środa, czerwca 06, 2007

Klient Oracle pod windows:
  1. Można zainstalować na szybko sterowniki typu instant. Są do ściągnięcia na stronie Oracle'a. Do ODBC są oddzielne i do JDBC. Procedura instalacyjna przebiega bezboleśnie. Trzeba pamiętać jedynie (i to jest bardzo ważne) o zainicjowaniu zmiennych środowiskowych:
  • NLS_LANG=POLISH_poland.EEMSWIN1250 oraz
  • TNS_ADMIN=c:orac
  1. Należy jeszcze utworzyć w katalogu gdzie jest zainstalowany ten "instantClient" plik tnsnames.ora o przykładowej treści:
  2. c3 = (DESCRIPTION = (ADDRESS = (PROTOCOL= TCP)(Host= c3)(Port=1522)) (CONNECT_DATA = (SID = devy)) )

Wprawki w Oracle:

  1. create sequence S_NPDES_ADDRESS_HISTORY increment by 1 start with 1 nocache;
  2. create or replace trigger kursy_BEFORE_INSERT
    before insert on kursy for each row
    declare
    v_Id Number;
    BEGIN
    If :new.mId Is Null or :new.mId < 1 Then
    select seq_kursy.nextval into v_Id from dual;
    :new.mId := v_Id;
    End If;
    End;
  3. insert into kursy values ('xxxx',1,'xx',2,0);

wtorek, czerwca 05, 2007

Co każdy programista Windows powinien wiedzieć (tu ). Opublikowano tu listę zagadnień, które powinien zanać każdy .NET-owiec. Jednym z ważniejszych zagadnień jest znajomość różnicy między wątkiem (thread) a procesem (process).

  1. Wątek to:
    • A private virtual address space
    • An executable program that is mapped into the process' virtual address space
    • A list of open handles to system resources that are accessible to all threads in the process
    • An access token (a security context that identifies the user, security groups, and privileges associated with the process)
    • A process ID (unique identifier)
  2. Proces to:
    • The neighborhood, bounded by its limits (A private virtual address space)
    • The drug den conversion operation (An executable program that is mapped into the process' virtual address space)
    • The tally of all the stores the Narayans now run (A list of open handles to system resources that are accessible to all threads in the process)
    • Information on the outsiders0 [An access token (a security context that identifies the user, security groups, and privileges associated with the process)]
    • The stain-encrusted hoodie [A process ID (unique identifier)]
    • At least one gang member (At least one thread of execution) – after all, how do you have a drug den conversion operation without anyone working towards it?

  3. Pytanie nie jest banalne, Windows znacznie lepiej zarządza wątkami. Dlatego przy przenoszeniu do środowiska Windos oprogramowania pisanego pod Linux'a się problemy wydajnościowe, szczególnie gdy apliakcja przenoszona napisana była w procesach (wątki w Linux są nowością). Firma Zen współpracuje właśnie z MS nad zwiększeniem efektywności działania PHP (przepisuje go na wątki?) pod Windows.

poniedziałek, czerwca 04, 2007

Triki w JS (http://developer.mozilla.org/en/docs/A_re-introduction_to_JavaScript)

  1. Tworzenie obiektów:
    1. var obj = new Object();
    2. var obj = {};
  2. Dostęp do nich:
    obj.name = "Simon" var name = obj.name; lub
    obj["name"] = "Simon"; var name = obj["name"];
  3. obj.for = "Simon"; // Syntax error, because 'for' is a reserved word obj["for"] = "Simon"; // works fine
  4. var obj = {     name: "Carrot",     "for": "Max",     details: {         color: "orange",         size: 12     } }
  5. > obj.details.color orange > obj["details"]["size"] 12
  6. Pętla: 
    for (var i = 0, len = a.length; i < len; i++) {     // Do something with a[i] }
  7. for (var i = 0, item; item = a[i]; i++) {     // Do something with item }
  8. for (var i in a) {   // Do something with a[i] }
  9. a[a.length] = item;                 // same as a.push(item);
  10. a.toString(), a.toLocaleString(), a.concat(item, ..), a.join(sep), a.pop(), a.push(item, ..), a.reverse(), a.shift(), a.slice(start, end), a.sort(cmpfn), a.splice(start, delcount, [item]..), a.unshift([item]..)
  11. Inne funkcje: 
    function add() {     var sum = 0;     for (var i = 0, j = arguments.length; i < j; i++) {         sum += arguments[i];     }     return sum; }  > add(2, 3, 4, 5) 14
  12. Functions

    Along with objects, functions are the core component in understanding JavaScript. The most basic function couldn't be much simpler:

    function add(x, y) {     var total = x + y;     return total; } 

    This demonstrates everything there is to know about basic functions. A JavaScript function can take 0 or more named parameters. The function body can contain as many statements as you like, and can declare its own variables which are local to that function. The return statement can be used to return a value at any time, terminating the function. If no return statement is used (or an empty return with no value), JavaScript returns undefined.

