ERP for SME

Google turns into VC

2007-07-05T18:28:00.000+06:30

Google ventures http://www.google.com/gadgetventures/ are providing seed capital to those who wish to startup a business around Google Gadgets.

So go have a cuppa Coffee and enjoy make some gadgets and hopefully tons of money along the way :)

Mashup Server in Java

2007-07-04T21:31:00.000+06:30

Now that Google and Yahoo are head-on with their versions of mashup server, what if you want to own one yourself?

Well you could do it in Java. Well you could use the Sun open source lib. for mashup., check out the project Rome. If you are into Apache Axis2, then you could do with WSo2 mashup, which uses apache technologies.

A good startup tutorial could be found here, but i am not too happy with the code quality as there is a lot of scope for enhancements. Never-the-less, it will get you up to speed.

Happy coding :)

Intellectual Capital 2

2007-07-03T19:14:00.000+06:30

Today Mint featured a story about NASCOM celebrating India's 1.6 million software programmers achieving a turnover of US$50 billion, that is 5.2% of India's GDP.
However I believe that only Infosys could have achieved this figure, see ERP for SME: Intellectual Capital.

Thus the average Intellectual Capital of an Indian programmer (or Intellectual per Capita) is US$ 31K.

The Intellectual Capita of Apple is US$ 1million, so even if 10% of the Indian programmers have that Intellectual capita the figure will add a cool $160 billion to the GDP.

But unfortunately the NASCOM only aims for US$ 60 billion by 2010.

I think we need to become more ambitious as a country. Come on guys we can do it!

Using Prolog to Find a Friend - 2

2007-06-29T23:30:00.000+06:30

Further to my pervious post : Using Prolog to Find a Friend

I have made a minor enhancement to compute the degrees of separation.
/* Prolog Program */
knows(a,b).
knows(b,c).
knows(c,d).
knows(d,e).

exists(X) :- knows(X,_).
exists(X) :- knows(_,X).

friend(X,Y,Deg) :- exists(X), exists(Y), foaf(X,Y,Deg).

foaf(X,Y, Deg) :- knows(X,Y), Deg is 1.
foaf(X,Y, Deg) :- knows(Y,X), Deg is 1.
foaf(X,Y, Deg) :- knows(X,Z),foaf(Z,Y, D1), Deg is D1 + 1.

/* end */

Run it using the goal:
?- friend(a,e,X).
Prolog Answer:
yes.
X / 4
Solution: friend(a,e,4)

Next I will make a List to append the friends name in it.

AJAX JSF on Mobile

2007-06-29T13:33:00.001+06:30

Long long ago, I had written an article in Computers Today about WAP. It was in November 2000 issue. What I had written then about server side delivery will be preferred way is still true.
Ericsson has released an open source JSF renderer for mobiles! get the presentation here.
You can also download the source from their site.

The advantage of using Java EE to deliver application to mobile is that you don't have to support multiple versions for each vendor and even intra vendor's platform. And unlike Nokia's SDK, which is too fat, Ericson has a small footprint and thus does not lock the developer in.

Recently Sun and Ericsson are collaborating to marry Java technologies with telecommunications. Not that Java was not present in the telecom space, it had JAIN (Java Advanced Intelligent Network) But then there was Parlay led by Microsoft. Now Sun and Ericson have collaborated to produce Parlay interop with Java EE. It too is open source.

To avoid confusion here, I must add that I am talking two different things here. The enterprise applications connect B2C where as AIN (Advanced Intellegent Network) application are more of telecom domain applications like delivering caller tunes of your choice or call divert or voice mail service. Thus you could think it as O2C (Operator to Customer) applications. The only common thread here is the use of Java EE technology.

Less Paper Office (Developer Release)

2007-06-28T21:02:00.000+06:30

In my previous blog, I had proposed that a micro enterprise can save time and cost by simply using a HP scanner, that comes with a document scanning software to convert scanned documents into search-able PDF documents. Also Open Office can convert a document into a PDF file.

However, Open Office cannot create PDF files with attached exotic files like XML and zip files.

Thus I have created a simple, Free Open Source Java application, for creating PDF with attachments. These attachments can be annotated as well.

It is of pre-alpha quality or developmental release for other developers and power users, to experiment.
The distribution can be downloaded from:

http://www.ashishbanerjee.com/LePaOf_v01_dist_28june07.zip

The distribution contains source as well as Java binary. Just unzip it into a directory and execute run.bat. For Linux and Solaris, just rename the run.bat to run.sh and give executable permissions. It needs Java runtime.

LePaOf uses third party open source lib. PDF BOX.

Netbeans Does Not Use Grizzly Yet

2007-06-24T22:57:00.000+06:30

Its a bit sad to figure out that Netbeans.org does not use Grizzly!
Now if you are wondering what all this is all about? Let me clear the bytes for you. Netbeans is the Sun's flagship IDE. Competing directly with Eclipse. Grizzly is the NIO framework within Glassfish. It has been proven within Sun, that Apache does not scale beyond 4 cores, whereas Glassfish with Grizzly technology scales well beyond.

However I figured out that Netbeans uses the old technology circa 1999. where Apache sat in front and connected to Tomcat or any other Java Server using AJP (Apache Java Protocol)

Don't ask me how I figured out that netbeans.org uses Apache 2.0.50 (as of 24 June 2007) as HTTP server.

