Why is Netbeans > Eclipse?
Mohamed Bana
Casper Bang
official top-down dominated by Sun and the other is the bottom-up
grassroots dominated by the Eclipse stuff (SWT, OSGi etc.). Usually
the two lives in harmony (pun intended) but people's preferences does
tend to go with whichever camp they are used to. I hope I offend no
one by suggesting that The Java Posse members tend to belong to the
first camp (all but Dick worked for Sun) so that would explain your
question.
Sun was veeery slow in getting on the IDE wagon, but I think NetBeans
is one of their greatest asset of this day and age. It's true that it
feels slower than Eclipse, but I think that has to do with some
unfortunate "perceived performance" optimizations in NetBeans which
appears to be ironed out slowly. What annoys me more than the UI
responsiveness is the constant I/O going on, although after getting an
SSD I don't really feel that anymore. I think you will find many who
thinks Eclipse is better - i.e. Google targets all of their SDK's for
Eclipse (Android, GWT...).
/Casper
kibitzer
really tried hard to make it the best they can. I can't speak to the
Linux experience, but here's why I like NetBeans:
* it's a far more intuitive IDE. I never got on the Eclipse bandwagon
-- around that time I was using IntelliJ Idea -- but every time I used
Eclipse it was a struggle to find where they'd put things: menu items,
preferences, features. It bears the sometimes odd IBM thinking of UI
placement and design.
* for the most part, the extensions just work. Until the latest
Eclipse release, I always had problems installing extensions due to
missing dependencies and such. Always. Now granted, that might say
something about my brain :-) -- all I know is NetBeans has not given
me that trouble.
* the font rendering is interesting because the 6.0 release onwards
have been exceptionally clean and clear, a real joy to use.
* the intangible -- I just like the way NetBeans does things -- the
way it looks, the way it works, its general build philosophy.
* choosing which package to install (I mean an initial NetBeans
package, not an extension) is simple, clear and easy.
Jan Goyvaerts
But still... I have to look to this all day long. So I really prefer it to be a bit slower and good looking than the opposite. :-)
--
You received this message because you are subscribed to the Google Groups "The Java Posse" group.
To post to this group, send email to java...@googlegroups.com.
To unsubscribe from this group, send email to javaposse+...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/javaposse?hl=en.
Fabrizio Giudici
For me it's a matter of look & feel really. And now also for JavaFX. Netbeans look definitly better than Eclipse. But Eclipse is definitly faster and more stable. Looking up a class in 600+ class project with many jar in the classpath is painful in Netbeans. While this is immediate in Eclipse. (how do they do this ?) The editor seems to be more powerful too. And the number of plugins easily outnumbers those of Netbeans. And its startup time is horrible. That is, in windows. In Linux it flies. Disabling the virus scanner in windows helps a bit though...
But still... I have to look to this all day long. So I really prefer it to be a bit slower and good looking than the opposite. :-)
On Sun, Dec 20, 2009 at 00:56, Mohamed Bana <moh...@bana.org.uk> wrote:
i'd like to hear why everyone seems to think Netbeans is better than Eclipse. �i'm not not in agreement with the way Eclipse is always made to seem like the lesser of the two, somewhat unprofessional.
- as a Linux user i can tell you Netbeans is noticeably slow compared to Eclipse, this is because it's using Swing. �font rendering is also very bad.
- it's funny how Netbeans are just starting to copy the functionality that Eclipse has had from a while --- e.g., mylyn.- Eclipse RCP is far more mature.
I think that there are many subjective feelings, and just a few objective ones. Look & feel is clearly subjective; indeed, speed can be greatly subjective if a detailed context is not given. As Jan said, there are huge performace figures with Windows and Linux and I agree (my experience is that even Mac OS X is slower, even though things have greatly improved in the latest months, as I don't feel any longer forced to work with Linux). I don't think that there are two camps, one "top-bottom" from Sun and one bottom-up from IBM - ah, sorry, I meant Eclipse. I see that there are only three products worth mentioning around, IDEA is the outsider and the rest of us falls in either Eclipse or NetBeans camp. Personally I'm pretty much sure that NetBeans is better, but in an average context I think it's fair to say that they are equivalently good, each one with pros and cons, satisfying different palates.- does Netbeans support OSGI? �to my knowledge, IntelliJ IDEA and Eclipse does.� �Mohamed
As per the original points:
Please stop spreading FUD about Swing in 2010. :-) SWT made sense a lot of years ago, but Swing is no more the thing of ten years ago. It's fast and hardware accelerated. Only looking at the list of big corporates working with the NetBeans Platform, which are just a subset of people using Swing, you can see that lots of large applications run with Swing without problems. I'm also working with a large customer developing on Swing (plain Swing, not the platform) with an application that is extremely rich, fast and responsive (I've been at last cleared for an interview, so I'll be able to post about it in a matter of weeks). So, the only SWT applications around seem to be those based on Eclipse, while if there are no constraints people seem to like Swing more. Of course NetBeans can be less responsive than Eclipse (I'd not say that, but it can of course), and there are many possible causes other than Swing. SWT for sure has got a few quality points, such as better font rendering in case one is seriously commited about it. But it's not a performance thing.- as a Linux user i can tell you Netbeans is noticeably slow compared to Eclipse, this is because it's using Swing. �font rendering is also very bad.
- Eclipse RCP is far more mature.
Honestly, if one is deeply interested in OSGi this has been a strong point for Eclipse. But it's going to get thinner and thinner and eventually disappear: not only in 2009 NetBeans has introduced some initially experimental OSGi support (http://wiki.netbeans.org/OSGiAndNetBeans), but I can tell you that the recent 6.9 roadmap just disclosed include OSGi support with the NetBeans Platform (http://wiki.netbeans.org/NetBeans_69). People building on the NetBeans Platform will be able to choose whether they want to be OSGi or not.- does Netbeans support OSGI? �to my knowledge, IntelliJ IDEA and Eclipse does.
Last but not least, I'm curious about the initial sentence:
"i'd like to hear why everyone seems to think Netbeans is better than Eclipse."
PS For what concerns NetBeans being driven "top-down" from Sun, I can say that the OSGi thing, plus other stuff, has been strongly influenced by the community. With my three year experience in the NetBeans community I can say that of course there are many more issues to address, but the relationship between Sun and the community has constantly improved in this time.
-- Fabrizio Giudici - Java Architect, Project Manager Tidalwave s.a.s. - "We make Java work. Everywhere." weblogs.java.net/blog/fabriziogiudici - www.tidalwave.it/people Fabrizio...@tidalwave.it
Jess Holle
That said, the code scanning is really getting to me.� It is abundantly clear to me that:
- Scanning source code should *never* block (much less hang!) any action in the IDE (though some like refactoring should loudly warn in such cases).
- Today it blocks all sorts of things, even "attach debugger"!
- I still get lots of hangs from trying to work while the scanner
is working
- Re-scanning a body of source code should never cause the IDE to temporarily lose knowledge of any class that is present the whole time
- Updates should be atomic
I like NetBeans' Ant integration philosophy and look-and-feel (Eclipse looks wanky to me), etc, but the scanner is really obnoxious.
Soon I'll likely stop worrying about this as NetBeans' scanner is also totally ignorant of annotation processors that generate source code, whereas Eclipse handles this.� This is likely to be the straw (or plank rather) that breaks the camel's back.
--
Jess Holle
Jan Goyvaerts wrote:
For me it's a matter of look & feel really. And now also for JavaFX. Netbeans look definitly better than Eclipse. But Eclipse is definitly faster and more stable. Looking up a class in 600+ class project with many jar in the classpath is painful in Netbeans. While this is immediate in Eclipse. (how do they do this ?) The editor seems to be more powerful too. And the number of plugins easily outnumbers those of Netbeans. And its startup time is horrible. That is, in windows. In Linux it flies. Disabling the virus scanner in windows helps a bit though...
