OST [Open Source Technology]

Open Source advantages
What does Open Source mean and why is it so important to so many others ? We discuss this matter here, especially the advantages for businesses as yours.

``Open Source promotes software reliability and quality by supporting independent peer review and rapid evolution of source code. '' - opensource.org

Openness
All advantages of Open Source are a result of (ta-ta) its openness. Having the code makes it easy to resolve problems (by yourself or the next guy) which means that you don't have to rely on only one vendor for fixing potential problems. This is very important to understand everything that follows.

Stability
Since you can rely on anyone and since the license states that any modification shipped elsewhere should be equally open, this means that after a period of time Open Source software is more stable then most commercially distributed software. (beware: Open Source doesn't necessarily mean you don't have to pay for it, though it usually is a result of its freedom.)

Adaptability
Open Source software means Open Standards, thus it is easy to adapt software to work closely with other Open Source software and even closed protocols and proprietary applications. This solves vendor lock-in situations which ties your hands and knees to one and only one vendor if you choose one's products.

Quality
Not only does software evolve onto a stable product, a large userbase also supplies new possibilities, making it a feature-rich solution. More new features, less bugs and a broader (testing) audience (peer-review) are significant to the quality of a product.

Innovation
Competition is what drives innovation and Open Source keeps competition alive. As noone has any unfair advantages, everybody has the possibility to add value and provide services. Information wants to be free.

Security:
It is widely known that security by obscurity is not a secure practice in the long run. By opening the code and by wide adoption of Open Source software, it grows more secure. Generally, new Open Source projects tend to be insecure, but once a project matures and becomes production-ready, it is more reliable and more secure than most available commercial software.

Zero-price tag ?
Although Open Source doesn't necessarily mean that it doesn't cost a dime. Most Open Source software is freely available and doesn't cost any additional licenses per user/year. This allows us to cut down in price and spend more time to create more secure and adapted solutions than commercial consultancy firms.

Linux

What is Linux ?
Linux is an open operating system available under the GPL. This means the source code is freely available.

Anyone distributing machine executable versions of this code, should also be able to provide the source code. Also any changes to the source code should be available under the same licensing conditions.

Linux is mainly developed by volunteers all over the world, although the IT industry starts contributing as well.

Linux runs on widely differing hardware platforms ranging from small embedded systems over commodity personal computers to huge clusters for processor intensive jobs like scientific calculations or 3D rendering.

CPU architectures supported include IA32 (Intel, AMD, Cyrix,...), IA64 (Intel), m68k (Motorola), PowerPC(IBM/Motorola), Sparc (Sun), Sparc64 (Sun), MIPS, ARM, Alpha (Compaq/Digital).

Technically the term 'Linux' denotes only the kernel of the operating system. Various companies and groups of volunteers have build Linux distributions around this kernel.

A Linux distribution contains all necessary tools and programs to install and maintain the system, perform basic operations and develop software. In addition to this a number of applications are also included such as a web browser, MUA, news reader, bitmap editor, audio manipulation tools,... Almost all of these application programs carry a similar open license as the Linux kernel.

Key advantages of Linux
Linux source code is freely distributed- Tens of thousands of programmers have reviewed the source code to improve performance, eliminate bugs, and strengthen security. No other operating system has ever undergone this level of review. This Open Source design has created most of the advantages listed below.

Linux has the best technical support available- Linux is supported by commercial distributors, consultants, and by a very active community of users and developers. In 1997, the Linux community was awarded InfoWorld's Product of the Year Award for Best Technical Support over all commercial software vendors.

Linux has no vendor lock-in.- The availability of source code means that every user and support provider is empowered to get to the root of technical problems quickly and effectively. This contrasts sharply with proprietary operating systems, where even top-tier support providers must rely on the OS vendor for technical information and bug fixes.

Linux runs on a wide range of hardware-Most Linux systems are based on standard PC hardware, and Linux supports a very wide range of PC devices. However, it also supports a wide range of other computer types, including Alpha, Power PC, 680x0, SPARC, and Strong Arm processors, and system sizes ranging from PDAs (such as the PalmPilot) to supercomputers constructed from clusters of systems (Beowulf clusters).

Linux is exceptionally stable- Properly configured, Linux systems will generally run until the hardware fails or the system is shut down. Continuous up-times of hundreds of days (up to a year or more) are not uncommon.

Linux has the tools and applications you need- Programs ranging from the market-dominating Apache web server to the powerful GIMP graphics editor are included in most Linux distributions. Free and commercial applications meet are available to meet most application needs.

Linux interoperates with many other types of computer systems- Linux communicates using the native networking protocols of Unix, Microsoft Windows 95/NT, IBM OS/2, Netware, and Macintosh systems and can also read and write disks and partitions from these and other operating systems.

