By Ben Galbraith
Ajax -- called DHTML just a few months ago -- has revolutionized (or "radically iterated", if you like) web application development in the short few months since the term was coined.

What is it all about? Why are we excited about a set of capabilites that have been sitting in our browser for years? What can you do with it? And, how can you do it?

Ajax, short for Asynchronous JavaScript and XML, is a technique for communicating with servers from within a web page without causing a page refresh.

This session provides an introduction to Ajax and an orientation to the state of the ajaxian universe. The basic ajaxian techniques will be demonstrated through live coding, and more advanced examples of Ajax will be demonstrated and deconstructed.

Attendees will understand how the Google Maps UI is built (and why it isn't as hard as it looks), how Ajax can improve portals, community sites, and pretty much any other type of web application.

Furthermore, the issues surrounding how to create an Ajax application that doesn't turn into an unmaintainable pile of hacked up crap JavaScript will be discussed.

At the end of the session, an off-line capable, web services consuming Ajax RSS aggregator will also be demonstrated.

This talk will be presented by one or more of the founders of Ajaxian.com.

The session "Ajaxian JavaScript Frameworks" complements this session, and dives deeper into specifics on how to use many of the frameworks introduced in this session.

By Ben Galbraith
In the "Introduction to Ajax" session, we discuss what Ajax is, how it works, and how others are using it.

This session goes deeper into Ajax by reviewing the existing JavaScript frameworks that aim to make it easier.

The scope of the frameworks is all over the made, from unit testing JavaScript to deconstructing other websites to making it easier to create your own ajaxian effects.

If you want to easily add some Ajax to your site, come to this talk, presented by one or more of the founders of Ajaxian.com.

By Ben Galbraith
For many of us, XML has become a ubiquitous presence in application development, whether parsing, validating, or manipulating it. For many of us, all
that XML is coupled with pain, in the form of tedious APIs (like, say, the W3C DOM API) and confusing technologies (oh, I don't know, W3C XML
Schema?).

In this session, I share the following tips for making the XML in our lives a little easier to deal with:
- Use StAX instead of SAX
- Use StAX to create XML
- Use JDOM instead of W3C DOM
- Use XPath to select XML
- Use Jaxen to enable XPath over custom trees
- Use RELAX NG instead of DTD or WXS
- Use Trang when DTD/WXS output is required
- Use Sun's RELAX NG Converter when WXS input is required
- Consider RELAX NG's compact syntax
- Use Schematron to extend schema languages
- Consider XML namespaces for versioning
- Ignore unknown namespaces

By Ben Galbraith
It sounded like such a good idea back in the mid-nineties: based the Java platform on a standards-based, open community, and let anyone participate. There is no question that Sun's strategy for Java's stewardship via the JCP and sponsored open-source has yielded some enormous benefits. However, these have not been enjoyed without tremendous cost.

Perhaps the recent pop-culture book The Paradox of Choice put it best: "When people have no choice, life is almost unbearable. As the number of available choices increases, [as it has in the Java community], the autonomy, control, and liberation this variety brings are powerful and positive. But as the number of choices keeps growing, negative aspects of having a multitude of options begin to appear. as the number of choices grows further, the negatives escalate until we become overloaded. At this point, choice no longer liberates, but debilitates. It might even be said to tyrannize."

Does this ring true in your environment? Are you tired of spending countless hours evaluating IDEs, build systems, app server vendors, competing web frameworks, competing persistence standards, competing vendor implementations of those standards, and so forth? You're not alone.

The mess of competing standards, implementations, and other overlapping non-standard frameworks in Java, and lack of a single authoritative vendor-guide (i.e., Sun's "guidance" has proved irrelevant and unproductive) kills Java's productivity for all but a handful of experts with the experience to navigate the landscape.

This session details the ideas and experiences of one enterprise that has set out to solve this problem.
The topics reviewed will consists of:

- Defining a standard "stack" of Java frameworks and technologies, but also "standardizing on demand"

- Creating a template application that acts as the starting point for any new project

- Approaching reuse retrospectively, not prospectively

- Unifying training and support, and providing organization mentoring

- Simple project health monitoring

Of course, the idea of standardizing application development in an organization is nothing new. You may have tried it. Did it work? Being successful at this endeavor is tricky, and most efforts fail.

