Matt RaibleMatt Raible is a writer with a passion for software. Connect with him on LinkedIn.

The Angular Mini-Book The Angular Mini-Book is a guide to getting started with Angular. You'll learn how to develop a bare-bones application, test it, and deploy it. Then you'll move on to adding Bootstrap, Angular Material, continuous integration, and authentication.

Spring Boot is a popular framework for building REST APIs. You'll learn how to integrate Angular with Spring Boot and use security best practices like HTTPS and a content security policy.

For book updates, follow @angular_book on Twitter.

The JHipster Mini-Book The JHipster Mini-Book is a guide to getting started with hip technologies today: Angular, Bootstrap, and Spring Boot. All of these frameworks are wrapped up in an easy-to-use project called JHipster.

This book shows you how to build an app with JHipster, and guides you through the plethora of tools, techniques and options you can use. Furthermore, it explains the UI and API building blocks so you understand the underpinnings of your great application.

For book updates, follow @jhipster-book on Twitter.

10+ YEARS


Over 10 years ago, I wrote my first blog post. Since then, I've authored books, had kids, traveled the world, found Trish and blogged about it all.
You searched this site for "jvm". 113 entries found.

You can also try this same search on Google.

Choosing a JVM Web Framework

This morning I delivered my Choosing a JVM Web Framework presentation at the Colorado Software Summit. One of my goals for the talk was to get more audience participation and stories of how folks thought it best to choose a web framework. The room was packed and the crowd was interested, so we barely even used the slides I prepared. One of the most interesting things about the audience was that over 60% (of 50-60 people) were using Struts 1. Most of them came to learn about frameworks they might think about migrating too. Unfortunately, I didn't talk a whole lot about the frameworks and their features, but a few members had advice concerning frameworks *not* to use based on their experiences. Overall, it was a lot of fun to interact so much with the audience and hear their thoughts on web development for the Java Platform.

You can download a PDF version of my presentation from my presentations page. Thanks to all the folks who responded to my Stories Wanted post - I used many of these comments as part of the "Case Studies" in the presentation.

Posted in Java at Oct 23 2007, 02:20:13 PM MDT 3 Comments

Colorado Software Summit - are you coming?

Are you coming to the Colorado Software Summit this year? I'm excited to go because I wrote new presentations and I think they'll be a lot of fun to deliver. Also, as I've said before, I really enjoy this conference because it's so relaxing. It's a full-week long, which is a tough commitment, but I like to think of it as a vacation. You do have to deliver your talks 3 times each, so you still have to work every day, but there's also a great opportunity to learn from other speakers. And you don't feel rushed since each talk is given 3 times. This means you can treat some days like real vacation days where you only work a couple hours and others you can pack it in and get a brain full of stuff.

Here's my Choosing a JVM Web Framework abstract?

One of the most difficult things to do (in Java web development) today is to pick which web framework to use when developing an application. A few years ago, there were over 50 Java web frameworks available, most of them open source. Since then, the number hasn't gone down, but the quality of choices has certainly improved. Should you use the standard JSF, or something like Tapestry or Wicket? What about Struts' successor ? is Struts 2 better than Spring MVC or Stripes? And what about the slick-looking applications that Flex and OpenLaszlo can create? Should you use Rails on GlassFish or Grails with Groovy? Is ZK really the next best thing? Where does RIFE fit into all of this? The choice hasn't gotten easier over the years.

This session is a discussion about choosing the best tool for the job. Not only will various frameworks and their features be discussed, but so will important factors for choosing a web framework. Is ease of development more important, or future maintenance? Is the project community an important factor? All of these questions will be discussed and answers will be provided. If you are about to choose a web framework, or if you have an opinion about a web framework, this session is for you.

I think it's important to note that this talk is going to be a discussion. I don't plan on offering my opinions as much as I plan on extracting them from others. This talk probably wouldn't work with the Norway crowd (they don't like to participate much), but I think it'll work with the Colorado folks.

If you're attending ApacheCon this year, which talk would you rather attend - Comparing or Choosing? Or maybe "choosing" would fit in better as a BOF?

Posted in Java at Sep 24 2007, 06:44:03 PM MDT 9 Comments

Does Struts 2 suck?

