greptilian logo

IRC log for #javaee, 2014-03-12

Please see http://irclog.greptilian.com/javaee for which days have been logged.

| Channels | #javaee index | Today | | Search | Google Search | Plain-Text | plain, newest first | summary

All times shown according to UTC.

Time S Nick Message
00:21 whartung joined ##javaee
00:26 sfisque dunno about django, but basically struts is pretty analogous to CGI.  basically you execute a url which maps to an action which results in some navigation rule that constructs an output view
00:26 sfisque where jsf is the other way around.  you request a view which contains components that have activities attached to them
00:27 sfisque it took some time for me to grok the phased lifecycle of jsf
00:32 pdurbin maybe struts would fit my brain better
00:33 sfisque a marriage of both would be primo.  view based for deep linking and efficient data marshalling with component activity for UX embellishments.  P H A T
00:33 pdurbin heh
00:34 sfisque struts is better for things like tables and reports.  jsf is better for wizards and UX granularity
00:35 sfisque afk for a bit again
00:55 drspockbr1 joined ##javaee
00:58 Fubar^ joined ##javaee
00:58 rektide joined ##javaee
01:00 TinkerTyper joined ##javaee
01:04 kobain joined ##javaee
01:19 SoniEx2 joined ##javaee
02:15 whaley lol struts
02:15 whaley 2003 called and wants its tech back
02:15 whaley left ##javaee
02:32 sfisque joined ##javaee
03:46 kobain joined ##javaee
05:17 sfisque joined ##javaee
07:47 AlexCzar joined ##javaee
08:57 neuro_sys joined ##javaee
09:40 cem__ joined ##javaee
09:42 cem__ how to get backing bean name aka packagenme.classname in validate method of validator
09:42 cem__ public void validate(FacesContext context, UIComponent component, Object value) throws ValidatorException { boolean isduplicate = false; context. if(isduplicate) System.out.println(this); System.out.println(value); }
09:43 cem__ i want to know the bean name :/
09:51 Bombe Object.getClass() has all that information.
10:08 pdurbin http://docs.oracle.com/javase/7/docs/api/java/lang/Class.html#getCanonicalName%28%29
11:06 cem__ lol :/ i guess i'm bad at explaining  problem
11:54 pdurbin another morning, another `jps | xargs kill -9`
12:25 cem__ comparing f:param with servlet webapp
12:26 cem__ in servlets you cannot amnipulate request object , cant add request data in server side but jsp can do
12:27 cem__ and jsf too
12:28 cem__ manipulate in the serverside means adding parameters in the request object
12:29 cem__ but jsp and jsf can add parameters to request object
12:31 tjsnell which makes sense
12:34 cem__ i dont understand tjsnell
12:35 tjsnell jsp and jsf represent client side where you are making the request so of course you can manipulate the request
12:35 tjsnell a servlet receives a request from the client side, the server shouldn't be manipulating it
12:36 tjsnell just create a new object and add whatever you need from the request and your added information and pass that along
12:36 cem__ are you forgeting jsf and jsp are still serverside
12:36 tjsnell no
12:39 cem__ hmmm
12:47 cem__ i guess this was added lately ?
12:47 cem__ searching  jsp 1 spec
12:50 cem__ k going out see u guys later
12:51 * cem__ stuck with reportss :'(
12:51 drspockbr joined ##javaee
12:53 cem__ i need ur help pdurbin
12:53 cem__ on reports :?
12:54 cem__ bye bye for now :)
13:11 Naros joined ##javaee
13:19 fabioportieri joined ##javaee
13:38 sajjadg joined ##javaee
13:39 fabioportieri my agency asked me to go work in their main office, after i finish my daily 9 hours by the client office...
13:39 fabioportieri for a total of 12+ hours per day
13:39 ilhami joined ##javaee
13:39 ilhami Hey
13:41 ilhami I need a way to insert data in my DB via my webservice with Json. Is it easy?
13:42 CJ_ What does everyone recommend for a java profiler?
13:47 tjsnell I like yourkit
13:47 pdurbin ilhami: I use moxy for that: http://irclog.greptilian.com/javaee/2014-01-20#i_52487
13:48 CJ_ tjsnell, What in particular do you like about yourkit?