While the specific example detailed in this session is still underway and its too early to declare unqualified success, come learn about this effort and how its principles can be applied in your organization.

By Bruce Tate
This session, for the Spring beginner, helps you:
• Understand dependency injection and inversion of control
• Know the meaning of lightweight containers and Spring
• Understand the basic pieces of Spring
• See core Spring modules in action, including Persistence, AOP, transactions.

Attendees need not know anything about Spring. This session does talk about integration with core J2EE frameworks like JDBC and transactions.

The Spring framework is one of the fastest growing open source frameworks. New job postings are gaining rapidly, and many customers are adopting Spring instead of heavier alternatives. In this session, we’ll introduce Spring. You’ll see how Spring can give you much of the power of EJB, without the complexity or pain.

Spring uses concepts like dependency injection and aspect oriented programming to ease standard enterprise development. Spring developers write plain, ordinary Java objects (POJOs), instead of sophisticated components. In this session, you’ll see a basic Spring application. You’ll also see some details about some of the enterprise integration strategies, including:

• Spring AOP
• Transactions
• Persistence
• Model/view/controller

When the session is over, you won’t be an expert, but you should have a much clearer understanding of what Spring does, what it doesn’t do, and why it’s growing so rapidly.

By Bruce Tate
O/RM (Object/Relational Mapping) seeks to eliminate repetitive or tedious work enabling the CRUD (create, read, update, delete) that underlies most applications. Hibernate is a popular, open-source O/RM tool that uses reflection (instead of code generation, like EJB, or bytecode injection, like JDO) to manage your persistence layer.

This session will introduce you to Hibernate. After an overview of common usage scenarios, including web and enterprise applications, we'll examine the basics of getting Hibernate running. We'll cover the mapping file format and syntax, including common relational mapping structures. Then, we'll examine the Hibernate API for interacting with the framework. Finally, we'll cover the common architectural decisions you'll have to make as you include this (or any other) O/RM framework.

By Bruce Tate
Agile programming is a collection of core principles and techniques that allow software developers to create lighter, more responsive applications, and to have fun doing it. Many established organizations are either openly or sub-conciously hostile to many of the principles of Agile development.

We'll explore the intersection of these new practices and old-world sensibilities, relying on real-world case studies to illustrate some of the compromises that are necessary to bridge the gap. In addition to technical and process aspects, we'll also spend some time talking about the business aspects, such as how Agile development affects contracts.

By Craig Walls
Windows changed everything. Back in the days of MS-DOS, you could only run one application at a time. Switching between writing a letter and balancing your checkbook involved closing a word processor and opening a spreadsheet. But now you can be running dozens of applications simultaneously, each inside its own window. And now switching from one
application to another may be as simple as a shift of your eye or a click of the mouse button.



Portals do for web applications what Windows did for MS-DOS. With traditional web applications such activities as checking the weather, viewing baseball scores, and keeping up with the latest news involves visiting several distinct web applications. But with portals, all of these applications, presented as portlets, can be combined into a
single web-page for convenient and concise viewing.

In this session, I'll demonstrate how to build portlet application using Spring Portlet MVC, an adaptation of the Spring MVC framework that is geared toward writing JSR-168 compliant portlet applications.

By Craig Walls
Where Spring promotes loose-coupling between your application objects, service-oriented architecture (SOA) encourages loose-coupling between applications that interact with each other.



In this presentation, I'll show you how to build loosely-coupled architectures based on Spring-enabled services. You'll see how to use Axis and XFire to turn your Java objects into web-services and also see how to configure services within the Mule enterprise service bus.

By Dave Thomas
Are you frustrated by experts who can't tell you what to do, or by junior team members who refuse to see the big picture? How can you best develop careers: both yours and those of your teammates and managers? How can we learn to apply experience more effectively, and why do the many approaches designed to tame complexity actually end up increasing it?

Dave Thomas, of The Pragmatic Programmers, describes the solutions to these and other problems as he turns the Pragmatic Spotlight (and a good dose of twisted humor) on formal learning models, the Nursing profession, and streamlining sheep.

By Dave Thomas
Ruby recently enjoyed its tenth birthday. Instead of cake and candles, the community celebrated by releasing a wave of new libraries and frameworks that make Ruby programming even easier. This talk features some of the best of these, as we explore Ruby.