But still... I have to look to this all day long. So I really prefer it to be a bit slower and good looking than the opposite. :-)
On Sun, Dec 20, 2009 at 00:56, Mohamed Bana <moh...@bana.org.uk> wrote:
i'd like to hear why everyone seems to think Netbeans is better than Eclipse. �i'm not not in agreement with the way Eclipse is always made to seem like the lesser of the two, somewhat unprofessional.
- as a Linux user i can tell you Netbeans is noticeably slow compared to Eclipse, this is because it's using Swing. �font rendering is also very bad.
- it's funny how Netbeans are just starting to copy the functionality that Eclipse has had from a while --- e.g., mylyn.- Eclipse RCP is far more mature.
- does Netbeans support OSGI? �to my knowledge, IntelliJ IDEA and Eclipse does.� �Mohamed
--
You received this message because you are subscribed to the Google Groups "The Java Posse" group.
To post to this group, send email to java...@googlegroups.com.
To unsubscribe from this group, send email to javaposse+...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/javaposse?hl=en.
Eric Newcomer
Eric
Neil Bartlett
Your answer regarding OSGi seems to be about the runtime, i.e. use of
OSGi in the NB Platform. However I haven't seen anything about tooling
support for building OSGi bundles using NetBeans.
Given that NB appears to be moving to OSGi for its runtime, and
GlassFish v3 already permits deployment of OSGi bundles (along with
other Sun products such as Java CAPS), it seems NB will need some OSGi
tooling soon. Do there exist plans to offer any?
Regards,
Neil
On Dec 20, 1:01 pm, Fabrizio Giudici <fabrizio.giud...@tidalwave.it>
wrote:
> Jan Goyvaerts wrote:
> > For me it's a matter of look & feel really. And now also for JavaFX.
> > Netbeans look definitly better than Eclipse. But Eclipse is definitly
> > faster and more stable. Looking up a class in 600+ class project with
> > many jar in the classpath is painful in Netbeans. While this is
> > immediate in Eclipse. (how do they do this ?) The editor seems to be
> > more powerful too. And the number of plugins easily outnumbers those
> > of Netbeans. And its startup time is horrible. That is, in windows. In
> > Linux it flies. Disabling the virus scanner in windows helps a bit
> > though...
>
> > But still... I have to look to this all day long. So I really prefer
> > it to be a bit slower and good looking than the opposite. :-)
>
> > On Sun, Dec 20, 2009 at 00:56, Mohamed Bana <moha...@bana.org.uk
> > <mailto:moha...@bana.org.uk>> wrote:
>
> > i'd like to hear why everyone seems to think Netbeans is better
> > than Eclipse. i'm not not in agreement with the way Eclipse is
> > always made to seem like the lesser of the two, somewhat
> > unprofessional.
>
> > - as a Linux user i can tell you Netbeans is noticeably slow
> > compared to Eclipse, this is because it's using Swing. font
> > rendering is also very bad.
> > - it's funny how Netbeans are just starting to copy the
> > functionality that Eclipse has had from a while --- e.g., mylyn.
> > - Eclipse RCP is far more mature.
> > - does Netbeans support OSGI? to my knowledge, IntelliJ IDEA and
> > Eclipse does.
>
> > �Mohamed
>
> I think that there are many subjective feelings, and just a few
> objective ones. Look & feel is clearly subjective; indeed, speed can be
> greatly subjective if a detailed context is not given. As Jan said,
> there are huge performace figures with Windows and Linux and I agree (my
> experience is that even Mac OS X is slower, even though things have
> greatly improved in the latest months, as I don't feel any longer forced
> to work with Linux). I don't think that there are two camps, one
> "top-bottom" from Sun and one bottom-up from IBM - ah, sorry, I meant
> Eclipse. I see that there are only three products worth mentioning
> around, IDEA is the outsider and the rest of us falls in either Eclipse
> or NetBeans camp. Personally I'm pretty much sure that NetBeans is
> better, but in an average context I think it's fair to say that they are
> equivalently good, each one with pros and cons, satisfying different
> palates.
>
> As per the original points:
>
> > - as a Linux user i can tell you Netbeans is noticeably slow
> > compared to Eclipse, this is because it's using Swing. font
> > rendering is also very bad.
>
> Please stop spreading FUD about Swing in 2010. :-) SWT made sense a lot
> of years ago, but Swing is no more the thing of ten years ago. It's fast
> and hardware accelerated. Only looking at the list of big corporates
> working with the NetBeans Platform, which are just a subset of people
> using Swing, you can see that lots of large applications run with Swing
> without problems. I'm also working with a large customer developing on
> Swing (plain Swing, not the platform) with an application that is
> extremely rich, fast and responsive (I've been at last cleared for an
> interview, so I'll be able to post about it in a matter of weeks). So,
> the only SWT applications around seem to be those based on Eclipse,
> while if there are no constraints people seem to like Swing more. Of
> course NetBeans can be less responsive than Eclipse (I'd not say that,
> but it can of course), and there are many possible causes other than
> Swing. SWT for sure has got a few quality points, such as better font
> rendering in case one is seriously commited about it. But it's not a
> performance thing.
>
> > - Eclipse RCP is far more mature.
>
> Can you elaborare more on that? It can be subjective or objective, of
> course - without any argument is purely subjective. :-) The large number
> of people building on NetBeans Platform of course don't think that they
> are building on an immature platform.
>
> > - does Netbeans support OSGI? to my knowledge, IntelliJ IDEA and
Kfir Shay
OSGi came from the embedded space, and was not born or dictated by Sun.
kfir
Eric Newcomer
Yes, OSGi was originally intended for the embedded space, for home automation gateway systems in particular. However Sun was originally among the sponsors and OSGi was originally started within the JCP as JSR 8. This is the point, that it was originally one of the "top down" style projects from the Sun-controlled Java initiative. It did not originate as one of the "grass roots" bottom up style of Java projects, although you might say that since the independent OSGi Alliance was formed and took over the evolution of JSR 8 (which OSGi still is doing by the way) that it became a grass roots bottom up project, but OSGi did not start out that way. That was the point.
Eric
Casper Bang
fragmentation I think can be observed. I could and probably should
have used Apache rather than Eclipse to paint a picture of the
"alternative" camp - whatever you prefer to call it. Those who gave us
a proper logging facility, a proper web framework etc. etc.
/Casper
On Dec 21, 4:47 pm, Eric Newcomer <enewco...@gmail.com> wrote:
> Kfir,
>
> Yes, OSGi was originally intended for the embedded space, for home
> automation gateway systems in particular. However Sun was originally among
> the sponsors and OSGi was originally started within the JCP as JSR 8. This
> is the point, that it was originally one of the "top down" style projects
> from the Sun-controlled Java initiative. It did not originate as one of the
> "grass roots" bottom up style of Java projects, although you might say that
> since the independent OSGi Alliance was formed and took over the evolution
> of JSR 8 (which OSGi still is doing by the way) that it became a grass roots
> bottom up project, but OSGi did not start out that way. That was the point.
>
> Eric
>
> On Mon, Dec 21, 2009 at 9:09 AM, Kfir Shay <kfir.s...@gmail.com> wrote:
> > Eric,
>
> > OSGi came from the embedded space, and was not born or dictated by Sun.
>
> > kfir
>
> > On Sun, Dec 20, 2009 at 9:33 AM, Eric Newcomer <enewco...@gmail.com>
> > wrote:
> > > Just one small thing here, OSGi is not really "Eclipse stuff" but
> > > "independent" stuff - I guess you could call it grass roots now but its
> > > origins were in the JCP (JSR 8) more than 10 years ago now, and was at
> > that
> > > time among the "official top-down" Sun backed initiatives. This of
> > course
> > > long before anyone even thought of Eclipse. This is just to say that
> > OSGi
> > > is not "Eclipse stuff" the way RCP for example is. It's much more generic
> > -
> > > Eclipse just happens to be the "biggest name" adopter of OSGi.
>
> > > Eric
>
> > > On Sat, Dec 19, 2009 at 10:40 PM, Casper Bang <casper.b...@gmail.com>
> > >> javaposse+...@googlegroups.com<javaposse%2Bunsu...@googlegroups.com>
> > .
> > >> For more options, visit this group at
> > >>http://groups.google.com/group/javaposse?hl=en.