I would like to appeal to Netbeans admin to seriously consider using Glassfish.

Jetty 6 , which also uses NIO, run their web site on Jetty itself! That's what I call confidence!

Finacial and Banking Transaction Links

2007-06-22T23:37:00.000+06:30

BFSI (Banking, Finance, Security and Insurance) is a vast and deep domain.
I do not wish to map it here, but focus into Financial Transactions which is the most dynamic domain and heart of todays e-commerce backbone.

Just a few URLs for my younger tribers who wish to get into Banking and Financial Transaction domain:

Financial Transaction/Communication standards:
http://www.ifxforum.org/home
http://www.twiststandards.org/
http://www.iso20022.org/
http://www.swift.com/

Also must study UMM at
http://ebxml.org/

Open source:
http://jpos.org/
http://wife.sourceforge.net/

PKIX:

http://www.ietf.org/html.charters/pkix-charter.html
http://www.oasis-open.org/committees/security/

Java Stack
https://open-esb.dev.java.net/

Feel free to ask questions to me at:
http://www.techtribe.com/triber/ashishbanerjee

How to Blog in Hindi

2007-06-22T20:30:00.000+06:30

In case you are wondering, how I type Sanskrit in my blogs, let me share with you the knowhow. Well Hindi, Marathi and Sanskrit are written in Devanagri script.

Most bloggers of Indian origin are English speaking and are more comfortable with Querty than Indic keyboard.

Eons ago, the Department of Information Technology had funded a project with IIT Kanpur, called GIST. Now CDAC carries the torch. It resulted in LIPI and ISCI . It is now dated. Only die hard Don Quixotes of IT at government funded agencies use it. No more used in real life.

In-fact we burned a few Lakhs of rupees in consulting and Indian language conversion with CDAC, and got zilch result. But what paid off is their brand name that sells in the Banking segment.

But if you are not into politics of IT sales, then what's the technology you should go for?

The technology is Unicode. Both Windows, Linux and Solaris support it.

Best and simplest of all you can type in English and transliterate it in Hindi! That's what Google supports, see: http://googleblog.blogspot.com/2007/04/now-you-can-blog-in-hindi.html

Also checkout ITRANS, which is the original technology on which Google is based.

But what's under the hood? Good question :)

Check out my test page at : http://ash.banerjee.googlepages.com/dev2uni.html

The Java source code is available there. In-fact, by changing just a few lines of code, Inheritance in Java speak, I could make it work for Bengali and Punjabi! That's the beauty of Indian languages.

By the way Sanskrit is the most scientific language ever spoken. And A.A.Mcdonald in his Sanskrit grammar book wrote that Sanskrit is at-least 200 years ahead of English. And Panini was the world's first grammarian!

Now go and Blog in Hindi.

Wealth of Knowledge by Bhamini

2007-06-22T13:09:00.000+06:30

Here is a Sanskrit shloka attibuted to Bhamini's Sabhatarangini:

न चोरहार्यं न च राजहार्यं न भ्रातृभाज्यं न च भारकारि।
व्यये कृते वर्धत एव नित्यम् विद्याधनं सर्वधनप्रधानं।।

It cannot be stolen by the thieves or the kings, nor can brothers divide it and it is burden less. Every time its is spent it grows. Knowledge is indeed the supreme wealth.
Sabhatarangini by Bhaamini

Active Magazine is Awesome

2007-06-20T20:30:00.000+06:30

I came across the Olive Software's Active Magazine product, when trying to read the Red Herring magazine online.

As the user experience was so good and natural; Incredibly I flicked through all of the 88 pages of the Red Herring issue!

It worked in Firefox. And, it does not load any heavy duty plugins, just Java Script, though I did not care to look under its hood to figure out if it was using any Flash, the user experience was so good, that the content had grabbed my attention and my techie instinct took a back seat.

What I have noticed about me is that I start looking under the hood, only when; either the site get slow, or crashes...I guess that's when my engineering sole wakes up and takes over from the Net surfer.

The Active magazine is a great concept, though I guess it would be costing a bomb! Given that they don't disclose the prices upfront.

If you are running a community news letter, then best is to use Open Office which is free and open source it comes with a SDK. You can also generate PDF with a press of a button.

But, if you are running a professional e-zine setup, then go for Active Magazine!

Route Guru

2007-06-19T20:40:00.000+06:30

I just came across routeguru.com , promoted and founded by Avinash Agrawal. Its still in Alpha (19-June-07). But works!!

Route Guru is about planning route, presently only a few Indian cities are supported. The data is licensed from Eicher, yes the same company that manufactures tractors and had published the city guides. In fact, we had approached Eicher around Y2K (during the last dot com boom), and we could not strike a deal as they were asking a bomb for their data and wouldn't consider revenue share! Good that Avinash has been able to convince them. Though, it would be interesting to figure out the terms of the deals :)

The technology is Java, though Struts has been used, which is a bit outdated. Ajax has been used as well. Though, use of Google Map API would have been a cool feature. The site was slightly slow when I clicked about us. But, I guess it may be due to the sever capability. probably a VPS with less than 200MB RAM must have been used. That's OK for testing the concept.

The idea of Route Guru, is well timed as the 2010 games is looming...also many mobiles come with LBS (Location Based Service) and GPS.

I think Route Guru should be ported to mobile, using Google Ajax mobile technology which is free and open source.

