Central Iowa Software Symposium

August 3 - 5, 2007



Event Details

Location

Sheraton West Des Moines
1800 50th Street
West Des Moines, IA 50266
View Map
NOTE: You are viewing details about a past event. You may view our upcoming event schedule here ».

Session Schedule

About the Session Schedule
Download Agenda PDF We are committed to hype-free technical training for software architects, programmers, developers, and technical managers. This year's symposium places increased emphasis on the role of XML, J2EE, Web Services, Agile Methodologies, and Open Source. We offer over 50 sessions in the span of one weekend. Featuring leading industry experts, who share their practical and real-world experiences; we offer intensive speaker interaction time during sessions and breaks.

About Sessions
Our sessions are designed to cover the latest in trends, best practices, and latest developments in Java application development. Each session lasts 90 minutes unless otherwise noted.

Friday - August 03


  1 2 3 4 5
12:00 - 1:00 PM REGISTRATION
1:00 - 1:15 PM WELCOME
1:15 - 2:45 PM
2:45 - 3:15 PM BREAK
3:15 - 4:45 PM
4:45 - 5:00 PM BREAK
5:00 - 6:30 PM
6:30 - 7:15 PM DINNER
7:15 - 8:00 PM Keynote: No, I Won't Tell You Which Web Framework to Use: or The Truth (with Jokes) by Scott Davis

Sunday - August 05


  1 2 3 4 5
8:00 - 9:00 AM BREAKFAST
9:00 - 10:30 AM
10:30 - 11:00 AM BREAK
11:00 - 12:30 PM
12:30 - 1:15 PM LUNCH
1:15 - 2:15 PM EXPERT PANEL DISCUSSION
2:15 - 3:45 PM
3:45 - 4:00 PM BREAK
4:00 - 5:30 PM

Behavior-driven development in Java

close

Andrew Glover By Andrew Glover
Behavior-driven development, or BDD, has attracted a lot of attention a la RSpec in the Ruby community, but BDD's roots stem from JBehave, a Java based framework. In this session, we'll look at what BDD is and how it shifts the traditional testing vocabulary from being test-based to behavior-based.

Behavior-driven development, or BDD, has attracted a lot of attention a la RSpec in the Ruby community, but BDD's roots stem from JBehave, a Java based framework. In this session, we'll look at what BDD is and how it shifts the traditional testing vocabulary from being test-based to behavior-based.

Monitoring Software Quality with Continuous Integration

close

Andrew Glover By Andrew Glover
The practice of continuous integration facilitates early visibility into the development process by regularly conducting software builds, thus integrating disparate software pieces earlier than later, which often times minimizes the interval between when a defect is coded and when it is discovered. Given the automated nature of continuous integration spawned builds, software teams can now start to look at their build process as something more useful than a simple compile and test process.


The practice of continuous integration facilitates early visibility into the development process by regularly conducting software builds, thus integrating disparate software pieces earlier than later, which often times minimizes the interval between when a defect is coded and when it is discovered. Given the automated nature of continuous integration spawned builds, software teams can now start to look at their build process as something more useful than a simple compile and test process. Builds can be augmented with a series of Software Inspectors, which report on various aspects of software quality, such as code complexity, code duplication and code dependences to name a few. In this presentation, attendees will learn about the practice of continuous integration and the available CI tools for Java. Furthermore, Software Inspectors will be examined and attendees will learn how to interpret the data they provide and how to take actionable items based upon that data.

Refactoring Ant builds with Ivy, Groovy, and good old fashion common sense

close

Andrew Glover By Andrew Glover
Are your Ant builds giant XML files that scream for attention? Why not enhance your build process to act like a quality gate, much like a test suite would?

Are your Ant builds giant XML files that scream for attention? Why not enhance your build process to act like a quality gate, much like a test suite would? In this session, we'll look at managing 3rd party dependencies with Ivy and then add the power of Groovy to script in quality checks, such as monitoring complexity; plus, we'll look at how to create a customizable dashboard via Groovy.

Spring 2.0: New and Noteworthy

close

Ben Hale By Ben Hale
Spring 2.0 has marked a major advance in the Spring Framework. While still maintaining backwards compatibility, this release adds quite a few new features. What are those features and how do they add value? Come by and see.

In this session we'll provide a practical tour of what's new in Spring 2.0. Spring 1.x users who are looking to upgrade to Spring 2.0 will love this session. If you're not using Spring already, this talk will give a great overview of the things you're missing out by not using Spring 2.0.