Linux has a low total cost of ownership-Although the Linux learning curve is significant, the stability, design, and breadth of tools available for Linux result in very low ongoing operating costs.

Linux: ``all for one and one for all?? All changes one makes in Open Source software will benefit each and everyone, all over the world. Without exceptions or constraints.

Linux is fun!

Servlets and JSP: An Overview

1. What are Java Servlets?
Servlets are Java technology's answer to CGI programming. They are programs that run on a Web server and build Web pages. Building Web pages on the fly is useful (and commonly done) for a number of reasons:

The Web page is based on data submitted by the user: For example the results pages from search engines are generated this way, and programs that process orders for e-commerce sites do this as well.

The data changes frequently- For example, a weather-report or news headlines page might build the page dynamically, perhaps returning a previously built page if it is still up to date.

The Web page uses information from corporate databases or other such sources- For example, you would use this for making a Web page at an on-line store that lists current prices and number of items in stock.

2. What are the Advantage of Servlets Over "Traditional" CGI?
Java servlets are more efficient, easier to use, more powerful, more portable, and cheaper than traditional CGI and than many alternative CGI-like technologies. (More importantly, servlet developers get paid more than Perl programmers :-).

Efficient.-With traditional CGI, a new process is started for each HTTP request. If the CGI program does a relatively fast operation, the overhead of starting the process can dominate the execution time. With servlets, the Java Virtual Machine stays up, and each request is handled by a lightweight Java thread, not a heavyweight operating system process.

Similarly, in traditional CGI, if there are N simultaneous request to the same CGI program, then the code for the CGI program is loaded into memory N times.

With servlets, however, there are N threads but only a single copy of the servlet class. Servlets also have more alternatives than do regular CGI programs for optimizations such as caching previous computations, keeping database connections open, and the like.

Convenient- Hey, you already know Java. Why learn Perl too? Besides the convenience of being able to use a familiar language, servlets have an extensive infrastructure for automatically parsing and decoding HTML form data, reading and setting HTTP headers, handling cookies, tracking sessions, and many other such utilities.

Powerful-Java servlets let you easily do several things that are difficult or impossible with regular CGI. For one thing, servlets can talk directly to the Web server (regular CGI programs can't). This simplifies operations that need to look up images and other data stored in standard places. Servlets can also share data among each other, making useful things like database connection pools easy to implement. They can also maintain information from request to request, simplifying things like session tracking and caching of previous computations.

Portable- Servlets are written in Java and follow a well-standardized API. Consequently, servlets written for, say I-Planet Enterprise Server can run virtually unchanged on Apache, Microsoft IIS, or WebStar. Servlets are supported directly or via a plugin on almost every major Web server.

Inexpensive- There are a number of free or very inexpensive Web servers available that are good for "personal" use or low-volume Web sites. However, with the major exception of Apache, which is free, most commercial-quality Web servers are relatively expensive.

Nevertheless, once you have a Web server, no matter the cost of that server, adding servlet support to it (if it doesn't come preconfigured to support servlets) is generally free or cheap.

3. What is JSP?
Java Server Pages (JSP) is a technology that lets you mix regular, static HTML with dynamically-generated HTML. Many Web pages that are built by CGI programs are mostly static, with the dynamic part limited to a few small locations. But most CGI variations, including servlets, make you generate the entire page via your program, even though most of it is always the same. JSP lets you create the two parts separately. Here's an example:

Welcome to Our Store
Welcome,
To access your account settings, click here.

Regular HTML for all the rest of the on-line store's Web page.

4. What are the Advantages of JSP?
vs. Active Server Pages (ASP)- ASP is a similar technology from Microsoft. The advantages of JSP are twofold. First, the dynamic part is written in Java, not Visual Basic or other MS-specific language, so it is more powerful and easier to use. Second, it is portable to other operating systems and non-Microsoft Web servers.

vs. Pure Servlets- JSP doesn't give you anything that you couldn't in principle do with a servlet. But it is more convenient to write (and to modify!) regular HTML than to have a zillion println statements that generate the HTML. Plus, by separating the look from the content you can put different people on different tasks: your Web page design experts can build the HTML, leaving places for your servlet programmers to insert the dynamic content.

vs. Server-Side Includes (SSI)-SSI is a widely-supported technology for including externally-defined pieces into a static Web page. JSP is better because it lets you use servlets instead of a separate program to generate that dynamic part. Besides, SSI is really only intended for simple inclusions, not for "real" programs that use form data, make database connections, and the like.

vs. JavaScript- JavaScript can generate HTML dynamically on the client. This is a useful capability, but only handles situations where the dynamic information is based on the client's environment. With the exception of cookies, HTTP and form submission data is not available to JavaScript. And, since it runs on the client, JavaScript can't access server-side resources like databases, catalogs, pricing information, and the like.

vs. Static HTML-Regular HTML, of course, cannot contain dynamic information. JSP is so easy and convenient that it is quite feasible to augment HTML pages that only benefit marginally by the insertion of small amounts of dynamic data. Previously, the cost of using dynamic data would preclude its use in all but the most valuable instances.