As far as I can tell, Struts 2 sucks. To be fair, so does Stripes. Why? Because there's no developer feedback for invalid properties or OGNL Expressions. What does this mean? It means if you fat-finger a property name, nothing happens. The OGNL exception is swallowed and you never know you did anything wrong. Furthermore, no one seems to care. The XWork folks will help you build, but not solve the problem. This seems like a major deal-breaker to me, However, I also believe it can be fixed - so maybe there's hope.

To demonstrate the problem, I did an experiment. I used the "user details" page in AppFuse Light to fat-finger a property name for the following frameworks: Struts 1, WebWork, Struts 2, JSF, Spring MVC, Stripes, Tapestry and Wicket. First, I tried changing the "lastName" property to "LastName" to see if the framework's property evaluation was case-sensitive. I found that with WebWork/Struts 2, Stripes and Tapestry, the property is not case-sensitive. I prefer case-sensitivity, but maybe that's because I prefer Unix over Windows.

The 2nd thing I tried was changing "lastName" to "pastName" to see if I'd get an error. An error occurred for all the frameworks mentioned, except for WebWork/Struts 2 and Stripes. This makes me believe these frameworks suck. The both use OGNL, so they could blame it on that, but Tapestry uses OGNL and it presents an error message. After this small experiment, my conclusion is the following frameworks have the best developer feedback:

  • Struts 1
  • JSF
  • Spring MVC
  • Tapestry
  • Wicket*

* Wicket seems like it needs some work as all it presents is "Internal Error" and makes you dig through your log files to find the problem.

Without good developer feedback, how can you have good productivity?

Dear Struts 2 and Stripes Developers,

What do you think about improving your error messages for invalid properties and expressions? Is this a feature you think you could add? We'd love it if you did.

Sincerely,

Your Users

Click here for some screenshots of how a fat-fingered property looks in various frameworks:

Update: Stripes doesn't suck and Wicket has excellent error reporting. See my comment below for more details.

Update 2: I've created a patch to (hopefully) solve this issue in XWork. If you have any feedback on ways to improve this patch, I'd love to hear about it.

Posted in Java at Sep 05 2007, 11:21:57 AM MDT 39 Comments

Choosing a JVM Web Framework: Stories Wanted

My last post on choosing a web framework got quite a few comments. Some seemed to like the application categorization technique as a means to narrow the choices. However, others seemed to disagree. So if application categorization is not a good methodology for narrowing the choices, what is?

I think one of the best ways to figure out a good methodology is to find out what people have done to choose their web framework. I'm looking for stories from developers who have evaluated 2-3+ frameworks for a project. I'd like to come up with 3-5 stories as part of my talk to highlight how some teams have chosen their web framework. What were your important criteria? What made you choose the one you did? Was it a tight race between a few of them? Did industry buzz or application categorization play a part in your decision?

Please send any stories you'd like to share to [email protected]. Of course, you can also post your story in the comments - but an e-mail gives it a bit more validity. If you'd like to share your company name, that'd be great, but it's by no means required. I haven't decided if I'm going to prevent all cases as anonymous companies or not. If you do send a story, I'll make sure and ask your permission before I share any of your personal/company information. Thanks!

Posted in Java at Aug 22 2007, 12:02:58 PM MDT 19 Comments

Want a kick-ass Java/UI Engineering Job in Mountain View?

The last month working at LinkedIn has been an absolute blast. I'm new to the whole "treating developers like royalty" thing, so that's taken a while to get used to. It's definitely nice, especially when the company gives you ownership of the things you're working on. Sure, there's schedules and priorities, but it seems like each and every engineer has control of their own destiny. As a consultant, I've been very impressed with the way I've been embraced and folded into the team like a regular employee. There's lots of team lunches, a tech meetup every now and then, and I even played hoops with a bunch of guys last night. This is probably the coolest company I've ever worked for.

Wanna have fun like I am? LinkedIn is looking to hire quite aggressively over the next several months. There's new faces almost every week and hopefully I can "hook you up" to be a part of the festivities. Below is a position that we're currently hiring for in the UI Engineering team. Working remotely is not an option at this time, you need to live in (or relocate to) the Bay Area.