    The named parameters turn out to be more like guidelines than anything else. You can call a function without passing the parameters it expects, in which case they will be set to undefined.

    > add() NaN // You can't perform addition on undefined 

    You can also pass in more arguments than the function is expecting:

    > add(2, 3, 4) 5 // added the first two; 4 was ignored 

    That may seem a little silly, but functions have access to an additional variable inside their body called arguments, which is an array-like object holding all of the values passed to the function. Let's re-write the add function to take as many values as we want:

    function add() {     var sum = 0;     for (var i = 0, j = arguments.length; i < j; i++) {         sum += arguments[i];     }     return sum; }  > add(2, 3, 4, 5) 14 

    That's really not any more useful than writing 2 + 3 + 4 + 5 though. Let's create an averaging function:

    function avg() {     var sum = 0;     for (var i = 0, j = arguments.length; i < j; i++) {         sum += arguments[i];     }     return sum / arguments.length; } > avg(2, 3, 4, 5) 3.5 

    This is pretty useful, but introduces a new problem. The avg() function takes a comma separated list of arguments - but what if you want to find the average of an array? You could just rewrite the function as follows:

    function avgArray(arr) {     var sum = 0;     for (var i = 0, j = arr.length; i < j; i++) {         sum += arr[i];     }     return sum / arr.length; } > avgArray([2, 3, 4, 5]) 3.5 

    But it would be nice to be able to reuse the function that we've already created. Luckily, JavaScript lets you call a function and call it with an arbitrary array of arguments, using the apply() method of any function object.

    > avg.apply(null, [2, 3, 4, 5]) 3.5 

    The second argument to apply() is the array to use as arguments; the first will be discussed later on. This emphasizes the fact that functions are objects too.

    JavaScript lets you create anonymous functions.

    var avg = function() {     var sum = 0;     for (var i = 0, j = arguments.length; i < j; i++) {         sum += arguments[i];     }     return sum / arguments.length; } 

    This is semantically equivalent to the function avg() form. It's extremely powerful, as it lets you put a full function definition anywhere that you would normally put an expression. This enables all sorts of clever tricks. Here's a way of "hiding" some local variables - like block scope in C:

    > var a = 1; > var b = 2; > (function() {     var b = 3;     a += b; })(); > a 4 > b 2 

    JavaScript allows you to call functions recursively. This is particularly useful for dealing with tree structures, such as you get in the browser DOM.

    function countChars(elm) {     if (elm.nodeType == 3) { // TEXT_NODE         return elm.nodeValue.length;     }     var count = 0;     for (var i = 0, child; child = elm.childNodes[i]; i++) {         count += countChars(child);     }     return count; } 

    This highlights a potential problem with anonymous functions: how do you call them recursively if they don't have a name? The answer lies with the arguments object, which in addition to acting as a list of arguments also provides a property called arguments.callee. This always refers to the current function, and hence can be used to make recursive calls:

    var charsInBody = (function(elm) {     if (elm.nodeType == 3) { // TEXT_NODE         return elm.nodeValue.length;     }     var count = 0;     for (var i = 0, child; child = elm.childNodes[i]; i++) {         count += arguments.callee(child);     }     return count; })(document.body); 

    Since arguments.callee is the current function, and all functions are objects, you can use arguments.callee to save information across multiple calls to the same function. Here's a function that remembers how many times it has been called:

    function counter() {     if (!arguments.callee.count) {         arguments.callee.count = 0;     }     return arguments.callee.count++; }  > counter() 0 > counter() 1 > counter() 2 

    Custom objects

    In classic Object Oriented Programming, objects are collections of data and methods that operate on that data. Let's consider a person object with first and last name fields. There are two ways in which their name might be displayed: as "first last" or as "last, first". Using the functions and objects that we've discussed previously, here's one way of doing it:

    function makePerson(first, last) {     return {         first: first,         last: last     } } function personFullName(person) {     return person.first + ' ' + person.last; } function personFullNameReversed(person) {     return person.last + ', ' + person.first } > s = makePerson("Simon", "Willison"); > personFullName(s) Simon Willison > personFullNameReversed(s) Willison, Simon 