>
> > > --
>
> > > You received this message because you are subscribed to the Google Groups
> > > "The Java Posse" group.
> > > To post to this group, send email to java...@googlegroups.com.
> > > To unsubscribe from this group, send email to
> > > javaposse+...@googlegroups.com<javaposse%2Bunsu...@googlegroups.com>
> > .
> > > For more options, visit this group at
> > >http://groups.google.com/group/javaposse?hl=en.
>
> > --
>
> > You received this message because you are subscribed to the Google Groups
> > "The Java Posse" group.
> > To post to this group, send email to java...@googlegroups.com.
> > To unsubscribe from this group, send email to
> > javaposse+...@googlegroups.com<javaposse%2Bunsu...@googlegroups.com>
Eric Newcomer
Yes, agreed. Osgi is just kind of funny since it kind of historically straddles the two.
Eric
On Dec 21, 2009 11:52 AM, "Casper Bang" <caspe...@gmail.com> wrote:
In any event, my overall goal was to point out a subtle but existing
fragmentation I think can be observed. I could and probably should
have used Apache rather than Eclipse to paint a picture of the
"alternative" camp - whatever you prefer to call it. Those who gave us
a proper logging facility, a proper web framework etc. etc.
/Casper
On Dec 21, 4:47 pm, Eric Newcomer <enewco...@gmail.com> wrote: > Kfir, > > Yes, OSGi was originally...
> On Mon, Dec 21, 2009 at 9:09 AM, Kfir Shay <kfir.s...@gmail.com> wrote: > > Eric, > > > OSGi came ...
> > On Sun, Dec 20, 2009 at 9:33 AM, Eric Newcomer <enewco...@gmail.com>
> > wrote: > > > Just one small thing here, OSGi is not really "Eclipse stuff" but > > > "independen...
> > > On Sat, Dec 19, 2009 at 10:40 PM, Casper Bang <casper.b...@gmail.com>
> > wrote: > > > >> I tend to think of the Java community as having two camps, one is the > > >> off...
> > >> javaposse+...@googlegroups.com<javaposse%2Bunsu...@googlegroups.com>
> > . > > >> For more options, visit this group at > > >>http://groups.google.com/group/javaposse?hl...
> > > javaposse+...@googlegroups.com<javaposse%2Bunsu...@googlegroups.com>
> > . > > > For more options, visit this group at > > >http://groups.google.com/group/javaposse?hl=e...
> > javaposse+...@googlegroups.com<javaposse%2Bunsu...@googlegroups.com>
> > . > > For more options, visit this group at > >http://groups.google.com/group/javaposse?hl=en. ...
Kfir Shay
> To unsubscribe from this group, send email to javaposse+...@googlegroups.com.
Casper Bang
tower one is superior to the official JSF. I like Wicket because it
lets me be a Java programmer and not an XML masochist.
/Casper
On Dec 21, 5:56 pm, Kfir Shay <kfir.s...@gmail.com> wrote:
> just of curiosity what did you mean when you said proper web framework?!
>
Kfir Shay
I don't do web apps in java :-/
Java is great for web services and background processes doing the
heavy lifting behind the scene but I don't see it shine in web app
realm
As for the IDE question that started this thread, I use IntelliJ
Andre Van Klaveren
realm"
OMG! ROFLMAO!!
Thanks! I needed that. ;)
Neil Bartlett
I don't think "everyone" thinks Netbeans is better than Eclipse. There
are certain communities and forums where you hear a lot of pro-
Netbeans voices, and others where you hear a lot of pro-Eclipse
voices. These are really tiny cross-sections of the IDE-using public,
so don't extrapolate from them too wildly.
I do think that *this* particular forum is somewhat more pro-Netbeans
than others, perhaps because of Tor.
Regards,
Neil
Kfir Shay
are an Architect of some sort probably working for a big corp / bank.
If you were in the valley or a startup soaked area you would probably
understand where I am coming from.
oh well...
Andre Van Klaveren
I just thought it was funny that you said it in such a over-reaching way. I do understand where you're coming from, and I think I understand *why* you have that view. It sounds like you've been burned by Java in the web space.
Spencer Uresk
while I really prefer Eclipse the most, I think it comes down to
largely personal preference and how a particular IDE matches the way
you work.
I've been working on an internal Eclipse distribution aimed at
improving developer productivity with our software stack. About a year
or so ago, as part of the requirement gathering process, I went around
and talked to the various teams about IDE usage. We are mostly Eclipse
but have a large (and slowly growing) number of IntelliJ users and a
handful of Netbeans users, and I was interested in finding out what
users of other IDEs liked the most. I found a few interesting things:
- Developers often have a really hard time articulating why they like
a particular IDE over another. I think that goes back to the personal
preference and muscle memory thing.
- When they do think of specific things they like about an IDE, it
isn't often something that is clear-cut or consistent with responses
from other developers. I remember talking with some IntelliJ users and
they ticked off a list of things they liked about IntelliJ, and I
remember thinking on some of them "Wow! I really hated that particular
behavior and it is one of the reasons I quit using it."
So, while they may kind of leapfrog each other in certain areas
(support for various alternate JVM languages, for example), I think
you'd have a hard time convincing me that any one IDE is better than
another.
Kfir Shay
driven web sites (platforms really) mostly in the media and web space.
And no I didn't get burn in the Java web space in fact Java scaled
well and was a great solution for us.
That didn't change the fact that over time the web app was replaced to
something simpler and lighter, as we moved to be strictly js on the
front end with java web services serving json, as I was part of the
backend team it wasn't really my call but the front end developers
were happy to move away from java.
Anyway... first let me say that I agree with you that making any
technology shine depends more on the implementation than anything
else. With that said my previous statement was in the context of new
web application.
These days it is a lot simpler and cheaper to find Python / php / Ruby
developers in the valley, using these technologies works well for a
majority of the web application domain and tend to have a lower cost /
higher productivity.
Sure for some problems Java is still the best choice but that case is
not the majority anymore.
No body said it can't be done in Java, nor that Java can't shine
technically. It was more about the fact that there is a shift in the
industry away from Java with regard to web applications. That shift
exists for X number of reasons whatever if we like it or not. just my
.02
On Mon, Dec 21, 2009 at 2:34 PM, Andre Van Klaveren
Spencer Uresk
hell a lot these days, and I'm not sure I understand it. I can see
these complaints being made several years ago when annotation-based
configuration hadn't really caught on (although, EJB2 + Struts was
still worse than anything I encountered in Spring + JSF), but these
days it is pretty easy to avoid an XML mess.
I've used JSF and Spring (and Seam, in some cases) over the past few
years and rarely find myself staring at XML, so I guess I'm curious as
to what other people are doing differently?
Casper Bang
can't use exploratory development (let's see what this validator can
do etc...) and tags can be combined in arbitrary ways. The devil will
always be in the details, which you have to comb the documentation for
- a particulary hairy thing to do with RichFaces [http://
docs.jboss.org/richfaces/3.3.2.GA/en/devguide/html_single/]. And
imperative constructs always seem to seep into the markup, i.e.
rich:dataTable is really just a templated way to state the old
c:forEach.
But it's not JUST the XML aspect that gets to me with JSF, it's also
the inherent focus on session scope [http://
coffeecokeandcode.blogspot.com/2009/05/pain-of-request-scoped-
jsf.html]. Some people appear to have no trouble with it and that's
good for them. But me... never again.
/Casper
Reinier Zwitserloot
I want from netbeans:
- editor
- non-java language support
- kenai and hg support
I want from eclipse:
- settings management
- source traversal
- refactor scripts
- project management
- 'working set' concept
> > > > >> > >> javaposse+...@googlegroups.com<javaposse%2Bunsubscribe@googlegroups .com>
> > > > >> > .
> > > > >> > >> For more options, visit this group at
> > > > >> > >>http://groups.google.com/group/javaposse?hl=en.
>
> > > > >> > > --
>
> > > > >> > > You received this message because you are subscribed to the Google Groups
> > > > >> > > "The Java Posse" group.
