Minimalist variant of JavaLoader that only instantiates bCrypt

19 views
Skip to first unread message

Dave Merrill

unread,
Nov 2, 2016, 11:36:14 AM11/2/16
to javaloader-dev
Hi, not a Java guy, wondering how hard it would be for someone with more knowledge than me to create a minimalist version of JavaLoader that only instantiates bCrypt, nothing else.

If that's not too hard, would it be significantly smaller, or would most of the full JavaLoader package be required?

If it's worth it, would anyone be willing to take a crack at it? This is for a personal project that's not open source yet, but I hope will be.

For reasons not worth going into here, source should be as small as possible, and I'd like to switch it from SHA-512 hashing to bCrypt.

Thanks in advance for any thoughts and/or help,
Dave

todd sharp

unread,
Nov 2, 2016, 12:32:46 PM11/2/16
to javaloa...@googlegroups.com
What version of CF are you running on that you can't use the baked in Java Loader stuff?

Otherwise, i'd just drop the JAR in the CF classpath and be done with it.

--
You received this message because you are subscribed to the Google Groups "javaloader-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to javaloader-dev+unsubscribe@googlegroups.com.
To post to this group, send email to javaloader-dev@googlegroups.com.
Visit this group at https://groups.google.com/group/javaloader-dev.
For more options, visit https://groups.google.com/d/optout.



--
Todd Sharp

Dave Merrill

unread,
Nov 2, 2016, 2:32:02 PM11/2/16
to javaloader-dev, to...@cfsilence.com
Thanks for your reply.

I didn't want to bore people with the details of this app, but those are reasonable questions...

This is a "portable" dev and support tool that can be installed on any CFML server through its own browser-based install UI. It shouldn't require any modification of the target environment beyond what its installer does, which is basically just unzip itself. In other words, no classpath changes, cf restart, etc.

It supports back to cf8 as of now, I'd rather not undermine that unless it's super necessary.

This tool has evolved over a long period of time, and is quite useful. It's my intention to open source it, then more of what it is and does will be clear. Moving to bCrypt is one of the things I want to do before opening it up.



On Wednesday, November 2, 2016 at 12:32:46 PM UTC-4, todd sharp wrote:
What version of CF are you running on that you can't use the baked in Java Loader stuff?

Otherwise, i'd just drop the JAR in the CF classpath and be done with it.
On Wed, Nov 2, 2016 at 10:42 AM, Dave Merrill <enig...@gmail.com> wrote:
Hi, not a Java guy, wondering how hard it would be for someone with more knowledge than me to create a minimalist version of JavaLoader that only instantiates bCrypt, nothing else.

If that's not too hard, would it be significantly smaller, or would most of the full JavaLoader package be required?

If it's worth it, would anyone be willing to take a crack at it? This is for a personal project that's not open source yet, but I hope will be.

For reasons not worth going into here, source should be as small as possible, and I'd like to switch it from SHA-512 hashing to bCrypt.

Thanks in advance for any thoughts and/or help,
Dave

--
You received this message because you are subscribed to the Google Groups "javaloader-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to javaloader-de...@googlegroups.com.
To post to this group, send email to javaloa...@googlegroups.com.



--
Todd Sharp

Dave Merrill

unread,
Nov 3, 2016, 12:52:08 PM11/3/16
to javaloader-dev, to...@cfsilence.com
No takers? I understand of course if no one has the time or inclination, but I would really appreciate it.

If it's a huge job, or would require nearly all of the full JavaLoader, it'd be good to know that too.

Thanks,
Dave

todd sharp

unread,
Nov 3, 2016, 4:43:26 PM11/3/16
to javaloa...@googlegroups.com

Javaloader is pretty defunct at this point. You're welcome to look at the source code yourself to see if you can rip out bits you don't need but I'm pretty sure no one is going to volunteer to do some free work for you.

I'd just include the whole library if I were you.


To unsubscribe from this group and stop receiving emails from it, send an email to javaloader-dev+unsubscribe@googlegroups.com.
To post to this group, send email to javaloader-dev@googlegroups.com.

