www.somesite.com/unsubscribe/u/NSFAHPF/aW5aaW1pdHk

Ideally, you would want the user to click that (personalized) URL and the system should automatically unsubscribe, or perform any simple non-secure operations like registering for a poll. How would you then create a url that is unique to the user id, yet obfuscated enough to make it secure and personalized?

Here’s a Java utility class that will do encode a url and decode a url based on the java persistence id of the user. It’s based on Java’s inbuilt hash algorithm.

Of course, for a fine grain control over the URL generation, a Strategy interface could be used that can be passed to the PURLGenerator.

import java.net.URI;

public class PURLGenerator {

	// Maximum bits used by the value
	private static final int VALUE_BITS = Integer.SIZE - 1;

	// Maximum bits used by the encoded value
	private static final int ENCODED_BITS = Long.SIZE - 1;

	// Bits available for each encoding bucket
	private static final int BUCKET_BITS = ENCODED_BITS - VALUE_BITS;

	// Size of the encoding bucket
	private static final long BUCKET_SIZE = 1L << BUCKET_BITS;

	// Hash factor for encoding within the bucket
	private static final long BUCKET_HASH = (BUCKET_SIZE / 2) - 37;

	// Radix used for text encoding
	private static final int ENCODED_RADIX = 35;

	// Base URI
	private URI baseUri;

	public URI generateUri(Integer id) {
		if (id == null) {
			throw new NullPointerException();
		}

		if (id < 1) {
			throw new IllegalArgumentException("Id must be greater then zero");
		}

		// Find the base for the mapped encoding bucket
		final long valueBase = (id - 1) * BUCKET_SIZE;

		// Hash the value within the bucket
		final long valueHash = (id * BUCKET_HASH) % BUCKET_SIZE;

		// Generate the encoded value
		final long value = valueBase + valueHash;

		// Serialize encoded value as text
		final String code = Long.toString(value, ENCODED_RADIX);

		// Return the appended URI
		return this.baseUri.resolve(code);
	}

	public Integer parseUri(URI uri) {
		if (uri == null) {
			throw new NullPointerException();
		}

		if (!uri.getPath().startsWith(this.baseUri.getPath())) {
			throw new IllegalArgumentException("Invalid URI format: "
					+ uri);
		}

		// Get the serialized value
		final String code = uri.getPath().substring(
				this.baseUri.getPath().length());

		// Deserialize the encoded value
		final long value = Long.parseLong(code, ENCODED_RADIX);

		// Decode the id
		final int id = (int) ((value / BUCKET_SIZE) + 1);

		// Decode the id hash
		final long idHash = value % BUCKET_SIZE;

		// Validate the hash
		if (idHash != ((id * BUCKET_HASH) % BUCKET_SIZE)) {
			return null;
		}
		return id;
	}
}

CAPTCHA stands for: “Completely Automated Public Turing test to Tell Computers and Humans Apart”. It refers to a technology familiar to anyone who’s registered on a popular website – the “what word is shown on this image” challenge. As the “Turing test” alludes to, the purpose is to distinguish between humans and computers. Types of CAPTCHA:

* Photo/Image CAPTCHA
* Animated CAPTCHA
* Sound CAPTCHA
* Multiple choice questions
* Logic questions

CAPTCHA doesn’t prevent hackers or attackers to the site. It merely attempts to prevent bots and spammers.

How does CAPTCHA work?

CAPTCHA fools the bots by asking questions or generating pictures only human can answer. They contain distorted letters, different pictures with different letters in different shapes. After the user submits the answer CAPTCHA validate the answer. Since Bots cannot recognize each letter alone, this is a fairly difficult to break.

How to create CAPTCHA?
CAPTCHA can be written using any programming languages including Java. The code should provide three main functions. First, the code should generate a random picture with different properties. Second, validate the user answer. Third, make these pictures secure. Also, there are many things to make the code more reliable like” Rotate the text randomly, add random spaces in between characters, use a TTF fonts and change the font randomly every time, use a random text and image size every time, use more advanced text distortion and colors, move the lines randomly, store the password in a random cookie. In addition, there are CAPTCHA creator programs which allow users to choose their CAPTCHA shapes. Sophisticated libraries often provide extensions for developers to create their own algorithm for drawing images.
CAPTCHA benefits

* Preventing Comment Spam in Blogs.
* Protecting Website Registration.
* Protecting Email Addresses from Scrapers.
* Online Polls
* Search Engine Bots.
* Worms and Spam

