Related link: http://www.neward.net/ted/weblog?date=20021231

According to William Grosso, it’s customary for those with soapboxes to take to them at the end of the year and predict what’s coming for the coming year. He challenged those of us with OReilly weblogs to do so, and as those who know me know, I can’t resist a challenge like that. So off to the crystal ball we go.

Related link: http://onjava.com

Here are this year’s top five featured articles from ONJava.com:

5. Using Tomcat by James Goodwill

4. Learning Jakarta Struts by Sue Spielman

3. Jakarta Struts: Seven Lessons from the Trenches by Chuck Cavaness, Programming Jakarta Struts author

2. Top Ten Cool New Features of Java 2SE 1.4 by Java in a Nutshell, 4th Edition author David Flanagan

1. Ten Reasons We Need Java 3 by O’Reilly author Elliotte Rusty Harold

Happy New Year, everyone!!!

Vote for the best you saw on ONJava.com in 2002. What would you like to see in 2003?

Related link: http://www.infoworld.com/articles/hn/xml/02/12/23/021223hnmsjavaupdate.xml?s=IDG…

According to InfoWorld: “Microsoft must distribute Java technology from Sun in every copy of Windows and Internet Explorer that it ships.” Of course, InfoWorld and CRN report that Microsoft plans to appeal this injunction.

For the time being though, Sun’s stock price gets a much needed 6% boost in Nasdaq trading according to CNET. Given Sun’s woes of late, there has been speculation concerning Sun Microsystems and Dell. Specifically, Dell may be interested in acquiring Sun assuming Dell had the financial leverage, which becomes more difficult with this boost in Sun’s stock price. Anyway, Dell wants to expand its business into the server market.

What better way than to acquire Sun? However, what would happen to Java if this were to happen? That’s the multi-billion dollar question; isn’t it? Remember, Dell is currently a Microsoft shop; therefore, they’re likely to be a .NET shop as well.

What would happen to Java if Dell acquired Sun? That’s the multi-billion dollar question; isn’t it?

There are approximately 90 people with weblogs on oreillynet. The weblogs themselves span the gamut of technologies and interests. And it’s a great site, chock full of fascinating tidbits and useful information.

But where are the predictions? It’s a time-honored and venerable New Year’s tradition: everyone with a soapbox is supposed to stand up and say what’s going to happen in the New Year.

Which is why, next Wednesday, I’ll be posting my top five technology predictions for 2003.

I hope everyone with a weblog at oreillynet joins me in doing so. Together, we can make enough predictions that no-one will be able to
fact check all of us.

What am I going to say?

Related link: http://www.javaworld.com/javaworld/jw-11-2002/jw-1129-jsf.html

Here’s a first look at the new JavaServer Faces (JSF) written by David Geary and published by JavaWorld.

Related link: http://www2.theserverside.com/home/thread.jsp?thread_id=17163&article_count=10

From TheServerSide: “A computerwire article reports that ‘Microsoft Corp is believed to have trained its acquisition crosshairs on Macromedia Inc, lining up a deal that would throw enterprise Java into a spin.’ Macromedia has built its Flash and Coldufusion server platforms on top of J2EE which provides an entry point into the J2EE world for flash/coldfusion programmers. A Microsoft acquisition of Macromedia would inevitably see Flash, and Macromedia’s other cross-platform tools, tailored purely for Windows and .NET.”

This may be Microsoft’s best opportunity to truly enter the multimedia market for its Windows OS. As far as the enterprise aspect, such an acquisition could also be a play into the Java arena given a recent anti-trust court ruling requiring Microsoft to carry Java in Windows. Macromedia’s JRun J2EE container would be key in this instance; however, Microsoft is certainly not giving up on .NET.

Don’t forget about Microsoft’s potential interest in acquiring Borland as well. However, given that Borland is the only other significant Windows tools vendor, my take is that such an acquisition would eventually be blocked by the U.S. FTC. I guess we’ll see.