We'll spend about half the session getting to know Ruby: the syntax, type system, blocks, iterators, and so on. Then we'll dive in and develop some real-world code using web services, RSS, and databases. If you want to come to the Rails talk, and you're not that familiar with Ruby, this talk is a good starting point.

By Dave Thomas
The Ruby on Rails framework has exploded onto the scene over the last few months. Propelled by some genuine benefits, and fueled by a whole lot of controversy, Rails seems here to stay. So, is it a Java killer? (No.) Is it a great way to develop certain classes of web application? (Yes.) Does it really deliver the 10-fold increase in developer productivity that some have claimed? (It depends...)



If you can't help thinking that there must be an easier way of developing web projects, come and join us as we construct an MVC-based Ruby on Rails application using the very latest libraries and tools. You'll get a taste of Ruby, and also a feel for some of the power and productivity gains offered by this remarkable framework. You'll need a grounding in Ruby to get the most from this talk; if you're not already a Ruby developer you might want to attend the Facets of Ruby talk before coming to this one.

By David Geary
Okay, so you know a little about JSF. You understand managed beans, action outcomes and how to attach standard JSF validators to components in a JSP page.

But there is a great deal of functionality that the average web application supports that JSF doesn't provide out of the box. For example, wouldn't you like to have JSF automatically place asteriks in front of labels for required fields? You are going to implement client-side validation, which JSF does not support out of the box, aren't you? Of course, you're going to test your application, right? And don't forget to trap unauthorized use of the back button.

How do you do all of that stuff in a JSF application? If those are the kinds of questions that keep you up at night, then this session is for you. We will explore the outer reaches of JSF development to illustrate how you can bend your next JSF application to your will.

By David Geary
JavaServer Faces is a well designed user interface framework, but it lacks a number of features you might otherwise expect out of the box; for example, JSF does not explicitly provide support for client-side validation.

So, from the folks that brought you Struts, comes Shale, a collection of useful enhancements to JSF. A top-level Apache Software Foundation project, Shale adds some really cool features to vanilla JSF, including:

Web flow: script dialog flow
Remote Method Calls: easily call JavaBean methods from JavaScript
Tapestry-like views: code views in pure HTML
Use Apache Commons Validator validators on the client or server, or both
JSF testing framework: mocks for easy JSF testing

There's a lot of cool stuff in Shale that makes JSF a much more compelling proposition. Come see what it's all about.

This is a code-intensive, fast-paced look at Apache Shale. Forty-plus slides and five demos makes for an action packed session that illustrates the cool features that Shale provides.

By David Geary
User interfaces are usually the most turbulent aspect of an application during development. Constant tinkering with the UI means constant changes to your code, so as a UI developer, you want to minimize the scope and effects of those code changes.

Open-source Java provides two powerful software packages that help you manage UI complexity: Tiles and Sitemesh. Tiles composes webpages from discrete regions of your user interface known as tiles. A tile contains a JSP page for layout and one or more JSP pages for content. Sitemesh decorates webpages with decorators that can be associated with URL patterns. Once you set up your decorators, you can decorate pages that match a decorator's URL pattern.

Come see how to use Tiles and Sitemesh with a guided tour from the inventor of Tiles, who has recently become a Sitemesh believer.

By Eitan Suez
Today, the Cascading Style Sheets (CSS) specification is well supported by the major browsers (Mozilla, Safari, IE). CSS has become a practical tool for web content publishers that has helped turn heavy, buggy, and hard-to-maintain web sites into lean, clean, and stylish ones. CSS is sometimes stereotyped as a technology geared for graphic designers and artists. I beg to differ: I see CSS as a refactoring tool for content publishers and one that encourages content to become more strongly semantic. Come see a developer's perspective on CSS and how it can be applied to refactor your web content.

Session Goals:
To "grok" CSS. To dispell the myth that CSS is not a tool for software developers. To learn to wield CSS to produce superior web user interfaces.

Prerequisites:
Prior experience with web technologies (specifically HTML) is assumed. Audience is assumed to have a programming background.