> > > > >> > > To post to this group, send email to java...@googlegroups.com.
> > > > >> > > To unsubscribe from this group, send email to
> > > > >> > > javaposse+...@googlegroups.com<javaposse%2Bunsubscribe@googlegroups .com>
> > > > >> > .
> > > > >> > > For more options, visit this group at
> > > > >> > >http://groups.google.com/group/javaposse?hl=en.
>
> > > > >> > --
>
> > > > >> > You received this message because you are subscribed to the Google Groups
> > > > >> > "The Java Posse" group.
> > > > >> > To post to this group, send email to java...@googlegroups.com.
> > > > >> > To unsubscribe from this group, send email to
> > > > >> > javaposse+...@googlegroups.com<javaposse%2Bunsubscribe@googlegroups .com>
Spencer Uresk
> It's just that XML is not type safe (apart from a basic XSD) so you
> can't use exploratory development (let's see what this validator can
> do etc...) and tags can be combined in arbitrary ways. The devil will
> always be in the details, which you have to comb the documentation for
> - a particulary hairy thing to do with RichFaces [http://
> docs.jboss.org/richfaces/3.3.2.GA/en/devguide/html_single/]. And
> imperative constructs always seem to seep into the markup, i.e.
> rich:dataTable is really just a templated way to state the old
> c:forEach.
I get why XML is bad for a lot of things, but I'm a little confused. I
thought you were referring to configuration files (which was kind of a
problem), but it sounds as though your issue is with the tag libraries
used to construct the actual page - is that the case? If so, then I'm
not sure what that really has to do with XML, other than the fact that
if you are using facelets your page has to be proper XHTML. Really,
the only way to solve the problems you describe in the view layer is
to write your views in code, and that brings a whole new set of
problems.
Part of the problem, of course, is that the tool support JSF was
supposed to lend itself so well to has never materialized, which is
disappointing.
> But it's not JUST the XML aspect that gets to me with JSF, it's also
> the inherent focus on session scope [http://
> coffeecokeandcode.blogspot.com/2009/05/pain-of-request-scoped-
> jsf.html]. Some people appear to have no trouble with it and that's
> good for them. But me... never again.
Right, JSF 1.x certainly did favor stateful web applications and it
caused a fair share of problems for people when they realized what
that statefulness cost. For what it's worth, the people working on JSF
recognized this eventually and now JSF 2 has gone great lengths to
lend itself better to stateless application development.
We have seen a lot of backlash against stateful applications the last
few years. It is easy to put too much stuff in the session by accident
and scoping is sometimes an issue. Seam and its conversation scope
helped somewhat here, although in a lot of non-trivial use cases we
saw people misusing (on accident, usually) the conversation scope and
it ended up effectively being session-scoped. So, I fully understand
the problem with stateful applications. However, as I've watched
people start to use stateless frameworks more, I'm seeing that it
isn't always the magic bullet they expected. Not storing the state
leads to smaller sessions, but it also means you end up computing a
lot more data and potentially hitting the database server a lot more.
It is similar to the familiar time vs space algorithm design
decisions.
I guess what I'm saying is that I recognize the problems with stateful
web applications and I think a lot of projects will be better off
going the stateless route, but it isn't a case of "stateless is
unquestionably better than stateful in all cases". I think the
industry as a whole has been trying to find the right balance here
(asp.net web forms vs asp.net mvc is another example) and hopefully we
are getting better at it. You are correct in pointing out that JSF
lending itself poorly to stateless application development was a
problem, but hopefully it isn't so much of an issue in 2.0.
- Spencer
Casper Bang
> I get why XML is bad for a lot of things, but I'm a little confused. I
> thought you were referring to configuration files (which was kind of a
> problem), but it sounds as though your issue is with the tag libraries
> used to construct the actual page - is that the case?
Indeed, sorry forgot to mention that I was talking about facelets/
XHTML - which is now part of JSF 2.0 I believe.
> I guess what I'm saying is that I recognize the problems with stateful
> web applications and I think a lot of projects will be better off
> going the stateless route, but it isn't a case of "stateless is
> unquestionably better than stateful in all cases".
Right, it depends on context and requirements. However lately I've
been using Jersey (JSR-311) a lot and it's actually interesting how
far you can get without server state. The scalability issue you
mention can be handled by simply making the DAO layer a self
populating cache. No more session timeouts or "View could not be
restored" etc. If memory goes low or content expires, it's then simply
time to hit the database again and populate the cache. In short, I
don't think server state is bad, I do however think per session server
state is - for it will inevitably be polluted by all kind of temporary
client state and cause problems if one should have the tenacity of
running the same app in more than on window/tab.
/Casper
MassH
There are so many strengths/weaknesses between Eclipse/NetBeans (and
IntelliJ) that depend on what you are doing. I use NetBeans for some
tasks and projects and Eclipse for others.
Overall, I have thought that NetBeans was generally more logically
organized and less confusing and chaotic to understand than Eclipse.
But in certain specific ares, I have thought Eclipse does a better
job.
For example, last weekend, I was trying to debug a fairly simple
Python project in NetBeans 6.8. The debugger "Step into" feature just
didn't work on really simple scenarios. I switched to Eclipse + PyDev
and it works perfectly.
On the other hand, when I was doing heavy Java web app development in
2005-2007, Eclipse WTP was horribly buggy and switching to NetBeans
was a huge improvement. Eclipse may be different now, but I remember
even the Eclipse users seemed to be avoiding WTP and using various
third party plugins or commercial IDEs built on top of Eclipse (like
MyEclipse) for web development.
Finally, for large projects with lots of dependencies, a great
approach is using Maven project descriptors rather than IDE-specific
project configurations. The Maven descriptors are fairly easy to
debug, the build process is very automation friendly, and each
developer can optionally use their IDE of choice on top of Maven for
fancier navigation/editing/debugging features.
Nigel
I also wish that IBM had spent it's money improving Swing instead of
forking.
Jan Goyvaerts
Reinier Zwitserloot
more guilty of being fundamentally web-incompatible?
This URL is straight from the wicket examples page, once you click on
'page2':
yiiiiich.
You can taste the workarounds. You can pull some magic tricks and make
that work better, but the notion that the framework by default does
this already puts me off it.
> ...
>
> read more »
Casper Bang
regard. However at least it does not massively abuse HTTP POST, does
not have a convoluted response life-cycle and does not try to maintain
both component trees as well as backing beans in the session space
(i.e. JSF's javax.faces.application.ViewExpiredException). The
examples are not Wicket's greatest asset btw.
/Casper
On Dec 22, 12:31 pm, Reinier Zwitserloot <reini...@gmail.com> wrote:
> We're whining about JSF's statefulness when wicket is arguably even
> more guilty of being fundamentally web-incompatible?
>
> This URL is straight from the wicket examples page, once you click on
> 'page2':
>
> http://wicketstuff.org/wicket13/navomatic/?wicket:bookmarkablePage=:o...
> ...
>
> read more »
Fabrizio Giudici
> You have a point Reinier. Wicket is not much better than JSF in this
> regard. However at least it does not massively abuse HTTP POST, does
> not have a convoluted response life-cycle and does not try to maintain
> both component trees as well as backing beans in the session space
> (i.e. JSF's javax.faces.application.ViewExpiredException). The
> examples are not Wicket's greatest asset btw.
>
think that the whole concept of web application based on HTTP / HTML /
JavaScript is wrong, thus there are problems that aren't simply possible
to solve with an elegant solution. If you need to develop a complex web
application, go with an Applet, JavaFX, Flash/Flex, Silverlight instead.
But given that we have to deal with HTTP / HTML and so on, the
programming model of Wicket is much simpler than JSF. And I've found
that I can more easily write reusable components in Wicket than with JSF.
--
Fabrizio Giudici - Java Architect, Project Manager
Tidalwave s.a.s. - "We make Java work. Everywhere."
weblogs.java.net/blog/fabriziogiudici - www.tidalwave.it/people
Fabrizio Giudici
> Fabrizio,
>
> Your answer regarding OSGi seems to be about the runtime, i.e. use of
> OSGi in the NB Platform. However I haven't seen anything about tooling
> support for building OSGi bundles using NetBeans.
