Secure coding guidelines ...

Security Development Lifecycle (SDL) is a software development process that helps developers build more secure software and address security compliance requirements while reducing development cost.

Common Secure Coding Guidelines:

1. Input Validation
2. Output Encoding
3. Authentication and Password Management (includes secure handling of credentials by external services/scripts)
4. Session Management
5. Access Control
6. Cryptography Practices
7. Error Handling and Logging
8. Data Protection
9. Communication Security
10. System Configuration
11. Database Security
12. File Management
13. Memory Management
14. General Coding Practices

Secure Coding Books:

1. The CERT Oracle Secure Coding Standard for Java (SEI Series in Software Engineering) 
2. Java Coding Guidelines: 75 Recommendations for Reliable and Secure Programs (SEI Series in Software Engineering)
3. Secure Coding in C and C++ (SEI Series in Software Engineering)

ref:

1. OWASP Security Reference Guide -

• https://www.owasp.org/index.php/OWASP_Secure_Coding_Practices_-_Quick_Reference_Guide
• https://www.owasp.org/images/0/08/OWASP_SCP_Quick_Reference_Guide_v2.pdf
• https://www.owasp.org/index.php/OWASP_Java_Table_of_Contents#J2EE_Security_for_Developers
• https://security.berkeley.edu/content/application-software-security-guidelines
• https://www.owasp.org/index.php/Java_leading_security_practice

2. Java coding guidelines - 

• carnegie mellon university Android coding guidelines -  https://www.securecoding.cert.org/confluence/display/android/Android+Secure+Coding+Standard
• carnegie mellon university ‘oracle coding standard for java’ - https://www.securecoding.cert.org/confluence/display/java/Java+Coding+Guidelines
• carnegie mellon university ‘oracle coding standard for java synchronization ’ - https://www.securecoding.cert.org/confluence/pages/viewpage.action?pageId=1858104, https://www.securecoding.cert.org/confluence/display/java/SEI+CERT+Oracle+Coding+Standard+for+Java
• Java Thread synchronization - https://www.securecoding.cert.org/confluence/pages/viewpage.action?pageId=18581044

3. Oracle's Java Security guidelines -

• http://www.oracle.com/technetwork/java/seccodeguide-139067.html
• http://docs.oracle.com/cd/E26502_01/html/E29016/scode-1.html

4. Java Security guidelines videos - 

• https://www.youtube.com/watch?v=08gdSEeeiS4
• https://www.youtube.com/watch?v=PJaQM1UpdRQ

5. Twelve rules for developing more secure Java code - http://www.javaworld.com/article/2076837/mobile-java/twelve-rules-for-developing-more-secure-java-code.html

6. Security Development Life Cycle(SDL) - 

• https://msdn.microsoft.com/en-us/library/windows/desktop/84aed186-1d75-4366-8e61-8d258746bopq.aspx
• https://msdn.microsoft.com/en-us/library/windows/desktop/ee663293(v=vs.85).aspx

Digital Audio Programming

Digital Audio is the most commonly used method to represent sound inside a computer. In this method sound is stored as a sequence of samples taken from the audio signal using constant time intervals. The quality of digital audio signal depends on the time (recording rate) and voltage resolution (usually in an linear integer representation with basic unit one bit). A sample represents volume of the signal at the moment when it was measured. In uncompressed digital audio each sample require one or more bytes of storage. Number of bytes required depends on number of channels (mono, stereo) and sample format (8 or 16 bits, mu-Law, etc.). The length of this interval determines the sampling rate. Normally used sampling rates are between 8 kHz (telephone quality) and 48 kHz (DAT tapes).

Digital audio can be stored in a wide range of formats. Generally speaking, audio comes in two flavors: compressed and uncompressed. Compressed audio can further be subdivided into different kinds of compression: lossless, which preserves the original content exactly, and lossy which achieves more compression at the expense of degrading the audio. Uncompressed PCM audio, on the other hand, is defined by two parameters: the sample rate and the bit-depth. Loosely speaking, the sample rate limits the maximum frequency that can be represented by the format, and the bit-depth determines the maximum dynamic range that can be represented by the format. You can think of bit-depth as determining how much noise there is compared to signal.