Session Rating:
Intermediate

Category:
Languages

By Eitan Suez
JiBX is an open source XML data binding API for Java. JiBX is younger than most other APIs in this space (Castor XML, BEA XMLBeans, JAXB). JiBX's philosophy on data binding is that: [a] databinding should be fast, and [b] databinding frameworks should allow for the divergence and evolution of your codebase from its xml representation. JiBX excels on both counts and consequently is a practical tool for the purpose of data binding. In this session, Eitan will be covering all aspects of Dennis Sosnoski's JiBX framework.

Session Goals:
To learn the JiBX API in detail. JiBX can considerably simplify the task of parsing XML content into business objects and generating XML representations of these business objects.

Prerequisites:
Basic understanding of XML, but not of any of the variety of standards that build upon that foundation. Basic understanding of the Java programming language.

Session Rating:
Intermediate

Category:
XML/Web Services

By Eitan Suez
Classes will often bear various states. Examples include a user who may be "logged in" or "logged out," a bill that is "open" or "paid," or potentially a more complex situation where an object obeys a set of complex rules that determines which of a number of possible states that object is in. The Gang of Four gave us the State Pattern, a fairly straight-forward mechanism for developers to model and implement the behaviour of stateful objects. The State Pattern is only the beginning of the story. Robert Martin developed the State Machine Compiler and has taken the job of developing and maintaining stateful systems to a new level. Today, SMC is a well-maintained open source project hosted on sourceforge.net. Come learn about SMC, a fundamental tool for implementing stateful classes and systems that every software developer should have in his toolchest.

Session Goals:
Developers today are faced with increasing pressure to deliver robust software with increasing levels of sophistication and features. The goal of this session is to introduce a software consruction tool that cleanly separates the concern of managing object state transitions from the rest of a software system. The end result is an application that takes less time to code, is easier to maintain, and that can dramatically reduce the complexity (and consequently the increases the quality) of the implementation.

Prerequisites:
Basic understanding of the Java programming language and of object-oriented programming and design. Familiarity with "Gang Of Four" Design Patterns.

Session Rating:
Intermediate

Category:
Architecture/Languages

By Eitan Suez
Join Eitan in this hands-on session on Naked Objects. This session uses the "learning by doing" approach to learning an API or framework. Naked Objects is a powerful tool that can give you a significant advantage in the development of business systems. It gives you the ability to prototype a software application so quickly that it can be performed during information gathering phases of a project. It gives you the power to codevelop the core business model of your application with a non-developer business expert at your side. No prerequisite knowledge of Naked Objects is required.

Session Goals:
To learn to write software applications (possibly system prototypes) using the NakedObjects framework. Developing applications that use NakedObjects requires knowledge of the conventions and contract of this framework. NakedObjects is a fairly radical development in the domain of business software application development. Awareness of the concepts and implications of expressive systems is an important secondary goal.

Prerequisites:
Basic understanding of the Java programming language and of object-oriented programming and design. Familiarity in the domain of business application software development.

Session Rating:
Intermediate

Category:
Architecture

By Glenn Vanderburg
Every now and then, it's really helpful to be able to generate a new Java class at runtime. Some problems just can't be solved any other way. It's one of those troublesome tasks: it's fairly tricky to do, and you only need to do it occasionally—but when you need it, you really need it (and usually you need it yesterday). So you have to start essentially from scratch, learning about how to do it on the fly, under pressure.



This talk is designed to help. You may not face this problem for a while, so there's no point focusing on the arcane details that you'll soon forget. Instead, I'll give you what you'll need to quickly come back up to speed when the time comes. You will see some real bytecode generation, but more importantly we'll discuss the types of problems where runtime code generation can save the day, the variety of tools and techniques that are available, and a step-by-step approach to getting the job done. Finally, for those who may be working with more dynamic languages, I'll show how powerful runtime code generation can be when it's easy. We'll start simply, but before we're done we'll be pretty deep into the bag of tricks. Come along, and be ready for the next time you need more than what's in your JAR file.

By Glenn Vanderburg
Most of the time, Java's automatic memory management works really well—it's one of the things that makes programming in Java a pleasant and productive experience, and it's nice that we don't have to worry about managing memory manually. However, although it's usually nice to ignore memory management, occasionally we have to pay close attention. Sometimes we need to take control of certain aspects of memory management. Sometimes Java programs do exhibit memory leaks, or unacceptably long garbage collection pauses, or very poor overall performance. But because Java's memory management is supposed to be "fully automatic," it can be difficult to find out what's really going on inside the VM.