Happy Holidays!

What do you think of these potential acquisitions?

I’ve been looking at buying a home recently. It’s a good investment and interest rates are low. And I’ve always wanted to own my own place (and not be a renter).
There’s a problem, though. I learned a fair amount of economic theory as an undergraduate. Mostly “classical” economics, plus a fair amount of highly technical pricing economics (things like the capital asset pricing model).

A lot of what I learned there doesn’t seem to apply in the home market. Or, at least, it’s not obvious how to apply it. Home prices are dependent on an extraordinary number of factors, and it’s not clear that there’s enough of a “market” (in the sense of lots of almost-fungible goods or enough readily available information), to figure out what the right price for a house should be.

And so, since I’ve got a virus and am home sick today, I decided to read a basic economics text and get a through grounding in the basic logic of markets.

It’s a good book, but offers very little practical guidance for the home buyer (and, indeed, though this may be the virus speaking, Sowell sounds an awful lot like Dr. Pangloss at times).

Then I got even more confused. I gave up on thinking about houses and started thinking about software. Because all the pricing models I’ve ever learned about, including Sowell’s exposition, assume that there’s some fixed cost to producing the good, and some per-item (or marginal) cost.

And I’ve known for a long time that the per-item cost of software is pretty darn close to zero. But it never occured to me just how big a problem this is.

You see, Sowell devotes a huge amount of space to the argument that prices are signals. That is, every price is a indicator of the value of something. And the sum total of those indicators, those millions of individual signals, tells society how to allocate resources (though, there’s no “society”– it’s just each individual actor, acting individually, that determines how to maximize his or her revenue). The net effect is that a price-driven economy is a very effective way allocate scarce resources to the items and areas that society, as a whole, finds most valuable.

It’s sort of a moral argument for capitalism. And it makes a lot of sense when goods require resources to produce.

The question is: how does this work when the product is information? How well do markets and prices work when they’re not adjudicating competing claims to scarce resources?

And when I say “how well do they work,” what is it that they’re doing, anyway?

Teach me some economics! But please, no flames.

I’m currently working on a book about, among other things, software architecture for J2EE applications. A few days ago I sent off a rewritten draft of one of the chapters to my co-author, who sent it back with, among other comments, the observation that one of my diagrams was upside down.

One thing I’d mentioned in the chapter was that, in an ideal world, the various tiers in an enterprise application “look up to each other”. That is, the lower tiers are aware of the interfaces to the higher tiers, but the higher tiers don’t know about the lower tiers. This is a pretty well accepted design principle–there’s no need for an EJB (or whatever) to know anything about the servlet/Swing GUI/whatever that’s invoking it.

However, my explanation only works if you think about the business tier as the “top tier”. Which is what I’ve always done. When I’m visualizing an application I think about the presentation tier passing information requests “up” to the middle tier and the middle tier passing things “further up” to the database. Of course, the tiers get progressively more generic as you head away from the presentation layer towards the database. So it’s just as logical to draw the picture from the bottom up, with the presentation layer sitting on top of the middle tier, which sits on top of the database, and so forth. And this is, indeed, what a lot of people do.

Sun’s no help here. Their official picture goes left to right.

Seems like a trivial observation…but…I’d never overtly noticed the difference until I started explaining “looks up” to people. And since I’m trying to introduce people to the concept of tier separation in the first place, I want to do it in a way that is broadly intuitive to the largest possible audience. So, I’m going to do a little poll: do you put your business tier at the top of the picture, the bottom, or on the side? If you’ve got an opinion (or have ever thought about this at all), let me know below, or by email.

Top, bottom, left or right?

Related link: http://story.news.yahoo.com/news?tmpl=story&u=/ap/20021223/ap_on_hi_te/microsoft…

According to Associated Press: “Microsoft must include rival Sun Microsystem’s Java programming language in its Windows operating system, a federal judge ruled Monday, handing Sun a victory as it pursues its private antitrust case.” This injunction paves the way for more anti-trust rulings against Microsoft in the long-term.