The talk will highlight new configuration strategies, Spring AOP, bean scoping, JPA support, JMS improvements, new Spring MVC features, VM languages, and much more.

AOP and JMX: A match made in heaven

close

Ben Hale By Ben Hale
You're winding down a project and you get that dreaded email from your project manager, "How hard would it be to add some performance monitoring to the system?" Well, after this session, you'll be able to respond, "No problem at all!" It turns out that with a pinch of AOP and a dash of JMX, you can introduce amazing management and monitoring capabilities without changing your mainline code one bit.

In this session, we explore the technologies of AOP and JMX and how they can be used together to transparently add management and monitoring in a completely non-invasive way. We'll explore some of the various AOP packages including Spring AOP and AspectJ and how they can be used to apply management and monitoring inline to an application. Once we've added this functionality we'll how to expose it using JMX using Spring's JMX support and consume it using JConsole or Spring.

If you're tentative about introducing AOP or JMX into your application, come take a look at some of the cool things you can do with them and how easy it can be.

Spring and Hibernate in the Middle Tier

close

Ben Hale By Ben Hale
To today's JEE developer, there are two indispensable tools for creating applications; Spring and Hibernate. Together these two frameworks comprise one of the most powerful and often used stacks in the industry. While it is possible to do amazing things it's not always obvious how best to use them to maximize value. This session aims to correct that.

In this session, we'll start by addressing the basic design of an application using Spring and Hibernate. Once we've established some baseline best practices, we'll focus on how to best use Hibernate (both 2 and 3) in the persistence tier. We'll take a look at the use of Spring's HibernateTemplate and some new strategies in Spring 2.0. To finish with a look to the future, we'll explore use of JPA (Hibernate implementation) with Spring 2.0.

Acegi Security: The security framework with the funny name

close

Ben Hale By Ben Hale
Security is one of the major requirements in modern day enterprise applications and yet it is also one of the weakest parts of most developers toolboxes. The problem is of course that security is HARD! It turns out that rather than reinventing the wheel for each application, developers can turn to a great security framework out there already; Acegi.

In this session we'll discuss a little known but widely used Spring sub-project called Acegi Security. Acegi is a great tool for implementing security at the URL, method, and domain object layers and can greatly simplify security requirement fulfillment for enterprise applications. The first part of the session will focus primarily on some basic security concepts and where Acegi fits into the equation. The second part of the session will focus on basic design and usage principals of Acegi. The final segment will be a live coding example where we actually take an application and add all three levels of Acegi security to it. As a bonus, I'll even tell you the story of how the Acegi name came about :)

Spring Web Flow Jumpstart

close

Ben Hale By Ben Hale
Have you ever developed a web application with a long user action based on form input? Did you curse the Java community for their inability to address this very common application type? Well, attend this session about Spring Web Flow and you'll curse no more.

In this session we'll learn about a new(ish) Spring sub-project, Spring Web Flow. Spring Web Flow is an innovative new framework for declaratively modeling web application user interactions. We'll start with an exploration of some web development issues and then take a look at the value proposition that Web Flow brings to the table. Once everyone is comfortable with that, we'll jump straight to code. We'll start by exploring some of the features that SWF has and then we'll finish with a live coding example where the audience will help write the application.

AOP and JMX: A match made in heaven

close

Ben Hale By Ben Hale
You're winding down a project and you get that dreaded email from your project manager, "How hard would it be to add some performance monitoring to the system?" Well, after this session, you'll be able to respond, "No problem at all!" It turns out that with a pinch of AOP and a dash of JMX, you can introduce amazing management and monitoring capabilities without changing your mainline code one bit.

In this session, we explore the technologies of AOP and JMX and how they can be used together to transparently add management and monitoring in a completely non-invasive way. We'll explore some of the various AOP packages including Spring AOP and AspectJ and how they can be used to apply management and monitoring inline to an application. Once we've added this functionality we'll how to expose it using JMX using Spring's JMX support and consume it using JConsole or Spring.

If you're tentative about introducing AOP or JMX into your application, come take a look at some of the cool things you can do with them and how easy it can be.

Know your Object's Heritage

close

David Bock By David Bock
Creating new classes in Java is easy... but classes you create have a lot of inherited behavior that may or may not be what you need. There are also a lot of useful capabilities in the standard Java libraries that you may want to give your objects. Unfortunately, developers transitioning from other languages often don't discover these language features until some related problem bites them. The concepts here aren't sexy, but you will probably learn something that will make you go want to fix code in your current project.

