.000-08:00

Your Oracle table has lots of delete and load activities. Even if your table is empty, you find the SQL execution very slow - a forced full table scan is noted from your Oracle trace. However, if you truncate your table, and re-execute your SQL, you don't see such slowness. This may be due to a high watermark is set on your table.

Remark - this is NOT an obvious symptom during performance troubleshooting or diagnosis

Rationale - an internal watermark (~internal row counter) is set for your table for your delete and load activities.

How to find your high water

Example: HR.JOBS is a table from the demo table if you install Oracle 11g where HR is the owner and JOBS is the table name

High Watermark = Total blocks - Unused blocks - 1
= 8 - 3 - 1
= 4 blocks

SQL> select blocks from dba_segments where owner=upper('HR') and segment_name = upper('JOBS');

    BLOCKS
----------
   8

SQL> analyze table hr.jobs estimate statistics;

Table analyzed.

SQL> select empty_blocks from dba_tables where owner=upper('HR') and table_name = upper('jobs');

EMPTY_BLOCKS
------------
       3

How to trace an Oracle session

2011-01-07T10:53:00.000-08:00

I want to trace an Oracle sql execution. Oracle AWR report gives me a snapshot but won't give me the details for specific SQL (AWR report shows top x SQL only).

Approach
1. turn on trace
2. execute your sql
3. use tkprof utility to format the trace details into a readable format

What most blogs or wiki does not explain clearly is what or which trace file .trc you should specify in the tkprof command.

Details
1. Turn on trace

% sqlplus / as sysdba
SQL>alter session set sql_trace=true

Remark - you can also enable trace by "alter system trace_enabled=true"

2. Execute your SQL

Please note that the trace details will be captured under your session id.

3. Use tkprof to format trace output, e.g. "tkprof xxx.trc myoutput.txt"

If you don't know where the file location for user_dump_dest (where the trace files are stored), you can use the following SQL command. The user_dump_dest file location is usually defined in the init.ora config file, and by default, it's under $ORACLE_HOME/diag/rdbms/sid/trace.
The session trace file (from previous step) is usually the last .trc file under the user_dump_dest directory. However, if you system keeps on generating .trc, the last .trc file may not be the right file. Here's a simple way to find out the right trace file for the session.

select s.sid, s.serial#, pa.value || '/' || LOWER(SYS_CONTEXT('userenv','instance_name')) || '_ora_' || p.spid || '.trc' AS trace_file FROM v$session s, v$process p, v$parameter pa WHERE pa.name = 'user_dump_dest' AND s.paddr = p.addr AND s.audsid = SYS_CONTEXT('USERENV', 'SESSIONID');

Exit the sqlplus, and invoke this command from a shell:

%tkprof orcl_ora_30488.trc mytraceoutput.txt

Remark

To make the format readable, before you execute any SQL, you can run these commands:

set linesize 100

column trace_file format a60

You can also specify the output format from tkprof too, e.g.

TKPROF ora53269.trc ora53269.prf SORT = (PRSDSK, EXEDSK, FCHDSK) PRINT = 10

TKPROF dlsun12_jane_fg_sqlplus_007.trc OUTPUTA.PRF
EXPLAIN=scott/tiger TABLE=scott.temp_plan_table_a INSERT=STOREA.SQL SYS=NO
SORT=(EXECPU,FCHCPU)

VirginMiles: Motivating Myself to Walk More

2011-01-06T09:37:00.000-08:00

My company motivates employees to walk more (using a pedometer) for better health. VirginMiles program manages this program with incentives up to $300 per year, if you walk more I'd guess.

Upon self-registration, the program asks me to enter a motto (e.g. don't give it up). I entered:

Get me $300 Faster

Weird Job Interview Questions in 2010

2011-01-04T11:14:00.000-08:00

http://www.eweek.com/c/a/IT-Management/Google-Facebook-IBM-and-Others-Weird-Job-Interview-Questions-in-2010-612784/?kc=EWKNLCSM01042011STR1

"How many basketball[s] can you fit in this room?"
- Asked for a people analyst position at Google

"Given the numbers 1 to 1,000, what is the minimum number of guesses needed to find a specific number if you are given the hint 'higher' or 'lower' for each guess you make."
- Asked for a software engineer position at Facebook

"If you had 5,623 participants in a tournament, how many games would need to be played to determine the winner?"
- Asked for a manager position at Amazon.com

"If you were shrunk to the size of a pencil and put in a blender, how would you get out?"
- Asked for an analyst position at Goldman Sachs

"How many ridges [are there] around a quarter?"
- Asked for a project analyst position at Deloitte

"Rate yourself on a scale of 1 to 10 how weird you are."
- Asked for an operations analyst position at Capital One

"If you could be any superhero, who would it be?"
- Asked for a customer sales representative position at AT&T

"There are three boxes, one contains only apples, one contains only oranges, and one contains both apples and oranges. The boxes have been incorrectly labeled such that no label identifies the actual contents of the box it labels. Opening just one box, and without looking in the box, you take out one piece of fruit. By looking at the fruit, how can you immediately label all of the boxes correctly?"
- Asked for a software QA engineer position at Apple

"How do you weigh an elephant without using a weigh machine?"
- Asked for a software engineer position at IBM

"You have 8 pennies, 7 weigh the same, one weighs less. You also have a judge's scale. Find the one that weighs less in less than 3 steps."
- Asked for a systems validation engineer position at Intel

"A train leaves San Antonio for [Houston] at 60 mph. Another train leaves [Houston] for San Antonio at 80 mph. [Houston] and San Antonio are 300 miles apart. If a bird leaves San Antonio at 100 mph, and turns around and flies back once it reaches the [Houston] train, and continues to fly between the two, how far will it have flown when they collide?"
- Asked for a software engineer position at USAA

"Out of 25 horses, pick the fastest 3 horses. In each race, only 5 horses can run at the same time. What is the minimum number of races required?"
- Asked for a software developer position at Bloomberg LP Financial

Glassdoor also publishes 25 interview questions:
http://www.glassdoor.com/blog/top-25-oddball-interview-questions-2010/?utm_source=newsletter&utm_medium=email&utm_content=news-jan11u-top25&utm_campaign=news-jan11u

1. “If you were shrunk to the size of a pencil and put in a blender, how would you get out?” – view answers
Asked at Goldman Sachs. More Goldman Sachs interview questions.