Overall an excellent idea with great potiential and right timing. Good work Avinash :) and congrats to your team.

Need for a Single Sign On

2007-06-19T19:23:00.000+06:30

I just redeemed a gift voucher of Rs 1000/- at indiaplaza.in , I had received it for my writings at sulekha.com . This is a good concept of cross promotions between web sites.

However, there is a scope for improvement. I had to register again at indiaplaza, which inconvenienced me, also added another password and user-id to remember! Oh No! Not another id, for God's sake.

So, is there an alternative? Sure there is one. No make it two.

The concept is called Single Sign On (SSO). There are many standards for SSO. The best is SAML.
Apart from being a standard, Google also uses it. You can find the details here:
http://code.google.com/apis/apps/sso/saml_reference_implementation.html

You you are a lazy programmer like me, you would find the open source enterprise quality at OpenSSO. Get the source code from https://opensso.dev.java.net/

The other simpler alternative is openid. Open id is a democratic alternative to Microsoft's passport. Thus the user can choose where one wishes to keep their personal details.

OpenSSO extensions supports openid.

So guys lets have a SSO for techTribe.com and sulekha.com, the sites I like!

Java ME versus Java EE as a Career Option

2007-06-18T20:51:00.000+06:30

Jatin my mentee at techTribe, asked a question :

"can u tell me about the scope that j2me has in the industry?"

This blog entry attempts to answer the above query.
First J2ME has been re-branded as Java ME. So is J2EE as Java EE, and yes you guessed it J2SE is now Java SE.

Now that you have fallen in love with Java, (I fell for it when it was in beta circa 1997, and now happily married to it, though I have a mistress called C# :), after the initial infatuation stage, you will need to evaluate the career options.

First Java ME is heavily fragmented and most of the manufacturers support is as an afterthought. All these manufacturers have an alternate C++ SDK and their own custom options.
Nokia and Moto are two 400 pound gorillas in the mobile arena. Though these two support Java ME, they have their alternative SDK. Any real life application would have to use their SDK and be tied down to their platform. Moreover Sun has launched Java FX recently, which is targeted towards RIA (Rich Internet Application). Though Java FX is a layer over Java SE and ME, it does puts spanner in the Java ME's gears. talking about gears, it reminds me of Google..why? check out Google gears but that's another story and lets not digress.

Java ME has serious competition from RIA see Google API and apps for mobiles. Also Microsoft have been slowly and steadily been chipping away at the mobile OS market.

So Java ME is in its way out to join the Applet club (Going to Caribbean into the Dead Man's Chest, with apologies to the Pirates trilogy)

Lets understand why Java ME is going under. First, Google is leading a gang of RIA developers, the advantage of delivering an XHTML application with AJAX, is that most mobiles have a good Internet connectivity. Also distribution and lifecycle management is much easier. RIA apps can also remain offline and sync when network catches up, this is done by leveraging the cache technology.

The Microsoft's mobile OS initiative is more serious, since they have more at stake than Sun in this space.

That's because after Jonathan Schwartz took over, he buried the hatchet with Microsoft. So, no more mindless Gate's bashing. Also he re-focused Sun's strategy and Sun is now making ALL its software open source! So how does Sun makes money? Good question and answering it will answer your query as well.

Sun makes its money by selling high end servers, and that is not the dual core types but more like 128 cores :) Check out Sun Blackbox as an example. Sun is also very good at making apps runs faster on their Solaris and extreme hardware platforms. For example, I have a patent (owned by Sun), to make Java faster than 'C'. So Sun really does not make money on simple hand-held devices, but by selling high end servers.

Given that Java EE has a mobile extension for RIA (Ajax, xHTML) its more of interest to Sun if applications are delivered from servers than embedded inside mobile devices.

Thus if you are wanting to go for Java, go for Java EE not ME. Sun is more focused on EE.

Now when I read the Nokia's tag line "This has what computers have become", Sun's Blackbox comes to my mind and not Nokia's N series.

I hope I have answered your query.

Intellectual Capital

2007-06-17T23:44:00.000+06:30

I have been concerned lately about the unsustainable business model followed by most Indian software companies; excuse my language, but I call the model Software Coolies model. [1]

There are two major issues with the coolies model, first the growth is unsustainable, see the blog [2]. Second, other low cost destinations are emerging. The hourly rates are under pressure, the Indian software talents are demanding more salaries and the rupees is appreciating.

So, we have two options, one to keep running the rat race of labor rate arbitrage, by moving to class B and C cities, opening development centers in Eastern Europe and Jakarta and so on. Train more people to increase the manpower supply and other such mundane no brainers.
But that's a losers' game, at worst when played with your customers or at best, a win-loose kind of a game, that you play with your employees.

So what the win-win strategy? The idea is to increase the Intellectual Capital [3].

However, unlike Thomas Stewart, I would like to define Intellectual Capital more narrowly.

Intellectual capital is about real money. I shall in my later posts muse more about the details of my Intellectual Capital framework. But for the purpose of this blog posting I shall define it in through a simple metrics. Since, what good is an elaborate theory, which can't be put to practice?

In a nutshell, its the leverage that knowledge provides to your employees.

The Intellectual Capital for an IT company can be measured by simply diving the turnover by the number of employees.