In this session we will cover:
- Reasons for and pitfalls when implementing your own equals() and hashCode() methods
- Best practices for object construction (Factories and Immutability)
- Useful toString() idioms
- Serializable, Externalizable, and custom serialization techniques using the 'hidden' methods of Serializable
- Clonable, shallow and deep copies, and why Clone() is evil.
- Comparators and the Comparable Interface
- Finalize(), and why not to use it
- Your class's 'Class' object: opening the door to reflection.
- Leaky references to 'this'
- Guidelines for building objects in inheritance hierarchies
- Many other useful practices and idioms
- Tools to help you find and fix problems like these

Introducing Agility to Large Organizations

close

David Bock By David Bock
For several years, I was a member of a team of people caught in the middle of a 200+ person software development company, with senior management wanting "buzzword compliant process improvement" such as CMMI, and engineers wanting more ?agile? solutions (and people on both sides confusing Agile with ad-hoc). We were responsible for sorting it all out. Reconciling this was a herculean effort, and can be a source of lessons learned for your own process improvement efforts. Are you trying to be more agile in your organization? Are you expecting it to be harder than it needs to be because of political and bureaucratic forces beyond your control? Do you have to "educate" your senior management to protect them from buzzwords? Come learn from my successes... and mistakes.

Introducing change into a large organization can be difficult, even when everyone is in agreement. By starting with 'the quick win' and fixing some real pain in your organization, you can begin to get people moving in the right direction. In this talk we will look at the kinds of quick process wins that are possible, and how to introduce new ideas into a large organization.

Software Metrics and the Great Pyramid of Giza

close

David Bock By David Bock
Most software engineers hate metrics... Why? Because we know the work we do is hard to quantify – any measurement of 'software engineering' is like trying to tell how tall someone is by how much they weigh... There may be some correlation, but there is so much deviation as to make the answer practically meaningless. As a result, we often see metrics used to justify improper conclusions. There are plenty of good metrics though, and plenty of ways to use them effectively.


In this presentation we will analyze what makes a 'good' metric, why some metrics are 'bad', and how you can use them to make meaningful measurements of your projects. We will look at several methods for gathering metrics too, including some open source tools you can put to use immediately.

Internationalization and Localization in Java

close

David Bock By David Bock
Internationalization and Localization in Java is easy, right? Everyone knows you just store your strings in some resource bundles, set the locale, wave your hands a little bit, and your application is good-to-go. Right? Maybe not... Java provides some great utilities to get started, but leaves you needing more when it comes to things like screen layout, cultural sensitivities, semantic differences in translation, use of color and iconography, and other issues.

This presenter spent 9 years developing applications for the U.S. State Department that have been deployed in dozens of countries and languages. While some aspects of internationalization and localization are trivial, there are plenty of issues that are not. If you have an application that you expect to localize into other locales, there will be information here that is invaluable to you. This talk is entertaining for the war-stories alone! No other no-fluff presentation will feature pictures of the presenter waiting in line behind a herd of sheep to cross a pontoon bridge into Bosnia.

Capistrano: Application Deployment and More

close

David Bock By David Bock
Capistrano (formerly Switchtower) is a tool originally written to help automate application deployment for Ruby on Rails. It does this well, but it has grown up into a tool capable of much, much more. It can be used for deploying Java applications, updating server configurations acrtoss an enterprise, administering netwoeks, backing up files, and all sorts of other activities. Any activity you might do from the command line, you can now do simultaneously across large numbers of machines, with all machines succeeding (or rolling back in case of failure) together.

In this talk I discuss the fundamentals of capistrano, use the built-in tasks to deploy a rails application, demonstrate the capability of performing custom tasks across several computers simultaneously (thanks to several virtual machines), and show how applications can be rolled back in case of problems. Capistrano isn't perfect though; we will also discuss best practices, limitations, and lessons learned.

Capistrano requires a POSIX-compatible shell and SSH on the machines it is going to control; as a side-benefit, we will also learn about CYGWIN, an open source tool that provides these capabilities (and lots lots more) to Windows environments.

Maintaining Project Integrity with JDepend, Macker, PMD, Maven, and other open source tools

close

David Bock By David Bock
How many times have you started a new project only to find that several months into it, you have a big ball of code you have to plod through to try to get anything done? How many times have you been the ?new guy? on an established project where it seems like the code grew more like weeds and brambles than a well-tended garden? With a few good structural guidelines and several tools to help analyze the code, we can keep our project from turning into that big ball of mud, and we can salvage a project that is already headed down that path.