Java memory management is just like most labor-saving simplifications: it works well most of the time, but for the weird edge cases when it doesn't work quite right, it can be a nightmare. This talk opens the hood, examining the inner workings of Java's memory system, including allocation and garbage collection. We'll look at how to control the memory system and interact with it, what's costly and what's not, how to tune the garbage collector and when to switch to a different GC algorithm, and other topics.

By Glenn Vanderburg
The Java Collections framework is a cornerstone of Java development. It's been a part of J2SE for six years now. Every Java developer knows it—how to create Lists, Maps, and Sets, how to put things into them and take things out, and how to iterate over the contents. But there's a lot more to the collections framework than that -- and very few programmers really know how to exploit the power that's just under the surface.

The basics of the collections classes are so simple that many developers haven't even thought to look for the additional power that's there. And it's not just built-in capabilities, either. The design of the collections framework makes possible several powerful techniques and patterns that can magnify your productivity, as well as helping you build systems that are efficient and scalable.

It may seem strange to give a talk on a framework that every Java programmer already knows. But in every project I've worked on for the past six years, I've seen a lot of code that uses the collections poorly. More often than not, that code was written by skilled programmers with significant Java experience. In this talk, you'll learn how to use the collections well, exploiting their full power—the little-known capabilities, the extensibility features, and powerful patterns such as wrappers, adapters, and decorators. We'll also cover some new features that slipped into Java 1.5, plus a few especially useful third-party collection implementations.

By Jason Hunter
Java's new Metadata facility introduced in J2SE 5.0 defines a way to attach decorations to classes, fields, methods, and even packages that can be extracted by the compiler or runtime tools to provide advanced functionality. Think of metadata as an extended @deprecated flag, or think of XDoclet++. In this tutorial session you'll learn how Metadata fits in the Java platform (and how it compares to the C# platform). We'll cover how to use the metadata attributes provided in the core J2SE libraries and how to write your own. We'll also show a bit of what's coming in JSR-181, tasked to define standard metadata attributes for web services.

Attendees should be skilled Java programmers ready to see what's possible in the latest release and learn to make the most of it.

By Jason Hunter
The new Java 5 release introduces a number of significant Java language enhancements: generics, typesafe enums, autoboxing, an enhanced "for" loop, a static import facility, and a general-purpose metadata facility. This talk gives an overview of the changes and helps you understand what all the funny new syntax means.

The main new language topics covered:

* Generics, also called "parameterized types", which let you specify the type of objects used in a collection, among many other things.

* Autoboxing, that lets you implicitly convert from primitives to reference types, and vice-versa.

* An Enhanced For Loop, that lets you iterate over arrays or collections with half the code as before.

* Typesafe Enums, to create object-oriented, extensible enumerated values.

* Static Imports, to put into scope static methods and fields.

* Varargs, that allows methods to accept an arbitrary number of parameters.

* A Metadata Facility, allowing decoration to classes and methods for later tool consumption. Covered in more depth in the "Java Metadata" talk.

* Random new Library Features, like the ability to control external process launching, output formatting, and input scanning.

This talk describes the proposed changes and shows how they work together to improve the Java language. We also take breaks to see how closely Java matches the C# designs!

Attendees are assumed to be competent Java programmers.

By Jason Hunter
XQuery is a new language from the W3C that lets you query and manipulate XML -- or anything that can be represented as XML, such as relational databases. As a Java developer -- especially a server-side Java developer -- XQuery is key to searching and manipulating large XML repositories or performing any XML-centric task.

This talk introduces XQuery. I'll explain the XQuery language; I'll show how to call XQuery from Java; and as the creator of JDOM, I'll also explain when to use XQuery instead of JDOM, and when to use both.


Attendees should have an interest or need in managing large sets of XML, but need not have any past experience with XQuery. After the session, attendees will be able to program XQuery and know which implementations to trust.

By Jason Hunter
Web Caching is very important for high traffic, high performance web site but few people know all the professional-level strategies. In this talk I'll share some of the tricks of the trade, including advanced tips from Yahoo's Mike Radwin.

We'll start with the basics: using client-side caches, conditional get, and proxies. Then we'll talk about more advanced features: how best to handle personalized content, setting up an image caching server, using a cookie-free domain for static content, and using randomization in URLs for accurate hit metering or sensitive content.