In the Linux kernel, there have historically been two uniform sound APIs used. One is OSS(Open Sound System); the other is ALSA (Advanced Linux Sound Architecture). ALSA is available for Linux only, and as there is only one implementation of the ALSA interface, ALSA refers equally to that implementation and to the interface itself.

Android Native code makes uses of OpenSL ES (Open Sound Library for Embedded Systems) for handling Audio processing.

ref:

The ABCs of PCM (Uncompressed) digital audio - http://blog.bjornroche.com/2013/05/the-abcs-of-pcm-uncompressed-digital.html

WAVE PCM soundfile format - https://ccrma.stanford.edu/courses/422/projects/WaveFormat/

An introduction to Linux sound systems and APIs - http://archive09.linux.com/articles/113775

A Tutorial on Using the ALSA Audio API - http://equalarea.com/paul/alsa-audio.html

How to write ALSA driver - http://c-qs.blogspot.com/2014/05/writing-of-alsa-driver.html

alsa vs tinyalsa - http://blog.csdn.net/myzhzygh/article/details/8468210

Open Sound System(OSS) - 

1. http://en.wikipedia.org/wiki/Open_Sound_System
2. https://wiki.archlinux.org/index.php/Open_Sound_System
3. http://www.4front-tech.com/pguide/audio.html

Advanced Linux Sound Architecture(ALSA) -

1. ALSA pcm -  http://www.alsa-project.org/alsa-doc/alsa-lib/pcm.html
2. ALSA -  alsa-lib, libsound2.so - http://www.alsa-project.org/alsa-doc/alsa-lib/pcm.html
3. ALSA Pulse Audio - http://freedesktop.org/software/pulseaudio/doxygen/simple.html
4. Pulse Audio(libpulse.so)  - http://freedesktop.org/software/pulseaudio/doxygen/simple.html
5. Linux sound drivers -  http://www.tldp.org/HOWTO/Sound-HOWTO/

Introduction to Audio programming -

1. How Audio Data is Represented - http://blogs.msdn.com/b/dawate/archive/2009/06/22/intro-to-audio-programming-part-1-how-audio-data-is-represented.aspx
2. Demystifying the WAV Format - http://blogs.msdn.com/b/dawate/archive/2009/06/23/intro-to-audio-programming-part-2-demystifying-the-wav-format.aspx
3. An Introduction to Audio Processing Objects - http://msdn.microsoft.com/en-us/magazine/dn201755.aspx
4. Synthesizing Simple Wave Audio using C# - http://blogs.msdn.com/b/dawate/archive/2009/06/24/intro-to-audio-programming-part-3-synthesizing-simple-wave-audio-using-c.aspx
5. Algorithms for Different Sound Waves in C# - http://blogs.msdn.com/b/dawate/archive/2009/06/25/intro-to-audio-programming-part-4-algorithms-for-different-sound-waves-in-c.aspx

C/C++ wav processing sample code - https://android.googlesource.com/platform/frameworks/av/+/jb-dev/cmds/stagefright/

Linux pcm audio sample code - http://www.alsa-project.org/alsa-doc/alsa-lib/_2test_2pcm_8c-example.html

Android audio native programming using OpenSL ES - http://audioprograming.wordpress.com/2012/03/03/android-audio-streaming-with-opensl-es-and-the-ndk/

Android API for record/play audio(example: pcm): AudioRecord, AudioTrack - 

1. http://www.edumobile.org/android/android-development/audio-recording-in-wav-format-in-android-programming/
2. http://stackoverflow.com/questions/5245497/how-to-record-wav-format-file-in-android
3. http://stackoverflow.com/questions/4871149/how-to-record-voice-in-wav-formt-using-android

Popular Java/JavaScript frameworks/tools

JAX-RS Implementations: 