This talk will talk about everything from build processes, teamwork, and project structure through versioning, release plans, upgrde strategies, package dependencies, and more. Using real-world scenarios from two projects with 12-15 people working together over a 5-year time span, this presentation will offer advice based on multiple successful deliveries of real software.

JavaServer Faces: A Whirlwind Tour

close

David Geary By David Geary
In April 2005, annual growth rates for jobs in JavaServer Faces, Struts, and Ruby on Rails were all at about 0%. Today, Struts' growth rate still hovers around 0%, but JSF and Rails have taken off. At the end of 2007, both JSF and Rails were growing at a rate of between 400-500% annually (according to indeed.com).

JSF has passed the adoption tipping point, and is now the Java-based framework of choice, as is evidenced by its ecosystem. From vendors such as MyEclipse and RedHat to open source projects such as Seam, Facelets, and Ajax4JSF, JSF is where the action is.

Come see why JSF is so popular. In this code- and demo-intensive session, I'll show you the fundamentals of JSF.

This session is taught by a member of the JSF Expert Group for JSF 1.0 and 2.0., and co-author of the best-selling book on JSF: Core JavaServer Faces. David will take you through a whirlwind introduction to JSF including what JSF is, how it was developed, and how you can best take advantage of the technology. Here is a list of topics:

Components, managed beans, value expressions, and static navigation
i18n, CSS, and actions
The Faces Context and Faces messages
The JSF Event Model
Using JavaScript with JSF

This introduction to JSF also contains 5 live-code demos, where David will develop a simple, but robust application during the course of the session.

Prerequisite: Some knowledge of Java-based web applications, such as Struts, is a plus, but is not required. If you have a significant experience with JSF, you probably already know most of what's covered in this session.


Killer JavaScript Frameworks: Prototype, Scriptaculous, and Rico

close

David Geary By David Geary
An introduction to the popular Prototype JavaScript framework, and two frameworks built on top of Prototype: Scriptaculous and Rico.

Web2.0 is all about rich, interactive user interfaces (UIs), and these three frameworks provide the capabilities that you need to develop those UIs.

Prototype (prototype.conio.net) is a low-level JavaScript framework that adds significant features to JavaScript that make it easier for you to use the language and to incorporate Ajax calls in your applications.

Scriptaculous is a framework (script.aculo.us) built on top of Prototype that adds some pizazz to Prototype with features such as a wide array of special effects, animation, and drag and drop.

Rico is another framework (openrico.org) built on top of Prototype that, among other things, provides something known as behaviours, where you adorn plain-vanilla HTML with seemingly magical behaviours.

Come to this session and learn how to harness the power of these three frameworks.

Ajaxian Faces

close

David Geary By David Geary
JavaServer Faces is a perfect platform for implementing Web 2.0 interfaces with Ajax. This session explores how you can use these two potent technologies--JSF and Ajax--together to create applications that look and behave like desktop applications but run in the browser.

JavaServer Faces, with a mature component model and flexible lifecyle, is a perfect platform for implementing Web 2.0 user interfaces with Ajax. This session explores using JSF and Ajax to create applications that act like desktop applications but run in a browser.

We'll start with a quick look at implementing basic Ajax in a JSF application. Then, once your bloodthirst has been slaked, we'll dive deeper into Ajaxian Faces dynamics with a form completion demo that requires its implementor to understand two simple, but vital facts about JSF.

If you're savvy, you probably use client-side validation to augment your server side validation logic, which parenthetically, is no no-brainer in either of the leading web application frameworks, JSF or Rails. But anyway, client-side validation is old school. All the cool developers nowadays use Ajax to implement realtime validation, where you sneak a trip to the server as an unwary user types into your input fields. But to accomplish that, we'll have to dive even deeper into JSF, with concerns such as accessing view state and accounting for client-side state saving.

All of this Ajax development is great fun, but most of it is best relegated to components and frameworks, which are the topics that will wrap up our session. We'll see how to keep your JavaScript separate from your JSF components and how to pass JSP tag attributes all the way through to JavaScript. Finally, we'll take a look at Ajax4jsf, a JSF component library with a tag library that blends Ajax into JSF in a natural, intuitive way without having to write JavaScript.

As web developers, we've been handcuffed long enough by the shackles of Web 1.0 development. Come to this session and see the brave new world of Web 2.0 development with one of the hottest web application frameworks.