To repeat myself, I see a generally unsustainable trend in the explosive growth of the Indian Software Industry in general. Most of the revenue comes from T&M (Time and Material) model.

For example if one studies the balance sheet of the India's most successful and admired company, InfoSys, the 40% growth comes from 40% increase in manpower. Thus there is NO real terms of growth when seen from Revenue per Employee. Now look at the Revenue per employee of Uncle Gates' company or even Larry Ellison's company. If you multiply this figure with the number of InfoSys employees, the subtract this figure with the current InfoSys turnover, you will arrive at the potential for growth of InfoSys' Intellectual Capital !

So if we look at Apple, it has 18,200 employees and $1 million revenue per employee! that is, its Intellectual Capital is $1 Million.[4]

Compare this with InfoSys. It had 52,700 employees and $2.1 Billion in turnover, for the year 06-07 as per [2]. That is $2.1B/52.7K = 39,848 $/emp. Thus the Intellectual Capital is just $39K!

Now if InfoSys had the Intellectual Capital of Apple, then it would have had a turnover of $52.7 Billions!

If it paid back just 10% of its Intellectual Capital to its employee, then an average salary of an InfoSys employee would be $100K or nearly INR 40 lakhs per annum!!!

But how to achieve that fabulous figure?

The solution I propose is productizing the service. It comes in two flavors (or business models if you please).

The first one is the IBM model. whereby, IBM takes over the end-to-end delivery responsibility and takes a percentage of top-line revenue or a fixed cost based on a performance metrics. For example it charges Galileo GDS US$ 2 Billion for a guarantee of maintaining a sustained performance capability of 20,000 transactions per second (this was circa 1998). It takes 5 to 6% of Airtel's topline revenue for maintaining its IT infrastructure, including billing system.
This model is not confined to big ticket companies.

I knew a small company that was being paid by a Wall street banker, five years ago, US$100,000 per month, for maintaining a computational platform capable of calculating Black Shoal's Option pricing for NYSE selected derivatives to under 10 seconds. The startup had two programmers in India, and 1 person in US. Now the metrics have come down to sub-millisecond performance, and I am sure so has the price!

The second model is the Open Source model. Here a company or a group of people, develops an Open source product that is widely used and gets revenue in terms for providing alternate license, consulting (for example Redhat charges $150 /hour for JBOSS consulting, Alfresco charges in excess of $50,000 / pa for certified stack and scalability guarantee for its open source product.

You may say that's not an easy thing to achieve in practice! True, but then, is anything is easy in real life?

As Richard Branson says : "Screw it, let's do it" [5]

References:
[1] My previous post:

[2] Infosys employees strength : http://india.seekingalpha.com/article/37850

[3] Intellectual Capital, Thomas A Stewart ISBN: 0-385-48381-3

[4] Outsourcing... ET (Economic Times) Pg 22, Friday 15 June 2007.

[5] Srew It, Just do it. Lessons in Life, Sir Richard Branson. ISBN: 0-7535-1099-5

Using Prolog to Find a Friend

2007-06-14T22:10:00.000+06:30

I was just experimenting with the foaf (Friend of a Friend). So, if we have an RDF database Jena, and can store the aggregated foaf:knows harvested from Google. A Prolog engine can be then embedded inside the Query Engine. A knows() predicate can be build-in, that retrieves the foaf:knows values for a given person.

The following sample program can be used to determine if two persons directly or indirectly know each other.


/* predicate will be build-in that retrieves foaf:knows from the RDF repository */
knows(a,b).
knows(b,c).
knows(c,d).
knows(x,e).

/* Actual theory */
exists(X) :- knows(X,_).
exists(X) :- knows(_,X).

foaf(X,Y) :- knows(X,Y).
foaf(X,Y) :- knows(Y,X).
foaf(X,Y) :- knows(X,Z), foaf(Z,Y).

friend(X,Y) :- exists(X), exists(Y), foaf(X,Y).

The above program can be tested within any Prolog system, with the goal :
?- friend(a,d).

The above program is the bare bone proof-of-concept. It can be further improved by adding degrees of separation and common linkages of friends separation the two persons.

India Eclipsed, Need To Get Our Shine Back

2007-06-07T08:37:00.000+06:30

India IT is loosing its shine due to rising costs, I just read the news items in HT2 Business & world (Hindustan Times, 07June07, page 21) that TCS is planning to hire 5000 software professionals in Mexico; mainly to save cost.

Recently, as an acting CTO for a startup, I too decided to get a software module outsourced from eastern Europe. Believe me, we got good quality, fast turnaround at less than one fifth (Yes that's 1/5th) the lowest Indian quote!

Salaries in India has been sky rocketing, and rising rupees does not help as well. Not that I am against high salaries. People work hard and they have all the rights to get paid the highest possible sustainable salaries.

The problem lies with our Indian software leaders. We do not get out of our colonial coolies mindsets. Indians in 18th and 19th centuries we taken to South Africa and West Indies, by the Angrez to work on farm. Unlike their African counterpart in 15th and 16th centuries, who were enslaved against their will; the Indians willingly went along for some fast money. Recently too illiterate workers from Kerela go to Emirates as coolies.

The same model was followed by our great software leaders in 21th century, albeit in IT space. Indian intellect did shine the world. But we still had the old business model. We just remained glorified cyber coolies.

The software mughals of today, have earned the glory and the booty as labor suppliers , just like the slave traders did in 15th centuries. Only that they were whites trading black, and we are brown sahibs exploiting the fellow browns.