• Jersey ( JAX-RS Reference Implementation from Sun )
• RESTEasy ( JBoss Application Server's JAX-RS project )
• Apache CXF
• RESTlet

JAX-WS Implementations: 

• Apache CXF
• Apache Axis2
• Metro ( from Sun )
• Spring-WS

ORM Frameworks:

• Hibernate ( from JBoss )
• TopLink ( from Oracle )
• MyBatis ( google code project )
• Cayenne ( from Apache )

Java Messaging Service(JMS) Implementations:

• Apache ActiveMQ
• IBM MQSeries ( Websphere MQ )
• Oracle OpenMQ ( Open Message Queue )
• JBoss HornetQ

Opensource Java Enterprise Service Bus(ESB):

• Mule
• Apache ServiceMix
• Open ESB

Java to XML Bindings:

• JAXB
• Castor
• XMLBeans

Java Search Engines:

• Lucene
• Solr ( uses Lucense internally )

Unit Testing Frameworks:

• TestNG
• JUnit

Javascript Frameworks:

• AngularJS
• Dojo
• JQuery

JavaScript(WebUI) Unit Testing Frameworks:

• Jasmine
• QUnit
• JSTestDriver
• JsUnit

Opensource Web Application UI Testing(Automating Web Browsers) Frameworks:

• WebDriver ( Selenium 2.0 )
• Selenium
• Watij

Analyse Security Vulnerabilities in Code:

• HP Fortify - Identify, fix and protect from security vulnerabilities in software applications
• IBM Rational AppScan - Intended to test Web applications for security vulnerabilities during the development process
• Coverity - Static code analysis tools for C/C++/Java/C# used to find defects and security vulnerabilities in source code

WebServices Frameworks

Java WebServices Development Tools:

Apache CXF: Apache CXF is an open source services framework. CXF helps you build and develop services using frontend programming APIs, like JAX-WS and JAX-RS. These services can speak a variety of protocols such as SOAP, XML/HTTP, RESTful HTTP, or CORBA and work over a variety of transports such as HTTP, JMS or JBI.

Apache Axis2: is a Web Services / SOAP / WSDL engine, the successor to the widely used Apache Axis SOAP stack. There are two implementations of the Apache Axis2 Web services engine - Apache Axis2/Java and Apache Axis2/C.

Apache Wink: Apache Wink is a simple yet solid framework for building RESTful Web services. It is comprised of a Server module and a Client module for developing and consuming RESTful Web services.

JAX-WS: JAVA-API( XML-based Webservices, means mainly WSDL/SOAP though REST is possible too )

RI(Reference Implementation): JAX-WS: { javax.xml.ws.**.* , core Web services support } = JAX-WS “RI” [is subset of] Metro
Note: Metro = JAX-WS “RI” + WSIT/Tango ( WSIT/Tango provides support for Security, Reliability, Transactions and Interoperability with .NET 3.0 )

JAX-RS: JAVA-API( RESTful Web Services )
RI(RI(Reference Implementation): JAX-RS = { javax.ws.rs.**.* } = Jersey

AWS Toolkit for Eclipse: The AWS Toolkit for Eclipse is an open source plug-in for the Eclipse Java IDE that makes it easier for developers to develop, debug, and deploy Java applications using Amazon Web Services. With the AWS Toolkit for Eclipse, you’ll be able to get started faster and be more productive when building AWS applications.

Eclipse WST Web Services UI: The Web Services project is a sub-project in the Eclipse WTP Top-Level Project. The project consists of two components: The JST Web services component, which contains tools for developing and interacting with Java Web services and the WST Web services component, which contains tools for Web services development which is not Java specific.

Eclipse with Lomboz plugin: Lomboz is an open source and free J2EE development environment for businesses and individuals. You can develop, test, profile and deploy Web, Web services, Java, J2EE and EJB applications with this IDE. Lomboz has comprehensive support for most J2EE standard application server runtimes, and supports most popular open source runtimes such as JOnAS, and other vendor runtime environments. Lomboz is buillt on the Eclipse open source platform and the Web Tools Platform (WTP) projects.

