RSS feed for InstantSpot site orangepips

Railo: A Lot to Like & the US Tour 08

Thu, 31 Jul 2008 16:09:00 GMT

Impressions from the Railo US Tour 08 stop in Baltimore.

CF Equivalent MD5 Hashing Functions for SQL Server 2005+ & Oracle 8+

Fri, 23 May 2008 19:00:00 GMT

Both Oracle and SQL Server have built-in hashing functions. The trick is neither returns a value that is immediately comparable to a hashed value in ColdFusion (i.e. 32 character, hex based, upper case). So some additional conversion is required.

Oracle 8+

I couldn't figure out how to make it work inline with a SELECT statement, so first create a database function MD5_HASH:

CREATE OR REPLACE FUNCTION MD5_HASH (v_input_string in varchar2) RETURN VARCHAR2 IS
    v_checksum VARCHAR2(20);
BEGIN
   v_checksum := dbms_obfuscation_toolkit.md5 (input_string => v_input_string);
   RETURN utl_raw.cast_to_raw(v_checksum);
END;

Then use this with a SELECT statement. The "dbms_obfuscation_toolkit.md5()" generates a RAW value that is then converted with "utl_raw.cast_to_raw()" to return a string than is equivalent to a CF hash() call. So an example SELECT statement:

SELECT MD5_HASH([column]) FROM [table]

SQL Server 2005+

Note there is an option for earlier versions of SQL Server that involve installing a .dll, but this example takes advantage of a function introduced in 2005 "HashBytes()".

SELECT UPPER( RIGHT( master.dbo.fn_varbintohexstr( HashBytes( 'MD5', [column] ) ), 32) )
FROM [table]

A few notes:

master.dbo.fn_varbintohexstr() is an undocumented function, but it has been around for awhile, and doesn't appear to be going anywhere, and I don't know another way to do the conversion
RIGHT( [value], 32) is needed because the value returned has a leading 0x to indicate the value is hexadecimal, which ColdFusion does not do.
Finally UPPER() is there because the value returned is lower cased.

Hiring a Coldfusion Software Engineer North of Baltimore, MD

Thu, 15 May 2008 20:50:00 GMT

I work on a Coldfusion Content Management System SiteExecutive. This is very much a product with an established client base in the dozens. We are looking to hire another programmer to work on the product to join a team of programmers including myself.

I think this is an opportunity to solve some interesting problems with datasets that number in the hundreds of thousands of records (and continually growing). It involves understanding and applying concepts and technologies particularly in the parsing and search algorithms space. Generally speaking, the focus is on doing the right thing as opposed to the expedient.

That said, rather than tell you "It's the greatest place to work in the world!" here are some specifics and I'll leave it up to you to make up your mind. Feel free to drop me a line here with questions. The link above includes information about how to apply.

Technologies

Languages: ColdFusion 8, Java 5
Web Servers: IIS, Apache
Databases: Oracle 10, SQL Server 2005 (looking at 2008 this year). There is an opportunity to add MySQL to this stack as well
OSes: Windows Server 2003 (looking at 2008 this year), Redhat & Solaris (not sure which versions)
Defect Tracking: Trac
Source Control: Subversion

Process

Requirements & Use Cases: from the Alistair Cockburn school of thought (i.e. not UML).
Coding: no finicky coding standards, emphasis is on avoiding lousy algorithms (e.g. O(n²))
Testing & Support: developers are not the front line for either

CF Development on Linux: Looking for Suggestions

Thu, 27 Mar 2008 15:47:00 GMT

Looking for comments from people who are doing Coldfusion develoment on Linux about their experiences. Note, moving to Macs is not one of the options on the table. See below:

Email from my boss:

What are your thought of a development team using Linux OS instead of Windows? Is there sufficient development tools at work well on Linux?

My response:

Doable.

Problems to Solve

Laptops: loading *nix thereon is more painful than a desktop install. VM is not a solution because disk I/O too slow.

Microsoft:

.NET / Coldfusion integration only runs on Windows.

SQL Server don’t run on no *nix I’m aware of.