>
> Given that NB appears to be moving to OSGi for its runtime, and
> GlassFish v3 already permits deployment of OSGi bundles (along with
> other Sun products such as Java CAPS), it seems NB will need some OSGi
> tooling soon. Do there exist plans to offer any?
>
>
referred screencasts) of one of the pages I pointed to:
http://wiki.netbeans.org/OSGiAndNetBeans
you'll see a wizard for creating OSGi bundles. I don't expect it to be
complete, of course, but it would be the sort of stuff that would be
developed for the 6.9. Of course, at the moment in which the Platform
itself goes OSGi compatible, I expect more tooling to appear. If you
look at the NetIGSO mailing lists, you'll see that people are already
able to create applications which mix together parts of the NetBeans
platform and parts of the Eclipse Platform.
Of course, it would be nicer that the community expresses its wishes -
for instance, I'd like to hear from people already working with OSGi and
liking NetBeans (and perhaps "forced" to use Eclipse for the OSGi stuff)
what they feel are the most immediate needs.
--
Fabrizio Giudici - Java Architect, Project Manager
Tidalwave s.a.s. - "We make Java work. Everywhere."
weblogs.java.net/blog/fabriziogiudici - www.tidalwave.it/people
Mark Volkmann
<fabrizio...@tidalwave.it> wrote:
> I think that the whole concept of web application based on HTTP / HTML /
> JavaScript is wrong, thus there are problems that aren't simply possible
> to solve with an elegant solution. If you need to develop a complex web
> application, go with an Applet, JavaFX, Flash/Flex, Silverlight instead.
I'd really like to hear more about why you feel using
HTTP/HTML/JavaScript is wrong and can't provide an elegant solution
for certain problems. Can you elaborate?
--
R. Mark Volkmann
Object Computing, Inc.
fabrizio...@tidalwave.it
> I'd really like to hear more about why you feel using
> HTTP/HTML/JavaScript is wrong and can't provide an elegant
> solution for certain problems. Can you elaborate?
(I know that this is highly controversial and partly
subjective).
Because the web has not been originally designed for web
applications and the whole history of AJAX is the history of
a set of hacks. For years, AJAX has just pursued things such
as drag-and-drop, that had been state-of-the-art in the
desktop for years. The average usability of an AJAX
application is still behind the one of a regular desktop
application of a few years ago and I weekly scream, while
using a web application made by others, because of a form
data loss or such (due to a temporary disconnection or a
back button) - or more subtle things such as a total break
of the application because it failed to completely download
some script.
Of course one might argue that it's not AJAX fault, but a
fault of most of AJAX developers (but when it comes to Swing
and the many things that it did wrong in the past, the blame
was with Swing, not developers).
On the contrary, my experience with Flex applications (just
to cite the most spread technology) is completely different
(e.g. Parley's rich client). Unfortunately AJAX and the
other stuff is there and won't go away, so we have to deal
with it.
--
f.g.
--
Fabrizio Giudici, Ph.D. - Java Architect, Project Manager
Tidalwave s.a.s. - "We make Java work. Everywhere."
weblogs.java.net/blog/fabriziogiudici -
www.tidalwave.it/blog
Fabrizio...@tidalwave.it - mobile: +39 348.150.6941
Kfir Shay
HTTP/HTML/JavaScript, word on the street is that it works pretty well
for a set of hacks ;)
And if your backend is scalable and done right than you get the best
of both worlds
Fabrizio did you try to use a desktop mail client with 6k (~2.5GB)
messages in your inbox... why won't you do that on your desktop and
tell its better than Gmail
> --
>
> You received this message because you are subscribed to the Google Groups "The Java Posse" group.
> To post to this group, send email to java...@googlegroups.com.
> To unsubscribe from this group, send email to javaposse+...@googlegroups.com.
fabrizio...@tidalwave.it
----- Original Message -----
Da : Kfir Shay <kfir...@gmail.com>
A : java...@googlegroups.com
Oggetto : Re: [The Java Posse] Re: Why is Netbeans >
Eclipse?
Data : Tue, 22 Dec 2009 10:21:57 -0500
> I heard about this obscure app called Gmail that uses
> HTTP/HTML/JavaScript, word on the street is that it works
> pretty well for a set of hacks ;)
Well, yes it's a set of hacks. :-) In the end, unfortunately
I have to say that the fact that a thing works doesn't imply
it is well designed: this statement is drawn from my
experience, having seen tons of industrial systems in banks,
trade exchanges, telcos, real time telemetry systems,
industrial control processes and whatever, all of them
"working" and most of them with a lot of hacks in some part
of the system.
I don't use GMail, because I think it's crazy to put all my
email in Google's hands (but this is another point). I don't
think that its success is due to the particular technology,
rather to Google big power in pushing its solutions because
they are fashionable (not by chance I say that Google is XXI
century Microsoft - of course, their technology is anyway
much superior to Microsoft's).
I also see that in order to having it work properly, they
had to introduce Gears, which - yes - is another hack to the
concept of webapp. I think that if Adobe were interested in
the same core business, they could have done it with Flex.
> And if your backend is scalable and done right than you
> get the best of both worlds
Yes, and here Google has got the supremacy of course, but I
think it's not relevant to the rest of the discussion. You
can plug any kind of client technology on a scalable back
end.
>
> Fabrizio did you try to use a desktop mail client with 6k
> (~2.5GB) messages in your inbox... why won't you do that
> on your desktop and tell its better than Gmail
At the moment I have 2.5k messages in my inbox with
Thunderbird (my fault, it's not a tidy management of email
if you have so many in inbox, but that's another matter) and
other mailboxes with more than 10k emails (e.g. the Wicket
one). It works, and it doesn't sound slow, what's the
problem? :-) There are other implementation details of
Thunderbird that I don't like.
Reinier Zwitserloot
Practically speaking, webapps beat desktop apps almost all the time in
usability.
They are far easier to install and keep up to date, they get the
internet-enabled thing right whereas most desktop based apps don't
(I'm talking about applications that integrate networking features
such as connecting to friends, not that something 'runs on teh
interwebs', that's kind of a given for webapps, and either irrelevant
or a bad thing, as it means you're dependent on a connection!), they
tend to be far more usable by people with accessibility issues than
desktop apps. They tend to crash less. They tend to look better. They
tend to be easier to write.
Case in point: The best email client ever written is gmail, no doubts
about it. The only other mail program I know of that gets mail this
right is Mailplane, but that's cheating, because its just a webkit
instance running gmail.com with gears pre-installed and some magic to
make file attachments work better. Even comparing it to something good
like Mail.app or Thunderbird, it's in a league of its own.
On Dec 22, 4:48 pm, "fabrizio.giud...@tidalwave.it"
<fabrizio.giud...@tidalwave.it> wrote:
> ----- Original Message -----
>
> Da : Kfir Shay <kfir.s...@gmail.com>
> Fabrizio.Giud...@tidalwave.it - mobile: +39 348.150.6941
Mark Volkmann
deficiencies. I won't claim it matches Flex, but it is very nice.
--
fabrizio...@tidalwave.it
> Fabrizio, in theory you are right.
>
> Practically speaking, webapps beat desktop apps almost all
> the time in usability.
>
> They are far easier to install and keep up to date, they
> get the internet-enabled thing right whereas most desktop
> based apps don't (I'm talking about applications that
> integrate networking features such as connecting to
> friends, not that something 'runs on teh interwebs',
> that's kind of a given for webapps, and either irrelevant
> or a bad thing, as it means you're dependent on a
> connection!), they tend to be far more usable by people
> with accessibility issues than desktop apps. They tend to
> crash less. They tend to look better. They tend to be
> easier to write.
This largely depends on other factors. For instance, let me
enumerate a few desktop applications I'm using: Keynote,
iMovie, Adobe Lightroom, Adobe Photoshop. They are excellent
applications, look very elegant, are perfectly usable, I can
hardly recall a crash. None is web based: but their makers,
Adobe and Apple, have got a lot of commitment and experience
on usability, elegance and robustness. It's mostly a thing
of culture: for instance, Apple has been able to build a
culture-compatible ecosystem with other small corporates
able to do the same (e.g, back to the app I routinely use,
Omnigraffle is a fantastic little piece of graphic designer,
made by a small company).