Analyze any balance sheet of the darlings of BSE (Bombay Stock Exchange). The 40% growth in revenues are backed by 40% increase in manpower! So, no real business model efficiencies in real term of revenue per employee.

Microsoft and other software product and productized services companies have much more revenue per employee. Their leverage is their IP (Intellectual Property).

Yes I agree! Doing product, or productizing services not easy. We are not here for a easy game either.

The software coolies mindset need to be changed, if we are to sustain the competitive edge and keep paying more and more salaries.

The leaders need to re-incarnate themselves into Intellectual property developers. Then and only then we can survive the next wave.

We have gained much experience working for the US, UK and EU. Now leverage that to create products and services. Also, we need to have our presence in the emerging markets to leverage the cheaper labor there; Or else, others will beat us at it.

hey guys! wake up! If you are a CXO then think about it and talk to your board of directors or investors.

If you are an employee, use email and blog power to convince your management to graduate to productizers. Or better still, MOVE YOUR OWN CHEESE. Chuck your cushy job, and start a company. If you don't move our own cheese, some one else will move it.

If you havn't notices till now, Our Iceberg is Melting (with apologies to John Kotter,)

Scan and deposit checks from Home @ Net

2007-06-05T01:28:00.000+06:30

https://www.depositnow.com/depositnow/default

I came across the above URL through google ad. Being professionally interested in Banking systems, I looked at it. What they claim is that under Check-21 Act, http://www.federalreserve.gov/paymentsystems/truncation/ all one needs is a scanner and an Internet connection to deposit your check sitting right at home, I am talking about USA (just in case you did not notice the Check-21 Act URL :)

Back home in India, RBI has selected NCR for supplying the check truncation system. See:

http://www.ncr.com/solutions/payment_and_imaging_solutions/check_truncation/cheque_truncation_system.jsp
And
http://www.ncr.com/documents/RBI_Check%20Truncation.pdf

You can read more about RBI initiatives at : http://www.rbi.org.in/scripts/AnnualReportPublications.aspx?Id=433
It talks about check truncation, smart cards and RTGS.

Though as of now you can't scan a check at home and deposit it online, but most banks like ICICI Bank have introduced kiosks at branches that scan the checks and issue you an image receipts. Also you could use Internet banking and write an e-check and use RTGS (Real Time Gross Settlement) to transfer money between diffrent banks.

Having said that, the NCR system that they have implemented is quite old and not open in true sense of the word.
I think I will cover these issue in another post :)

Guy Kawasaki's Recording on Startup

2007-06-04T00:29:00.000+06:30

Just found Guy Kawasaki's recording on tips for getting VC funding:
http://www.guykawasaki.com/files/mp3/raising.mp3
You MUST listen to it now.

Appropiate Technology for Document Management for Micro Enterprise

2007-06-02T23:52:00.000+06:30

Today Vikas, my techie friend, called me up to discuss he dad's need to manage a few thousands of documents that have accumulated over a period of 10 years or more. All these documents are important and most are legal in nature that needs to be crossed referred.

Vikas being a techie, like me, fell into the technology trap. We get carried away by the cutting edge technologies, without caring for the problem at hand. Once we get into the cutting edge, we bleed our resources dry :)

So, he saw my logic, when I told him that I had tried and failed to implement such state-of-the-art document management software for small enterprises. even these small enterprise, who may have a part time computer maintainer; is not equipped to maintain a sophisticated (read complex) document management system. Best is to use an appropriate technology.

Go for an HP scanner (Don't go for all-in-one types, just a simple scanner). Use its document scanning software, that has image to text capability. Use it to convert the scanned documents into PDF formatted files. These file are search-able using free PDF reader from Adobe.
Store them in a hiarchical directory structure, if you need to annotate use OpenOffice.org
software (its free and open source) to create a master document that links other pdf documents, and save it also as a PDF.

Archive these files in a DVD. Anytime you wish to search, just open the adobe pdf reader and search the scanned documents stored inside the DVD as pdf file.
Thus you don't need a system admin to maintain the archive. But if your need grows with the growth of your organization, then use Alfresco , also an open source Java based document management system. Its best of the breeds. I think I will take this up in another post.

(c) www.Ashish.Banerjee.name

Dynamic Configuration Management For Clustered Java EE

2007-06-02T22:58:00.000+06:30

I have posted a tech. brief at http://www.ashishbanerjee.com/dyna-config-25may07.pdf
This technical brief, first describes the dynamic application specific configuration, then describes an use-case scenario. Thereafter, design constrains and solution architecture is described. Two
implementations are proposed.

Also a programmer's guideline is provided for using the dynamically configurable application parameters.

It is concluded that a JNDI wrapped LDAP store is the best solution, followed by Entity Beans and
finally by Java Spaces.

However, all the three implementations are transparent to the application programmer, who uses JNDI abstraction to access the parameters.

Beware of Credit Card Companies in India

2006-05-07T12:41:00.000+06:30

Credit Cards are not only unsafe in hands of strangers but also in the hands of its owner. The banks aggressively push it through their DSA (Direct Sales Agents). The DSA chase the customers without telling them about the fine prints.