2. “How many ridges [are there] around a quarter?” – view answers
Asked at Deloitte. More Deloitte interview questions.

3. “What is the philosophy of Martial Arts?” – view answers
Asked at Aflac. More Aflac interview questions.

4. “Explain [to] me what has happened in this country during the last 10 years.” – view answers
Asked at Boston Consulting. More Boston Consulting interview questions.

5. “Rate yourself on a scale of 1 to 10 how weird you are.” – view answers
Asked at Capital One. More Capital One interview questions.

6. “How many basketball[s] can you fit in this room” – view answers
Asked at Google. More Google interview questions.

7. “Out of 25 horses, pick the fastest 3 horses. In each race, only 5 horses can run at the same time. What is the minimum number of races required?” – view answers
Asked at Bloomberg LP. More Bloomberg LP interview questions.

8. “If you could be any superhero, who would it be?” – view answers
Asked at AT&T. More AT&T interview questions.

9. “You have a birthday cake and have exactly 3 slices to cut it into 8 equal pieces. How do you do it?” – view answers
Asked at Blackrock. More Blackrock interview questions.

10. “Given the numbers 1 to 1000, what is the minimum numbers guesses needed to find a specific number if you are given the hint “higher” or “lower” for each guess you make.” – view answers
Asked at Facebook. More Facebook interview questions.

11. “If you had 5,623 participants in a tournament, how many games would need to be played to determine the winner?” – view answers
Asked at Amazon. More Amazon interview questions.

12. “An apple costs 20 cents, an orange costs 40 cents, and a grapefruit costs 60 cents, how much is a pear?” – view answers
Asked at Epic Systems. More Epic Systems interview questions.

13. “There are three boxes, one contains only apples, one contains only oranges, and one contains both apples and oranges. The boxes have been incorrectly labeled such that no label identifies the actual contents of the box it labels. Opening just one box, and without looking in the box, you take out one piece of fruit. By looking at the fruit, how can you immediately label all of the boxes correctly?” – view answers
Asked at Apple. More Apple interview questions.

14. “How many traffic lights in Manhattan?” – view answers
Asked at Argus Information & Advisory Services. More Argus Information & Advisory Services interview questions.

15. “You are in a dark room with no light. You need matching socks for your interview and you have 19 gray socks and 25 black socks. What are the chances you will get a matching pair? “ – view answers
Asked at Eze Castle. More Eze Castle interview questions.

16. “What do wood and alcohol have in common?” – view answers
Asked at Guardsmark. More Guardsmark interview questions.

17. “How do you weigh an elephant without using a weigh machine?” – view answers
Asked at IBM. More IBM interview questions.

18. “You have 8 pennies, 7 weight the same, one weighs less. You also have a judges scale. Find the one that weighs less in less than 3 steps.” – view answers
Asked at Intel. More Intel interview questions.

19. “Why do you think only a small percentage of the population makes over $150K?” – view answers
Asked at New York Life. More New York Life interview questions.

20. “You are in charge of 20 people, organize them to figure out how many bicycles were sold in your area last year.” – view answers
Asked at Schlumberger. More Schlumberger interview questions.

21. “How many bottles of beer are drank in the city over the week.” – view answers
Asked at The Nielsen Company. More The Nielsen Company interview questions.

22. “What’s the square root of 2000?” – view answers
Asked at UBS. More UBS interview questions.

23. “A train leaves San Antonio for Huston at 60mph. Another train leaves Huston for San Antonio at 80mph. Huston and San Antonio are 300 miles apart. If a bird leaves San Antonio at 100mph, and turns around and flies back once it reaches the Huston train, and continues to fly between the two, how far will it have flown when they collide.”- view answers
Asked at USAA. More USAA interview questions.

24. “How are M&M’s made?” – view answers
Asked at US Bank. More US Bank interview questions.

25. “What would you do if you just inherit a pizzeria from your uncle?” – view answers
Asked at Volkswagen. More Volkswagen interview questions.

Love Poem

2010-12-30T10:51:00.000-08:00

I think I would have been a very different loving person if I reached that maturity 2 decades ago. This poem is very reflective: http://www.azlovepoems.com/whatslove.shtml

Love is a thing shared by two
Love is what you feel for me and you
Love is precious when its shared
Love is danger when its dared

Love wanders and searches for the one
Love plays and just do it for fun
Love lets you hear love songs to emote
Love lets you make sweet poems & a quote

Love makes the world go around
Love makes us happy if the one we love
is finally found
Love turns the world upside down
Love cheers us never with a frown

Love makes you cry
Love sacrifices and says goodbye
Love has its own reason and time
Love can make someone you love "mine"

Love makes a person kiss
Love makes a person miss
Love is experienced by all
Love conquers when you fall.

Love can forgive if you repeat the same mistakes more than once. Love can make you feel being loved without explicitly telling. Love blossoms into creativity.
And love is a feeling too.