13:49 tjsnell it works
13:49 tjsnell I honestly don't remember the details, was an eval long ago
13:49 CJ_ Undertsood.
13:49 tjsnell now we just use it and it does the job
13:50 ilhami but pdurbin I already have chosen my tools
13:50 ilhami I am using Jersey
13:50 ilhami Rest
13:50 CJ_ Holy hell, yourkit is expensive.
13:51 tjsnell Jersey and REST are completely orthogonal to writing to a db
13:51 ilhami CJ_ stop it
13:51 CJ_ ilhami, Eh?
13:52 ilhami with those stupid expressions :D
13:52 tjsnell you're offending him!
13:52 tjsnell he can say he wishes your family members can be put to death
13:52 tjsnell but hell don't offend him!
13:55 CJ_ Going to try JVM Monitor first as it's built into Eclipse.
13:57 tjsnell jvisualvm works for simple cases too
13:57 tjsnell and yourkit is free for 30 days :)
13:58 ilhami should I make a new servlet for each CRUD statement? :D
13:59 tjsnell that is funny!
14:00 CJ_ VisualVM is on my list as well.
14:01 CJ_ Not sure if JVM Monitor likes the fact that I'm trying to profile a tomcat instance inside eclipse.
14:02 CJ_ Do I need to start tomcat in debug mode?
14:02 fabioportieri nop
14:02 fabioportieri iirc it will display tomcat instance as a node and jvm as another node (jvisualvm)
14:03 CJ_ fabioportieri, I'm using JVM Monitor.  I haven't tried jvisualvm yet.
14:05 CJ_ So far it just sits on start monitoring for a minute or two and then stops.
14:12 fabioportieri oh, i think i never used jvm monitor
14:16 ilhami fabioportieri dude
14:18 tjsnell dude!
14:19 CJ_ Trying jvisualvm now and I'm having the same issue.
14:23 fabioportieri ah with jvisualvm is very important to use the one inside the jre you are executing
14:23 fabioportieri otherwise it won't work
14:24 fabioportieri i remember having this issue
14:27 fabioportieri but i'm seeing visualvm is insde jdk.. so in short you'll have to make tomcat use the jre inside your jdk, and start the visualvm executable from the same jdk
14:29 CJ_ visualvm sees the tomcat instance but it won't connect to it.
14:29 fabioportieri indeed
14:36 sfisque CJ_ are you on linux or unix?
14:36 CJ_ sfisque, arch linux
14:37 CJ_ It finally appears to have connected.  Took around five minutes, though.
14:37 sfisque you have to run it as root
14:37 sfisque i find if i dont run jvis as root, it has "issues" connecting to localhost processes via /proc
14:38 ilhami joined ##javaee
14:41 ilhami left ##javaee
14:47 CJ_ sfisque, Understood.  As I mentioned, I was able to get it to connect, but it took quite some time.
14:47 sfisque aye, i saw that
14:49 CJ_ Unfortunately, I can't figure out how to determine the part of my code that is responsible for the issue.
14:49 CJ_ Something in my application is causing a massive amount of threads to be spawned, but I can't find if it's in my code or a library.
14:50 sfisque use a commercial profiler.  i know jprofiler will let you introspect into running threads and you can find out who owns them
14:53 CJ_ If I run jvisualvm as root, it doesn't show my local vms.
14:58 tjsnell they have to have jmx enabled
15:04 jieryn joined ##javaee
15:13 CJ_ tjsnell, My understanding is that jmx is not required if it is run in a local vm.
15:13 tjsnell in some cases it seems like it does
15:14 tjsnell I've never investigated because I always enable jmx
15:14 fabioportieri CJ_: from what jdk are you starting visualvm?
15:14 CJ_ Understood.
15:14 CJ_ fabioportieri, I only have one jdk installed.  I'm just calling jvisualvm from the command line.
15:19 sfisque CJ_ if the app does not have jmx enabled you can only monitor the underlying jvm, not the app itself.