You're right for the installation thing - that's clearly a
plus on the usability side, even though you install once and
run many times, so I find a bit less relevant (unless is a
showstopper). Yet, it's not a perfect thing since it's still
easy to find stuff that doesn't work with Firefox or Safari.
For the connectivity with friends class of applications, I
can't speak - I don't use any technology for that, since I
connect to friends personally and consider FaceBook and co.
totally useless, so I don't know what advanced stuff you can
do with them. In my limited knowledge, I consider them more
dynamic web sites than web applications, and I don't have
any objection in using HTTP / HTML / etc with web sites. If
somebody is interested in how I differentiate between web
site and application, it would be an interesting topic. A
few months ago there has been an interesting discussion in a
mailing list grouping together people interested in RIAs
with multiple technologies (all the most important) and
while most of people agreed about such a differentiation, it
has been impossible do define it formally. My take is that
the difference is in purpose: precisely whether the thing
has been primarily meant as a communication channel among
people or not. But it's not exhaustive as I can think of
exceptions.
--
f.g.
--
Fabrizio Giudici, Ph.D. - Java Architect, Project Manager
Tidalwave s.a.s. - "We make Java work. Everywhere."
Casper Bang
Flex/Silverlight/JavaFX, they will always be containers and limited by
their own hacks to interact with "the native web". Every time I see a
JavaFX demo and the use of the (deprecated 10 years ago) applet tag, I
laugh a little to my self. For the current web, GWT and jQuery wins.
It runs anywhere, there's no deployment, development round trip time
is minimal etc. Testing can be tricky however. But considering how
browser vendors continue to push the limit it's hard to imagine this
trend reversing (I.e. Opera's Carakan engine now makes Chrome look
like an old version of MSIE:
http://lifehacker.com/5432054/opera-105-pre+alpha-is-all-about-speed-and-private-browsing).
/Casper
On Dec 22, 5:20 pm, Mark Volkmann <r.mark.volkm...@gmail.com> wrote:
> My feeling is that jQuery makes up for a large number of the
> deficiencies. I won't claim it matches Flex, but it is very nice.
>
> On Tue, Dec 22, 2009 at 8:55 AM, fabrizio.giud...@tidalwave.it
Kfir Shay
>Thunderbird (my fault, it's not a tidy management of email
>if you have so many in inbox, but that's another matter) and
>other mailboxes with more than 10k emails (e.g. the Wicket
>one). It works, and it doesn't sound slow, what's the
>problem? :-) There are other implementation details of
>Thunderbird that I don't like.
Why on earth would I want to sort my inbox?!
I have search, which is powerful and fast. There is no need for tidy
email management. This of course is one of Gmail's great strength.
I don't want to be rude but I think you should try something before
writing it off, probably true for facebook as well.
fabrizio...@tidalwave.it
> I have search, which is powerful and fast. There is no
> need for tidy email management. This of course is one of
Perhaps because the mess reflects the mess in organizing my
life :-) I tend to do things related to interaction with
others (ranging from paid jobs to supporting open source
projects to paying taxes) in email-driven mails, by properly
tagging. This happens 80%+ of my emails, that get properly
collected in folders, but not for the remaining ones. On one
side I'm just involved in too many things, so I always lack
large portions of time, on the other I have to improve my
efficiency. I've been suggested to read the book "Getting
things done", but so far I haven't found the time to do it
:-)
> Gmail's great strength. I don't want to be rude but I
> think you should try something before writing it off,
> probably true for facebook as well.
No rudeness, instead I'm always thankful for advice. But
Thunderbird basic concepts are ok for me (tags and
searches). And as I said, even though GMail was so better, I
don't want to put all my stuff in the hands of Google (I'm
always puzzled when I see people complaining for yet another
camera at the airport check in, and then put all their
digital life in other's hands).
For FaceBook, I've already expressed my thoughts two years
ago:
http://weblogs.java.net/blog/2008/02/15/officially-i-hate-social-networking-non-java-rants
It just sounds as FaceBook incarnates the opposite of my
life style.
--
Fabrizio Giudici
Ryan Waterer
This is something that I've become much more passionate about in the
last couple of years, and I appreciate Fabrizio for his viewpoints.
We, as a group, tend to enjoy the newest features, the newest toys and
worry more about the time to deploy, stability and functionality than
security and privacy.
Fundamentally, JavaScript is a broken piece of software. Java Script
is the primary culprit for most web based attacks. If we look at
Adobe, the primary reason why Reader has so many updates and security
holes is simply due to adding JavaScript into the Adobe Reader. There
are many hacks, workaround and policies that have been invented in the
last 14 or so years to sidestep the vulnerabilities of JavaScript and
mitigate the possible damages. I don't believe that there is a need
to go into this right now; a Google search will come up with pages and
pages of examples of both attacks and defenses.
I've been consulting off and on for a few local lawyers and I've told
each of them to get off of google mail. While this may seem strange
to many people, the privacy of a lawyer and their discussions is
paramount. While Google Mail does offer many strengths, they are an
easy target for legal subpoena of all of your email content. This
also has been well documented in Google's privacy policy as well as
online. (Yes, I understand the risks of a hosting a private email
server as well)
Recently, Eric Schmidt has come under fire for his views on privacy on
the internet as well.
http://www.pcworld.com/article/184446/googles_schmidt_roasted_for_privacy_comments.html
FaceBook has recently come under a lot of fire for their privacy
policy changes. From appearances, it looks like they're trying to
scale up and in essence going to sell your data to do so.
Please note, I love what Google is doing with their products. They are
really pushing the envelope as to how we interact with each other,
data, and also computers. As with Fabrizio, I just don't trust them
to store all of my data in a secure, private way. I've hesitated to
really start using products such as Google Voice, Google Mail, Wave,
etc. due to that lack of trust. I don't want to be a tin-foil wearing
psychopath, and yet, there are so many examples of why I should be!
Now, back on topic:
I love NetBeans, and I'm trying to incorporate it more into my daily
life. However, I find that Eclipse just does some things better than
NetBeans. As with others, I wish we could have a good melting of the
best of NetBeans, and the best of Eclipse.
--Ryan
Kfir Shay
ags
Kfir Shay
use Eclipse but at the end of the day its just a tool. So as long as
my Vi plugin has decent support I am happy
On Tue, Dec 22, 2009 at 3:45 PM, ags <andrzej...@gmail.com> wrote:
> I am, it rocks, and I've managed to convert a few hardcore eclipse users ;-)
>
Kerry Sainsbury
Reinier Zwitserloot
beyond the reach of web-based apps, sure, but then you really picked
the exceptions out of the lineup.
Keynote will still fare far better as a standalone app, but a
sufficiently cool webapp could end up in, if not the same ballpark, at
least right next to it.
Apple is a nice example for this stuff; they've been building
excellent web apps as well, pushing HTML standards to the front, and
working on letting webapps do things they couldn't before (example:
<canvas>).
I don't think this discussion started with apps like iMovie or even
keynote in mind.
Also, flex, silverlight, and even javafx aren't very good tools to
build something like iMovie with either. The apps would have to ask
for some pretty hefty permissions, and getting something like multi-
screen management right is going to be tough in these sandbox VM style
environments, you need to work closer to the metal. Those apps are the
obvious exceptions, but they are nothing like what your average app,
especially in the corporate world, needs to do.
On Dec 22, 5:57 pm, "fabrizio.giud...@tidalwave.it"
Reinier Zwitserloot
Don't be daft.
It's not software, it's a programming language. The web in general
suffers from many security issues. So does:
- flash
- SSL (which has been seriously beaten in the past year)
- JVMs in the browser, in various ways, at various times.