    This works, but it's pretty ugly. You end up with dozens of functions in your global namespace. What we really need is a way to attach a function to an object. Since functions are objects, this is easy:

    function makePerson(first, last) {     return {         first: first,         last: last,         fullName: function() {             return this.first + ' ' + this.last;         },         fullNameReversed: function() {             return this.last + ', ' + this.first;         }     } } > s = makePerson("Simon", "Willison") > s.fullName() Simon Willison > s.fullNameReversed() Willison, Simon 

    There's something here we haven't seen before: the 'this' keyword. Used inside a function, 'this' refers to the current object. What that actually means is specified by the way in which you called that function. If you called it using dot notation or bracket notation on an object, that object becomes 'this'. If dot notation wasn't used for the call, 'this' refers to the global object. This is a frequent cause of mistakes. For example:

    > s = makePerson("Simon", "Willison") > var fullName = s.fullName; > fullName() undefined undefined 

    When we call fullName(), 'this' is bound to the global object. Since there are no global variables called first or last we get undefined for each one.

    We can take advantage of the 'this' keyword to improve our makePerson function:

    function Person(first, last) {     this.first = first;     this.last = last;     this.fullName = function() {         return this.first + ' ' + this.last;     }     this.fullNameReversed = function() {         return this.last + ', ' + this.first;     } } var s = new Person("Simon", "Willison"); 

    We've introduced another keyword: 'new'. new is strongly related to 'this'. What it does is it creates a brand new empty object, and then calls the function specified, with 'this' set to that new object. Functions that are designed to be called by 'new' are called constructor functions. Common practise is to capitalise these functions as a reminder to call them with new.

    Our person objects are getting better, but there are still some ugly edges to them. Every time we create a person object we are creating two brand new function objects within it - wouldn't it be better if this code was shared?

    function personFullName() {     return this.first + ' ' + this.last; } function personFullNameReversed() {     return this.last + ', ' + this.first; } function Person(first, last) {     this.first = first;     this.last = last;     this.fullName = personFullName;     this.fullNameReversed = personFullNameReversed; } 

    That's better: we are creating the method functions only once, and assigning references to them inside the constructor. Can we do any better than that? The answer is yes:

    function Person(first, last) {     this.first = first;     this.last = last; } Person.prototype.fullName = function() {     return this.first + ' ' + this.last; } Person.prototype.fullNameReversed = function() {     return this.last + ', ' + this.first; } 

    Person.prototype is an object shared by all instances of Person. It forms part of a lookup chain (that has a special name, "prototype chain"): any time you attempt to access a property of Person that isn't set, JavaScript will check Person.prototype to see if that property exists there instead. As a result, anything assigned to Person.prototype becomes available to all instances of that constructor via the this object.

    This is an incredibly powerful tool. JavaScript lets you modify something's prototype at any time in your program, which means you can add extra methods to existing objects at runtime:

    > s = new Person("Simon", "Willison"); > s.firstNameCaps(); TypeError on line 1: s.firstNameCaps is not a function > Person.prototype.firstNameCaps = function() {     return this.first.toUpperCase() } > s.firstNameCaps() SIMON 

    Interestingly, you can also add things to the prototype of built-in JavaScript objects. Let's add a method to String that returns that string in reverse:

    > var s = "Simon"; > s.reversed() TypeError on line 1: s.reversed is not a function > String.prototype.reversed = function() {     var r = "";     for (var i = this.length - 1; i >= 0; i--) {         r += this[i];     }     return r; } > s.reversed() nomiS 

    Our new method even works on string literals!

    > "This can now be reversed".reversed() desrever eb won nac sihT 

    As I mentioned before, the prototype forms part of a chain. The root of that chain is Object.prototype, whose methods include toString() - it is this method that is called when you try to represent an object as a string. This is useful for debugging our Person objects:

    > var s = new Person("Simon", "Willison"); > s [object Object] > Person.prototype.toString = function() {     return '<Person: ' + this.fullName() + '>'; } > s <Person: Simon Willison> 

    Remember how avg.apply() had a null first argument? We can revisit that now. The first argument to apply() is the object that should be treated as 'this'. For example, here's a trivial implementation of 'new':

    function trivialNew(constructor) {     var o = {}; // Create an object     constructor.apply(o, arguments);     return o; } 

    This isn't an exact replica of new as it doesn't set up the prototype chain. apply() is difficult to illustrate - it's not something you use very often, but it's useful to know about.