Attendees should have experience or interest in how the web works and in cajoling the web into doing their bidding.

By Jason Hunter
Open source isn't about a license, it's about human interaction and individual motivation. I've seen open source from all sides. I've been an individual contributor and a project leader. I've worked on commercial and open source efforts, and have both helped commercial projects go open and designed ways for open projects to absorb commercial codebases. I've been on the front lines in the Apache/Sun negotiations on open source Java that ended on the JavaOne keynote stage with Scott McNealy. In this talk, I'd like to share my favorite stories in and around open source and the lessons they teach us.

* What it was like to take the servlet engine Tomcat from a Sun internal project to an Apache open source project

* How Jakarta changed Apache's character

* How *not* to think about Apache

* The pros and cons of leading the JDOM project

* Why JDOM is not part of Apache

* Why my latest coding work isn't open source

* How companies can best utilize open source and open source ideas

* The past, present, and future of open source Java

By Mike Cohn
Transitioning to an agile process from a traditional process is fraught with potential dangers. Attend this class and learn the dozen things you absolutely must do in order to succeed.

Learn how to overcome resistance, communicate progress, deal with nay-sayers, get the project off on the right foot, and select an appropriate first project. This class will be equally suited for programmers, testers, managers and even customers and analysts who are interested in adopting an agile process.

By Mike Cohn
Estimating and planning are key skills. A good plan helps both the organization and the developers working on the project. In this session you’ll learn how an easy and effective approach to estimating and planning that can help you create more realistic plans.

Planning is important for all projects, even for projects using agile processes such as XP, Scrum, or Feature-Driven Development. Unfortunately, we’ve all seen so many worthless plans that we’d like to throw them away altogether. The good news is that it is possible to create a project plan that looks forward six to nine months that can be accurate and useful. In this class we will look at why traditional plans fail but why planning is still necessary even on agile projects. We will look at various approaches to estimating including unit-less points and ideal time. The class will describe four techniques for deriving estimates as well as when and how to re-estimate. We will look at techniques to create a plan that dramatically improves the project’s chances of on-time completion. Also discussed will be using velocity to track progress against the plan. This class will be equally suited for managers, programmers, testers, or anyone involved in estimating or planning a project.

By Mike Cohn
Almost all of us have worked on too many projects that have failed because of economic reasons rather than technical reasons. Just as the technical team is required to estimate the effort that will go into a project, a marketing or product management team should estimate the benefits of doing the project. Benefits can come in the form of additional sales, increased customer retention, increased operating efficiencies, and so on.

In this session we will look at return on investment (ROI) as well as traditional discounted cash flow methods such as net present value (NPV), and discounted payback period. We will also look at newer approaches such as economic value added (EVA).

The math is easy, the concepts are powerful. You will return home with practical knowledge about how to apply these straight-forward techniques to prioritizing and selecting projects.

By Mike Cohn
Projects struggle for many reasons—overly aggressive deadlines, unproven technologies, scope creep, team dynamics, communication problems, and inter-team coordination are just some of the reasons. If not given attention, these problems can ultimately cause a project to fail entirely. However, if you act early and in the right way, most struggling projects can be turned around.

In this class we will look at how to determine what is causing a project to fail and then at what to do about it. You will learn how which remedies to consider in which situations and how to determine the appropriateness of each. Also covered will be advice on communicating the project correction plan to executives or project sponsors who may still think the project is on track. The class offers practical advice from the presenter’s years of experience in assessing both successful and unsuccessful projects.

By Neal Ford
Is Service Oriented Architecture the next wave of distributed computing or just the same old crap in a shiny new package? This session provides an overview of what most people agree is the definition of SOA. I talk about SOA, ESB, CORBA, your MOM, and a bunch of other acronyms.

This session is a pragmatic look at SOA from a developer perspective, including such (never talked about) topics like tranports, granularity, versioning services, transformations, and whether you should be doing this or not. I show lots of slides with diagrams and talk about how to evolve towards an SOA. SOA can work if you ignore the hype and focus on the real meat: building loosely coupled message-based applications. This session discusses just that.

By Neal Ford
This session highlights common mistakes made by web programmers, stating the problems and avoidance techniques.