OpenSource WebService Testing Tools:

• soapUI

• TestMaker

• WebInject

Miscellaneous:

• Tools to view HTTP requests and responses - Wireshark, Fiddler, IEInspector HTP Analyser, Firebug, HttpFox

           Web Development: Client side debugging tools/plugins inside Browser:

            Chrome => Chrome developer Tools ( F12 )

            Firefox  => FireBug/Poster

            IE          => Fiddler

• Tools to test RESTful Webservices - RESTClient(from GoogleCode; A Java application to test RESTful webservices), HTTP4E(REST HttpClient for Eclipse)

• POSTER add-on to Firefox - RESTful Web Services can be tested using a firefox addon called Poster. It's a developer tool for interacting with web services and other web resources that lets you make HTTP requests, set the entity body, and content type. This allows you to interact with web services and inspect the results.

• Microsoft’s WCF & Service Trace Viewer Tool - Windows Communication Foundation (WCF) Service Trace Viewer Tool helps you analyze diagnostic traces that are generated by WCF

ref:

Open Source Web Services Tools in Java - http://java-source.net/open-source/web-services-tools

WebServices (SOAP vs REST) - http://www.ajaxonomy.com/2008/xml/web-services-part-1-soap-vs-rest

JAX-WS and JAX-RS United in CXF - http://sberyozkin.blogspot.com/2011/01/jax-ws-and-jax-rs-united-in-cxf.html

J2EE Programming Tips

Popular Java/J2EE Development/Testing Tools

1. IDE => Eclipse/Netbeans/IntelliJ IDEA/JBuilder/JDeveloper/WSAD

2. Application Server => WebSphere/Weblogic/Sun GlassFish/Apache Tomcat/JBoss/JRun/Iplanet/NES(Netscape Enterprise Server)/NAS(Netscape Application Server) /IPLANET(It is latest version of NES and NAS)

3. Database Server => Oracle/Sqlserver/Sybase/MySql/DB2(if Application is Mainframe)

4. Middle Tier => EJB/Hibernate/TopLink/JDO/JMS/Corba(TAO,JavaOrb,OmniOrb ...)

5. Web Application Frameworks => Struts/Spring/JSF/GWT/Apache Wicket/Grails/Adobe Flex/ OpenLaszlo/SAILS/Tapestry

6. XML Parser => Xerces(Apache Parser)/JAXP(Sun Parser)

7. XSLT Parser => Xalan(Apache XSLT)/Saxon

8. JAVA XML Binding => JAXB/Castor/XMLBeans

9. Unit Testing Framework for Java => JUnit/GJTester

10. Unit Testing Framework for Servlets => Cactus/AppPerfect

11. Unit Testing Framework for Servlets/JSP/EJB => HtmlUnit/AppPerfect

12. Unit Testing Framework for Java Database Programming => SQLUnit / DBUnit / DAO

13. Java Memory Leak Tool => HeapRoots / JRockit JVM

14. Java Performance Checking Tool => Apache JMeter / JProfiler / JUnitPerf / The Grinder

15. Java Code Static Analysis Tool => ASSENT(TCS Product)/JTest

16. Java Code Coverage Tools => CheckStyle/PMD

17. Java Build Tool => Ant/Maven/Apache Ivy

18. Java Bug tracking Tool => Jira/Bugzilla/SVN Trac/QC(Quality Center)

19. Java Webservices Tool/Libraries => Jersey(RESTful) / Restllet / Axis(SOAP WebServices)

20. Java Common Utilities API => Apache Commons Library ( Please check this Library before you develop any new Java Utilities Classes)