What do you make of this injunction, in terms of both short-term and long-term effects?

Related link: http://news.com.com/2100-1001-978294.html?tag=lh

Wireless Java is here, but not hot to trot. The acceptance and application of wireless Java by developers is not as wide as anticipated for a number of reasons. This will, perhaps, continue for at least another year because of the following reasons:

As reported in this CNET News.com article, the release of MIDP 2.0 brings “the promise of simpler cell phone programming, richer games, more money for cell phone service providers and software that connects to Internet services. But some experts predict that memory requirements and cost will likely hamper adoption of the software, known as Mobile Information Device Platform (MIDP) 2.0.”

I think the other reasons include lack of Java development tools for wireless application development and a dwindling U.S. demand in sophisticated cell phones and cell phone applications during this economic downturn.

There’s no question that wireless Java is a powerful programming medium for cell phones and other wireless devices. It’s a question of “when”, not “if”.

Do you agree with my take that wireless Java is really a question of “when”, not “if”?

Related link: http://www.idg.net/ic_993328_6134_1-3523.html

In the wake of the recently announced release of the Java 2EE 1.4 beta, ComputerWorld’s Carol Sliwa interviews Sun Vice President Mark Bauhaus about his company’s latest efforts in the areas of Web services and Java. She also talks with Mark about the possibility that Java eventually might be turned over to the open-source community.

What do you think of Sun’s positioning on Web services and open source Java?

Related link: http://news.com.com/2100-1001-978445.html?tag=fd_top

According to Oracle, there isn’t in this CNET News.com story: “Oracle plan exposes Java rift.” Specifically, it’s a plan that calls for a Java Specification Request (JSR) 198 proposal which was submitted last month to the Java Community Process (JCP).

According to this article: “The proposal outlines a standardized way to merge Java programming tools from several companies into an integrated development environment (IDE), which would then allow access to all the tools through a single interface. Oracle intends to present a draft of the specification by March next year through the JCP. Java backers such as BEA Systems, Borland and IBM will contribute to suggested add-ons and incorporate approved updates to the specification to ensure it will work with their products. Oracle’s stated goal is to codify the mechanism for plugging together different Java programming applications. Once standardized, an application developer could use a single Java IDE and be sure that an application for testing Java code, for example, would work glitch-free with tools for program design and source-code control.”

Do you think Oracle’s plan has merit?

Related link: http://www.oreilly.com/catalog/javaebp/

Java developers typically go through four “stages” in mastering Java. In the first stage, they learn the language itself. In the second stage, they study the APIs. In the third stage, they become proficient in the environment. It is in the fourth stage –”the expert stage”– where things really get interesting, and Java Enterprise Best Practices is the tangible compendium of experience that developers need to breeze through this fourth and final stage of Enterprise Java mastery.

Crammed with tips and tricks, Java Enterprise Best Practices distills years of solid experience from eleven experts in the J2EE environment into a practical, to-the-point guide to J2EE.

Java Enterprise Best Practices gives developers the unvarnished, expert-tested advice that the manual pages don’t provide–what areas of the APIs should be used frequently (and which are better avoided); elegant solutions to problems you face that other developers have already discovered; what things you should always do, what things you should consider doing, and what things you should never do–even if the documentation says it’s ok.

Until Java Enterprise Best Practices, Java developers in the fourth stage of mastery relied on the advice of a loose-knit community of fellow developers, time-consuming online searches for examples or suggestions for the immediate problem they faced, and tedious trial-and-error. But Java has grown to include a huge number of APIs, classes, and methods. Now it is simply too large for even the most intrepid developer to know it all. The need for a written compendium of J2EE Best Practices has never been greater.

Java Enterprise Best Practices focuses on the Java 2 Enterprise Edition (J2EE) APIs. The J2EE APIs include such alphabet soup acronyms as EJB, JDBC, RMI, XML, and JMX. Java Enterprise Best Practices is a companion title to Java Best Practices, which covers the Java 2 Standard Edition (J2SE) APIs, such as Swing, the collections classes, performance tuning, and NIO.