    apply() has a sister function named call, which again lets you set 'this' but takes an expanded argument list as opposed to an array.

    function lastNameCaps() {     return this.last.toUpperCase(); } var s = new Person("Simon", "Willison"); lastNameCaps.call(s); // Is the same as: s.lastNameCaps = lastNameCaps; s.lastNameCaps(); 

    Inner functions

    JavaScript function declarations are allowed inside other functions. We've seen this once before, with an earlier makePerson() function. An important detail of nested functions in JavaScript is that they can access variables in their parent function's scope:

    function betterExampleNeeded() {     var a = 1;     function oneMoreThanA() {         return a + 1;     }     return oneMoreThanA(); } 

    This provides a great deal of utility in writing more maintainable code. If a function relies on one or two other functions that are not useful to any other part of your code, you can nest those utility functions inside the function that will be called from elsewhere. This keeps the number of functions that are in the global scope down, which is always a good thing.

    This is also a great counter to the lure of global variables. When writing complex code it is often tempting to use global variables to share values between multiple functions - which leads to code that is hard to maintain. Nested functions can share variables in their parent, so you can use that mechanism to couple functions together when it makes sense without polluting your global namespace - 'local globals' if you like. This technique should be used with caution, but it's a useful ability to have.

    [Closures

    This leads us to one of the most powerful abstractions that JavaScript has to offer - but also the most potentially confusing. What does this do?

    function makeAdder(a) {     return function(b) {         return a + b;     } } x = makeAdder(5); y = makeAdder(20); x(6) ? y(7) ? 

    The name of the makeAdder function should give it away: it creates new 'adder' functions, which when called with one argument add it to the argument that they were created with.

    What's happening here is pretty much the same as was happening with the inner functions earlier on: a function defined inside another function has access to the outer function's variables. The only difference here is that the outer function has returned, and hence common sense would seem to dictate that its local variables no longer exist. But they do still exist - otherwise the adder functions would be unable to work. What's more, there are two different "copies" of makeAdder's local variables - one in which a is 5 and one in which a is 20. So the result of those function calls is as follows:

    x(6) // returns 11 y(7) // returns 27 

    Here's what's actually happening. Whenever JavaScript executes a function, a 'scope' object is created to hold the local variables created within that function. It is initialised with any variables passed in as function parameters. This is similar to the global object that all global variables and functions live in, but with a couple of important differences: firstly, a brand new scope object is created every time a function starts executing, and secondly, unlike the global object (which in browsers is accessible as window) these scope objects cannot be directly accessed from your JavaScript code. There is no mechanism for iterating over the properties of the current scope object for example.

    So when makeAdder is called, a scope object is created with one property: a, which is the argument passed to the makeAdder function. makeAdder then returns a newly created function. Normally JavaScript's garbage collector would clean up the scope object created for makeAdder at this point, but the returned function maintains a reference back to that scope object. As a result, the scope object will not be garbage collected until there are no more references to the function object that makeAdder returned.

    Scope objects form a chain called the scope chain, similar to the prototype chain used by JavaScript's object system.

    A closure is the combination of a function and the scope object in which it was created.

    Closures let you save state - as such, they can often be used in place of objects.

    Memory leaks

    An unfortunate side effect of closures is that they make it trivially easy to leak memory in Internet Explorer. JavaScript is a garbage collected language - objects are allocated memory upon their creation and that memory is reclaimed by the browser when no references to an object remain. Objects provided by the host environment are handled by that environment.

    Browser hosts need to manage a large number of objects representing the HTML page being presented - the objects of the DOM. It is up to the browser to manage the allocation and recovery of these.

    Internet Explorer uses its own garbage collection scheme for this, separate from the mechanism used by JavaScript. It is the interaction between the two that can cause memory leaks.

    A memory leak in IE occurs any time a circular reference is formed between a JavaScript object and a native object. Consider the following:

    function leakMemory() {     var el = document.getElementById('el');     var o = { 'el': el };     el.o = o; } 

    The circular reference formed above creates a memory leak; IE will not free the memory used by el and o until the browser is completely restarted.

    The above case is likely to go unnoticed; memory leaks only become a real concern in long running applications or applications that leak large amounts of memory due to large data structures or leak patterns within loops.

    Leaks are rarely this obvious - often the leaked data structure can have many layers of references, obscuring the circular reference.