I can quote two examples from my personal experiences. ABNAMRO contacted me through their DSA and said that I am being gifted a lifetime Gold card by virtue of my having a fixed deposit (FD) with them. The FD was of 7% and their new advertised rates were 8%. The trap was that they were asking me to sign a legal document declaring that I will not redeem the FD for the lifetime!

Similarly HDFC bank approached me through their DSA claiming that I am being “gifted” a lifetime free card. On my repeated explicit queries about any hidden gotchas, they did not tell me that there was a one time fee of RS 2000! When I read the form I was signing and asked about the fee, the executive said that I can ignore it. When I requested for a written document confirming a waiver of the one time fee, the execute beat a hasty retreat.

Then I had an American Express card, which I found useless because, those days there were hardly any establishments accepting it in India (most still don't accept it even today!). Their statements came delayed as they came from Australia! So, I canceled it and at the time of cancellation there were no overdue or due balance. After accepting cancellation an executive called and requested me to withdraw the cancellation. I answered to her in negative and also sent a FAX to the effect. However, after 3 to 4 years I received a letter saying that I owed them renewal fee. This fee was applied after I had canceled the Card! After many pestering calls, I decided to pay the ransom for peace as fighting a case would have cost me much more. I paid under protest and am yet to receive a receipt! Fortunately I paid by Cheque, although they were insisting on cash!

The Card companies provide a useful service, but they should stop fleecing and conning their customers. Also, they should introduce PKI based digital signature or Smart Card based transaction to reduce and eliminate frauds.

JSP Database Access Best Practices Links

2005-10-25T10:16:00.000+06:30

Here are some of the JSP Database access best practices urls: http://java.sun.com/developer/technicalArticles/javaserverpages/servlets_jsp/

https://bpcatalog.dev.java.net/nonav/solutions.html

http://java.sun.com/reference/blueprints/ https://blueprints.dev.java.net/

Download the Blueprints book from: https://blueprints.dev.java.net/books.html

There are two ways of accessing database from a JSP page. One using a Java Bean Object, which could be using EJB or POJO (Plain Old Java Object), however EJB and POJO have converged in EJB 3.0.

For pages embedding SQL database access code, its strongly recommended to use JSTL (JSP Standard Template Lib.), which is specified in JSR 052 and here is an coding example from Oracle.

The Database tables needs to be converted to Java objects in many models, there are a few frameworks available for doing it. Notably EJB 3.0 has an excellent architecture. One should also consider Apache Object Relation Bridge , JDO (Java Database Access) and Hibernate (which is EJB 3 compatiable)

One could use Druid, an open source tool for database porting it also have a Java Object generator using Hybernate. A better, free but not open source software exists called C24 IO.

For new development one must seriously consider JSF (Java Server Faces) which is the next logical step from Struts. Its specified by JSR-127. One must not use adhoc models for navigating between pages.

I strongly recommend to follow the coding style specified by Sun.

Delving into Compiere

2005-08-25T23:56:00.000+06:30

In lookout for an Open Source Java ERP, I landed up with Compiere. We installed and tried to run it. Then I thought buying the user manual will make life easier, it did to a certain extent. Encouraged, I started to look under its hood. I was in for the shock of my life!

Let me start with the good things first. It has a comprehensive Swing based GUI. It even boasts of its own look and feel called Compiere looks! Another interesting thing is its JDO type of data model, which is generated by a Java tool in their dbport module. They have a Web based interface, which is still in beta state (as of 2.52e), it misbehaves a bit.

The downside is that the JDO type model also heavily depend on stored procedure written in PL/SQL and Oracle 10g is the only fully supported database. So much for its Open Source credentials! Though to be fair, I could see some efforts to make it run on other databases as well.

Having said that, they have JBOSS sitting tight inside it. But the disappointing aspect is the way they have used EJB. They pass around objects to the Session Beans which are SQL aware, the client side is also fully SQL aware. This is one of the glaring ANTI DESIGN PATTERN.

I think all Java J2EE programmers must study Compiere J2EE design as to learn how not to program in EJB.

I encourage all Java programmers to have a look at

[installed dir]/compiere-all/serverRoot/src/main/ejb/org/compiere/session/ServerBean.java

You can download Compiere from http://sourceforge.net/projects/compiere/

Best of luck, please don't die laughing!

Apache XML verses Sun Java XML

2005-08-24T14:24:00.000+06:30

Apache XML technologies, xml.apache.org, are implemented in Java, (though many API also support C++ and Perl). Sun Java XML API, also have a catchment of XML technologies. What are the differences and similarities in their approaches? Which is better?

Basically, both XML Apache and Sun Java agree upon and acknowledge the XML standards like XSD, XPATH, SOAP, WSDL to name a few. Also they agree upon the core XML API like SAX and DOM. Sun proclaims that there are three ways to parse XML SAX, DOM and Streams. XML over streams are implicitly acknowledged by XML Apache. There have also been cross contributions between Sun Java and XML Apache. The Java XML core API, reference implementation provided by Sun in JDK 1.5 is that of Apache Xerces. Also Apache Axis figured in Sun's Java Web Services Toolkit.

Some of the API and packages do conflict, like that of ApacheXML Beans with JAXB. Apache claims that it fully implements XSD , at the same time, it criticizes JAXB for not fully supporting XSD (XML Schema). Sun Java acknowledges in its documentation that JAXB partially supports XSD.

The reason for this partial XSD support in Sun Java; provides an insight into the differences in their respective design philosophies.