Exchange Email Client. I know there are *nix options, but never seen them

Coldfusion *Nix Support only on commercial *nix OSes, such as Redhat. The open source versions are not, such as Fedora, but still work (at least with some fiddling). So could be a pain point.

Think there are probably sufficient development tools.

Development Tools

IDE: Eclipse, Netbeans, Emacs

Database: Oracle SQL Developer

Productivity: Open Office

Course we could all move to Macs as well.

Coldfusion UI Tags Suggestion

Tue, 25 Mar 2008 15:17:00 GMT

A Rob Brooks-Bilson post touched a nerve of mine regarding Coldfusion's UI tags, like cfform and cfwindow. As well as its integration with third party libraries, such as Verity. In short, they're great if you can live within their limits. But, if you need to go beyond it's a big can't-get-there-from-here.

Take cfform for instance, great idea, but what happens when you start to need things like related select boxes? Little challenging. Or in the more recent case, the issue is the libraries continue to advance, such as Ext and FCKEdit, but the Coldfusion tags lag behind.

My suggestions:

divorce the release cycles between UI/third-party integration tags and Coldfusion
open source the UI tags with a license that requires changes be made freely available

Baltimore Adobe User's Group

Tue, 25 Mar 2008 11:15:00 GMT

So AboutWeb, which has expanded beyond it's I270 / DC / NoVa territory in Baltimore, is hosting an inagural Baltimore Adobe User Group. In my opinion this is a Good Thing^TM Several years ago, Fig Leaf ran a Baltimore Coldfusion User Group, but it died most likely due to lack of interest. Finally, there is also the TeraTech Maryland Coldfusion Users's Group. But this is a misleading name, as someone with a familiarity with MD geography can tell you, and really should be named something like the Montgomery County / Washington, DC Coldfusion Users's Group. But I suppose that doesn't quite have the same ring.

Anyway, glad to see it happening. And am looking forward to being there. If you are in the Baltimore metro area hope you show up.

P.S. You can also check out Nic Tunney's blog for a little more information as well.

Coldfusion, Open Source & C Syntax for cfscript

Fri, 21 Mar 2008 17:40:00 GMT

I wrote this post over a month ago calling for the addition of a full fledged C syntax for ColdFusion.And, I still want that to happen. But at the time felt it was not worth publishing. Also, I admit upfront I am absolutely guilty of previously calling for cfscript's demise. But now with New Atlanta's annoucement they will Open Source Blug Dragon and a recent Dan Vega post about how to change cfscript I decided to revisit and post.

Has Been

I've worked with ColdFusion since 1999 and in that time ColdFusion:

has been proclaimed, or implied, dead multiple times (Computerworld, Hal Helms, macromedia.coldfusion.cfml_general_discussion, et al. I'm sure.).
rewritten from C++ to Java
parent company was bought out twice - Allaire to Macromedia to Adobe

Each aquisition produced hand wringing. I am certainly guilty of doubting its survival. Even its own evangalist has noted ownership disregard as a red-headed step child. Yet it continues to chug along.

What has surprised me then is that the evolution includes players (Blue Dragon, Railo, Smith) other than ColdFusion's "owner". Of course that Adobe has posited Coldfusion is NOT a language, but rather a platform. This argument of platform vs. language stikes me as semantic. After all what's a language without its libraries?

I think this is a lesson Java has learned very well. Putting aside the idea of a polyglot VM for a moment, Java has incorporated ideas from a number of projects that began outside of Sun, including Spring, Hibernate and StAX XML processing to name a few. As well as language concepts such as generics (badly perhaps), enumerated types and possibly closures in the future. All of which Sun, to its credit, has fostered via the Java Community Process.

Err Is?

This is not to say Coldfusion has not evolved as well; rather its survival oft times appears to be in spite of its master. I have always found it frustrating that each new Macromedia, now Adobe, initiative targets another language/platform. Want Live Cycle? Or, a back end for Flex? Take a look at Java. And, developers matter.