    Closures make it easy to create a memory leak without meaning to. Consider this:

    function addHandler() {     var el = document.getElementById('el');     el.onclick = function() {         this.style.backgroundColor = 'red';     } } 

    The above code sets up the element to turn red when it is clicked. It also creates a memory leak. Why? Because the reference to el is inadvertently caught in the closure created for the anonymous inner function. This creates a circular reference between a JavaScript object (the function) and a native object (el).

    There are a number of workarounds for this problem. The simplest is this:

    function addHandler() {     var el = document.getElementById('el');     el.onclick = function() {         this.style.backgroundColor = 'red';     }     el = null; } 

    This works by breaking the circular reference.

    Surprisingly, one trick for breaking circular references introduced by a closure is to add another closure:

    function addHandler() {     var clickHandler = function() {         this.style.backgroundColor = 'red';     }     (function() {         var el = document.getElementById('el');         el.onclick = clickHandler;     })(); } 

    The inner function is executed straight away, and hides its contents from the closure created with clickHandler.

    Another good trick for avoiding closures is breaking circular references during the window.onunload event. Many event libraries will do this for you. Note that doing so disables bfcache in Firefox 1.5, so you should not register an unload listener in Firefox, unless you have other reasons to do so.

Przekładaniec ciąg dalszy (na podst. betanews)
Tym projektem G. zademonstrował chęć wzięcia większego udziału na scenie AJAX-a (nawet MS zapisał się do grupy wspierającej tworzenie standardów wokół tej technologii). Firma G chce przede wszystkim stworzyć ogólnie zaakceptowany standard, a dzięki swemu autorytetowi, szanse na to są spore. Dodatkowo G opiera rozwiązanie przechowywania stanu aplikacji w fazie offline na bazie lokalnej SQLlite (dotychczasowe stosowanie technologii cookies jest mało wygodne i ma mnóstwo ograniczeń np. rozmiar danych). Innym słowem chodzi o zmusznenie przeglądarki do zapamietania swego stanu.
Użytkownik aplikacji webowych zaczyna być ostrożny, nie chce przechowywać swoich kluczowych plików na obcym serwerze w Internecie, nie chce również aby ktoś inny miał do nich dostęp poprzez Internet.
Google Gear polega na zabezpieczenie protokołu transmisji na poziomie sesji (session laye security - ssl) oraz na polityce zaufanego źródła - żaden proces, za wyjątkiem procesów uruchomionych przez lokalną aplikację nie może mieć dostępu do lokalnych zasobów (same origin policy). Dodatkowym zabezpieczeniem jest modułowa budowa aplikacji z rozdzieloną funkcjonalnością. Cześć webowa wysyła zapytania o dane lokalne do warstwy "Data Switch Layer" (taki data brooker podobny do mechanizmu CORBA czy COM) i tylko poprzez nią ma dostęp do zasobów lokalnych.

piątek, czerwca 01, 2007

Gear czyli przekładnia (nadzieja SaaS):
Nowa inicjatywa Google polegająca na zaoferowaniu aplikacji klienckiej do przeglądania online Internetu i zapamiętywania informacji lokalnie spotkała się z dużym echem. Za ZDNet ( What Google Gears means for SaaS developers by ZDNet's Phil Wainewright -- Gears is almost a defensive announcement, an admission that the browser needs to move up a gear (pun intended) if it's going to stay relevant to the needs of Web application users.):
Wymagania aplikacji web2 są tak duże (powoli funkcjonalnością przypominają aplikacje klienckie), że możliwości obecnych przeglądarek już niewystarczające. Rozszerzenie funkcjonalności przeglądarek internetowych raczej nie wchodzi w rachubę (zmiany w JS przebiegają b.powoli ponieważ muszą być zgodne ze standardem). Dlatego buduje się rozszerzenia - programy klienckie do pobrania ze strony twórcy aplikacji (zabezpieczone - podpisane cyfrowo z certyfikatem). Ale tu nie tylko chodzi o offline expirience (praca w trybie lokalnym, bez połączenia z Internetem), a raczej o pełne RCA: multimedia, grafika, dostęp do zasobów lokalnych (pliki i urządzenia), szybką reakcję, dostęp do pakietów biurowych. Jednym słowem - greater client-side functionality.
Już mamy na rynku takie technologie: Yahoo Widget, Silverlight czy Apollo, na razie są one niszowe. Wszystkie one niebezpieczne ponieważ "wpuszczają" programy z Internetu do lokalnego komputera.
Chodzi o zbudowanie czegoś pośredniego między aplikacjami uruchamianymi w środowisku przeglądarki a "pełnokrwistą" aplikacją desktop-ową.
Google ma szanse na powodzenie z uwagi na swój autorytet jako pioniera wprowadzającego nowe i udane rozwiązania. Google może pociągnie i nada rozpędowi tą inicjatywę.