For Sun Java objects are the prime focus whereas Apache views XML as prime.

In Sun's philosophy you think in Java, and use XML for persisting Java Objects for storage and inter process communications.

Whereas, Apache's philosophy is to think in XML and use Java as an underlying implementation components. Thus lies the basic reason for the differences in their approaches.

I will not judge as to which of the two approaches are better, since I use both depending on which model fits the problem at hand the best. Languages are structural models for channeling the though process. Some languages have edge over the others in a given problem domain for providing a range of solutions.

Use either of the model that suits you and you feel at ease with, while modeling a solution to a given problem.

Ashish Banerjee (www.Ashish.Banerjee.name)

Sun Tzu : The Art of Cyber Warfare

2005-08-24T12:07:00.000+06:30

By Ashish Banerjee, www.Ashish.Banerjee.name, 12 May 2005.

We needed a framework for thinking and designing security for mission critical geographically distributed banking application over a wide area network.

Our goal was to provide the financial transactions, databases and computing infrastructure with highest possible security.

What does security mean in terms of information domain?

Information security must address Authenticity and Confidentiality. Authenticity involves data integrity and non repudiation. Data Integrity means that we are assured that the information is not tampered with and data packets have not been re-transmitted (or replayed) with malicious intent. Non repudiation means that the author of the record is not able to deny its originality, it mainly involves public key based digital signature. Confidentiality involves the assurance that no one is able to snoop on the communication and only authorized persons within the organization can access the information.

We found that the warfare paradigm suited us the best.

Sun Tzu, an ancient Chinese general in 6^th century BC, wrote the Art of Warfare over 2000 years ago and yet its principles are still used in modern warfare as well as in management thinking. Sun Tzu 's central doctrine is: To win without fighting is the best. We have adopted this doctrine for our security framework.

By thinking about security as a transformation of warfare into cyberspace, enables us to get the best of the two prevalent security models namely: the asset centric security and the perimeter centric security.

In the asset centric model, the assets like servers and databases are protected while in the perimeter based model, the focus is on protecting the corporate boundary. But in our framework, we model the Information Infrastructure Security as a manifest of warfare in virtual reality. Thus we are able to cover both the assets as well as the boundary.

Understanding the warfare terrain is the highest responsibility of the general, and it is imperative to examine them: Sun Tzu.

In our security framework we first define three concepts:

Terrain
Domain
Territory

The warfare Terrain encompasses all the network space from where the attack can be launched on our domain. Domain encompasses our territory as well as all the networking pathways, not owned by us, through which our data flows. The Territory encompasses all our computing assets, databases and networking infrastructures owned by us. The aim is to keep or domain secured and protect our territory.

Thus Terrain in a superset of Domain, which is a superset of Territory.

Imagine that you are a baron owning two castles and you need to transport foodstuff from one of your castles to another. You do not own the road connecting the two, as it passes through a friendly neighboring fiefdom. The roads passes through a valley surrounded by high mountains, not owned your neighbor nor yourself. In this analogy the two castles are your Territory. The road and the castles your Domain. And, the Terrain would constitute the high mountains, the valley, the road and the castles.

You may ask, why is castles included in the warfare terrain? Well, to protect ourselves from the enemy within. A study found that nearly 70% of the attacks are launched by insiders having intimate knowledge of the system's internal security.

Making armies able to take on opponents without being defeated is a matter of unorthodox and orthodox methods: Sun Tzu.

This brings us to face the enemy. Enemy is any entity who intends to attack our territory. In order to plan our defenses, we need to profile our potential enemies and chart out their motives.

A non exhaustive list of enemy profiles and their motives are:

A disgruntled current or ex employee, whose motive may be to harm the company.

A greedy employee out to make a quick money.

A hacker wanting to hold your data hostage for extracting a ransom.

A teenager out to prove herself a wise crack.

A customer wanting to gain an unfair advantage by fudging your accounts.

A competitor wanting an access to your trade secrets or your customer databases.

You can add more to this list. Also there are situations where the above profiled may collaborate to achieve their ends.

Invincibility is a matter of defense, vulnerability is a matter of attack: Sun Tzu.

Having profiled our potential attackers, lets see what are the types of attacks they can launch:

Denial of Service attack: the network or a server is rendered unusable by flooding it by spurious traffic.
Trojans: A program has trap doors built in to compromise the system, but sending information out or letting people in.
Facade: A dummy resource erected to fool the legal users to give out secret information. For example, a dummy ATM machine was setup by attackers to collect the credit card PIN numbers!
Spy wares: These are malicious program, usually get in through emails or rouge web sites, monitor your desktop for password typing and send back this information.
Man in the middle: In this type of attack, the communication is intercepted and modified for malicious reasons, by getting into and becoming a part of the communication channel.
Phishing: a type of social engineering attack, where official looking emails are send to harvest passwords and access codes.
IP Masquerading: A machine or a router is reprogrammed within the network of an service provider to redirect traffic to another computer.
DNS spoofing: The DNS server, which resolve the IP address for a domain name, is hijacked to resolve a trusted site name to a malicious computer.
Hack in: software venerability or a weak password is exploited by the attacker to break into the system.
Snooping: The attacker access the communication, many a times, the security authorities have hooks into the public IT infrastructures; this authority can be misused by an agent.
Authority misuse: An authorized internal person, misuses his access to manipulate the system to their advantage. A programmer had once programed to drop the rounded off change to his bank accounts!