21. Java Reporting Tools => BI Crystal Reports/Actuate/Jasper Reports/JCharts

22. Open Source UML & Modeling in Java => AgroUML/WebUML/Jude/Violet

23. Logging Tools => Log4J / Commons Logging / AspectJ / Log4plsql(Open-Source Tool for PL/SQL Logging) / jLo

24. Java Security Frameworks => Acegi, JaaS

25. Java Graph/Network Visualization Tools => Tom Sawyer / VizServer / Giny

26. Java Desktop GUI : AWT/SWING/GWT/SWT/JFace

27. Open Source Wiki Engines in Java => JSPWiki / MediaWiki

28. Web Browsers => Chrome/Mozilla FireFox/Safari/IE

29. Miscellaneous:

a. Continuous Integration/Build Tools => Jenkins / Hudson

b. Encryption/Decryption Libraries => JASYPT (Pretty good Java cryptography library to encrypt/decrypt your usernames, passwords, files ...)

c. Image API => Jai (Java Advanced API for Imaging)

d. Configuration Management Tools - Subversion / CVS

e. Java Service Wrapper (To run your java applications as a windows service)

f. Content Management System(CMS) - plone / zoomla / zope / drupal

g. Java Persistence API(JPI)

h. JCR - Content Repository API for Java (JCR) is a specification for a Java platform API for accessing content repositories in a uniform manner

i. MULE - Mule is the world's most widely used open source Enterprise Service Bus (ESB).

j. JSON - JSON (JavaScript Object Notation) is a lightweight data-interchange formatFor data-oriented applications, prefer JSON to XML due to its simplicity and ease of processing on the client side. XML may be great on the server side, but JSON is definitely easier to deal with on the client side. Popular JSON libraries are Jackson, Gson.

k. Rhino - Javascript Engine in Java

l. Apache Lucene/Solr - A high-performance, full-featured text search engine library written entirely in Java

m. JavaScript Web Frameworks - AngularJS, Dojo

n. JavaScript Unit Testing - Jasmine

Core Java Focus:

1. Core Java Fundamentals (Core Packages)
2. Collections, Generics, Reflections
3. Multithreaded Programming
4. AWT/SWING GUI Programming
5. JDBC programming
6. Network Progamming (sockets, ...)
7. HTTP Programming
8. RMI
9. JNDI

Compared to JDK 4.0 ( 1.4.4) , JDK 5.0 ( 1.4.5) has more features

1. Generics => which are like C++ STL (Standard Template Library)
2. Variable Args
3. enum
4. Auto Boxing
5. Reading Commandline Arguments
6. printf

J2EE Focus

Here you will focus on one of the J2EE Web Application Frameworks -

Any Web Application Framework => Presentation Tier, Middle Tier
Examples:

1. Struts => Presentation Tier(Servlets,JSP),Middle Tier(EJB)
2. Spring => Presentation Tier(Servlets, JSP), Middle Tier(Hibernate)
...

So the common and fundamental stuff in J2EE is Servlets, JSP
Servlets => HTML code Snippets embedded with JAVA code
JSP => Java Code Snippets embedded with HTML code

So we can say Servlets & JSP in J2EE as Fundamentals of J2EE programming.
To be a good one in J2EE, You have to be proficient in atleast one Application Server & one Database Server based on the Operating System that you are going to deploy J2EE Products/Applications.

Application Server can be => WebSphere/JBoss
Database Server can be => Oracle/SqlServer ( if OS is Windows then SqlServer )

Thanks To:
Special Thanks to my wife, Roja Koney for her inspiration, contribution and continuous support to write this Java/J2EE post.

Special Thanks to Changal Rayudu , Raghavendra Sai for their immense help in developing this write-up.