As a Java developer myself, I would like to see more best practices books. I can envision a need for wireless Java and Java Web services best practices. In general, I see a need for Web services best practices as the need for Web services design patterns and more will become evident. What do you think?

What do you think of best practices books in general?

Related link: http://java.sun.com/products/jsp/

I’ve been working (again) on taking a project from HTML to JSP, and doing so reminds me (once again) how completely horrible JSP is.

JSP has this nice impulse to take Java code out of HTML pages and put it into JavaBeans or other Java classes, where it belongs, so the HTML author doesn’t need to know Java. Great, that’s great. Unfortunately, the “not Java” that is included in the HTML page is completely alien to (most) HTML authors, that it might as well just be Java for all they know or care. So I have to put <exec:iterator condition=”<%= shopBean.validate() %>”> right here, or nothing on the page will work? Yeah, okay. How do I test that again?

The result of this is simple and stupid: once again my UI engineers will be taking perfectly good HTML written in Dreamweaver and tearing it apart, throwing out some of it and rewriting other parts of it, just to make it work with the JSP they’re writing. Once they’re done, the HTML author will have absolutely no clue what the page does any more, and will have no desire or ability to edit it. When we insist that no really we need this redesigned, we’ll spend twice as long doing it (doubling our costs, negative ROI, bad technology choice, yadda yadda yadda) since the HTML author will need that long to write in sample data and then have the JSP author tear it out again.

This is completely stupid. It’s as if your compiler tore up your source code every time you compiled, and you had to go back and reverse engineer your source again in order to change the binary. Stupid! JSP is only an effective solution when the JSP author is also the HTML author.

I want something different. (Yeah, yeah, I know. HTML templating languages are one of the most over-implemented pieces of code ever. Every single Web design shop, tools vendor, large Web site operator, and two-bit commentator like me has their own stupid solution to the problem. I’m tilting at windmills. I’m wasting my breath. Whatever. The reason there have been so many solutions, and there continue to be so many solutions, is because the problem is still completely broken. It wastes my time and the time of the people I work with and I still want it to be better.) I want something that lets HTML people write and keep their source code in their favorite tools, adding dummy data and seeing how it looks, and lets them add hooks for the Java coders in a way they’ll easily understand.

This general problem — separating markup from other kinds of document information — was handled very well by Cascading Style Sheets (CSS), which separate document markup from stylistic presentation information by linking the HTML document to an external style document. CSS did this by adding very minimal changes to HTML itself — namely the “class” and “id” tag attributes — and putting almost everything in the stylesheet.

I think what’s needed instead of stupid JSP is exactly the same type of solution for separating code and HTML. Give me a “code” attribute that I can add to any HTML tag, and overload the “id” attribute. Have the value of the code attribute be an opaque string referring to a codesheet, linked to the HTML document by a a ‘<link type=”text/ccs” rel=”codesheet” href=”code.ccs”>’ tag. Have the codesheet use a CSS-style rules specification for indicating which Java (or whatever) class should consume tags with that code or id attribute. Then tell the HTMLer to add the “code” and “id” attributes to the right place in their existing documents, and they’re done.

What’s important about this is everything it doesn’t try to do:

• It doesn’t try to handle class or method namespace collisions in the HTML document — no need for clumsy and confusing XML prefixes. (Instead, namespaces are managed in the codesheet, centrally named for the whole site.)
• It doesn’t try to let the JSP taglib author create whatever kind of tag they want, confusing the hell out of the HTML author and the HTML author’s tools. (Instead, the tagset is defined by the HTML standard the HTMLer already knows.)
• It doesn’t require the HTML author to have a JSP environment in order to author their pages. (Instead, they can put in sample, dummy data to see how the page will look when the code is running, and the Java coder can discard that data on the code side.)
• It doesn’t bind the HTML document to any programming language or paradigm. (Instead, it keeps the author to HTML, and lets the codesheet swap out implementations without changing the HTML.)
• It doesn’t require the HTML author to learn anything new in order to move from a static site to a dynamic site. (Instead, they can use their familiarity with CSS to understand the transition.)