LinkedIn is an online network of more than 11 million experienced professionals from around the world, representing 150 industries. We are four years old, profitable and one of the fastest growing pre-IPO Web 2.0 companies in Silicon Valley.

LinkedIn is developing the UI infrastructure for our next generation applications. This is a strategic initiative that will enable LinkedIn to develop highly interactive and intuitive applications leveraging the latest Web UI technologies. We are looking for a world-class software engineer to work on this critical component of our infrastructure, in partnership with one or more technical leads, the engineering and the product team.

POSITION REQUIREMENTS:
  • EXPERIENCE:
    • 3+ years of overall professional work experience
  • SKILLS & ABILITIES:
    • In depth and hands on knowledge of Java, the J2EE platform and experience working with relevant tools (IDEs, ant, junit, etc.)
    • A passion for UI frameworks: JSF and Facelets experience preferable.
    • In depth knowledge of JSP, JSTL.
    • Experience with Ajax.
    • Experience with portal technologies.
    • I18n experience a plus.
    • Solid understanding of design, coding and testing patterns
    • Ability to work in a fast paced, test-driven collaborative and iterative programming environment
    • Ability to effectively interact with product managers and other organizational units such as QA and CS
    • Excellent communication skills
  • EDUCATION:
    • B.S./M.S in Computer Science or equivalent experience.

I don't know if JSF and Facelets experience is still a requirement (now that I'm here ;-)), but a passion for UI frameworks and web development is. You should know at least two leading Java frameworks and have a lot of experiencing with testing web applications out-of-container. We're not looking for Java Developers turned web developers, we're more looking for Web Developers that know Java.

If this sounds interesting to you, shoot me your resume in an e-mail. Don't forget to include a link to your LinkedIn Profile.

Posted in Java at Aug 17 2007, 10:24:00 AM MDT 20 Comments

Jetty 6.x versus Tomcat 6.x

An AppFuse user asks:

Has anyone done any performance benchmarking between Jetty 6.x and Tomcat 6.x to see which one is better for production use in terms of scalability, performance and ease-of-use? I'm gearing towards Jetty 6.1 but want to hear other's opinions first.

I admit, I completely changed the wording in this quote to make it more readable.

Most of the companies I've worked with in recent years have been using Tomcat (very successfully) in production. However, I also know the Contegix and JavaLobby guys continue to swear by Resin for the most part. What's your opinion?

IMHO, I don't think it really matters - they're all good enough for production use.

Posted in Java at Aug 15 2007, 09:50:17 AM MDT 7 Comments

AppFuse vs. Grails vs. Rails

In the comments of my Choosing a JVM Web Framework, Graeme Rocher writes:

no offense Matt, but I fear you are a grossly inappropriate person to be writing such a study given your past history of claiming frameworks like Grails are competitors to AppFuse. Any such study will come laced with doubts over its honesty and I'm sure this doesn't just apply to Grails.

In the post Graeme linked to, I said:

I think Grails and AppFuse are more likely competitors rather than compatible. Grails uses Spring, Spring MVC and Hibernate under-the-covers, whereas AppFuse uses the raw frameworks. Of course, it would be cool to allow different classes w/in AppFuse to be written in Groovy or JRuby. At this point, I think it's probably better for users to choose one or the other.

Since writing that post a year ago, I've changed my opinion about AppFuse being competitors with Grails or Rails. Why? Because they're different languages. I don't think you should choose a web development stack first. I think you should choose your language first. For those that choose raw Java, I think AppFuse provides a good solution. To be more explicit, here's a private conversation that David Whitehurst (author of The AppFuse Primer) and I exchanged.

David: Have you been looking at Ruby on Rails any? And, if so, I'm sure you're as impressed by those who command the language as I am. But, I think the J2EE web application is not dead yet. Do you think any comparison of the complexity of AppFuse vs. Rails should be mentioned in the book?

Matt: I'm highly aware of Rails, have attended talks and tutorials on it, even bought books about it - but I've never written an app, done a tutorial or used it in the real-world. I'm afraid of it. I'm almost certain I'd like it, and I'd likely like Grails as well. However, the reason I stick with pure Java is because that's where my clients' demand is and hence the consulting dollars for me.