15:19 sfisque the jvm has it's own jmx layer that it exposes by default
15:19 sfisque if the app exposes jmx beans as well, you get deeper monitoring of the app beyond just what the jvm provides
16:09 CJ_ sfisque, Understood.
16:12 whartung anyone use the async stuff in Servlet 3.0 yet?
16:14 sfisque is it related to ee async?
16:14 sfisque oh, websocket?
16:15 whartung not necessarily websocket
16:15 sfisque javaeebot lucky servlet 3.0 asynch feature
16:15 javaeebot sfisque: http://www.javaworld.com/article/2077995/java-concurrency/asynchronous-processing-support-in-servlet-3-0.html
16:16 sfisque so it's push related.  no i have not
16:17 fabioportieri interesting stuff ^
16:17 whartung I guess my question is that I assume the output stream is "async-enabled", meaning that once you start streaming, you stop blocking the request.
16:17 whartung just not sure how that works
16:18 sfisque i'd have to read deeper
16:20 sfisque taking recommendations for easy to setup and maintain issue tracker
16:20 sfisque +1 if it integrates with NB
16:21 sfisque +304853058 if it drops into jboss or comes with it's own bootstrap setup
16:21 tjsnell jira
16:21 sfisque preferably free
16:21 tjsnell free options are not worth it
16:21 sfisque i like jira but i cannot justify paying for a personal copy
16:21 tjsnell $10/month isn't bad
16:22 sfisque 120/year for something that will be used very modestly… too much
16:22 tjsnell or just $10 if you host it
16:23 tjsnell $120 and very little setup time vs how many hours of your time to setup a less capable one?
16:23 tjsnell the $10/10 user version for download is really hard to beat for modest use :)
16:24 sfisque i'm surprised no one has done a SaaS one like sourceforge or github only for issue tracking vs. src control
16:24 tjsnell that'd be atlassian on demand :)
16:24 sfisque maybe i'll take a second look.  i think the 10u one was missing a couple features i wanted
16:25 tjsnell ahh
16:25 sfisque had teh right footprint though
16:25 sfisque 10u would be more than enough
16:25 tjsnell I really haven't found a free one that didn't irritate the holy crap out of me.
16:25 sfisque i bet
16:26 sfisque like scm packages.  i've tried them all and "bleargh"
16:26 tjsnell ditto for wiki's. When they came out with confluence I made a lot of fun of them
16:26 tjsnell "Who would pay for a wiki!?"
16:26 sfisque jspwiki is still pretty good
16:26 tjsnell then after trying many in house and seeing adoption suck I tried confluence
16:26 sfisque drops into jboss with minimal work
16:26 tjsnell and damn if even the sales team didn't start using it heavily
16:26 sfisque confluence is ncie
16:26 sfisque **nice
16:28 sfisque hrm, trac is wiki based.  i guess i "could" use my wiki for issue tracking.
16:29 whartung what about a free account on bitbucket? doesn't that come with jura?
16:29 whartung JIRA
16:29 * whartung loathes confluence
16:29 tjsnell why?
16:29 whartung Because I find the editor very hard to use.
16:30 whartung and I prefer a markup option
16:30 sfisque you can switch in confluence.  just like jspwiki, the editor switches between rich and raw
16:30 whartung no, you can't
16:30 whartung you can not author in markup in confluence any more
16:30 sfisque the version they had at my last gig did
16:30 sfisque oh, they removed it?
16:30 sfisque that's stupid
16:30 whartung yes
16:31 tjsnell not in the new versions
16:31 tjsnell I don't mind
16:31 tjsnell my goal is company wide, not just devs
16:31 sfisque aye but having both is huge
16:31 sfisque you can choose
16:31 sfisque removing the raw edit is just dumn
16:31 sfisque **dummmm
16:31 sfisque ***dummmmmmmmmmmmmmm
16:31 sfisque b
16:32 tjsnell apparently not
16:32 tjsnell their sales continue to be crazy good
16:32 whartung I could also yank out the raw markup, use a Real Text Editor(™) for larger work, and paste it back in.