Lots have weighed in on how to find these elusive good programmers such as Spolsky, Yegge and Braithwaite. In other words, it's always hard to find good help. And at least once a month I heard how much easier it is to find .NET, Java or something else programmers. So, what happens then if the people who could help you don't want to?

Could Be

Make Coldfusion a language programmers want to work with. Do this by giving them the C-like syntactical goodness that has ruled the day in the software engineering world for the past 20+ years. Make cfscript ECMAScript compliant. Flex is there. Some people believe the Next Big Language will be such. So take the red-headed stepchild's runt of the litter and make it a worthwhile feature.

Make cfscript a full fledged language. Make it ActionScript. Make it Groovy. Do something. Create a Coldfusion paradigm that encourages the separation of presentation (i.e. CFML) and logic (cfscript) in a way that's approachable to the rest of the programming world.

In short, Coldfusion is approachable for greenhorns, and easy to dismiss for veterans. Making Coldfusion something that experienced programmers want to use is the right next step. The stories of people switching to Coldfusion from something else are few and far in between. And, that is the tide to change.

Could Could Be

So the Blue Dragon is out the bag. As New Atlant CEO Vince Bonifanti posted, I think the most important aspect of this decision is that the "free" rather than open. While some have pointed out that the real push for Blue Dragon is .NET that the J2EE version will be available for free opens up possibilities. Such as C-like syntax for cfscript.

TDD Backlash

Mon, 03 Mar 2008 19:17:00 GMT

It's been said, "A foolish consistency is the hobgoblin of little minds." And, in my experience TDD can easily slide into this fallacy. So it gladens me to see someone like Cédric Beust, creator of the TestNG unit testing framework, call out the TDD zealots. In addition he also offers some heuristics that I think really capture the essence of how unit testing should be approached.

To wit, I tried introducting unit testing at my workplace and ran into this very problem. But, some background first:

The product I work on is closing in on a decade of development. And stuff that was almost 10 years ago, which is still around and used, has UI, database I/O and business logic all intertwined. Very much a Model 1 architecture. But, before you start ranting about bad design practices and MVC and so forth, know the product works, and makes money. And, it started out in Coldfusion 4. So objects were not an option and Fusebox was nascent at best.

With a codebase like this, you cannot just flip a switch and make it unit testable. Anyone who proclaims changes to said code must be unit testable is not living in reality. It's possible to move in that direction, but if it took you years to create that codebase, don't expect it to take days, weeks or months to get to a unit testable state. These things are intertwined and must be broken apart carefully with planning and coordination with testing.

Programming is fundamentally just as much a social and technical problem. Attempting to impose a command and control structure on programmers == bad idea. But the appeal of implementing a Good Idea as the Only Idea can be overwhelming. This was definitely the case for my environment, where instead of focusing on the notion of having good unit tests, TDD ruled the day and it became you must have unit tests before you code.

This crashed and burned rather quickly as developers pushed back.

Now personally I write unit tests for my code that does not involve database I/O or UI. Where I find the configuring the dependencies, even through injection, outweigh the benefits of unit testing. But as a result, most code that I write separates these aspects out leaving everything else in a unit testable state.

What I do find is that sometimes unit tests makes maintenance easier. But, that sometimes if the change is large, I need to throw out the old tests. Maybe I write new tests or maybe I don't. It just depends on complexity and time. And, for TDD adherents I am sure this is probaby heresay.

cfindex:Unable to connect to the ColdFusion Search service

Wed, 20 Feb 2008 17:58:00 GMT

Problem I ran into recently where I knew the collection existed. Running Coldfusion 8 in multiserver configuration on a Windows machine that previously had Coldfusion 7 installed. Tried to use the cfindex tag to no avail.