It's probably also possible to create AppFuse for both Rails and Grails. I believe Rails' Streamlined in much like AppFuse. I like to think of AppFuse as language agnostic - it's always been designed to eliminate ramp up time. While Rails and Grails simplify the programming API and make it possible to develop code with less lines of code, it'd be nice to have user management, file upload and other things like AppFuse has. When I start using these frameworks, it's likely I'll develop some sort of features like AppFuse has and use them on projects. Of course, if they already have all the features of AppFuse via plugins, I wouldn't reinvent the wheel - I'm simply use what's already there and be happy about it.

I don't know if it's relevant to mention Rails, but it probably doesn't hurt. There's no reason to ignore the competition if they're indeed competition. I don't see them as competition, and I almost don't see Grails as competition either. AppFuse (in its current state) is for developers that've chosen to use the language and frameworks that AppFuse supports. It's not trying to solve everyone's problems - it's merely trying to simplify things for those using the frameworks it supports.

There's nothing saying that AppFuse can't have a Rails or Grails version in the future. For me, it'll happen if I start developing applications using these frameworks and see the integration needs like I saw with the Java frameworks. The good news is most of these frameworks have done the integration work, so it's really just a matter of creating features or using plugins.

David: I keep getting these "dream-squasher" friends of mine showing me Rails, Grails, and how wonderful Ruby is. It's impressive, but I'm not convinced that big business is ready to adopt it any time soon.

Matt: As a Java programmer, I think you'd be a fool to ignore Rails or Grails and not at least be familiar with them. There's no reason to discount technology until you've used it on a real-world project - at least 6 months or longer - IMO.

Just because you're productive in Ruby and like it - that doesn't make you a bad Java programmer.

I hope this clears up any confusion on how I feel towards Rails or Grails. I would welcome the opportunity to use them on a project. If I was starting a products-based company, I certainly would give them a shot in the prototyping phase. However, I'm a consultant that makes money from clients hiring me to explain/do what I know best. At the current time, that happens to be open source Java frameworks.

I do plan on learning a plethora of other frameworks, in other languages, I just haven't had the time yet. When I do, I hope that I can somehow become proficient enough to help companies adopt them as well. However, to build up that experience and expertise will likely take years. I think this is how lots of companies feel. Can you blame them for not "jumping ship" on their current skills and knowledge?

Of course, then you have the Relevance guys who seem to be doing exactly what I hope to be doing in several years from now. Not only do they specialize in Java and its frameworks, but they also do consulting and training around Rails, Grails and Ajax. I can't help but admire them tremendously.

Posted in Java at Aug 08 2007, 10:22:34 AM MDT 13 Comments

Choosing a JVM Web Framework

I plan on rewriting my "Comparing Java Web Frameworks" presentation for this year's Colorado Software Summit. Rather than "Comparing Java Web Frameworks", I'm going to make it into more of a "Choosing a JVM Web Framework" presentation. I think this opens it up to more possibilities such as Grails, JRuby on Rails, Flex and GWT.

One of the things I hope to talk about is choosing the right tool for the job. I think there's 3 types of web applications you can develop:

  1. Consumer-facing, high-traffic, stateless applications
  2. Internal, more desktop-like applications that are stateful
  3. Media-rich applications that require a RIA framework like Flex

Once you've decided on which of these you're developing, it's much easier to narrow down the choices:

  1. Struts 2, Spring MVC, Stripes
  2. JSF, Tapestry, Wicket
  3. GWT, Flex, OpenLaszlo

I'm not sure if GWT fits in the RIA category. I'm not sure where Rails or Grails fit either. They more closely resemble category #1 than any other, yet there's a lot of speculation about their scalability. I think if that perception can be changed, they'll fit into the first category quite well. However, I don't think they compete with component-based or RIA because they don't hold state or offer rich-media capabilities.

Sidenote: I find the scalability debate quite interesting. There's a fair amount of propaganda in Javaland that scalability can be achieved with appservers and clustering tools like Terracotta. If this is true, I've yet to read good solid proof of it. Most of the "how to scale" information out there suggests "share nothing" architectures that shard data and applications across several servers. Of course, there's scalability and then there's massive scalability. Can appservers and clustering solve massive scalability like Google and Amazon require?