RAD JSF with Seam, Facelets, and Ajax4jsf, Part One

close

David Geary By David Geary
In this session, see how you can get Ruby On Rails-like productivity on the Java side of the house with this compelling combination of technologies.

JSF has been out for nearly three years now, and in many respects, the JSF specification has become a bit long in the tooth. Fortunately, the open source community has picked up the ball in a big way. In this 2-session presentation, we will explore three open source projects based on JSF--Seam, Facelets, and Ajax4jsf-- that will propel you into the stratosphere of productivity.

Seam is a framework from JBoss that combines the JSF and EJB3.0/Hibernate 3.0 frameworks into one component model. That means you only have to learn one framework to build compelling web applications.

This is the first of a two-part session, where we'll focus mostly on the Seam framework.

RAD JSF with Seam, Facelets, and Ajax4jsf, Part Two

close

David Geary By David Geary
A continuation of a 2-session presentation on Seam, Facelets, and Ajax4jsf.

In the second part of this 2-session presentation, we'll turn our attention to Facelets and how you can use this compelling display technology with Seam.

We will also discuss Ajax4jsf and demonstrate how you can use that framework to create rich, interactive user interfaces for your JSF-based web applications.

The Google Web Toolkit, Part One

close

David Geary By David Geary
Developing highly interactive web applications, for the most part requires knowledge of a wide array of technologies: HTML, CSS, JavaScript, XMLHttpRequest, JSP, JSF, etc.

With the Google Web Toolkit (GWT), Google turns that notion of development on its head. Instead, you implement Ajax applications by writing almost entirely in Java. You use an AWT-like API, which the Google compiler compiles to JavaScript that runs on the client.

In the early days of Java, application development with the AWT was relatively simple. You had to have a decent understanding of Java and AWT fundamentals, but once equipped with such knowledge, you could dive in and develop some impressive applications.

Ten years later, we have, in so many respects, gone significantly backwards. We've shoehorned technologies such as HTML into shoes for which they were never intended, and for our efforts, we have a mismatch of disparate technologies that one needs to knit together for a truly interactive web application.

This is the first session of a two-part presentation on the GWT, where I'll concentrate on GWT basics: implementing Ajax-enabled applications in Java, internationalization, testing, and remote procedure calls.

The Google Web Toolkit, Part Two

close

David Geary By David Geary
The second part of a 2-session presentation on the Google Web Toolkit.

In this session, we'll dive deeper into the GWT and explore some of it's more advanced aspects, such as implementing custom widgets, deploying your application in a servlet container, and implementing drag and drop.

Agile Immersion

close

David Hussman By David Hussman
Have you heard about SCRUM or XP but never done it? If you want to give it a try, this session will allow you to participate in planning and executing several agile iterations. A working knowledge of either XP or SCRUM will be helpful but not mandatory.

After a brief introduction, we will assume roles, create a simple backlog, roadmap, and complete several iterations, finishing with a short retrospective.

Creating Agile Requirements

close

David Hussman By David Hussman
Successful project communities balance written requirements with a healthy amount of discussion. This is at the core of requirements that could be deemed "agile". Many agile projects choose to use user stories, but others may be using use cases or other forms of written requirements. This session is for anyone wanting to improve their requirements, including the creation of good requirement and the presentation styles that help people focus on creating great software products, and stop focusing on documents.

The session will focus on finding the people who are best suited to create and communicate agile requirements. We will examine how to ensure agility for user stories, use cases, and several other common forms of requirements. Without regard to the document type, we will show how to smoke out what needs to be captured in written form when, challenging the age old notion that more detail in requirements produces better software.

Executable Documentation

close

David Hussman By David Hussman
Why is so much documentation worthless? Wouldn't is be nice if your documentation actually reflected what your system does? One way to do this is to create what is being called executable documentation or executable specifications. If you are struggling with ambiguous requirements, lack of contact with the business, or a chasm between development and testing, this session is for you.

What is executable documentation? Simply put, instead of adding more details to requirements, capture the desired system behavior in acceptance testing tools which are accessible to the entire project community. The session will focus on FIT, but it may include other tools for creating ED. History has shown me that ED - requirements that have two states (green and red) - helps project communities consistently create better software, faster!

Coaching Agile Projects: Finding Your Groove

close

David Hussman By David Hussman
Is someone asking you to lead an agile project? There are many how to books for agile methods, but the coverage of skills and techniques for leading are a bit on the light side. Whether you are a manager, tech lead, or a non-stop inspiration for your fellow developers, this session will provide you with new insights into the how and whys associated with coaching / leading an agile project or an agile transition.