16:33 whartung if they put that feature back, I'd likely loathe it less
16:33 tjsnell hrmm
16:33 tjsnell you can use markup
16:33 tjsnell it's converted to wysiwyg on the fly
16:33 tjsnell not the same I know
16:33 tjsnell but I didn't know that
16:33 whartung no, it's not
16:34 whartung yea, pretty sure you can do silly things like *bold* and have magic happen, but you can;t get the markup version out.
16:34 tjsnell right, they don't store it in markup
16:39 aspire joined ##javaee
16:52 CJ_ Anyone familiar with spring prototype scope and threads?  #spring is pretty dead.
16:53 * sfisque will refrain from jumping all over that setup
16:53 * sfisque smirks evilly
16:57 CJ_ Figured out the problem.  I still had aop scoped proxy in my app context from when I was doing request scope.
17:03 _boot joined ##javaee
17:03 AlexCzar joined ##javaee
17:34 jieryn i think it is perverse to talk about spring here in ##javaee
17:34 whartung interesting article
17:34 whartung https://plumbr.eu/blog/how-to-use-asynchronous-servlets-to-improve-performance
17:49 sfisque so, let me see if i grok this correctly.  if the servlet is configured for asynch, the servlet "returns instantly" and then funnels the result of it's processing when it's done?  i assume there is a proxy that handles the reception and immediate return after dispatching the request to the asynch servlet handler.  correct?
17:57 whartung if it's configured async, the servlet is allowed to grab an AsyncContext, which can be used to, effectively, "stash" the request, and for the servlet to return.
17:58 whartung Later, Something Else(™) can then use the stashed context to send information through the connection
17:58 sfisque aye.  i guess i'm curious if you have to put that handling IN or does the annotation signal the container to do some "magic" for you
17:58 whartung you have to manage the async context your self
17:58 whartung the annotation simply enables that to be possible
17:59 whartung it's not quite the "single threaded server" kind of thing, it doesn't need to be.
17:59 whartung effectively, the server allocating each new request to its own thread
17:59 sfisque gotcha
18:00 whartung the handler is then tasked to try and free that thread up as quickly as practical, allowing the server to accept more requests with few threads
18:00 whartung then the asymc context is handed off to some other mechanism to be processed.
18:00 whartung so, effectively what's happening is before the socket is associated with a request which was pinned to a thread
18:01 whartung now, the socket is still associated with a request, but the request can be detached from its controlling thread and treated as a first class thing by the rest of the system
18:04 whartung what I found curious about that example, though, is that it seemed to me it was serializing all of the requests (i.e. each of them had to wait 2s), so, you'd think the response time would be related to the number of requests in the queue (i.e. requests that have not been handled yet).
18:04 whartung so I dunno how they go the 2000ms average response
18:08 sfisque so this is analogous to having a servlet call a method tagged @Asynch, returning instantly, and then having the response populate some values that get pushed back to the client via some push mech (like Comet or asynch polling)
18:08 sfisque correct?
18:09 sfisque but they're baking it into the stack
18:09 sfisque rather than having to glue together mechs
18:09 sfisque am i grok'ing this right?
18:10 whartung yes
18:10 whartung my mistake earlier was conflating the servlet async capability with what node.js does, and it's not the same at all
18:10 sfisque nifty
18:11 sfisque so what has to happen on the client side to make this happen?  (is there some JS lib or tags in the template?)
18:12 whartung you mean the browser side?
18:13 whartung nothing happens, they don't know anything is different
18:13 whartung if you have a "long polling" utility on the browser side, it should just work, as long as it's fed whatever it want from the server
18:20 sfisque right.  but would i HAVE to have something like a poller on the client side or is there a JS lib i'd have to include for it to "just happen"
18:21 sfisque i guess i'm trying to figure out what i get doing it "this way" vs dispatching to an @Asynch ejb method and polling for the updated values
18:21 whartung if you want that kind of support on the client side, then yea, you'd need to have something. That's independent of this
18:21 whartung what you get is a thread freed up
18:21 whartung on the server
18:21 whartung and the associated overhead
18:22 sfisque aye.  but i guess we already had that using the mechanic i described.  i wonder what this new feature benefit is
18:22 whartung while a paused thread has no CPU cost, per se (it's "sleeping"), it does have a bookkeeping and scheduling cost
18:22 whartung how do you have that now? You can't return from the thread without this
18:22 whartung this allows you to hand the process of the socket to a different thread. The original model did not.