Implementations of CAPTCHA
There are several implementations of CAPTCHA – commercial and open-source, in almost every programming language. The following are some Java based CAPTCHA frameworks
* reCaptcha (most popular, available as web-service)
* SimpleCaptcha (Java)
* JBoss Seam Captcha (for Java Seam based projects, works out of the box, can extend algorithm)
* jCaptcha (Java)
* Kaptcha (very simple java alternative to jCaptcha)
* … and many more

Problems
* When captchas get funky that humans with 20/20 vision start struggling; accessibility is far away
* Prone to common attacks
* The image challenge is inaccessible to visually impaired users. This problem is usually addressed by providing an alternative audio CAPTCHA for these users. However, many audio CAPTCHAs can be difficult to hear even to those with good hearing due to background noise and distorted pronunciation.
* Providing both image and audio CAPTCHAs is difficult to implement. ReCAPTCHA can simplify the process, but requires Javascript, and needs to be imbedded in your mark-up using iframes.
* Image CAPTCHAs are not infallible. A number of projects have shown that automatic character recognition software can often read the letters in the image.

Alternate Solutions
There are several alternatives to CAPTCHA. Most of them can be easily incorporated into an existing web framework:

• Dummy form elements

Dummy form elements can be added to trick bots into filling them and hiddeen those from users with CSS. Additionally, dummy elements should be named suggestively to fool the bots – for example, subject, name, URL. Then when form is submitted, system can check if any of these fields have been filled and if so you can isolate a “bot.”

• Session variable / GET request detection

This isn’t CAPTCHA alternative, but it can be used to filter out spam-bots. A variable is put in session when a GET request is made and when a form is submitted the system checks the session for that variable. This can filter out bots that submit request directly to POST without getting a page with the form. However this system can be easily fooled by creating a bot that acts like a web browser.

• Session variable with time computation

Similar to the above session idea where, time can be recorded when the form was loaded. On post, system calculates the time difference and if it’s less than say 5 seconds, it can be ignored as spam. However spam bots could easily adjust for this by building in a delay.

• 5 Layer Spam Filter

It uses some cunning techniques to identify bots without having to resort to CAPTCHA:

* Do fields hidden off-screen still get filled in
* Is the form filled in in seconds?
* Do they not have JavaScript enabled?
* Does Askimet mark it as spam
* Etc …

• Forced Visual cues

This is a simpler alternative. The webpage with a “yes” and a “no” radio button can make “no” the default and have the visitors state that they are not spammers by selecting “yes.”

• SAPTCHA (“Text based CAPTCHA)

SAPTCHA stands for Semi Automatic Public Turing Test to Tell Computers and Humans Apart.

The key concept is same as with CAPTCHA: user is presented with test question or instructions and must give correct answer to use resource. Main difference is that computer does not try to automatically generate “unique” test questions on each query; only verification of answer is automatic. Instead, unique test question and answer[s] is set by moderator or owner when SAPTCHA is installed, and should be easy to change if needed.
Comparison of SAPTCHA versus CAPTCHA features

Advantages of SAPTCHA over CAPTCHA:

1. SAPTCHA software is much easier to implement than CAPTCHA
2. Textual SAPTCHA does not discriminate against disabled who can use internet. [Audio CAPTCHA plus visual CAPTCHA would double effort and is thus very uncommon in practice]
3. There is methods for breaking image based CAPTCHAs. Even with popular CAPTCHA, the system may still get spammed by entirely automatic bot. SAPTCHAs can be much more varied and there won’t be common method of breaking until it becomes possible for computers to interpret human instructions in normal human language.

Advantages of CAPTCHA over SAPTCHA (disadvantages of SAPTCHA):

1. With SAPTCHA, when banning spammer, moderator must enter new question and answer. With CAPTCHA, though, there’s point 1 above (& CAPTCHA code won’t remain useful forever either), so for not extremely popular websites it seems highly unlikely that even in long run CAPTCHA would save work.
2. If SAPTCHA is used to protect registration, it is easier to register many accounts at once than with CAPTCHA; may matter with popular email services.
3. Verbal SAPTCHA is problematic when it is multi-language resource that needs frequent changes.

• Mouse Intervention CAPTCHA

A simple Mouse Intervention CAPTCHA implemented in a Java applet. The server generates some drawings and asks the user to click on all drawings with an odd number of edges. The mouse click events are recorded. As long as the mouse is clicked within the dark area of drawings with an odd number of edges, access is granted.