Building secure web applications is difficult. Common trivial mistakes in other programming environments break web applications. This session highlights common mistakes made by web programmers, stating the problems and avoidance techniques. The material in this session is derived from the Open Web Application Security Project (OWASP) and other sources. It covers the OWASP top 10 list of vulnerabilities (including examples). It also demonstrates some (legal!) hacker tools that malicious developers use against you. This session includes case studies showing complete attacks, from vulnerability acquisition to compromise. It also covers open-source tools (such as Stinger) that automate some of the security jobs for developers. This session is designed to scare you – but in a good way!



Key Session Points:

* OWASP List of Vulnerabilities

10. Insecure configuration management
9. Denial of service
8. Insecure storage
7. Improper error handling
6. Injection flaws
5. Buffer overflows
4. Cross site scripting flaws
3. Broken authentication and session management
2. Broken access control
1. Unvalidated input

* Security Tools and frameworks
* Case Study: Hacking Oracle through a browser
* Case Study: Cross-site scripting
* Case Study: SQL Injection

By Neal Ford
This session delivers 10 techniques for improving your code, whether you are freshly graduated or a grizzled veteran.

Even the most competent programmer falls into habits and coding ruts. This session delivers 10 techniques for improving your code, whether you are freshly graduated or a grizzled veteran. It is derived from many sources, including other languages (Smalltalk, Lisp, Java, and others), and techniques and idioms we have developed teaching developers. It also consolidates information from books that delve into the craft of writing good software. The goal is to create code that is easier to read, maintain, debug, and enhance.

Key Session Points:

1. Names of Things


2. Composed Method


3. Apply the Unix Philosophies


4. Syntactic Stuff




• Constants


• Enumerations


• Common Methods: equals() && hashcode()




5. Orthogonality


6. Compactness


7. The Pragmatic Rules


8. Template Method


9. Bad Inheritance


10. Decoupling with Interfaces

By Neal Ford
This session discusses techniques and tools for debugging enterprise applications (without using System.out.println()!)

It's an interesting dilemma – we have the best tools for software development ever, yet developers are still debugging enterprise applications using ystem.out.println()! This session discusses techniques and tools for debugging enterprise applications. It shows how to perform remote debugging through all the major IDEs, either on the same machine or across a network. It also shows how to debug using the command-line jdb debugger (the only one guaranteed to always be available).This session shows how to debug web, EJB, and lightweight enterprise applications. It discusses class loaders, interactive enterprise debugging with Groovy, and how to automate repetitive tasks using JWebUnit and Selenium, making the computer do work for you instead of vice versa (how many times do you have to walk multiple pages through a web application to get to the point where you can debug it?). This session shows you how to automate these and other common debugging tasks. The goal is to make hunting and eliminating bugs in complex applications much easier.

Key Session Points:
• Setting up remote debugging in IDE's
   o Eclipse
   o IntelliJ
• Effective remote debugging
• When it's all you've got: jdb and enterprise applications
• Forensic debugging using loggers
• Debugging web applications
   o Inspector
   o Bookmarklets
• Debugging EJB
• Debugging in lightweight frameworks
• Interactive Debugging with Groovy
• Automating debugging tasks
   o JWebUnit
   o Selenium

By Neal Ford
Regular expressions should be an integral part of every developer?s toolbox, but most don?t realize what an important topic it is. Regular expressions have existed for decades, but many developers don't understand how to take full advantage of this powerful mechanism, either through command line tools and editors or in their development.

This session shows how to fully exploit regular expressions. It begins with the basic premise of how regular expressions work, then shows how to take advantage of the RegEx library built into the Java platform. This session shows how to use wildcards, escape characters, meta-tags, character class operators, look-aheads/look-behinds, and how to use the greedy operators effectively. It covers regular expressions from the beginning through to advanced usage, both in Java and in tools that support regular expressions. This session is packed with real examples of regular expressions (including a game show with no fabulous prizes).

Key Session Points:

Common Regex mistakes

By Neal Ford
This session shows how to use Java as the building block for domain-specific languages. It discusses the next revolution in programming: language-oriented programming and the nascent tools that support it.