Andrew Myers

unread,
Nov 3, 2016, 4:55:24 PM11/3/16
to javaloa...@googlegroups.com
_____________________________
From: todd sharp <to...@cfsilence.com>
Sent: Friday, November 4, 2016 7:43 am
Subject: Re: Minimalist variant of JavaLoader that only instantiates bCrypt
To: <javaloa...@googlegroups.com>

Todd Sharp

unread,
Nov 3, 2016, 4:59:18 PM11/3/16
to javaloa...@googlegroups.com

He already said he wants to support back to CF 8 so that won't work.


On Nov 3, 2016 4:55 PM, "Andrew Myers" <am2...@gmail.com> wrote:
_____________________________
From: todd sharp <to...@cfsilence.com>
Sent: Friday, November 4, 2016 7:43 am
Subject: Re: Minimalist variant of JavaLoader that only instantiates bCrypt

Andrew Myers

unread,
Nov 3, 2016, 5:04:49 PM11/3/16
to javaloa...@googlegroups.com
Ahh yep, sorry I saw that after I hit send :-(


Jamie Jackson

unread,
Nov 3, 2016, 5:42:36 PM11/3/16
to javaloa...@googlegroups.com
JavaLoader is about ~100k (k, not MB). You could put 14 of them on a floppy disk from 1986.

Maybe what you really want to know is: How do I configure JavaLoader to use jBCrypt? That would be a more straightforward question to answer.

On Wed, Nov 2, 2016 at 10:42 AM, Dave Merrill <enig...@gmail.com> wrote:

--

Dave Merrill

unread,
Nov 4, 2016, 6:59:06 AM11/4/16
to javaloader-dev
Loading bCrypt via JavaLoader isn't a problem, that's working fine.

The full JavaLoader would add very very roughly 20% to the size of this app. Would that push it over the line from viable to not? Of course not. Still, I hope you get why I'd look at other options before accepting that as the cost of adding that one hashing algorithm.

JavaLoader does a lot more than I need, and I've done some work on trimming it down at the CF level. But someone with more Java and class loader knowledge might do significantly better.

My hope was that this was a quick thing for someone with the right knowledge. If that's not the case, or if it'd be only 5% smaller anyway, or no one has the cycles, then so be it, just thought I'd ask.

Thanks for reading in any case,
Dave



On Thursday, November 3, 2016 at 5:42:36 PM UTC-4, Jamie Jackson wrote:
JavaLoader is about ~100k (k, not MB). You could put 14 of them on a floppy disk from 1986.

Maybe what you really want to know is: How do I configure JavaLoader to use jBCrypt? That would be a more straightforward question to answer.
On Wed, Nov 2, 2016 at 10:42 AM, Dave Merrill <enig...@gmail.com> wrote:
Hi, not a Java guy, wondering how hard it would be for someone with more knowledge than me to create a minimalist version of JavaLoader that only instantiates bCrypt, nothing else.

If that's not too hard, would it be significantly smaller, or would most of the full JavaLoader package be required?

If it's worth it, would anyone be willing to take a crack at it? This is for a personal project that's not open source yet, but I hope will be.

For reasons not worth going into here, source should be as small as possible, and I'd like to switch it from SHA-512 hashing to bCrypt.

Thanks in advance for any thoughts and/or help,
Dave

--
You received this message because you are subscribed to the Google Groups "javaloader-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to javaloader-de...@googlegroups.com.
To post to this group, send email to javaloa...@googlegroups.com.

Leigh

unread,
Nov 5, 2016, 10:45:23 AM11/5/16
to javaloa...@googlegroups.com
I do not have time to poke around much, but I would suggest taking a look over older versions. See what optional features were added to get an idea of which ones you could omit.

1. You could probably skip the /support (spring and dynamic proxy) folder. Does not sound like you are using either of those.
2. Generally speaking, none of *-src.zip's are needed, but inclusion may be required by licensing
3. It does not sound like you need JavaCompiler support either. (Requires java 1.6, it would not work on CF8 anyway.) Though it looks to be more integrated into the main component, so you would have to look over the code to determine how to omit it.
Reply all
Reply to author
Forward
0 new messages