Lista tematów:
  1. search.live.com - czasami dobrze jest poszukać zgodnie z nastawieniem MS (jak oni patrzą na problem)
  2. myEclipse -środowisko do Java już za 30 $ rocznie
  3. CodeGear Borland - daje środowisko do tworzenia aplikacji w PHP (ok.250 Eu)
  4. Ciekawy link do historycznej dyskusji Jobs/Gates
  5. Strona do prototype - http://prototypejs.org/
    1. Tutorial - http://prototypejs.org/learn
  6. Przegląd darmowych frameworków do tworzenia tabel (grid) w JS (po stronie klienta) - smashingmagazine.
  7. Enterprise Grid - nitobi
  8. Mootools - przykłady - http://www.chrisesler.com/mootools/index.html
  9. Studium użyteczności - http://www.usability.gov/
  10. Serwer a la furl - http://swik.net/json/del.icio.us%2Ftag%2Fjson/JSON+in+Java/82uu
  11. KompozEr - nowy, poprawiony NVU.
  12. Why Google is more dangerous than Microsoft by ZDNet's Donna Bogatin -- Why Google is More dangerous than Microsoft
  13. Video prezentacje techniczne - http://www.bestechvideos.com/2007/05/31/microsoft-mix07-partying-with-php-and-the-microsoft-platform/
  14. Lekcje Ajaxa - http://www.ajaxlessons.com/2006/03/07/ajax-workshop-4-live-data-with-json-prototypejs/
  15. Blogi - http://blogs.zdnet.com/

czwartek, maja 31, 2007

Nowości AJAX-owe:
  1. Super tutorial o nauce AJAX-a - Max Kiesler.
  2. Biblioteka obsługi SSH w .NET - http://www.tamirgal.com/home/dev.aspx?Item=sharpSsh
  3. Powyższa biblioteka bazuje na innej bibliotece firmy Mentalis. Tutaj są projekty: http://www.mentalis.org/soft/projects.qpx
  4. Ciekawe książki na http://www.infoq.com/minibooks/ruby/
  5. Instruktaż stosowania - http://msdn.microsoft.com/vstudio/express/beginner/

poniedziałek, maja 28, 2007

JSON tu i tam:

  1. Serwer - PHP
    1. $i = array(
      array("id" => 1, "name" => "sumardi"),
      array("id" => 2, "name" => "hassan"),
      array("id" => 3, "name" => "ruby")
      );
    2. echo json_encode($i);
    3. Zwróci - [{"id":1,"name":"sumardi"},{"id":2,"name":"hassan"},{"id":3,"name":"ruby"}]
  2. Klient - JS
    1. for(var i = 0; i < json.length; i++)
      {
      console.info(json.id + " " + json.name);
      }

Ataki na logowanie:

  1. Można logować się do systemu poprzez podanie konta/hasła w czystej postaci, ale to ma swoje wady - podatność na in-the-middle attack tzn. można się podszyć pod dane konto stosując "lewy" serwer DNS (aby temu zapobiec często używa się OpenDNS), wszystko widać w czasie transmisji i w bazie (w kolumnach gdzie się przechowujekont/hasło)
  2. Można hashować hasło po stronie klienta (biblioteka jsSHA2.js na stronie http://anmar.eu.org/,

<form onsubmit="pwField.value = b64_sha256(pwField.value);">

Co to daje? Brak wiedzy o haśle, a nawet jego długości. Wady - musi być włączony JS w przeglądrce, atak słownikowy, atak replay atack (wystarczy podstawić hash zamiast hasła) dlatego podczas transmisji stosuje się tunel SSL.

  1. Można do tego dodać dane specyficzne dla użytkownika np.: <form onsubmit="pwField.value = b64_hmac_sha256(userId.value, pwField.value);">
  2. Wykorzystanie schematu pytanie-odpowiedź (challenge-response) zwanej też CHAP (http://pajhome.org.uk/crypt/md5/auth.html implementacja MD5 i SHA1) - hasło po stronie klienta jest hashowane dodatkowo przy pomocy informacji przysłanej przez serwer

Formaty informacji zakodowanej:

  1. Uwaga - do podpisywania i sprawdzania potrzebne są biblioteki kryptograficzne. Można wyróżnić trzy rodzaje:
    1. CAPICOM - lokalny ActiveX, który można po specjalnych zabiegach uruchamiać w przeglądarce IE, zaleta jest automatyczna dostępność (element CAPICOM jest zawsze obecny w MS Windows XP)
    2. Sigillum - ale nie wiem jak ją dostarczyć do klienta (wpakować do portalu jako "element do pobrania" i zainstalowania)
    3. AspCrypt - automatycznie instaluje się w trakcie wejscia na stronę, działa tylko w IE i w środowisku serwera MS IIS, wydatek ok. 250 USD
  2. PKCS#7 - Informacja jest zakodowana wraz z certyfikatem i kluczem publicznym w tzw. kopercie ("envelope"), można ją odczytać pod warunkiem posiadania klucza prywatnego zawartego w kopercie certyfikatu. Możliwe jest składanie też wielu podpisów. Do odcyfrowania takiej koperty wystarczy jeden klucz prywatny. Public-Key Cryptography Standards (PKCS) are RSA Data Security, Inc.'s series of de-facto standard formats for public-key cryptography. Among all the PKCS standards, PKCS#7 is probably the most widely used one. It describes a general syntax for data that may have cryptography applied to it, such as digital signatures and digital envelopes.
  3. The S/MIME secure mail standard uses PKCS#7 for its digitally signed and encrypted messages. Certificate requests and certificate store (.spc) files also normally use the PKCS#7 format. Every PKCS#7 blob usually encapsulates some content (such as an encrypted message or signed hash value) and one or more certificates used to encrypt or sign this content.

  4. CMS - ...

  5. XML-SIG - ...

  1. Szyfrowanie w .NET (można ją również odczytać ze strony):
  • Odpowiada za to przestrzeń System.Security.Cryptography.
  • Szyfrowanie/Odkodowanie danych jednostronne (służy autentykacji):
  • Obliczanie funkcji HASH. Wiele sytuacji wymaga przechowywania hasła bez jego znajomości. W ym celu korzysta się z tej funkcji do zapamiętania "skrótu" hasła w polu w bazie zamiast samego hasła. Minusem tego rozwiązania jest, że nie wiadomo jakie jest hasło (jeżeli ulegnie zapomnieniu, to trzeba wygenerować je na nowo). Zapewnia ona: a) mapowanie długich nazw na ich krótkie skrótu, b) skróty dla różnych łańcuchów wejściowych są praktycznie zawsze różne, c) nie można odtworzyć łańcucha wejściowego na podstawie znajomości skrótu. Są dwie implementacje tej metody: SHA1 i MD5.
  • Hash z jądrem (salted hash) - wadą poprzedniego rozwiązania jest to, że dwa łańcuchy we. produkują te same skróty. Można temu zapobiec "dosalając" dane wejsciowe innymi, specyficznymi dla użytkownika danymi np. e-mail, data uruodzenia. Jednak praktycznie stosuje się do tego generator liczb pseudolosowych, aby zapobie atakowi słownikowemu.
  • Szyfrowanie/Odkodowanie danych dwustronne. Rozróżniamy dwa sposoby: symetryczne i asymetryczne.
  • Szyfrowanie symetryczne (używając klucza prywatnego), szybkie zaszyfrowanie danych we. kluczem którego zna tylko odbiorca i nadawca (i tu leży główna słabość, klucz musi być tajny). Stosowane algorytmy: DES, RC2, Rijndael, and TripleDES.
  • Szyfrowanie asymetryczne (używając klucza publicznego, a właściwie pary: klucz publiczny/klucz prywatny), wada - bardzo obciążające procesor. Nadaje się tylko dla małych porcji informacji.
  • Rozróżniamy dwa komplementarne scenariusze:
  • Susan wysyła dane do Boba szyfrując dane jego kluczem publicznym, Bob i tylko on (ponieważ ma drugi element pary - klucz prywatny) może dane rozszyfrować. Metoda ta zapewnia szyfrowanie informacji.
  • Susan wysyła dane do Boba szyfrując je swoim kluczem prywatnym, Bob korzystając z ogólnie dostępnego klucz publicznego Susan może odczytać informację (ale nie tylko on). Ta metoda zapewnia niezaprzeczalność otrzymanej informacji.