If you look at the way advanced programmers in highly dynamic languages (like Lisp, Smalltalk, Ruby, etc.) work, they tend to build domain specific languages on top of their low-level language. The language syntax itself becomes building blocks for languages that are highly specific to their problem domain. It’s not as easy to apply this technique to a static language (like Java), but it is possible. This session shows how to use Java as the building block for domain-specific languages. It discusses internal and external DSLs, with pros and cons for each. This session progresses from creating an internal DSL using Java syntactic elements as keywords through using compiler-building tools to create your own external DSL arriving ultimately at the new tools that allow you to build, edit, and deploy external DSL (language workbenches). This session covers the theory and practice of building DSL's and why this is an important step in the evolution of programming paradigm.


Key Session Points:
1. Why Dynamic languages?
2. Building domain languages
3. Language-oriented Programming
   a. Internal DSLs
   b. External DSLs
4. Internal DSL
   a. Characteristics
   b. Advantages
   c. Disadvantages
5. External DSL
   a. Characteristics
   b. Advantages
   c. Disadvantages
6. Case Study: Building your own language
   a. Building the parser
   b. Building the lexer
   c. Abstract Syntax Trees
7. Parsing other languages
   a. Parsing Java
   b. Parsing HTML, JavaScript, and others
8. Language Workbenches

By Neal Ford
This session talks about how to actually get XP done in the real world (and what to tell your boss).

Extreme programming sounds a little too ?ESPN2? for most managers, but there is a lot of sound engineering behind its principles. My employer, ThoughtWorks, has been extremely successful using the full XP stack and we have developed lots of experience with it. This session talks about how to do XP in the real world. XP is all about feedback loops, so I discuss how to replace the radical sounding ones with more palatable ones. I talk about the parts of XP that are absolutely vital (unit testing, collective ownership, continuous integration, etc) and the ones that you can introduce a little more slowly (pair programming, only a 40 hour work week). This session focuses on the practicality of XP and how you can adopt it at your organization. I also talk about political battles with managers, other departments, and barriers that pop up anytime you try to introduce change in a large enterprise. Discussion is encouraged (required) in this session.

Key Session Points:
XP and Feedback Loops
A pragmatic look at the XP practices
    The planning game
    Small releases
    Metaphor
    Simple design
    Testing
    Refactoring
    Pair programming
    Collective ownership
    Continuous integration
    40-hour week
    On-site customer
    Coding standards
XP in the real world

By Stuart Halloway
Java has always provided a model for concurrency and threads. With Java 1.5, this model received a major facelift. Learn how to use the new concurrency utilities to build responsive, scalable, and correct concurrent applications.


Java's support for threads is broad and deep. From the early days of the platform, programmers have used threads, synchronized blocks, and monitors to build safe multi-threaded applications. Java 1.5's new concurrency utilities greatly reduce the need to use these primitives directly. Now, Java provides a set of lock classes and task scheduling tools that provide much more leverage in writing real applications. We'll explore java.util.concurrent, and also see how the Java Memory Model has been corrected in 1.5.

Most of the advantages of java.util.concurrent can also be had in previous version of Java. We'll discuss Doug Lea's concurrency utilities and the backport of java.util.concurrent to 1.4. Both of these are appropriate for production use.

Finally, we'll look at common mistakes in multi-threaded programming. The most common mistake is using threads when you don't need them. We'll look at alternatives to threads, and how to choose between them.

By Stuart Halloway
JUnit is great. Jython and JRuby are even better. Unit testing libraries look the same everywhere, so why not use the one that lets you get your job done faster?

Unit testing has taken the world by storm. Almost every major language has a JUnit-like library. And here's the good news: These libraries are so similar that once you learn one, you can use any of them.

Given that many languages interoperate directly with Java, you aren't limited to JUnit. You can pick the library that provides the best language level support for writing concise, easily maintainable unit tests. Circa late 2005, there are good arguments for the unittest module in Jython, and Test::Unit in JRuby.

The talk is divided into three parts:

1. A crash introduction to unit testing Java code. We'll cover test-driven development, test cases, assertions, fixtures, and test suites. We'll be using Jython and JRuby but the concepts are exactly the same in any language


2. A look at the Python and Ruby features that make Jython and JRuby compelling choices. We'll see how tests are faster to develop and easier to maintain than JUnit tests. And perhaps surprisingly, we'll also see how tests scale better when applications get large.


3. A candid comparison of Jython, JRuby, and JUnit, including advantages and disadvantages of each. One size does not fit all.

By Stuart Halloway
For centuries people have used crypto to build (and break) secure sys