18:22 sfisque servlet executes ejb method marked @Asynch.  it can then return instantly
18:23 whartung with the CLIENT doing the polling you mean
18:23 sfisque yeah
18:23 whartung this doesn't require the client to poll -- it can treat the request as a synchronous request.
18:23 sfisque so like websockets?
18:24 whartung I think you're mixing up the issues.
18:24 sfisque the stream is considered open even though it's detached?
18:24 whartung yes
18:24 whartung the stream is still open
18:24 whartung the underlying socket is still alive
18:24 sfisque ok now i see.
18:24 sfisque so the socket is set up with some context switching mech, i guess?
18:25 sfisque not being snarky, just trying to grok how it works to see the benefit over doing it "other ways"
18:26 sfisque benefit could be as simple as "write less code"
18:27 whartung I think it's a more flexible server programming model, enabling a host of techniques
18:28 sfisque gotcha
18:28 sfisque i will have to research this further.  i am intrigued
18:29 sfisque anyone have exp with jtrac?
18:30 sfisque it looks like it has a very modest installation footprint (drop in, quick config, done) for a jee container
18:42 sfisque man i miss the "near" operator that altavista provided
18:44 whartung no I've not seen or used jtrac
18:44 whartung whats the "near" operator?
18:45 sfisque back when AV was "THE search engine" you could do searches like —>   I near want near this near phrase near matched      (which would then do proximity weighting, so you'd get better results)
18:46 whartung ah i see
18:46 sfisque so it would match all sorts of approximate sentence/paragraphs without giving you results "just because those words appeared anywhere on the page"
18:46 sfisque google really needs that
18:48 sfisque for cases where i know the exact phrase i want to search on, but i also want to include various grammatically similar results just in case the author of the page paraphrased it
18:51 sfisque neat syntax question.  anyone know if there is a way to instantiate an inline delegate and have it implement Serializable?
18:51 whartung what does that even mean?
18:53 sfisque lets say i want to so soemthing like    ClassX blah = new ClassX(){ @Override public method() { /* do something */ };        but i need the class to be tagged serializable.  i dont want to create a top level class because it's just a one off delegate
18:53 sfisque i tried putting implements Serializable before the block but NB complains about syntax
18:53 whartung and the original is not serializable
18:53 sfisque it might not be possible.  just curious if anyone has done that
18:53 whartung I doubt you can do that
18:54 whartung without byte code shenanigans at least
18:54 sfisque no the original interface is not.  OH, but i could subclass that interface, add serializable and then instantiate it.   TY whartung
18:55 whartung sure
19:00 Voyage joined ##javaee
19:00 Voyage is node.js good for huge infrastructure that requires scalability and almost all features that javaee gives? for a facebook like app?
19:01 whartung when you get to something like Facebook, a decision of node.js vs anything else is irrelevant. Facebook uses PHP remember.
19:02 Voyage whartung,  no.
19:02 Voyage fb uses hphp,  now shifting to Javaee
19:03 whartung so?
19:04 sfisque fb is shifting to jee?
19:04 sfisque you have any links to substantiate that?
19:04 whartung the point is there are so many architectural decisions outside and unrelated to the what language you write your code in, that they tend to dominate the discussion. Java, JS, PHP, etc. etc. almost become bike shed arguments.
19:04 whartung Ebay used to run on a single C++ DLL.
19:05 whartung they they switched to "J2EE", but not in any way recognizable by reading a "J2EE enterprise patterns" book
19:06 sfisque i guess i'm curious what facilities are they using?  are they using PHP on top of java based REST?  JMS for internode comm?  because they're PHP on the front end
19:07 sfisque jee is a big platform that most of already know goes beyond servlets and ejbs
19:07 sfisque *** most of us
19:08 whartung yet most folks who use the term mean servlets
19:08 sfisque jee can be C# nodes talking corba to a jee container that is a messaging hubs
19:08 sfisque aye
19:08 whartung just like most folks who use "REST" really mean "RPC things over HTTP"
19:11 Voyage hm
19:11 Voyage I dont want my decision to be biased because I used javaee. i see its scalable and stable and feature full. mature too. but if node.js is better. I SHOULD go for it for a social networking full stack site server coding
19:12 whartung So, you want to build a Facebook app from scratch that will "scale to 100 million" on day 1?