Trial and error and some reading here on Adobe's site led me to this:

Uninstalled Coldfusion 7 Search Service still on the box
Checked cfadmin to see what ports should be used 9951, 9921 & 9961
Noted that k2index.exe and k2server.exe services were not running via cports (i.e. 9921 & 9961)
ran C:\JRun4\verity\verity-install.bat and noted the following errors:
1. WARNING: The RCAdmin call failed. Command = styleset 1 "Def_FileSystem" 1 1 filesys "default File System style files" y exit
2. WARNING: The RCAdmin call failed. Command = styleset 1 "ColdFusionK2" 1 1 filesys "ColdFusion K2 Style Files" y exit
3. WARNING: The RCAdmin call failed. Command = styleset 1 "ColdFusionVspider" 1 1 filesys "ColdFusion Vspider Style Files" y exit
4. WARNING: The RCAdmin call failed. Command = serverset 1 "ColdFusionK2_server1" 9921 "ColdFusion K2Server" y y y ColdFusionK2 "C:\JRun4\verity\k2\common" 200 2 n 300000 900000 y exit
5. WARNING: The RCAdmin call failed. Command = indexerset 1 "ColdFusionK2_indexserver1" 9961 "ColdFusion K2 Index Server" ColdFusionK2 4 1 y exit
ran C:\JRun4\verity\k2\_nti40\bin\rcadmin.exe
1. styledel Def_FileSystem
2. styledel ColdfusionK2
3. styledel ColdfusionVspider
ran C:\JRun4\verity\verity-install.bat (still will get serverset and indexerset failure messages)

Works again.

Think the problem is either because (a) had Coldfusion 7 search service installed or (b) the admin.xml files inside the verity directory (subdirectory) had bad values in them and running styledel and subsequently the .bat file resolved it.

Code Snippet: Rolling Paged Navigation Control

Fri, 15 Feb 2008 22:10:00 GMT

cfflush Problem (and Solution) on CF8 with IIS

Wed, 12 Dec 2007 13:39:02 GMT

Posting for three reasons:

Googlers can confirm their suspicion that others are having the same problem.
Provide a solution that, while perhaps inelegant, works.
Avoids all the "must be something other than Coldfusion's fault" posts that seem to have accreted around the topic.

The Problem

The problem exists in CF8 through Cumulative Hotfix 2.

So yes, others are having the same problem, including posters to Adobe and House of Fusion's forums. The issue appears to only happen on a combination of CF8 and IIS. I have personally verified this on CF8 with IIS6 and others have claimed the same problem on IIS7. This does not happen with Apache 2.2, which I have verified, and I have not tested it on other Apache versions.

Why the problem happens is unclear. Note, in the scenarios described it does not have to do with IIS compression (see the Dan G. Switzer's comment). Multiple people have posted that IIS has some sort of minimum buffer length before it will return content to the client (i.e. browser), albeit this does not manifest itself on CF7.

Is it a bug? I'm sure I don't know. Adobe has not acknowledged it as such. But if you are here, chances are you are having a problem. So read on for a solution that works.

A Solution

The solution is outputting enough data before a cfflush call that it will cause CF8/IIS to send to the client. The problem is evident in situations using JavaScript or Flash where an image or DOM object is updated during a long running process (think progress bar UI convention)¹. With CF8 and IIS, depending on the amount of output before a call to cfflush, the client may update only sporadically or only show the final output when the page request finishes.

A way to do this is create a proxy custom tag (e.g. cf_flush) with the content as such:

[codeshare dec49f28]

The 73729 value is one from the Adobe forum discovered by a poster there as the minimum data length needed to send to the client.

Yes this could be more sophisticated, doing things such as testing on the Coldfusion version and Web Server, but making the assumption that if you made it this far you can figure that out for yourself if you need it.

¹ Yes use you could use AJAX, instead of flushing, and avoid the problem altogether.

Coldfusion and UUIDs

Mon, 12 Nov 2007 13:57:53 GMT

Addressing some common questions and issues seen with UUIDs and Coldfusion.

Through version 7, the Coldfusion UUID implementation, createUUID(), is slow. So here are some alternatives depending on JVM version.

1.5+: look at java.util.UUID.
1.4 & earlier: see the Java Uuid Generator (JUG) that the 1.5 implementation is based upon (http://jug.safehaus.org/)

Even if UUID generation performance is not an issue you may still want to use something other than Coldfusion's implementation: see the Security heading below.

