All posts by Nick Lothian

DRM in Office 2003 AND Internet Explorer

Tim Bray notes that Office 2003 has built-in DRM support. About a year ago I was pretty shocked to discover that Internet Explorer offers that same thing: Rights Managed Add-on for Internet Explorer. This appears to use the same facilities that Tim notes Office 2003 supports:

Using Windows Rights Management Services technology, authors can set restricted permission to limit what a reader can do with the content they receive. These restrictions are customizable, that is, an author can specify that one person may view the document but not print it, another may do both, and that a third person may view and print the document, but only for five days.

Content can be created with restricted permission by using an application that supports Windows Right Management Services, such as Microsoft Office Professional Edition 2003. When an author creates a protected document, Office will also embed a rights-managed HTML version of the content within the file.

(Lack of) Java Security

Ted Neward wrote an entry today on Java Security. This post started out as a comment on that, but it got too long.

Are there any java open source projects that actually use any Java Security (ignoring spec implementations where it is required)?

Some frameworks have some support for using it, but apart from that I think even the best projects fail to use it.

I'm not blaming the authors for that – I know there are times when I've thought that I should be using Java security, but it's a whole area I know I don't understand as well as I should, and while I think I'm very secuity conscious as programmers go, I suspect there may be others in the same position.

I'd love to see some sample code for using the principle-of-least-privilege in Java. Java programmers often shout about how much more secure it is than C, but at least in C you do see code that deliberatly reduces the permissions it requires.

Spring Portlet Support

Since there were no promising responses to my previous request for portlet frameworks I decided to do something about it myself.

I've submitted a patch to Spring 1.1 to enhance the spring portlet support so it will allow the use of the Spring Tag Libraries. It isn't (yet) as extensible as the web framework, but it is a good starting point (I think).

There isn't much in the way of documentation for it yet, but I did port the MVC tutorial code to the portlet framework.

Some notes:

  • The portlet version of the application leverages the concept of view and edit portlet modes. The view mode allows the user to view the current prices, while the edit mode allows the user to increase the prices.
  • The code in the bus package is identical to the Web version.
  • This JSP pages are almost identical to the Web versions, with the following exceptions:
    • The Portlet tag library is included as a jsp page directive in the JSP pages.
      If the various Portals properly exposed the taglib themselves this would not be required.
    • The link from the view.jsp page to priceincrease is a portlet:renderURL tag
    • The form in priceincrease.jsp has to submit to the a URL defined by a portlet:actionURL tag
  • The code in the controller package is specific to the Portlet version.

The ultimate version of this would allow the reuse of JSP views in both the Portlet and Web frameworks.

I'm hopeful that it will incorporated into Spring and people will find it useful.

Portlet Frameworks

What frameworks are people using to build java Portlets – in particular the user interface part?

I know the EXO people use JavaServerFaces, and I think both EXO and Liferay come with Stuts bridges. I'd love to hear peoples impressions of how well that work.

I believe Struts 1.2 adds (some?) support for Portlets, but I'm not sure how far it extends.

I've been using the Portlet support in the Spring sandbox with some success, but getting the taglibs to work is taking some work (ie, it isn't supported), and it looks to me that Webwork2 is in a fairly similar state.

So here's a hint for framework authors: if your framework allows developers to use the same JSP taglibs in pages for both web and portlet applications you are going to pick up some quick marketshare.

WinFS cut back in MS Longhorn: What of ObjectSpaces

In case you haven't been keeping up, Microsoft have announced that Longhorn will come out in 2006, but some of the promised features will need to be cut back to make that release date.

One of the big promised features that is going to be at least reduced in scope is WinFS:

“Basically it looks like most of Avalon is going to get the ax. And most of WinFS is going to get axed,” said a developer who asked not to be named.

(from Microsoft Watch)

One thing that I haven't discussed once is what will happen to ObjectSpaces – Microsoft upcoming Object/Relational Mapping technology. In Microsoft's words:

Developers who have been following the evolution of ObjectSpaces (a technology effort building services supporting object representations of data in relational databases) will be interested to know that these efforts are being merged with the object/data technology WinFS. This decision was made after evaluating the overlapping scenarios that each of these technologies delivered and firm feedback that developers and architects need a consistent, long-lived API delivering this functionality.

Will the delay in the full release of WinFS further delay the release of ObjectSpaces? Should .NET developers begin to look at non-Microsoft ORM APIs? And what motivation is there for third party vendors to fill that gap knowing that at some undisclosed future time Microsoft will release its own API?

Personally, I'm a bit disappointed that WinFS is being left out. I seem to be one of the few people around that believes it would be useful.

Interesting Search Paper

For all you search engine geeks out there: Block-level Link Analysis – analysis of web pages at the block, rather than page level, and using with algorithms such as Page Rank & HITS. (From MS Research, via Doug Cutting on the nutch-dev list)

To quote the abstract:

Link Analysis has shown great potential in improving the per-formance of web search. PageRank and HITS are two of the most popular algorithms. Most of the existing link analysis algorithms treat a web page as a single node in the web graph. However, in most cases, a web page contains multiple semantics and hence the web page might not be considered as the atomic node. In this paper, the web page is partitioned into blocks using the vision-based page segmentation algorithm. By extracting the page-to-block, block-to-page relationships from link structure and page layout analysis, we can construct a semantic graph over the WWW such that each node exactly represents a single semantic topic. This graph can better describe the semantic structure of the web. Based on block-level link analysis, we proposed two new algorithms, Block Level PageRank and Block Level HITS, whose performances we study extensively using web data.

My understanding is that this is similar to the method used by Google's AdSense program to work oout what advertisment to display on each page.