Conclusion
CAPTCHA is widely used across the internet including by Google, Yahoo and Microsoft. Hence discarding this solution should be done only for a ground-breaking alternative. With CAPTCHA, the criteria would be to pick an image/audio based CAPTCHA or text-based CAPTCHA for the project depending on the target user base. Once that’s decided, one of the several free libraries can be chosen to fit well into an existing technology stack. A relatively “light” library that provides easy extension hooks for custom extensions of CAPTCHA algorithms would be ideal.

One thing that many new frameworks are striving to offer these days is a quick startup- you can push this button, pull this lever, and voila, you have a hello world and can build from there. Of course this sounds better than writing a domain class, a dao, a service class, then enter some BS in your web.xml, and wire your beans, and add a *-servlet.xml, configure log4j, etc etc etc. And it is. Except when it doesn’t work.

My initial attempt at creating a Grails project went like this:

• grails create-app created my application.
• import project imported my project into Eclipse. I ended up with 25 or so classes in my base directory.
• grails run-app runs Jetty. I pull up a browser and can see my new site- everything appears to be going great.
• grails create-domain-class Create a domain class. Edit the domain class file, add a few properties. Easy.
• grails create-controller Creates a controller class. Remove the index() method and add def scaffold = domain class.
• grails run-app start my server again. This time I see my controller, click on it.

NullPointerException

The crazy thing is, this is after following directions from the book written by the lead developer of the Grails project! Ouch!

Here’s another example:

The getting started with Grails documentation highlights using Bootstrap.groovy in grails-app/conf as a place to inject test data.

So for example, using a domain class Bookmark, in the Bootstrap.groovy file you could write:

new Bookmark(property1: "value1", property2: "value2").save()

and have the bookmark show up in the Grails scaffolding.

With this approach I ended up with a “NoMethodException” saying that save() was not a valid method for this domain class.

Nice.

Another approach mentioned using the groovy console to add data. I could create an object, such as the Bookmark, but again I could not save it. This time it seemed like after creating it, it could not find the object in the stack.

I will continue to post about this as I find out the source of my problems.

Update 5/28/08: After rereading the extensive “how to set up a Grails project in Eclipse” documentation, it became clear that without disabling the Groovy plugin auto-compilation feature, I wouldn’t have much success. In fact, after last night’s effort I’ve made some nice progress and am beginning to see some similarities between Grails and Seam, at least in terms of work-cycle.

I’m frustrated though, by the fact that grails shell is not working for me. I believe the issue is that I’m using cygwin. It may be time to just switch over the linux entirely.

Update: The “grails console” option appears to work.

Update 5/29/08: One thing I’ve noticed is that given a domain object like this:

class Person {
	static optionals = ['middleInitial']
	String firstName
	String lastName
	String middleInitial
}

In the grails console, you MUST specify the optional property middleInitial in order to successfully create an object. Unfortunately, there’s no warning or explanation in the console. It just doesn’t work without all properties being passed in the constructor.

So this will work:

def p = new Person(firstName: "test", lastName: "test", middleInitial: "m")
p.save()

But this will not:

def p = new Person(firstName: "test", lastName: "test")
p.save()

And neither will this:

def p = new Person()
p.firstName = "test"
p.lastName = "test"
p.save()

But this will:

def p = new Person()
p.firstName = "test"
p.lastName = "test"
p.middleInitial  = "m"
p.save()

There are a couple different free tools that can achieve this. By far, the most comprehensive is FreePops. FreePops can be installed as a service and run in the background. It is very simple to configure an account using FreePops. You simply enter your username as the full email address. FreePops will know which connection module to use based on the domain of your email address. Then you specify the pop3 server as localhost:2000 or 127.0.0.1:2000. 2000 is the default port and you can change it if you wish.

FreePops does not provide smtp access and has limited features out of the box, but it does work well. This brings me to the second tool I like to use. It’s called YPops! and it is exclusive to Yahoo web-mail. However, it includes SMTP access and has a couple more features that come in handy. For instance, you can limit the amount of mail that gets downloaded, or set it to download new messages only. This is nice for me because I’ve had my yahoo account for a long time, so I don’t want it to download all the messages when I connect, just new ones. The defaults for it are:
Pop3- localhost:110 or 127.0.0.1:110
SMTP- localhost:25 or 127.0.0.1:25

I’ve got Hotmail and Gmail configured through FreePops and Yahoo configured through YPops; all in fetchmail. They all go to the same “Inbox” via procmail and then I can read them with Pine. For more information on configuring Pine with procmail and fetchmail, see Jeff’s post here.

