my recent reads..

Sep 25, 2007 Database Security

Proof! Oracle Development have a funny bone

Recurity Labs GmbH have a very interesting post on their investigation of the new password algorithms in Oracle Database 11g.

I did a double-take when I saw the set of hashing algorithm identifier values (used as a parameter to the ztv2ghashs hashing function)..


0xf00d means: Use MD4 
0xdead means: Use SHA1 
0xbeaf means: Use MD5

Ah! It's an oldie but a goodie. Brings back schoolboy memories of getting your LCD calculator to spell out well-known petroleum companies.

And good to see that even in the depths of Oracle Development there's a willingness to do something a little special, for no reason other than because they can.
read more and comment..

Sep 23, 2007 TechRead Read

Rails for Java Developers


I've picked up and put down quote a few Ruby and Rails books, but haven't found anything that really captured me. That is, until Rails for Java Developers. The discussion is intelligent, and the comparisons between Java and Rails approaches is a great learning process. Thankfully, it doesn't get into slamming one or the other but just focuses on the how. I've worked through some parts of the book so far (my Rails learning is not exactly on the fast track yet!), but I can definitely recommended it if you have the Java background.

Ruby on Rails for Dummies, on the other hand, simply reinforces my dislike of the whole Dummies idea. I'm not against straight-to-the-point beginner texts (on the contrary, that's what I was looking for!) but this books suffers the worst of two blights:
  • It doesn't get straight to the point. Only so many cutesy, hip analogies and stories I can deal with.

  • It lays a limited and 'closed' foundation of knowledge. For example, it takes you through project configuration with an IDE but never hints there is another way. Fine if you never want to go beyond the basics that you get spoon fed here, but if you have higher ambitions at some point you'll have to unlearn/relearn all of the fundamentals you learn here. I hate that. By all means teach me grade 1, but help me build a mental model that can accommodate grade 2,3 and beyond at the same time.
Give this a wide berth.




read more and comment..

Sep 23, 2007 Laugh Read

The Pyrates


Before Guybrush Threepwood, before Captain Jack Sparrow ... there was Captain Avery and Colonel Blood to shiver your timbers and brace the mains'l. Avast thar!

George MacDonald Fraser's Pyrates is a grand farce that rolls in just about every piratical stereotype. Similar in style to his Flashman series, and I think executed almost - but not quite - as successfully.

The delicious juxtaposition in book's dedication gives you an idea of GMF's style ;-)

In memory of the Most Reverend and Right Honourable Lancelot Blackburne (1658-1743)
Archibishop of York and Buccaneer



read more and comment..

Sep 19, 2007 SOAP BPEL Ajax Web 2.0 RSS SOA

Pipes - Web 2.0 Wake-up Call for BPEL?

Recently I've spent some time playing with Yahoo Pipes. I was tipped off by comments to Chris Muir's blog on Drowning in Oracle Blogs Aggregators.

So I've had some fun with Pipes, using it to aggregate all my Oracle news for example. Pipes is still beta and has a fairly modest objective of giving end-users a way to craft their own data feeds on the net, but I think there are some exciting implications.

My Little Experiment

I did a simple experiment with a Perl CGI that issues a "quote of the day" in JSON format, consumed it in Pipes, and then subscribed to an RSS version of the result in FeedReader.

I could have used an existing data source supported by Pipes (RSS, JSON, CSV or XML) but I wanted to experiement with formats. Hence the little bit of coding .. 

use strict;
use CGI;
use JSON;

print header();

my $obj = {
  title   => 'Quote of the Day',
  quote   => 'the only dependency we have on the proof of concept is whether it works or not'
};

print objToJson($obj);
1;
(btw, that's one of my favourite quotes from a collegue during a particularly long and weary evening;-)

The Pipes editor makes it a piece of cake to get tricky ... like add a flickr lookup that will roll in a suitable photo to go along with the quote:

All fairly straight-forward, but what grabbed my attention is how Pipes provides an extremely intuitive graphical editor that makes it simple for an end-user to transform and consume data in a hosted model that would conventionally require server-side programming to arrange. It even has an integrated "debugger" that lets you see the output at any stage of the pipe you select.

Pipes - a Web 2.0 Wake-up Call for BPEL?

There are a few things that Pipes can't do (yet), like handle SOAP Web Services, incorporate human workflow or asynchronous events, secure published pipes, and of course reach data sources or systems that are not accessible from the Internet.

But I'm thinking it wouldn't take too much enhancement along these lines and we'd see Pipes rapidly encroaching the BPEL domain (albeit without the standards support). This would be a perfect example of the Web 2.0 challenge to Enterprise IT.
  • Pipes - the funky UI that lets anyone create and publish their "flow"

  • BPEL - a robust standards-based engine that runs "processes" that have been designed, tested and deployed by experts
If these two extremes don't come crashing together soon, I think we are not trying hard enough!

I'm not sure if Yahoo could do this without a rip'n'replace of the Pipes back-end, and rethink the whole hosting model. More likely that we see someone re-think our approach to BPEL, and the set of use cases it assumes.

I don't hear or see much movement in this direction from the existing BPEL players however. That includes the commercial offerings like Oracle BPEL Process Manager and also the free/open source kind like ActiveBPEL and OpenBPEL.

I suspect we need to challenge a few key assumptions implicit in current BPEL offerings. That processes are (a) largely a conversation between systems, and (b) built by a developer (or at least a skilled business analyst).

While that can and will remain true for core business processes, I think Pipes is beginning to demonstrate that there is a bigger picture we have yet to address.

Put it this way. I'd like to take a robust BPEL engine with...

  • BPEL standards support of course

  • Web Services (WSDL + SOAP) and WSIF adapter model

  • Sophisticated human workflow and asynchronous task support

  • Something I can deploy behind the firewall if needed (to access enterprise goodies)

  • A decent security model

Then add some of the Pipes goodness:

  • Oh-so-Web-2.0 hosted design tools - made for end-users.

  • "Publish" instead of "Deploy". Implies automatically maintained (and accessible) registry of published pipes/processes.

  • Support for RSS, JSON, CSV and plain XML "web sources"

  • Inheritance by chaining or cloning existing pipes

  • Smart output rendering. Need RSS, JSON or SOAP? If it makes sense, ask for it and the correct format should be delivered. Transformation taken care of by the infrastructure, not the process definition.

As an enterprise user, this means I'd expect to be able to launch my company's BPELPipes site and see the pipes published by IT. If I need something a bit different, I just go ahead and create it (or clone an existing service). And once I've done creating my pipe, I can use it immediately as maybe an RSS feed or somthing I can embed in my portal. And share it with others if I like..

Perhaps here lies the future of Enterprise 2.0 Workflow (WikiWorkflow?!), finally bringing SOA to the people rather than having it left stuck somewhere in the middle tier.
read more and comment..