19:12 sfisque whartung - subclassing the interface to add Serializable worked!!!
19:12 whartung w00t!
19:12 whartung shit it!
19:13 whartung ship
19:13 sfisque :-)
19:13 sfisque \o/
19:13 whartung auto correct ftw
19:14 sfisque for anyone interested.  if you want to "inline" a jsf validator, you have to extend the Validator interface and interpose Serializable IF you're exposing the validator as a "binding" rather than by ID or class ref
19:14 whartung ah clever
19:14 sfisque :-)
19:15 sfisque i needed to have the validator have access to fields in teh controller and passing refs around was messy IMO so inlining made the most sense (following the AWT delegate model)
19:15 Voyage whartung,  yes
19:15 Voyage want to build a Facebook app from scratch that will "scale to 100 million" on day 1?
19:15 sfisque get some VC first voyage :P
19:16 Voyage VC?
19:16 Voyage valued customer?
19:16 whartung so you need an app that allows you to throw "cloud resources" at the problem as the spike grows. So, basically your "computing unit" is a 3rd party VM someplace out in the world.
19:16 whartung Venture Capital
19:16 Voyage my boss has that.
19:16 Voyage :)
19:17 whartung Like the movie GoodFellas, pay attention to the Restaurant scene.
19:17 Voyage whartung,  sfisque  so what you recomend? javaee or node?
19:17 Voyage despite what ever we know.
19:17 Voyage but whats right for the job?
19:18 whartung I'd go JEE simply because I know JEE, I know JEE can do the job, and it's a devil I know.
19:19 whartung of course, it depends on your time frame. How many years do you plan to take building it?
19:20 Voyage both things are irrelavent.
19:20 semiosis lol if you're seriously working on a site for "100 million on day 1" and asking how to do it on IRC
19:20 Voyage assume that I know both javaee and node. assume you know both too.        what should be choosen?
19:20 Voyage semiosis,  no. I am deciding for a tool to pick. thats all
19:20 whartung if you knew them both, then you'd be able to choose to your satisfaction
19:21 Voyage whartung,  if you didnt knew any. what would you chose ?:)
19:21 whartung I'd choose node because "everyone else is and its hip right now". Mind, I can't say if it will work.
19:22 Voyage ::::)
19:22 whartung all the cool kids use node, and being ignorant, I want to be cool too.
19:22 Voyage hm thats what I was wanting to hear.
19:22 * Voyage shifts to node and not having a breakup with his first girl friend. java.
19:23 Voyage thanks !!
19:23 whartung but the pure truth is that Java is the most versatile computing platform on the planet.
19:23 semiosis whartung: you are a thought leader!
19:24 whartung this thought leader needs lunch...
19:24 Voyage its just I am a javaee dev. its hard for me to believe that can node give me all those features, like threading, IO, spring, ejb, hiberante etc. OOP..   i just cant believe with ease. thats all.
19:25 acuzio Voyage: How many applications have you written in node ? how many users ?
19:25 Voyage acuzio,  4
19:25 acuzio 4 users?
19:25 Voyage acuzio,  4 years. apps. cant count
19:25 acuzio What ?
19:25 acuzio Make sense
19:25 Voyage acuzio,  users? well 20,000,000 users
19:26 acuzio You have an application with 20 million users ?
19:26 Voyage yes
19:26 acuzio And its written in node.js
19:26 Voyage no
19:26 sfisque voyage you can do both.  node on the front end, data served via ee on the back end
19:26 Voyage android, ios, j2me
19:26 sfisque they are not mutually exclusiive
19:26 semiosis sfisque: node is backend javascript
19:27 acuzio Voyage: And you are asking this question ?