My .fetchmailrc file


set daemon 180
set postmaster "eokuwwy"

Additionally, I appended an alias to my bash profile that makes use of the MailUtil program that you can get for Pine. It can be found here:
http://www.washington.edu/pine/getpine/pcpine.html

This simply checks my Inbox to see if there are any new mails. That way, I don’t need to keep a mail client open all the time.

export WIN_MAILPATH="C:\\devtools\\cygwin\\var\\spool\\mail\\eokuwwy"
alias mail="mailutil check '$WIN_MAILPATH'"


mailutil is already installed in a directory that’s included in the $PATH.

Well that about does it. Happy popping.

The Pros:

SiteMesh takes the approach that your page (JSP) doesn’t even know or care that it’s being decorated. Using SiteMesh, your pages don’t have to worry about a layout at all

With Tiles, the whole concept of TilesRequestProcessor has never been easy to configure. For example, regarding your page chunking (headings etc) – you can already do this via the content blocks feature. Simply put content here into your page, and it will be available to your decorator as ‘page.x’. Also useful because without decoration browsers will ignore the tag, hence you can still preview your pages. You can use this technique for all sorts of things, for example you could use it to aggregate stylesheets as you talked about using … and then in your decorator display all of the stylesheets in your head tag – or something like that.

You can also define your own DecoratorMapper implementation which is basically a strategy that chooses which decorator to use for each request (it defaults to looking in a config file). This can be used to do more dynamic things such as different decorators based on locale, user, category, browser, whatever

The Cons:-

Part of this content is inspired from other sources/blogs, I’m gonna keep this post ‘sticky’ and keep updating it as and when I come across interesting points.

• PHP/Java Bridge
  

  The php/Java bridge is an optimized, XML-based network protocol, which can be used to connect a native script engine, PHP, with a Java or ECMA 335 virtual machine. It is more than 50 times faster than local RPC via SOAP, requires less resources on the web-server side, and it is faster and more reliable than communication via the Java Native Interface. read more…

• Zend’s Java Bridge
  

  The Zend Platform Java Bridge is the leading performance and reliability solution for businesses that seek to utilize both PHP and Java/J2EE. Based on a unique design that allows for a single Java Virtual Machine (JVM) instantiation and direct calls from PHP, the Java Bridge delivers unprecedented performance and scalability that make true PHP and Java integration a reality.

• AlphaWorks WAS Integration
  

  PHP Integration Kit for WebSphere® Application Server (WAS), Community Edition (CE), allows users to integrate PHP-based scripting into their Java™ 2 Enterprise Edition (J2EE) applications. Integrating these technologies gives programmers the advantages of both PHP and Java, providing greater flexibility in deploying dynamic applications, building Web front ends, and creating development projects.

  The PHP Integration Kit provides a sample Web application that can contain Java resources (JSPs and servlets, as with any J2EE Web application) as well as PHP scripts. The sample application is preconfigured to forward each PHP request to a separate PHP run-time environment, which then executes the requested PHP script. Users can then manage the combined Java/PHP application as a single unit within WAS CE: Users can deploy and undeploy the application using the WAS CE administration console and can apply security constraints to both Java and PHP resources using the J2EE security model.

In my mind this makes a lot of sense. The Java web development experience is cumbersome, tedious, and extremely heavyweight.

*I’m not going to provide a link to the article because the JDJ site is too full of ads.

I found my solution with the help of this article. It’s indeed possible to draw images in the dark and render them as actual files later. I’m rambling again, so let’s get to it.