Books(https://drive.google.com/folderview?id=0B_hC-3L4eq17REdOa053SFF0Rm8&usp=sharing_eid)

1. "Thinking in Java , 3rd Edition" by Bruce Eckle - http://www.mindview.net/Books/TIJ/

2. Joshua Bloch effective Java (2nd edition) - http://uet.vnu.edu.vn/~chauttm/e-books/java/Effective.Java.2nd.Edition.May.2008.3000th.Release.pdf

3."'J2EE Web Services: The Ultimate Guide" by Richard Monson-Haefel -http://books.google.com/books?id=NNqmolbaApQC&pg=PA1&dq=j2ee&sig=ACfU3U3-RDn6uGY8QZ6DjYPT_Fb_dSPiKA#PPA885,M1

4. "J2EE Design Patterns" by William Crawford, Jonathan Kaplan -
http://books.google.com/books?id=N_cEwmcSauUC&printsec=frontcover&dq=j2ee&sig=ACfU3U0cgVRY8TUXpZc8TH31xU_4Z_XgRA

5. "Core J2ee Patterns: Best Practices and Design Strategies" by Deepak Alur, John Crupi -
http://books.google.com/books?id=1dx34EMVyi8C&printsec=frontcover&dq=j2ee&sig=ACfU3U34F4XCp2YQSIge-EQHvjjJqQcU9w#PPA11,M1

6. "J2EE and JAX: developing Web applications and Web services" by Michael Yawn -
http://books.google.com/books?id=SK0Im1uI3jsC&printsec=frontcover&dq=j2ee&lr=&sig=ACfU3U3gToC6jT-YLbNQ5WRzKgL7hlmNcQ

7. "Sun Certified Enterprise Architect for J2EE Study Guide (exam 310-051)" by Paul R. Allen, Joseph J. Bambara -
http://books.google.com/books?id=GJRKjnwYJcgC&printsec=frontcover&dq=j2ee&lr=&sig=ACfU3U3qAxMyrwvi8V26J7QYGiwp1vZkDA

8. "Sun Certified Enterprise Architect for J2EE technology study guide" by Mark Cade, Simon Roberts -
http://books.google.com/books?id=qczD49Yc9OoC&pg=PA11&dq=j2ee&sig=ACfU3U3fiZUtuhg0RHFnbFJEz5ZXu8-dlQ#PPP1,M1

9. "Core Web Programming" by Marty Hall and Larry Brown

10. "CodeNotes for J2EE: EJB, JDBC, JSP, and Servlets" by Gregory Brill

ref:

1. Open Source Software in Java - http://java-source.net/

2. Open Source Testing Tools in Java - http://java-source.net/open-source/testing-tools

3. Java/J2EE IDEs Overview - http://www.devx.com/Java/Article/34009

4. J2EE Interview Questions - http://www.geekinterview.com/Interview-Questions/J2EE

5. J2EE Overview - http://java.sun.com/j2ee/1.4/docs/tutorial/doc/Overview.html

6. J2EE Overview - http://www.comptechdoc.org/docs/kanti/ejb/j2eeoverview.html

7. .NET vs J2EE - http://www.oreillynet.com/pub/a/oreilly/java/news/farley_0800.html

8. Java Desktop GUI - http://www.javaworld.com/javaworld/jw-04-2004/jw-0426-swtjface.html

9. Java Content Repository(JCR) API -http://en.wikipedia.org/wiki/Content_repository_API_for_Java

10. Mule -
http://www.mulesource.com/products/mule.php
http://www.theserverside.com/tt/articles/article.tss?track=NL-461&ad=645256&l=COISWithMuleandJCR&asrc=EM_NLN_3809631&uid=3048354