This session will focus on the skills and tasks that help agile projects succeed and last. Topics covered will range from coaching to communication to tracking to addressing problems and problem people and more.

Getting Agile Planning and Tracking Up and Running

close

David Hussman By David Hussman
If your company is using agile or thinking about it, this session will show you how to plan and tracking an agile project. Examples projects will be discussed, including the glory and horrors. Various planning tools that help distributed teams will be presented as well as a collection of lo-fi tools which truly help find and address the issue that plagues so many projects: "when are we going to complete this project".

From using markers and post it notes to go faster tools, this session will examine ways to get agile going in various situations (e.g. small projects, large projects, or distributed projects). A variety of techniques and tools will be shown and discussed along with the pros and cons of each. Most importantly, you will come away with a variety of ways to start planning and tracking agile projects, so you can choose a path which fits best within your company.

Cutting an Agile Groove: Transition Tips

close

David Hussman By David Hussman
If you are thinking about, just starting, or in the midst of transitioning to agile, this session is overflowing with practices, tip, techniques, and experiences. Stop talking about whether or not you are doing agile and come learn how to setup and maintain agility that extends beyond a single project.

From your first agile steps to keeping the agile groove alive, this session will provide a guide for making agile work for you. Adopting agile without understanding (or showing) how it will help your project is a recipe for failure. From planning to tracking to coaching to coding, this session is filled with pragmatic experiences from a wide variety of projects and industries.

Distributed Teams: Remote Agility

close

Jared Richardson By Jared Richardson
How do you keep a team scattered across time zones in sync?

It's difficult to keep a local team coordinated. When we add geographical distance to the equation, problems are immediately magnified. We'll talk about techniques that you can use to be sure everyone is sharing information and on the same page whether they're in the same office or in different time zones.

Agile Software Testing Strategies

close

Jared Richardson By Jared Richardson
Creating and maintaining a solid automated test suite is critical to an Agile strategy, but often we're just told to "Do it." In this talk we'll look at several pragmatic strategies for creating and building your suite.

We'll examine these strategies and then look at scenarios for using them next week. This presentation will get you started whether you're starting a new project or trying to clean up an existing one.

Shippers Unite!

close

Jared Richardson By Jared Richardson
An overview of the Agile software approach from the book Ship It! A Practical Guide to Successful Software Projects.

This book provides a comprehensive look at the software life cycle and can be used to retool the way you, and your team, builds software. While we can't cover the entire book in nintey minutes, we can look how a holistic view of the software life cycle helps you improve your projects and makes your life easier.

Build Teams, Not Products

close

Jared Richardson By Jared Richardson
A great team builds great software, but how do you build a great team?

Let's move beyond getting lucky and look at some key practices that will help you build your scattered cats into a well-oiled machine.

Comparing Java and Groovy

close

Matt Secoske By Matt Secoske
With interest in Groovy continuing to rise, many Java developers are wondering how Groovy differs from Java, and what benefits they may gain from this new language. This presentation highlights the differences between Java and Groovy by exploring some code solutions written in each language.

We will look at how Groovy handles things differently from Java:
- General code style
- Collections
- Static vs Dynamic Typing
- Accessors
- Testing

Introduction to Java Cryptography

close

Matt Secoske By Matt Secoske
Cryptography is an essential part of many applications, from simple e-commerce applications to back-end credit card processing systems to highly sensitive customer information. This session covers basic concepts of Cryptography and how they are used in the Java programming language.

Such as:
- Symmetric and Asymmetric encryption algorithms
- Message digests, digital signatures
- Public Key Cryptography
- Elliptical Curve Cryptography
- Secure protocols (SSL, SSH, SFTP)

Implementing DSLs with Groovy

close

Matt Secoske By Matt Secoske
Domain Specific Languages (DSLs) have been a powerful technique used throughout programming's history to elevate developer productivity. This talk will discuss how to create and use DSLs with the Groovy programming language. Different techniques for creating DSLs will be shown, along side an exploration of the features in Groovy that make it especially useful for DSLs.

Specific topics covered:

What is a DSL?
When should you use one?
Groovy's features for building DSLs
Examples

Web Application Hacking

close

Roman Hustad By Roman Hustad
See the hacker's toolbox in action as various web applications are ripped open by exploiting simple software bugs. Common problems such as Cross-Site Scripting (XSS) and SQL Injection will be demonstrated and explained, along with more subtle vulnerabilities including privilege escalation, data tampering, and Cross-Site Request Forgery.