This class is a sliced up version of the prototype servlet I made for the client. All the meat is in this snippet. Actually, there isn’t much more to it in the real thing.

package com.boohbah.web.servlet.demo;
import java.awt.Color;
import java.awt.Graphics;
import java.awt.Image;
import java.awt.Toolkit;
import java.awt.image.BufferedImage;
import java.io.IOException;

import javax.servlet.Servlet;
import javax.servlet.ServletConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

import com.sun.image.codec.jpeg.JPEGCodec;
import com.sun.image.codec.jpeg.JPEGImageEncoder;

public class SizingDiagramServlet implements Servlet{
	/**
	 *
	 */
	//input properties
	private int disWidth;
	private int disHeight;
	private int ductWidth;
	private int ductHeight;

public void service(ServletRequest request, ServletResponse response) throws ServletException, IOException {
		setDisHeight(Integer.parseInt(request.getParameter("disHeight")));
		setDisWidth(Integer.parseInt(request.getParameter("disWidth")));
		setDuctWidth(Integer.parseInt(request.getParameter("ductWidth")));
		setDuctHeight(Integer.parseInt(request.getParameter("ductHeight")));

		BufferedImage im = createImage();

		response.setContentType("image/jpeg");
		//encode the image we created with sun's jpeg codec
		JPEGImageEncoder encoder = JPEGCodec.createJPEGEncoder(response.getOutputStream());
		encoder.encode(im);
	}

	//using the properties provided by the user, we can create the image
	private BufferedImage createImage()
    {
	//blank.jpg is an actual file I created ahead of time and put into the top level of my application war
		Image image = Toolkit.getDefaultToolkit().getImage("blank.jpg");
		BufferedImage bufferedImage = new BufferedImage(IMG_WIDTH, IMG_HEIGHT,BufferedImage.TYPE_INT_RGB);
		Graphics g = bufferedImage.createGraphics();

		//clear and set background
		g.clearRect(0, 0, IMG_WIDTH, IMG_HEIGHT);
		g.setColor(Color.WHITE);
		g.fillRect(0, 0, IMG_WIDTH, IMG_HEIGHT);

		//image drawing code takes place here
		//...
		//...
		//...
		//...
		//...

		//finalize drawing
		g.drawImage(image, 0, 0, null);
		g.dispose();

		return bufferedImage;
	}

	/*
		Code for
		property getters and setters would be here.

	*/

}

Not too bad is it?


Here are some screen shots that show the resulting jpegs based on a user request.



From:

http://localhost:8080/diagram?disHeight=46&disWidth=46&ductWidth=48&ductHeight=48

And another image where the user’s configuration (data entered) is apparently ill-advised.


From: http://localhost:8080/diagram?disHeight=35&disWidth=60&ductWidth=50&ductHeight=50





What’s the point of all this? You can and you WILL avoid using Flash, Ajax widgets, and other fancy means of drawing dynamic and attractive graphics. All chant “Server-Side AWT!”

It’s amazing how illusive standards support is across browsers, despite the ubiquitous nature of the web today.

Subversion can output a change log in XML, which gives us easy access to manipulate its display.

So, this script will call the “svn log” command using the “–xml” parameter. We can then transform this into nice, easy to read HTML by using XSL and CSS style sheets.

You will need to have Subversion and xsltproc installed in order to run this script.

Xsltproc can be found at http://xmlsoft.org/XSLT/downloads.html.

The stylesheets in this example can be found at http://subversion.tigris.org/tools_contrib.html.

Note: You will want to download svn2html.xsl and svn2html.css for sure.

In this script $XSL_HOME is the directory where the stylesheets are stored.

#!/bin/bash
#script to generate a nice html page from subversion change log using a stylesheet

USAGE=’USAGE: create_changelog [name] [svnurl] (svn log options)’

if [ -n "$2" ]
then
svnurl=$2
if [ -n "$1" ]
then
outfile=$1
good=’good’
fi
fi

if [ -n "$good" ]
then

outfile=$outfile.htm
template=$XSL_HOME/svn2html.xsl
tempfile=tempfile431651.xml
templateCSS=$XSL_HOME/svn2html.css
currdir=”$(pwd)”
newdir=$(basename $outfile .htm)
mkdir $newdir
cd $newdir

#create log in XML
svn log –verbose –xml $3 $4 $5 $6 $7 $8 $9 $svnurl > $tempfile

#transform to html using stylesheet, using cygwin on windows
xsltproc $(cygpath -w $template) $tempfile > $outfile

#copy stylesheet to output location
cp $templateCSS .

#destroy contents
rm -rf $tempfile

#go back to first dir
cd “$currdir”

echo New files created in $newdir.
else
echo $USAGE
fi

The user of this script will provide the Name of the log, the svn url, and additional svn log parameters as arguments. Once it is run the HTML file will be created using the Name parameter and the CSS file needed to properly display that page will be copied to the same directory.

Everyone loves change logs, especially if they are easy to read.