19:27 semiosis acuzio: !!!
19:27 Voyage sfisque,  node on the front end ? well node is for backend.
19:27 acuzio semiosis: yo
19:27 Voyage acuzio,  asking what?
19:28 acuzio Voyage: You are asking a question of node vs jee when you have applications with 20 million users . - something doesn't compute.
19:28 sfisque whoa i see.  i misudnerstood what node.js is then
19:28 Voyage acuzio,  we are redesiging
19:28 Voyage acuzio,  previous history is irrelavent
19:29 acuzio sfisque: The whole point of node.js is that it does JS on the backend ., so JS  programmers can go across the "chasm" - Its event driven and callback based mainly
19:29 acuzio Voyage: HAve you heard of Occams Razor ?
19:33 Voyage no
19:44 sajjadg joined ##javaee
19:48 sfisque i figured it out.  i was misconstruing node with dojo.  i had to look back on an old project.  lolz
19:48 sfisque so looking at node.js site.  interesting stuff
20:43 neuro_sys joined ##javaee
20:43 semiosis is there any risk to allowing AJP from the world?
20:43 semiosis (tomcat)
20:45 whartung you mean, opening up AJP to the world?
20:45 semiosis thats right
20:45 Naros We typically have apache proxy AJP over to tomcat
20:45 whartung but not fire walling the box behind the apache that's feeding it?
20:45 Naros http/https -> apache -> ajp -> tomcat
20:45 whartung I would say no, there's no risk.
20:46 Naros but agree with whartung, risk is minimal if any.
20:46 semiosis it's an AWS/EC2 thing... my API servers are in an autoscaling group behind an ELB.  i want to use AJP to reach those API servers from some web frontend servers, but I want to go through the ELB, so my frontends look like any other public traffic
20:46 whartung assuming all of your security sans HTTPS is done in the app, you should be fine, as AJP is just tweaked HTTP
20:48 semiosis thx
20:51 whartung with us, we use apache to terminate HTTPS, but we have the app server ports blocked by the firewall (apache is on the same box)
20:53 sfisque the risk would be taht your container has to run as root if you want it to bind to port 80.  if you're exposing a non priv'ed port to the cloud, it's less of a security hole, but there are known exploits against some servlet containers that can compromise the underlying machine
20:54 whartung if you're using AJP you're likely not putting that on 80 sfisque
20:54 sfisque if you do put java on the edge of the cloud LOCK DOWN jmx, jms, jndi and other non servlet services
20:54 sfisque when it comes to security i do not make assumptions
20:54 sfisque you maybe right
20:54 sfisque but he didnt specify
20:55 sfisque and make sure whatever container you deploy, it's admin servlet is locked and restricted to private ip (not cloud facing)
20:56 semiosis nothing reaches my app servers directly, all traffic goes through a load balancer. also tomcat runs unprivileged
20:57 semiosis i'm considering adding a tcp/8009 proxy to the load balancer, which would allow the world to reach tomcat over AJP
20:57 semiosis still doesnt expose any other ports on the app server
21:02 sfisque looking at the protocol desc of ajp, i'd say it's a bad idea.  ajp has a wider functionality than http does, which means more potential attack vectors
21:02 semiosis hrm ok
21:03 semiosis looks like i can restrict the AJP connector to only listen to my apaches using the requiredSecret option
21:03 sfisque ajp has 27 functional methods, http has 9
21:04 sfisque which was a surprise.  if hadnt looked it up, i would have said http has 7 but there are 2 others that seem arcane
21:05 sfisque bleh jtrac wont deploy to jboss unless i unzip the war file.  ugh, so 2003
21:18 sfisque tasty — http://www.computerworld.com/s/article/9246843/Sony_Panasonic_develop_300GB_optical_discs_for_enterprise_storage?source=CTWNLE_nlt_cloud_2014-03-10
21:48 unix-markow joined ##javaee
21:49 unix-markow left ##javaee
22:13 sajjadg joined ##javaee

| Channels | #javaee index | Today | | Search | Google Search | Plain-Text | plain, newest first | summary

Please see http://irclog.greptilian.com/javaee for which days have been logged.