Stanford Free Crypto Class - Review

The free online cryptography course I attended this April was taught by Stanford professor Dan Boneh. Its infrastructure and organization are provided by coursera company.

The course was everything I expect from an university course. It explains both the theory and its practical consequences. It shows how ciphers work, how to use them, what are their limitations and why they have been designed the way they have been designed.

Secure Encryption in Java

Last time I wrote about cryptography, I outlined Apache Shiro crypto API and shown how to use its two symmetric ciphers. I also wrote that "You do not need more to encrypt and decrypt sensitive data in your applications."

I learned more about cryptography and found out that you need to know more. What I wrote is true to some extend, but unless you are careful your sensitive data may not be secure against all attackers.

Out of the box Shiro provides Blowfish-CBC and AES-CBC encryption methods and I recommended to use them. Both have been designed to protect against passive eavesdropping attacker and are good at it. Unfortunately, real attackers are more sophisticated and may break the system based on them.

Writing Eclipse Plugins Tutorial - Part 1

Eclipse is one of three most popular java development IDEs. One reason for its success is its extensibility. Writing eclipse plugins can be very fast and easy for anyone who knows what to do and already done it.

Unfortunately, doing something in Eclipse for the first time can be very time consuming and frustrating. Eclipse framework is huge, powerful and sometimes complicated. It may be difficult to figure out which features are available and how to use them.

This tutorial explains basics of all eclipse features needed to automate a simple java refactoring task. It shows how to add new items into the menu and how to analyze, modify and format java source code. It also shows how to use dialogs to communicate with users.

JPA Tutorial

Java persistent API is a specification and set of interfaces that helps with persistence of java objects into the database. It has been created after success of object relational mapping frameworks - the most popular is Hibernate.

JPA defines standard basic set of features that every object relational mapping framework should have. Almost all current O/R frameworks implement JPA specification. Of course, most of them have additional features to set them apart.

Saving/loading data with JPA is easier, faster and less error prone than writing SQL and mapping query results to objects. However, JPA does not free you from relational database understanding. And while you do not have to write SQL anymore, you have to learn JPQL which is very similar.

Running JNDI and JPA Without J2EE Container

We wanted to test some JPA code with as simple setup as possible. The plan was to use only Java and Maven, without an application server or other J2EE container.

Our JPA configuration needs two things to run successfully:

• database to store data,
• JNDI to access the database.

This post has two parts. First part shows how to use standalone JNDI and an embedded in-memory database in test. Remaining chapters explain how the solution works.

JavaScript Testing with JSTestDriver

Js-test-driver is an open source JavaScript unit tests runner written in Java. The project was started at Google and is under active development. It is available under Apache License 2.0 license.

Js-test-driver is able to run from command line and reports results to the standard output. As a result, it is possible to fully automate JavaScript tests and run them on a continuous integration server.

Additionally, js-test-driver comes with IntelliJ IDEA plugin and Eclipse plugin. Of course, Eclipse plugin is compatible with Aptana Studio. If you use one of these IDEs, you can run tests directly from IDE and see progress and results in a view. It is very similar to java jUnit plugin.

Apache Shiro Part 3 - Cryptography

Besides securing web pages and managing access rights Apache Shiro does also basic cryptography tasks. The framework is able to:

• encrypt and decrypt data,
• hash data,
• generate random numbers.

Shiro does not implement any cryptography algorithms. All calculations are delegated to Java Cryptography Extension (JCE) API. The main benefit of using Shiro instead of what is already present in Java is ease of use and secure defaults. Shiro crypto module is written in higher abstraction level and by default implements all known best practices.