I know I’m glossing over a lot, but I think this is the right model. Has someone already done this? I’d love to see it, if so, that I might boot JSP out the window as it so richly deserves.

Related link: http://jboss.org/blue.pdf

It was very refreshing to read Marc’s BLUE paper, which basically discusses some of the history of JBoss, and EJB. You hear a lot of EJB bashing in the community, but it isn’t all bad! Many large projects are running well, fast, and scalable, using EJBs. Is it perfect? Do you have to use it in all applications? Do you have to use every type of EJB? Is every application server perfect? Of course not. It is also still progressing, and will further solidify and grow. Thanks Marc, for being possitive… and I look forward to RED

Related link: http://www.darpa.mil/iao/TIASystems.htm

Note: I originally wrote this in response to a thread on Politech about the Pentagon’s TIA program. I’ve made a few edits.

The criticism I would make of Total Information Awareness (TIA) and
the Department of Homeland Security (DHS) in general is that they are
agressively centralized solutions to an agressively decentralized
problem. I would feel better about our government’s efforts to fight
terrorism if I heard much more discussion of decentralized solutions,
and an economic and organizational plan that blended centralized and
decentralized approaches to the problems of terrorism. We need to talk about state and local solutions, not just Federal solutions.

The vast majority of discussion around government response to 9/11 has
framed the question as, “How can we change the Federal government to
prevent terrorist attacks?” The DHS is a Federal entity composed largely of
existing Federal entities. Its efforts, and likewise the Pentagon’s
TIA proposal, have (in public discussion at least) been described as
aiming to ensure information is shared between sources, analyzed at a
single desk, and acted upon by a central enforcement agency. In other
words, these efforts aim to centralize information about potential
terrorist acts.

Certainly these are approaches worth using. The INS sending Mohammed
Atta a letter to his Florida address months after 9/11 can only
provoke a wish for a better head on the shoulders of our national
bureaucracy. But do we really believe that terrorists — who
presumably have heard about the DHS — will act in the future in any
way that would trigger DHS or TIA attention?

We know these terrorists are determined and willing to spend enormous
time and resources preparing a plan. Terrorist groups, we’re told,
plant “sleeper cells” in our country years before an intended attack,
and these cells work strenuously to avoid detection or contact with
other cells. Assume that we go ahead with a TIA-type program, or even
just the DHS as planned, and that we are now able to monitor and
correlate border entries, large cash transfers, anomalous airline
ticket purchases, and whatever other data might alert a central
authority of terror plans. Does this really prevent terrorism? Do we
believe that no terrorist could ever enter the country without
creating a record, bring gold or drugs or something else to convert to
cash on the black market, buy a round-trip ticket rather than a
one-way ticket, and so forth? It seems obvious that even if
centralized data collection, analysis, and response help the problem,
they certainly do not solve the problem. A determined attacker — as
the 9/11 attackers certainly were — will do what it takes to avoid
TIA triggers.

Furthermore, is it really the best thing for the country for the FBI,
the CIA, and now the DHS to focus so intently on preventing terrorism
from Washington? I was taken aback to read in the November 21st New
York Times that

…the [FBI]’s commitment to nonterrorism cases that were once
staples of the bureau dropped significantly in the months after the
Sept. 11 attacks. The number of agents working narcotics cases
dropped 45 percent, bank fraud cases dropped 31 percent and bank
robbery investigations dropped 25 percent, according to the Justice
Department figures, even though the number of reported crimes in
some cases went up.