Digital Signatures in Java

In public key cryptography, there are two keys. One is used by the sender and is usually private. One is used by the receiver and is usually public.

The sender uses the private key to encode a message or data, and the receiver uses the public key to decode the message.

Digital signatures work just like public key cryptography. The signer encodes data with his own private key, and then anyone with his public key can decode it. This allows any receiver to verify the source or signer of data as accurate and guarantee its integrity and authenticity.

To set up a digital signature in Java, you first need to set up a private key, usually by using keytool or the security API methods. Programmers often use the Java Certificate feature to securely verify public key authenticity.

After you have a public key, you generate a digital signature using the jarsigner tool or the API methods. Use the Signature class to sign the data by creating the signature object, initialize it for signing, processing the data, and then sign it. After it's signed, you export the objects into files for shipping to the receiver.

Once the data is signed, you send the receiver the data and signature. You must supply the receiver with the public key corresponding to the private key you used to generate the signature. The receiver imports the public key then uses the key to verify integrity. The receiver can verify by grabbing the object, initializing it for verification, processing the data, and then comparing the signature.

You need two applications to use Java's digital signature feature. One application generates the digital signature (the sender). The other application verifies authenticity (the receiver).

The Sender Code
The methods for the sending code are part of the java.security package and are usually placed between try and catch blocks. The first step is to produce the public and private keys.

In order to create a digital signature, you need a private key. The program needs to generate a key pair by using the KeyPairGenerator class. First, you need to create the key pair generator, by calling the getInstance method on the KeyPairGenerator class. You can use a number of different signature algorithms for the generator (Sun Microsystems actually provides a Digital Signature Algorithm, or DSA).

After creating the key pair generator you must initialize it. The KeyPairGenerator class has an initialize method that takes two types of arguments, one for keysize and one for randomness. The keysize is the key length (in bits). The source of randomness must be an instance of the SecureRandom class. Finally, you generate the pair of keys and store them in Privatekey and Publickey objects.

/* create a key pair generator */

KeyPairGenerator instance = KeyPairGenerator.getInstance("signaturealgorithm");

/* Initialize the keypair generator */

SecureRandom random = SecureRandom.getInstance("algorithm", "provider");Instance.initialize(sizeinbits, randomsource);

/* store the pair of keys */

KeyPair pair = instance.generateKeyPair();PrivateKey private = pair.getPrivate();PublicKey public = pair.getPublic();

Signing the data is the second step. A digital signature is created and verified using an instance of the Signature class. First you create a Signature object using the signature algorithm you chose (for example Sun Microsystem's DSA). You must then use a private key to initialize the signature object. You then supply the data to be signed to the Signature object by calling the update method.

Once all of the data has been given to the Signature object, you generate the signature of the data. Then you save the Signature bytes in one file and the public key bytes in another so you can send them. You will have three pieces to send; the data, the signature, and the public key. The signature is placed in a byte array. The public key is placed in a PublicKey object. You can get the encoded key bytes by calling the getEncoded method and store the bytes in a file.

/* create signature object */

Signature signaturealgorythm = Signature.getInstance("algorithm", "provider")

/* initialize signature object */

signaturealgorythm.initializeSignature(private);

/* call for update methods belong here*/

/* generate signature */

Byte[] realSignature = signaturealgorythm.signature();

/* save the signature and public key in files */

The Receiver
To verify the signature and file, a receiver needs the data, the signature, and the public key. The methods for verifying data are part of the java.security package, and are usually placed between try and catch blocks.

The code needs to import the encoded public key bytes and convert them to PublicKey. PublicKey is necessary because that is what the Signature initVerify method requires to initialize the Signature object for verification. Once you hold the encoded public key bytes, you can then use the KeyFactory class to instantiate a public key from it's encoding. You need a key specification, a KeyFactory object to do the conversion, and then you use the KeyFactory object to generate a PublicKey from the key specification.

The signature is verified using an instance of the Signature class. You need to create a Signature object that uses the same algorithm that was used to generate the signature. Then you need to initialize the signature object and give the Signature object the data that needs to be verified by again calling the update method.

Once the Signature object has all of the data, you can verify the signature. The signature was read into a byte array, and a Boolean verifies value can be set to true if the alleged signature is the actual signature of the specified data file generated by the private key corresponding to the public key.