Even if you've seen XSS and SQL Injection before, advanced techniques will be presented that can slip through many protections. As a finale, the holy grail of web security will be broken with a Man-In-The-Middle attack on SSL. Although countermeasures are briefly covered, this is first and foremost a shock and awe presentation that will motivate you to secure your applications. Attendees will receive a CD with all the Hacme applications used during the presentation so you can practice your new 'skillz.'

Application Security Part 1: Stop the Bleeding

close

Roman Hustad By Roman Hustad
This session is geared for those who are ready to take the first steps towards securing their applications with minimal cost and effort. Most development teams know that they have not given security the attention it deserves, but also don't know where to begin. Should you run a scanning tool, go to security training, or just bury your head in the sand and pretend everything is OK?

A few simple activities are introduced that will pay big dividends for the security of your applications. One size does NOT fit all, and this session will enable you to spend your time and money where it will make the most difference. Peripheral issues are also addressed, such as obtaining management support and working with your IT security department.

Application Security Part 2: Building a Software Security Program

close

Roman Hustad By Roman Hustad
This session provides a comprehensive, flexible plan for baking security into the software development lifecycle. First off, we will talk about why you would want to do such a thing and how to get support for it. Then the discussion will turn to the practical aspects of planning and implementing a secure SDLC, covering all aspects of people, process, and technology.

Last and probably most important, we present ideas to help you avoid having your shiny new program ignored by the development team. If you are serious about producing secure software, this talk is for you.

How to Do a Security Code Review

close

Roman Hustad By Roman Hustad
This session is a hand-on exercise in Java code review that will cover both manual and automated techniques. If you envision code review as a line-by-line slog through thousands of programs, you will be surprised to learn some effective techniques that reduce the tedium and increase your enjoyment of this activity (well, maybe not the enjoyment part). Familiar methods such as pair programming and peer reviews are a great place to start and will immediately increase the security of your code base.

Other approaches will also be examined, ranging from the use of IDE-integrated tools to formal code review exercises and everything in between. In particular, threat modeling is presented as a means to identify sections of the code that have the highest security risks. Enforcing a code review policy is the last (and most contentious) topic that will be covered in this session.

Groovy: The Next Generation of Java

close

Scott Davis By Scott Davis
This is the year of the dynamic scripting language. Ruby (and Rails) has won the hearts and minds of many independent software developers. JavaScript is experiencing a renaissance thanks to the wild success of AJAX and websites like Google Maps. And Groovy (JSR-241) brings the same level of excitement and "scripting goodness" to the Java platform.



In this presentation, we take a very pragmatic "prove it in code" approach to learning Groovy. Since the syntax is (almost) identical to Java, we can dive right in from the very beginning, learning the "syntactic sugar" as we solve real world problems.

You'll learn how easy it is to install Groovy and get started working with it. You'll tackle file I/O, reading and creating text files. You'll create and parse XML and HTML. You'll interact with databases. You'll create Groovlets (servlets sprinkled with Groovy-dust). And finally, you'll get a brief introduction to Grails (hint: the 'G' is silent).

Groovy and Java: The Integration Story

close

Scott Davis By Scott Davis
I'm attracted to Groovy because of its spirit of inclusiveness. Because it extends my platform of choice, not replaces it -- include a single JAR in your classpath and you are Groovy-enabled. Because it offers full bidirectional integration with Java. Because it offers a nearly flat learning curve for experienced Java developers. Come see how you can use Groovy to augment your existing Java codebase.


We'll look at calling Groovy from Java. We'll look at calling Java from Groovy. We'll look at compiling Groovy code, JARring it up, and deploying it alongside Java.

Groovy offers the same level of integration with Ant. We'll look at Ant tasks that allow you to include Groovy in your build process. Or maybe you'd prefer to use the Groovy AntBuilder and completely manage your build in code. The choice is yours. The important thing is Groovy works along side your familiar toolkit instead of forcing you to replace it.

Real World Grails

close

Scott Davis By Scott Davis
Scott Davis is the Editor in Chief of aboutGroovy.com. The website, in addition to being, umm, about Groovy, is implemented in Grails. This talk shows you how to get started with Grails, but also talks about the experience of using it in a live, production web site.