Unique != Random

The Version 1 UUID algorithm used by Coldfusion virtually guarantees a globally unique value. In other words a call to createUUID() will generate a value different than any other computer in existence. And, the design ensures that repeated calls will generate a new, globally unique value each time.

However, to achieve this end the Version 1 UUID algorithm relies upon the time and MAC address of the computer generating the value. This means that a given UUID value can be reverse engineered to determine the MAC address and timestamp of the generator. In addition, a UUID can be generated to appear as if it came from the computer in question as well, given its MAC address.

As a result the value is predictable, i.e. not random, and may present a security problem.

Security

One proposed solution for making UUIDs secure is using an MD5 hash of the value. This is probably not a good solution because rainbow table attacks have made breaking this technique relatively cheap and straightforward. Instead, the Java options above both offer static methods that generate a random UUID value, not tied to the computer's timestamp and MAC address.

However, randomness creates a potential collision problem because the possibility exists that multiple calls may generate a duplicate value. For throwaway values, this may not be much of an issue, but for use with database primary keys it requires extra care to deal with dupes.

Database Primary Key for Replication

Replication is a problem when dealing large volumes of database records. The problem arises when copying a subset of records from a source to target system. Often key conflicts arise. UUIDs are a viable solution.

Auto-incrementing primary keys are a problem in this scenario because the target server may have already assigned the IDs. And, attempting to insert copied records may also violate foreign key constraints, particularly if data is coming from more than one table. So, UUIDs (at least version 1 UUIDs) as database primary keys guarantee records will not conflict when replicated.

XML StAX Processing with Coldfusion

Wed, 28 Mar 2007 15:04:00 GMT

Several problems with Coldfusion XML processing and solution set:

Slow: due to DOM processor (Xerces)
Inconsistent Round-Tripping (i.e. serialization / deserialization) :
1. (un-) escaping characters
2. non-printable characters
3. missing / multiple XML declaration(s)
4. character set problems
5. et al.
Kludgy Tree API yes you can use structure and array functions, just don't like it.

Note, don't see this as a flame on Adobe/Macromedia. The Coldfusion XML implementation uses best available technology at the time and APIs that fit in with the language paradigm. Just have better options now.

Slow Solution

Woodstox: Jim Collins wrote a CFDJ article about using a StAX XML processor with Coldfusion. Unfortunately, as near as I can tell, his open source project to integrate Coldfusion with Woodstox was never released. Testing demonstrates a StAX processor, such as Woodstox, provides very efficient (read: fast) XML processing, and a more intuitive API, than a SAX processor. But still not intuitive enough for me. So enter...

Round-Tripping & API Solutions

XOM provides a very easy to use API that roundtrips XML like a champ. Correct I/O is XOM's middle name. But it doesn't integrate natively with a StAX processor unless you use...

NUX is like a Swiss Army knife for XML. But the purpose of this entry just know it's the glue between XOM and Woodstox (note that NUX includes the XOM jar so you do not need to download it separately).

Code

Download the Woodstox and NUX jars and configure them in your Coldfusion classpath. The examples below build upon each other.

Setup

Creates a XOM Builder object backed by a StAX processor.

inputFactory = createObject("java", "com.ctc.wstx.stax.WstxInputFactory").init()
builder = createObject("java", "nux.xom.io.StaxUtil").createBuilder(local.joInputFactory, javacast("null", "")

XMLParse() Alternative

Returns a XOM Document object. Note: provide XMLString variable.

document = builder.create(XMLString)

XMLSearch() Alternative

Returns a XOM Nodes object (i.e. an iterator of Node objects). Note: provide XQueryString variable.

nodes = createObject("java", "nux.com.xquery.XQueryUtil").xquery(document, XQueryString)

loop from="0" to="#nodes.size() - 1#" index="idx"
element = nodes.get(javacast("int", idx))
attributeValue = element.getAttribute("attributeName").getValue()
attributeText = element.getValue
/loop

ToString() Alternative

Creates a string representation of the XML.

XMLString = document.toXML()