11. JSON - http://www.subbu.org/weblogs/main/2006/08/json_vs_xml_1.html

12. Ruby Blog - http://ola-bini.blogspot.com/2008/06/fractal-programming.html

13. Java Interview Questions -http://www.indijava.in/community/faq/java_interview_questions

14. Runtime Code Generation with JVM & CLR - http://www.itu.dk/~sestoft/rtcg/rtcg.pdf

15. JVM vs CLR memory allocation - http://benpryor.com/blog/2006/05/04/jvm-vs-clr-memory-allocation/

16. Javascript Engines : WebMonkey(in C) , Rhino(In Java) - http://www.mozillazine.org/

17. Runtime Code Generation with JVM & CLR - http://www.itu.dk/~sestoft/rtcg/rtcg.pdf

18. JVM vs CLR memory allocation - http://benpryor.com/blog/2006/05/04/jvm-vs-clr-memory-allocation/

19. PHP Frameworks - CAKE, ZEND, SYMFONY

20. Java Server Magazine - http://www.javaskyline.com/

HTTP & Servlet Debugging Tools

FireFox Plugin/Add On for HHTP Debugging - Tamper Data

Internet Explorer(IE) Plugin for HHTP Debugging - Fiddler

Servlet & JSP Debugging from Tomcat - Sysdeo Plugn & lomboz plugin

To debug Tomcat Servlets from Eclipse, we can use Sysdeo Tomcat Plugin ( where we have to launch Tomcat with in Eclipse IDE )
Steps:
1. Install Sysdeo Tomcat Plugin

2. Put Break Points in Servlet

3. Run Tomcat from IDE which breaks ...

Eclipse Short Cuts:
1. Control+Space to get Intellisense

2. We can generate Setters & Getters for Member Variables by right clicking on variable in the IDE , Goto Source & Select Setters & Getters

3. For adding the Servlet Jars => Goto Project properties -> Java BuildPath -> Libraries Tab -> Add all Servlet Jar files which are part of Tomcat Lib folder.

ref:
Sysdeo Eclipse Tomcat Plugin - http://www.eclipsetotale.com/tomcatPlugin.html

Process of integrating sysdeo plugin with Eclipse -http://socrates.acadiau.ca/courses/comp/dsilver/2513/EclipseAndTomcatTutorial/soft_step5.html

Java Database Access - JDBC, iBATIS, Hibernate Core, OpenJPA and PureQuery

Java Database Access API

• JDBC is good for applications in which the queries are dynamic and you need programmatic control of various tuning features to maximize performance. However, as the coding examples show, JDBC is relatively complex to use because you have to code the persistence logic yourself.

• iBATIS does a great job of insulating your object programmers from the details of JDBC and SQL by providing some ORM functions and keeping the SQL in a separate config file—especially applications that are based heavily on Stored Procedures or well-architected SQL from a DBA. However, if you prefer not to explicitly code SQL or if your domain objects have a complex life cycle, then iBATIS is not likely the best choice for you.

• Hibernate Core has a much more advanced ORM layer and has served as the basis for the new JPA standard; however, developers should begin to use the Hibernate JPA APIs if standards are important. Also, if you are using the JBoss Application Server, using Hibernate Core is a natural choice.

• OpenJPA, like Hibernate, has an excellent ORM layer that lets your Java programmers think in object terms. It has the additional advantage of being based on an industry standard and the capability to annotate the code and forgo the need for a mapping XML. ISVs may find the Apache license a better option for shipping software solutions based on OpenJPA. In addition, if you are using the WebSphere Application Server or WebLogic Server, using the OpenJPA-based runtime shipped with their container makes the most sense.

• pureQuery enables relational queries to be embedded in the Java code itself; however, it is relatively new as of publication and may undergo a number of changes that could impact code you write today. That said, it can have major advantages from a performance and tracing standpoint, especially if using DB2. Furthermore, pureQuery can be used in other types of environments, such as Web 2.0-based environments. Like iBATIS, applications that are based heavily on stored procedures or SQL written by a separate role such as a DBA should consider pureQuery as well. It is also worth noting that another persistence mechanism, such as the Groovy API's in Project Zero, may choose to implement on top of the pureQuery engine to exploit the performance and management features.

Some architects will not be willing to make the trade-offs associated with each of these mechanisms and will instead use this knowledge as an excuse to invent their own persistence framework exactly tailored to their requirements. Although inventing your own persistence layer can be fun, especially for architects with a strong computing science background, we advise against doing so because it puts your programmers in the middleware business instead of developing mission-critical enterprise applications.

Java Open-Source Tools

Java Unit Testing – Junit

Swing GUI - jfcUnit

Html - HtmlUnit, WebTest

Servlets/EJB - Cactus

ANT - ANT stands for Another Neat Tool, and it lives up to its name. ANT takes your source code and builds it into an application—sort of.