The 2nd and 3rd categories have someone of a blurry line, so I'm hoping to figure out how to clarify that. There's also a lot of other factors that will go into choosing a web framework. What if you're simply trying to replace a home-grown framework with an open-source one? If you want to keep your backend and all its logic, does it make sense to use something like Seam, Grails, JRuby on Rails or even AppFuse? Probably not - all their wizbang features and CRUD generation doesn't mean much if all you're using is the web framework. Also, if your application requires support for non-JavaScript browsers (for 508 compliance), then GWT and JSF can be easily eliminated. I know that there are many claims that JSF doesn't require JavaScript, but I've yet to see a real-world application developed with JSF that expects JavaScript to be turned off. Progressive enhancement is a requirement by many of my clients these days.

What's your opinion? How can we make it easier for developers and companies to choose a web framework? Is categorizing application types a good technique?

Posted in Java at Aug 07 2007, 10:10:05 AM MDT 43 Comments

OSCON 2007: Comparing Java Web Frameworks

This afternoon I delivered my Comparing Java Web Frameworks talk at OSCON in Portland. I told attendees I'd post it here afterwards, so here it is:Download Comparing Java Web Frameworks Presentation (5.1 MB)

For comments on this presentation from earlier this year, see related postings from ApacheCon EU and JA-SIG. This presentation is pretty much the same as the one from ApacheCon and JA-SIG, except it has a different theme and I chopped out the Sweetspots section (due to time constraints).

Portland is great this time of year, but unfortunately I won't be sticking around. I'm heading down to Salem to work remotely for a couple of days, returning for the Oregon Brewers Festival on Friday and heading back to Denver on Saturday. I'll be glad when July is over - I've traveled to a new state every week.

Posted in Java at Jul 25 2007, 04:50:55 PM MDT 9 Comments

Java Web Frameworks and XSS

In preparation for my talk at OSCON next week, I've been doing some research on cross-site scripting and how good Java web frameworks handle it. I'm disappointed to report that the handling of XSS in Java web frameworks is abysmal. First of all, the JSP EL doesn't bother to handle XSS:

With JSP 2.0 you can use the following to emit the description of a "todo" item:
${todo.description}
That's pretty nice. What happens when someone has entered a description like this?
<script type="text/javascript">alert('F#$@ you!');</script>
Well, it executes the JavaScript and pops up a nice little message to you.
...
My question is this: Why in the world did the expert group on the JSP 2.0 JSR decide to make not escaping XML content the default for EL expressions, when they made the opposite decision for c:out?

(Emphasis mine) If a company/developer wants to make sure their JSP-based code is not susceptible to XSS, they have two choices (as I see it):

  • Do lots of code review to make sure <c:out> is used instead of ${}.
  • Hack the jsp-compiler/el-engine to escape XML by default.

The good news is #2 doesn't seem to be that hard. I pulled down commons-el yesterday, added a hack to escape XML, re-jarred and put it in Tomcat 5.0.25's classpath. This actually worked and I was impressed it was so easy. However, when I looked at Tomcat 6, commons-el is no longer used and now there's a "jasper-el.jar" in the lib directory. I don't mind modifying another library, but what's the difference between jasper-el and commons-el?

Of course, the whole problem with JSP EL could be solved if Tomcat (and other containers) would allow a flag to turn on XML escaping by default. IMO, it's badly needed to make JSP-based webapps safe from XSS.

On a related note, there's a couple of web frameworks that I've found to be susceptible to XSS: namely Spring MVC and Struts 2. For Spring MVC, its <form:input> and <form:errors> tags are vulnerable. For Struts 2, OGNL expressions are evaluated, which is way worse than XSS and actually allows you to shutdown the JVM by putting %{@java.lang.System@exit(0)}" in a text field.

Even though it was surprising for me to see the issues with Struts 2 and Spring MVC, I'm somewhat glad they exist. If I hadn't discovered them, I might blissfully think that Java web frameworks aren't susceptible to XSS. However, it appears they're not only susceptible, but no one is really thinking about XSS when developing these framework. To further prove that theory, the Spring MVC and Struts 2 teams are aware of these issues, have been for quite some time - yet they've done nothing in the form of releasing upgrades or patches.

Seems kinda strange doesn't it?

Posted in Java at Jul 19 2007, 10:16:15 AM MDT 26 Comments