- browsers themselves with various buffer overflows unrelated to
javascript
Calling javascript fundamentally broken is a stupid thing to say
unless you follow through and also call applets, SSL, all browsers,
and flash fundamentally broken as well. That wouldn't be an
inconsistent viewpoint if you really ascribed to it, but I doubt
anyone is going to take you seriously if you espouse it.
> [snip rant on privacy]
Yes, privacy is an issue. Yes, Eric Schmidt's view on privacy makes
him a dangerous and hypocritical idiot. I don't understand what this
has to do with the web. If you mean that the entirety of the web was a
bad idea - you can, but know that standing in the way of technological
prowess like an old grandfather yelling at kids to stay off the lawn
has never once worked in the history of mankind.
> the internet as well.http://www.pcworld.com/article/184446/googles_schmidt_roasted_for_pri...
>
> FaceBook has recently come under a lot of fire for their privacy
> policy changes. From appearances, it looks like they're trying to
> scale up and in essence going to sell your data to do so.
>
> Please note, I love what Google is doing with their products. They are
> really pushing the envelope as to how we interact with each other,
> data, and also computers. As with Fabrizio, I just don't trust them
> to store all of my data in a secure, private way. I've hesitated to
> really start using products such as Google Voice, Google Mail, Wave,
> etc. due to that lack of trust. I don't want to be a tin-foil wearing
> psychopath, and yet, there are so many examples of why I should be!
>
> Now, back on topic:
>
> I love NetBeans, and I'm trying to incorporate it more into my daily
> life. However, I find that Eclipse just does some things better than
> NetBeans. As with others, I wish we could have a good melting of the
> best of NetBeans, and the best of Eclipse.
>
> --Ryan
>
> On Tue, Dec 22, 2009 at 11:15 AM, fabrizio.giud...@tidalwave.it
> >http://weblogs.java.net/blog/2008/02/15/officially-i-hate-social-netw...
>
> > It just sounds as FaceBook incarnates the opposite of my
> > life style.
>
> > --
> > Fabrizio Giudici
>
> > --
> > Fabrizio Giudici, Ph.D. - Java Architect, Project Manager
> > Tidalwave s.a.s. - "We make Java work. Everywhere."
> > weblogs.java.net/blog/fabriziogiudici -
> >www.tidalwave.it/blog
> > Fabrizio.Giud...@tidalwave.it - mobile: +39 348.150.6941
Ryan Waterer
However, I am not the one that came up with this stance, nor am I the
only one that thinks this way. In fact, more and more are even
taking the stance that the Browser model as it exists today is
fundamentally flawed.
See comments/podcasts/DEFCON talks by security experts such as Moxie
Marlinspike, Steve Gibson, Dan Kaminski etc.
I agree that I misspoke. I said software and yes, JavaScript is a
programming language. With the additions of JQuery, Google Analytics,
DOJO, YUI, and other tools that you can simply plug into a web site
without much knowledge, I feel that at times JavaScript is more of a
software tool than a programming language. (This is no way diminishes
the heroic effort of those creating such fantastic tools/libraries for
our use!)
As far as claiming it is fundamentally flawed - If you look at top
tech site such as TechCrunch, they import quite a few different
JavaScript plugins from other websites (google analytics, double
click, google syndication, snap.com, etc). If a hacker can compromise
just one of those imported scripts, they now own the entire page.
Imagine if you were able to take over googleanalytics code and insert
something dire. There are no MD5s of the code. There are no hash
sets of the code. Any web site simply loads the updated code and all
of a sudden the hacker (or you) now have control of thousands or
millions of web sites. Another part of the issue is that JavaScript
being loaded from HTTPS will not protect you either; there is no
protocol on how this should be done and each browser handles it
differently. Currently, they all will allow users to load JavaScript
from expired or invalid SSL certificates. So, with the above, I'll
amend my statement to the following: I believe that as it exists
today, JavaScript is fundamentally flawed when specifically dealing
with security.
I only brought up Eric Schmidt since I felt it was relevant to that
point in the discussion. A reader in here had indicated that they
felt everyone should be on Google Mail, and I believe Fabrizio
indicated he didn't trust putting his data on the internet. Given the
position that Eric has within Google, I felt it quite appropriate to
help Frabrizio in the point that he was making.
I'd be quite happy to continue the discussion, but I am not sure
others would want to. Therefore, I'll limit my viewpoints and
thoughts to the above until I'm suckered in for more. ;)
--Ryan
Casper Bang
start telnetting raw GET commands instead, like Steve Gibson would
probably recommend. JavaFX is more secure only because most users
never gets through clicking all the confirmation dialogs. :) In fact
what happens then is that users develop a nasty habit of not even
reading the dialogs and now we've just exchanged technological
engineering with social engineering - just as dangerous (if not more).
/Casper
Reinier Zwitserloot
broken'. That's fine, and there are a select few others who think that
way too. I also know somebody who thinks the moon is made of cheese.
It's a logical fallacy to claim that something must be true because
you're not the only crackpot out there.
> [snip theoretic rant about less-than-perfect SSL certificate implementations and third party libraries]
Same applies to any other library you use in any other environment.
Most libraries loaded cross-browser can be deployed locally as well
and yet a vast array of web authors, including many who are extremely
security conscious, decide to load from a site they trust. Security
isn't about painting absolutist horrorshows. It's about pragmatism.
Furthermore, your rant is just ridiculous. You're complaining about
the lack of a thorough key infrastructure surrounding browser-based
apps. This in contrast to applications for the desktop that you
download and run, that offer absolutely zero security, and on Windows
XP, give instant root access to the one doing the download+install.
So, if the web is fundamentally broken because of this, then you must
be consistent and say that desktop apps are even more broken than
that. Sure, some very rarely used platforms seem to have pretty good
security infrastructure, but how do you really know? SSL seemed
utterly unbeatable for 2 decades until recently when it was seriously
damaged. 2 decades. That's an amazing security record. It's also
getting fixed, more or less (and no doubt that fix will eventually be
compromised; security is an ongoing process). If java app signing
manages to survive unharmed for 2 decades even under the scrutiny
something as popular and ubiquitous as the web, I'll eat my shoes.
In regards to gmail, I'm guessing you're referring to me. Stop putting
words in my mouth; I claimed that the gmail interface is the best for
reading mail, hands down. I did not say that everyone should be using
it. As this thread hijack originally started when fabrizio basically
suggested that web apps are no good because you can't build good UI in
them, I showed that as an example: In practice, many web apps have far
better UI than desktop apps. I have absolutely no idea why you are
ranting about privacy here, it has zero relationship to UI design.
Sharing email between terminals is a fundamental utility feature of
any mail infrastructure, which usually means that people, even those
that use Mail.app or thunderbird, use IMAP and leave their email _ON A
SERVER_. Even if they didn't, email is never delivered straight to
your home computer via a signed certificate, so if you are google-
paranoid, then the fact that you use email at all indicates you don't
understand the first thing about the entire concept of mail. This is a
solid example of why I so thoroughly dislike your rants; you just grab
on to a random internet complaint and use it to prove a point, even
though the very thing you're clinging to is as bad or worse in the
desktop world. Thus, you're literally ranting: You're painting pretty
pictures of better worlds without stopping to think that these utopias
you are painting do not exist anywhere. Faulting one party in a wide
array (web apps, vs. flash, javafx, desktop apps, win32, cocoa, etc,
etc) for faults they all have is silly.
Ryan Waterer
You're a very passionate person and have a lot to provide to the
group; which I am glad that you do.
From your response, I believe that I'm not communicating very clearly
in this discussion, and I apologize for that. In this response, I
will try and be more thorough. I will attempt to leave out places
where assumptions can be made about my position, or my intention.
Earlier you had mentioned that if I take a particular stance, I'd be
mocked for that stance since I would be alone. I responded with some
examples of others who would take the same stance or something very
similar, and now you say I'm performing a logical fallacy for doing
so. If I am, I do apologize for the misunderstanding of trying to
provide some examples instead of speaking crap from my ass. :)
I do not claim to be the brightest, nor the smartest, nor even most
proficient among us. From the discussions that I've watched from the
sidelines, I believe that you understand many things in much more
depth than I do. The intention of my original "rant" was simply to
bring up a point that is rarely, if ever discussed in this group:
privacy and security. I might be incorrect and everyone in this group
would know about what you and I are discussing, and therefore, our
discussion really isn't informing anyone. From the sidelines, and
with the assistance of the lack of proper communication through email,
Fabrizio was appearing to be mocked for his views on privacy, and the
reasons why he didn't want to trust Google or the internet with all
his data. I wanted to show some points indicating he's not alone in
his viewpoints. Clearly, I've gone beyond that and went to the point
of offending you. This was not my intention.