I can only wonder what has happened to the CIA in parallel. The FBI
existed for good reason prior to 9/11 — fought serious and difficult
crimes prior to 9/11 — and yet it is now being criticized roundly for
not dropping its earlier priorities more quickly and completely.
(Senator Charles Grassley of Iowa was quoted in the same article as
saying, “Old habits die hard at the FBI.”) We are debilitating the
prevention of crimes that not only still occur, but are increasing.
Who will take up fighting these crimes if not the FBI? Probably state
and local law enforcement.

Let’s look at that for a moment. Prior to the Millenium celebrations,
a truck filled with bomb-making equipment was stopped at a ferry
crossing in Port Angeles, Washington, and this probably prevented a
serious attack. While the person who stopped the truck was a Federal
employee (a Customs Inspector), the reason for the stop was not a
centralized database nor an alert from a centralized agency. Instead,
the driver was stopped because he seemed suspicious. An individual
acted on a hunch, investigated, and stopped an attack. We should
learn from this, and we’re not.

Rather than focusing exclusively on centralizing, we also need to concentrate resources on training local law enforcement officers
how to better spot and combat terrorism; that is, how to be more like
the Port Angeles Customs Inspector. Rather than sucking all possible
data sources into the Pentagon or the DHS, we could distribute
knowledge to the local — far more numerous — law enforcement
resouces who are far more likely to be able to prevent terrorism. How
do you interview someone seeking admission to the country, or to a
sports arena? What are the signs of lying that may be visible in
facial expressions or demeanor? What set of purchases might signal an
attempt to build a bomb? What are the little details a
carefully-trained eye might be able to piece into detection of a
terrorist? This is what I mean by a decentralized approach. Move the
effort to the more massive, more distributed, more intuitive body of
law enforcement coming into daily contact with the same terrorist
cells trying so hard to look normal. If sleeper cells lie dormant for
years, local police will very likely encounter at least one member of
the cell in that time. Don’t we want those police officers to know
what questions to ask that might detect the cell?

We could be taking this approach, but we’re not. We could be
improving the ability of local law enforcement to detect terrorism –
but instead we’re degrading that ability, since we’re shifting the
FBI’s traditional crime-fighting work onto local resources. The one
method that has actually prevented a terrorist attack on US soil is
not being used, and is instead being inhibited. We are focusing on
centralizing intelligence and resources when instead — or at least in
addition — we should be decomposing, distributing, decentralizing.

I’m not suggesting, obviously, that the Federal government has no
role, nor a minimal role. Watch lists and signals intelligence and
data warehousing almost certainly are key tools for fighting
terrorism. But before we go too far in creating (or trying to create)
a grand unified database of all electronic transactions, maybe we
should think first about whether this is a problem best solved by
brute force data analysis, or a smart cop on the street.

Related link: http://www2.theserverside.com/home/thread.jsp?thread_id=16917&article_count=19

Posted by Bernhard Meyer-Willner on TheServerSide:

“According to The Register JBoss has completed J2EE 1.4 support and could become the first appserver to be J2EE 1.4 certified.” To clarify, JBoss could become the first open source appserver or container to be certified.

“JBoss will not be a complete implementation of J2EE 1.4, though. The article quotes Marc Fleury saying that APIs for Web services were excluded because of a lack of demand. The APIs will be included should that change, he said.” Now, I find this somewhat surprising.

JBoss may be J2EE 1.4 Certified: True or false?

Related link: http://www2.theserverside.com/home/thread.jsp?thread_id=16863&article_count=4

John Flinchbaugh posted the following on TheServerSide:

“Open source Java is on the horizon following support for changes to a Sun Microsystems-backed industry body overseeing development of the platform and programming language. A new article on theregister.co.uk provides a light discussion of the JCP changges and their effect on J2EE 1.4 implementations.”

Do you believe this?

Related link: http://www.sdforum.org/p/calEvent.asp?CID=969

Ian Oeschger, one of the authors of Creating Applications with Mozilla, will be giving a talk on Mozilla as a Platform.

That’s Tuesday, December 10, in Mountain View (CA). I, for one, am looking forward to it.