Again the above list is not exhaustive and newer methods are always being invented.

It is hard to know as the dark; its movement is like pealing thunder: Sun Tzu.

We not come to the point of planning our defenses. There are three situations in defense:

Preemptive : This is the best situation to be in, we have not been attacked and yet be are prepared for it. Erecting a firewall and venerability testing are the two most common plans for this situation.
Under Attack: Here we have been attacked and need to respond to the situation. Fighting a DOS (Denial of Service) attack is one of the most challenging example.
Postmortem : This situation arises after our security have been compromised. This is the worst situation of the three to face. We need to trace the intruder, sanitize the resources to remove any Trojans or spy wares also we need to inform and co-operate with legal agencies and collect the log files as evidence to trace and book the offender. An offender who goes Scott-free is likely to attack again.

Armies must know there are adaptations of the five kind of fire attacks, and adhere to them scientifically: Sun Tzu

In the warfare paradigm software tools, algorithm and programs become the weapons. Weapons, are technology tools and can be both used for defense as well as attacks.

There are many such tools available and since this is a general white paper, we shall come out with a detailed paper on specific tools applicable within our security framework. However many security sites like www.insecure.org and linux.org list many security tools in use.

One who is good at martial arts overcome other's forces without battle: Sun Tzu.

One of the strategies is to shrink the terrain. The optimum being domain being equal to the terrain. This can be achieved in multiple ways. One of them being, taking a VPN (Virtual Private Network) from a single vendor, having MPLS and IPSec protocols running over IPv6.

The maximum security you can get is to shrink the domain into your territory. That is you own all the networking as well as computing infrastructure. This scheme is however, not practical for most of the real life financial domain applications. For example, most of the financial transactions including ATM traffic in USA is routed over Internet!

So it is said that victory can be made: Sun Tzu.

Reference: The Art of War by Sun Tzu, translated by Thomas Cleary. ISBN 1-56957-100-7, Published by www.Shambhala.com

Open Source ERP for Small Enterprises

2005-08-17T13:49:00.000+06:30

We needed an Open Source ERP solution for small enterprises.

As I am personally inclined towards Java and XML (I love Dot Net architecture too! I co-authored a C# Web Services Book with Wrox.com); So I googled with the keywords "Open Source Java ERP", and up comes compiere everytime. Tiny ERP (www.tinyERP.org) also popped up and so did some wierd site have 5th Gen affiliations (I thought 5G was dead with Japanese AI initiative in mid and late 80's)!

I thus have zeroed on to compiere.org and www.tinyERP.org

TinyERP site tempted me by their FAQ, which says that it takes a few minutes to install their ERP! Though indeed it took me less than a minute to download, they forgot to mention in the FAQ that it also needs Python runtime and postgreSQL.

TinyErp is implemented in Python . Hope the snake loves Java! There is indeed a Java implementation available for Python called Jython. Netbeans, my favourite IDE, also seems to support Python coyote.dev.java.net!

Though TinyERP is less than a meg, PostgreSQL 8.03 is about 17 MB and Python runtime is about 10 MB.

Having said that, its been more than an hour since my temptation to try tinyERP and I am yet to see it running. I have since then downloaded and installed Python and PostgreSQL. The server setup script now wants psycopg (PostgreSQL module),libxml2 (libxml2 python bindings), libxslt (libxslt python bindings).

I feel like being crushed by a python! But, having gone this far, might as well download and install these as well. For all the tinyERP dependencies click here

After some two hours and addtional 8 to 10 MB downloads later,(thanks to broadband, downloads take no time), I was finally able to run the TinyERP client and server setup without any ugly Error messages.

But, I am yet to see any screens!

After a few false starts, I was finally been able to run the TinyERP server. It uses XML-RPC and serves at port 8069 by default. XML-RPC, hmmm..., its a good idea!

But I am yet to see any screens! so let me try and start the client. Yes! I could do it! The screens are pretty neat. Now in next few days I shall be exploring its features.

Earlier on, I had ignored GNU Enterprise GNUe, probably because it was not written in Java, but now that I have installed Python and have to certain extent overcome my ophidiophobia. I am in a good mind to try GNUe as well.

On the other hand, Compiere (Release 2.5.2e) runtime is about 27 MB and the source is about 33 MB.
Though they claim to be DB independent they have listed Oracle 10g as their requirement! The site however claims to be database independent in design, it also says : "At this point, only Oracle is fully supported. The installation on Sybase is Beta and currently requires good knowledge of Sybase and Compiere. Other databases will follow."

In contrast to TinyERP, installing Compiere was relatively smoother. This may be because we are native to Java. The biggest hurdle in Compiere installation is Oracle 10g installation. This beast needs 1GB of RAM, but we had a 512MB physical memory, so we increased the swap area and then increased the virtual memory to 4GB. If the virtual memory is less than a GB, Oracle gives out a warning and installs. But thereafter it haunts you with all sorts of problems. My colleagues at SIPL , Amit Goel and Shalendra Joshi installed Compiere and Oracle 10g. It took about 2 days to tame the dragon called 10g. Thereafter, following the instruction, Amit had a text book installation that took about an hour. Now we are off to explore its functionality.

Ashish Banerjee (www.Ashish.Banerjee.name)