CruiseControl - CruiseControl is a scheduling and reporting tool that uses ANT to build your system, and then runs all of its tests unit, integration, and acceptance (if they all exist, which they should). It then reports on the results in a variety of ways, including uploading HTML reports to a web server.

Castor - Castor is a relational-hierarchical-object mapping tool. It supports Java-to-XML , Java-to-SQL binding and lot more.

MySql - World's most popular OpenSource Databases. It's a general purpose database, and it comes with good JDBC drivers. (ConnectorJ is the official one)

Hibernate - OR mapping tool

Axis - Axis is a SOAP server from Jakarta. It implements SAAJ (SOAP with Attachments API for Java) from Sun, and SOAP 3 from W3C.

Tomcat - Servlet Engine
Catalina - the servlet container itself
Jasper - the JSP translator (it translates JSP source into Java source for a servlet)
Coyote - a web server

Reference:
The Best Java Open-Source Tools - http://www.informit.com/articles/article.aspx?p=29962

Java OpenSource Testing Tools - http://www.opensourcetesting.org/unit_java.php

Best of Java

Links:

Five Java articles you should share with your team - http://articles.techrepublic.com.com/5100-10878_11-1046131.html?tag=rbxccnbtr1

How to Write Doc Comments for the Javadoc Tool - http://java.sun.com/j2se/javadoc/writingdoccomments/index.html

Ten tips for creating killer Java docs - http://articles.techrepublic.com.com/5100-10878_11-1045800.html?tag=rbxccnbtr1

Doxygen way of Commenting the code - http://www.stack.nl/~dimitri/doxygen/docblocks.html

Commonly used architectural patterns in Java applications - http://articles.techrepublic.com.com/5100-10878_11-1049864.html?tag=rbxccnbtr1

Abstract packages ensure flexibility - http://articles.techrepublic.com.com/5100-10878_11-1058943.html?tag=rbxccnbtr1

Internationalization(i18n) & Localization(L10n)

i18n - Internationatioanlization
l10n - Localization

Making your Software ready for Locanguage specifica Translation is called Internationalization(i18n)

Translating the Strings/Messages to particular Language(German,Italian,Japanese) is called Localization(l10n)

i18n Check-List

1.Isolating Hard Coded Messages (ex: Error Messages, Log Messages …) from the Source Code.

C++
Windows : ResourceDll
UNIX : Message Catalogue

Java : Resource Bundle (Property Files)

.NET : ResourceManager(System.Resources.ResourceManager) , Satelite Assemblies

2. Format DATE, TIME, NUMBERS & CURRENCIES accordingly

3. String Comparisons:

Normal String Functions (ex: strcmp () in C++) do Binary Comparisons of Strings. As UNICODE needs 2 Bytes Binary Comparison does not work. We need to use Collator Functions

C++ : strcoll ()
Java : Collator Class

4. Converting Non-Unicode Text to Unicode text

C++
Windows : MultiByteToWideChar (), WideCharToMultiByte ()
UNIX : Mbstowcs (), Wcstombs ()

Java : GetBytes ()

What is the difference between Stateful and Stateless encoding?

In stateful encoding, the data stream has special sign (i.e. escape sequence or shift-in shift-out). For example, ISO-2022-JP is a stateful encoding.

In ISO-2022-JP data stream, if we have Kanji character in the stream, it must at least 2 ‘ESC’ character. So you have to seek the stream from the beginning of it.

ISO-2022-JP is used for e-mail message in Japanese environment. All most of your development, I think you don’t need to consider about it.


Links:

Java Code Internationalization checklist - http://java.sun.com/docs/books/tutorial/i18n/intro/checklist.html

.NET Localization - http://www.ondotnet.com/pub/a/dotnet/2002/09/30/manager.html

How To Create Localized Resource DLLs for MFC Application -http://support.microsoft.com/kb/198846

UTF-8, UTF-16, UTF-32 & BOM - http://unicode.org/faq/utf_bom.html