Vince Cerf has indicated that there is a problem with the way the
internet works regarding security. Quite frankly, I will gladly refer
to him and other experts on the subject. I'll attempt to be much more
clear this time around; even though there is a problem with security,
it does not mean that the internet can not or will not continue to
work as it is. In a security sense, it is fundamentally flawed, and
needs to be improved. I agree with your statement about security
being an evolutionary process, and one doesn't know they have a
security issue until they have been hacked or until a PoC has been
demonstrated.
Despite what you assumed, I do understand how email works, and how the
internet works. By the mere process of typing and sending this email
through the internet, I'm touching 14 different routers. While
impractical, each one could be siphoning off the data and storing it
somewhere. If I was that paranoid about my data being online I simply
wouldn't be online. We can not be online without something being
stored somewhere for an unknown amount of time. Could be as simple as
an IP address logged, or as crazy as everything being sucked into logs
(AT&T secret room as an example). If I was that paranoid, I wouldn't
carry a modern cell phone, or drive a modern car.
I am not saying that I can not use the internet, or anyone use it.
I'm just trying to say that there are flaws. I use Gmail. I use many
Google products -- as I mentioned earlier, I love what they are doing,
and how they are pushing the envelope. What I do not like is that the
CEO of Google making absurd privacy and security statements. I don't
want to trust Google with all my data. So many things in our lives
make it much, much easier to live our lives, and to communicate across
vast distances with friends, enemies and acquaintances. However,
those same benefits to our lives reduce our privacy and often our
security, and can cause more problems.
I am a developer; I have worked in a different environments and I have
seen few companies treat security and privacy as a priority. It is
not a leap of faith to realize that businesses are more concerned
about getting a product out of the door or an upgrade than to create a
secure experience that deals with data appropriately. In fact, each
company that I have worked for has essentially refused to encrypt
socials, and stores them as readable text in a database. One can look
at the number of government laptops sold on eBay in the last year (US,
UK, and others) that have had social security numbers or credit card
numbers still on the laptops, and understand that my personal
experiences are not the exception, but most likely the rule. This
last year, we have also discovered that possibly the Chinese
government infiltrated the Dalai Lama network through a very easy
security hole. The United States Government lost the plans to its
top-secret new plane still in development. I understand that each
attack was done in a different way, and through a different security
flaw. My point here is just simply that we all have reasons to be at
least concerned about who is collecting our data and how they are
storing it given the practices of developers and the policies of
companies that employ them.
Instead of going back and forth over whether I'm clinically insane,
frothing at the mouth, or should constantly wear a tin foil hat, I'd
love to discuss more about what people do to help secure applications.
What good experiences have people had regarding these issues? What
steps have the people here done to protect data? What can we do
individually or collectively as a group to talk about these issues
without coming across as a blathering idiot? Am I the only one in
this group that cares? I really would like to know more about how
people approach this. Would this be better served as a discussion
point regarding best practices at the roundup 2010 in Crested Butte?
P.S. SSL has been broken before, and subsequently fixed. In 1996,
SSL was updated from 2.0 to 3.0 to fix several security flaws (1.0 was
not released). TLS 1.1 was introduced after TLS 1.0 (upgrade to SSL
3.0) to fix an attack vector on SSL. SSL in the last 6-10 months has
been horribly beaten up, and completely broken under certain attack
vectors. It is indeed much worse than ever before, with at least
some, if not many real world attacks.
--Ryan
Reinier Zwitserloot
> Earlier you had mentioned that if I take a particular stance, I'd be
> mocked for that stance since I would be alone.
Stop putting words in my mouth! Please point out to me where I state
that you were alone in this opinion.
> I responded with some
> examples of others who would take the same stance or something very
> similar, and now you say I'm performing a logical fallacy for doing
> so.
Yes, I did say that. Because it IS a logical fallacy. Take your pick -
bandwagon fallacy, appeal to popularity, or appeal to authority:
http://www.logicalfallacies.info/
>
> I do not claim to be the brightest, nor the smartest, nor even most
> proficient among us.
You're on a roll. Not sure if this is putting words in my mouth or a
logical fallacy, depends on how I'm supposed to read between the lines
here. Either way, I don't understand how you NOT being the smartest,
brightest, or proficientest person in this discussion lends
credibility to your arguments.
> The intention of my original "rant" was simply to
> bring up a point that is rarely, if ever discussed in this group:
> privacy and security.
Stop posting random unrelated details to threads, then. If you hit
'reply', then other readers are going to frame your reply in the
context of the post you're replying to. In your particular case,
Fabrizio and I were discussing the merits (or lack thereof) of webapps
vs. desktop apps. Thus, your privacy and security rant was taken by me
as a motion of support for desktop apps, which made no sense
whatsoever, as all your arguments apply equally to either method of
building applications. Especially if you use obviously false hyperbole
such as, and I quote: "Fundamentally, javascript is a broken piece of
software". Your privacy rant, in the context of the post you were
replying to, was either a red herring or a straw man logical fallacy.
http://www.logicalfallacies.info/
> Fabrizio was appearing to be mocked for his views on privacy, and the
Please point out the post in this thread where Fabrizio was getting
mocked in regards to his privacy concerns. I can't find this anywhere.
Fabrizio was corrected for seemingly forgetting that searching your
email is endlessly more efficient than tagging them all by hand. I can
see how one can read this as being 'mocked' (IMO, whatever mocking
undertone was in there, he deserved it). Some sort of defense, ill
advised or not, is understandable if you feel Fabrizio had a point
worth defending with his I-tag-ten-thousand-emails plan, but that's
not what you covered in your reply at all.
> Vince Cerf has indicated that there is a problem with the way the
> internet works regarding security.
Yes, we covered this; the internet isn't perfect, but as we also
covered, you're holding the internet up to some utopian standard,
while giving desktop apps a free ride.
> If I was that paranoid about my data being online I simply
> wouldn't be online.
Good luck with that. We covered this too; the internet is here, it's
big, it's got decades of history behind it, trillions of dollars worth
of invested capital, and here you're telling people that we should
start over (which is kind of inherent in saying that there are
'fundamental flaws', no? The defining property of fundamental flaws is
that they are inherent to the system and cannot be removed without
starting over, pretty much). I'm telling you that saying that is not
going to convince anyone, as that notion is utterly impractical.
> I am not saying that I can not use the internet, or anyone use it.
> I'm just trying to say that there are flaws.
Yes. Again, how is this relevant to the already tangential point that
Fabrizio and/or I was making about web apps vs. desktop apps?
> What I do not like is that the
> CEO of Google making absurd privacy and security statements.
Those who understand the moral implications of privacy and heard what
Eric Schmidt said pretty much all think that was a stupid thing to
say. It's beyond this post to delve into why the "I have nothing to
hide" concept is morally bankrupt and dangerous, and nobody so far has
disputed this idea, so I'll leave a search for the arguments to this
as an exercise to the interested reader. I cannot stress how much I
agree with your apprehension at his words. Not, however, in any way
relevant to this discussion.
> I'd love to discuss more about what people do to help secure applications.
We could do that, though I suggest, as the javaposse google group is
fairly technically minded, that you open with more than just that one
question. Give us some technical tricks to discuss. I'm also guessing
that starting a new thread for this is going to be more fruitful than
letting this one grow.
> Would this be better served as a discussion
> point regarding best practices at the roundup 2010 in Crested Butte?
Privacy Best Practices. Yeah, that works. Go, go, universally
applicable theme gadget :P - If you're going to the roundup, toss it
on the agenda.
Ryan Waterer
for doing so.
--Ryan