Grails is a fully integrated, modern Java web development stack. In a single zip file, it includes a web server (Jetty), a database (HSQLDB), a build system (GANT, a Groovy/Ant hybrid), a logging framework (Log4J), and a unit testing framework (JUnit). It also includes mainstream libraries like Spring for dependency injection, Hibernate for Object/Relational mapping, Quartz for scheduling, and SiteMesh for page layout. For Ajax, Grails allows you to choose between three major included technology stacks: Prototype/script.aculo.us, the Yahoo UI library, and Dojo. Coupling the power of these mainstream libraries with the ease-of-use that Groovy offers, you have an unprecedented collection of technologies that will have you up and running in record time.

Grails maximizes the strengths of these familiar Java libraries while minimizing the XML jockeying it usually takes to get them all to play nicely with one another. It brings "Convention over Configuration" to Java. It uses Groovy as the language to glue the pieces together, which means that experienced JEE developers can learn Groovy in the context of libraries that they are already familiar with.

It is no exaggeration to say that you will have your first Grails application up and running in minutes. But Grails is more than about a quick start. In this talk, we'll look at ways to move beyond the default configurations. We'll deploy a Grails app to an external Tomcat instance instead of the included Jetty server. We'll move from the default HSQLDB database to MySQL. We'll include external JARs to bring new functionality to the mix.

KEYNOTE: No, I Won't Tell You Which Web Framework to Use: or The Truth (with Jokes)

close

Scott Davis By Scott Davis
"Which framework should I use?" is the question most often heard on the No Fluff, Just Stuff tour. It's well worth asking. Unfortunately, there is no simple answer. After years on the tour, most speakers have crafted a response that would make any Washington politician proud -- long on style, but essentially, "Well, it depends..."

In this humorous keynote, Scott Davis turns to unconventional sources for enlightenment. Could best-sellers like Blink, Freakonomics, The Tipping Point, The Paradox of Choice, and The Wisdom of Crowds finally solve the puzzle? In this "Da Vinci Code"-like romp through the conventional wisdom of the day, will the Holy Grail of web frameworks be revealed? Probably not, but possible side effects may include nausea, dry mouth, and insight into the eternal question of our industry.

The Secrets of GORM

close

Scott Davis By Scott Davis
GORM (the Grails Object/Relational Mapper) is one of the many high points of the Grails web framework. GORM is a thin Groovy wrapper over Hibernate, but that doesn't begin to capture excitement of what GORM brings to the party. Imagine being able to call book.save() and book.delete() on your Book class; calling Book.get(1) to retrieve your book from the database by primary key; using Book.list() to pull an ArrayList of Book objects into your application. Now imagine getting all of that functionality (and more) for free with each new class you define. No interfaces to implement. No abstract classes to extend. Persistence that is transparent, automatic, and simple to use: GORM.

Querying your data via GORM is a case study in the benefits of using a dynamic language. Queries like Book.findByAuthorAndTitle("Scott Davis", "Groovy Recipes") rule the day. For the really hard stuff, you can always get back to a more traditional SQL-based interface. We'll also explore Query-By-Example.

GORM allows you to model your objects in the database in a variety of ways. In addition to supporting the usual 1:M, 1:1, and M:M relationships, GORM allows you to flatten the model, breaking traditional normalization rules. (Just don't tell your DBAs about it...) Come see how GORM handles HashMaps, Arrays, and ArrayLists in your Groovy objects.

GORM can auto-generate your database schema from existing POGOs, but recognizes that not all development is greenfield development. GORM allows you to map existing tables to objects and arbitrary field names to POGO attributes. We'll also see how to bypass Hibernate altogether using EJB3 annotations.

If you are a Hibernate developer, you owe it to yourself to see how GORM makes a good thing even better. If you are a Groovy/Grails developer, come see how to get the most of your friendly neighborhood persistence framework.

The Zen of REST

close

Scott Davis By Scott Davis
Google quietly deprecated their SOAP search API at the end of 2006. While this doesn't mean that you should abandon SOAP, it does reflect a growing trend towards simpler dialects of web services. Google joins a number of popular websites (Yahoo, Flickr, YouTube, del.icio.us) that offer all of the benefits of web services without all of the complexity of SOAP.

REST isn't a specification or a framework -- it's a set of architectural principles. This means that you can begin using it immediately. No framework wars, no version mismatches. This talk demonstrates some of the more popular RESTful web services out there in the wild. It also shows you live examples of how to implement your own.

We'll look at the simplest form of REST -- GETful web services. We'll also look at more sophisticated RESTful interfaces that utilize all of the HTTP verbs (GET, POST, PUT, and DELETE) and MIME types. Finally, we'll look at Atom and the Atom Publishing Protocol -- the RESTful implementation that Google chose to replace its aging SOAP implementation.