How-to Java

How-to Java

Test for fun and profit, Part 2: Unit testing
While software testing seems very simple in concept, in practice it is surprisingly difficult to do thoroughly. This month, Todd Sundsted illustrates some of the problems you can expect to encounter. He also shows why testing must be kept in mind while you write your code, and even while you first sketch out the design. (1,500 words)
Todd Sundsted, July 2001

Secure your Java apps from end to end, Part 2
In Part 2 of Todd Sundsted's examination of security, he discusses application security. Little mistakes during application development often lead to big security problems for developers and users. Todd introduces you to the most common types of design and implementation flaws that turn into security vulnerabilities and describes how to avoid them. He also provides an excellent example of one such flaw from Sun's own JDK. (1,500 words)
Todd Sundsted, July 2001

Secure your Java apps from end to end, Part 1
Security means many things to many people. For much of its history, Java security has meant virtual machine and byte code security. That notion neglects two equally important facets -- application and network security. In this series of articles, Todd Sundsted examines virtual machine security, application security, and network security, explaining what it takes to make your application secure in each context. In Part 1, he examines the foundation of Java security: virtual machine and byte code security. (1,500 words)
Todd Sundsted, June 2001

Build secure network applications with SSL and the JSSE API
SSL (Secure Socket Layer) is the de facto standard for securing a communication channel between two applications that converse over the Internet. Sun's JSSE (Java Secure Socket Extension) provides SSL support for Java applications. This month, Todd Sundsted demystifies JSSE and demonstrates how to SSL-enable your applications. (1,700 words)
Todd Sundsted, May 2001

Construct secure networked applications with certificates, Part 4
You can build applications using the tools and the information provided in the first three parts of this series on certificates. However, to build the most secure applications possible, you must understand the details of authentication and certificate verification. This month, Todd Sundsted takes you on a tour of authentication from the X.509 perspective and describes the steps necessary for verifying a chain of X.509 certificates. (1,800 words)
Todd Sundsted, April 2001

Construct secure networked applications with certificates, Part 3
Certificates and public-key cryptography are great when private keys remain private. When a private key is exposed, either accidentally or maliciously, the security provided by public-key cryptography ends. Enter the certificate revocation list (CRL), an essential component of a public-key infrastructure (PKI) and the mechanism by which certificates terminate before their time. (1,400 words)
Todd Sundsted, March 2001

Construct secure networked applications with certificates, Part 2
Although it's not the only runner in the certificate race, the X.509 certificate standard is so far ahead that its eventual victory is all but guaranteed. This month, Todd Sundsted describes X.509 certificates and introduces you to the classes -- a standard part of the Java 2 platform -- that support them. (1,800 words)
Todd Sundsted, February 2001

Construct secure networked applications with certificates, Part 1
Public-key cryptography's importance to network security must not be overlooked. However, trust issues challenge public-key cryptography's usage in enterprise-scale settings. In Part 1 of this series on certificates, Todd Sundsted explains how they help public-key cryptography scale to meet the needs of the enterprise usage. (1,400 words)
Todd Sundsted, January 2001

Secure thread collaboration across protection domains
When threads collaborate across protection domains, they introduce interesting wrinkles into the science of building secure applications. This month, Todd Sundsted presents these scenarios and shows how to use the AccessControlContext and GuardedObject classes to build solid solutions. (1,300 words)
Todd Sundsted, December 2000

Signed and sealed objects deliver secure serialized content
With the Java serialization mechanism, you can transport Java objects from one Java VM to another and place Java objects in persistent storage. It does not protect the serialized content, however, and thus introduces the possibility of security flaws in applications using serialization. This month, Todd Sundsted introduces you to two classes designed to protect the contents of serialized objects from manipulation and examination. (1,000 words)
Todd Sundsted, November 2000

Alternative deployment methods, Part 3: The code
In Part 3 of his series on application deployment, Todd Sundsted looks at the code that supports the deployment tool he described in Part 2. This article explains the framework's operation, highlights its design features, and explores the challenges of building this type of application. (1,900 words)
Todd Sundsted, September 2000

Alternative deployment methods, Part 2: The best of both worlds
Despite a history of black eyes and a reputation for being difficult to work with, Java applets are still the dominant client-side Java application-deployment technique in enterprise environments. Unfortunately, they are often not the right tool for the job. In Part 2 of this deployment series, Todd Sundsted explains how to combine the best features of applets with a handful of more traditional deployment techniques, creating a solution both easy to use and powerful enough for the enterprise. (1,200 words)
Todd Sundsted, July 2000

Alternative deployment methods, Part 1: Beyond applets
When the issue of application deployment arises, developers typically consider the possibility of deployment as an applet. Often, this is not the correct approach. This month, Todd Sundsted begins an exploration of deployment alternatives that avoid some of the difficulties and limitations associated with applets. (1,400 words)
Todd Sundsted, May 2000

JNDI overview, Part 3: Advanced JNDI
A JNDI service can be much more than a computerized card catalog. JNDI's object-storage capabilities allow it to play the role of resource administrator in your distributed applications and to provide simple, manageable object persistence. In recognition of its potential, the architects of key Java technologies such as JDBC and EJB built JNDI into their specifications. This month Todd Sundsted shows you how to store objects in a JNDI service. (1,900 words)
Todd Sundsted, March 2000

JNDI overview, Part 2: An introduction to directory services
As applications become more distributed, the efficient management and distribution of the information upon which they depend becomes more and more of a problem. Directory services such as LDAP (the Lightweight Directory Access Protocol) address this problem. For Java applications, the Java Naming and Directory Interface (JNDI) provides a generic interface to LDAP and other directory services. This month, Todd Sundsted introduces you to JNDI directory services. (1,300 words)
Todd Sundsted, February 2000

Find more >