Zasoby na poniedziałek:

  1. http://www.onlamp.com/pub/a/onlamp/2007/04/05/the-lighttpd-web-server.html - serwer lighttp, specjalna odmiana serwera wzorowana na Apache, ale bardzo lekka. Ogrzebano moduł fastCGI. Apache czasami jest bardzo wolny i ma różne implementacje wieloprocesowości tzw MPM (multi-processing-model): a) prefork - zawczasu generuje pulę procesów i nią zarządza (powoduje to duży narzut na RAM - 30 MB) lub b) worker - stosuje wielowątkowość (można zyskać na szybkości działania, ale serwer i jego wszystkie komponenty i moduły muszą być tzw. threadsafe. Apache 2.0 i mod_php są, ale inne moduły już nie). Autorem jest Niemiec, Jan Kneschke (2003).
  2. http://ajaxwidgets.com/AllControlsSamples/ - Gaia projektAJAX
  3. www.dzone.com - ciekawy, szczególnie snippety: http://snippets.dzone.com/
  4. Jak naprawdę rozpocząć przygodę z Eclipse i Tomcat-em - http://www.devarticles.com/c/a/Java/Getting-Started-with-Java-Web-Development-in-Eclipse-and-Tomcat/3/

piątek, maja 25, 2007

Myśli:
  1. Instalacja VPN dla Staszic
  2. Poprawienie wydruków
  3. Kocierz - kontrolka do Excela z pobraniem danych z Internetu
  4. Opracuj "moje" pomysły na tworzenie oprogramowania(wypróbuj CR, google API)
  5. Tutaj mamy - http://joeon.net/AJAX_Frameworks_List.htm - listę wszystkich frameworków do AJAX-a, należy zwrócić szczególną uwagę na ten, które mają wsparcie dla JSP/Java lub JEE oraz wspierające siatki danych - firma nitobi. Dodatkowo:
    1. http://wiki.apache.org/incubator/xap
    2. http://gi.tibco.com - TIBCO
    3. http://ajaxwidgets.com/get_excited.aa - w ASP.NET
    4. http://jsc.sf.net for examples - C# świetna!!! - przykład interakcji appletu z JS
  6. Przesyłanie dużych ilości danych (>1GB) - wiele jest serwisów - np. xdrive (źródło )
  7. Pamiętasz o SELENIUM (FireFox)
  8. Serwis dzone.
  9. JSON może być niebezpieczny - Bruce Shneier
  10. Wyjaśnienie dlaczego "svhost" tak szaleje - http://entmag.com/news/article.asp?EditorialsID=8596 - jest na to poprawka MS z 23.05
  11. Program w IDG dla animacji GIF na podstawie filmu - movie2gif.zip
  12. 'Popfly' To Help Bring Silverlight to the Masses
  13. Nowe polityka MS w zakresie rozszerzenia dostępu i wsparcia do języków dynamicznych, obok IronPython ma być też Managed JScript i Ruby. Chodzi o projekt DLR (dynamic language runtime) i Silverlight. Można to ściągnąć stąd http://www.asp.net/downloads/futures/default.aspx?tabid=62.
  14. Ciekawe linki:
    1. http://msdn2.microsoft.com/en-us/asp.net/default.aspx - główna strona ASP.NET
    2. http://www.codeproject.com/Ajax/AjaxASPdotNET.asp - jak rozpocząć przygodę z AJAX-em
    3. http://www.codeproject.com/useritems/C__Instant_Oracle.asp - prosty program jak rozpocząć przygodę z Oraclem w C#
    4. http://www.oracle.com/technology/tech/java/ajax.html - co ma Oracle do powiedzenia odnośnie AJAX-a
    5. http://www.oracle.com/technology/tech/java/ajax.html - płatny portal developerów
    6. http://ejohn.org/apps/jselect/event.html
    7. http://json.org/JSONRequest.html - J(son)AJAX zamiast AJAX

środa, maja 16, 2007

Stylowe style
  1. Świetny tutorial na temat stylów w listach, selektorach, ramkach pływających - http://css.maxdesign.com.au/index.htm
  2. Strona prowadzona przez grupę zwolenników standardów webowych, pragmatyków i antagonistów W3C - http://www.webstandards.org/buzz/#a000203
  3. Lekcje na temat DOM - http://www.webstandards.org/2006/10/18/video-presentation-douglas-crockford-on-the-theory-of-the-dom/
  4. Polepszenie dostępności formularzy - http://www.webaim.org/
  5. To jest źródło tych artykułów - http://www.456bereastreet.com/lab/developing_with_web_standards/full/

piątek, maja 11, 2007

Piątek - weekednu początek:
  1. Dla mojego domowego notebooka - FinalBurner Free (nagrywa nawet DVD) - fb_free.exe
  2. Dla developerów IE - IEDeveloperToolBar - wersja 1.0, to dopiero początek
  3. Co trzeba spełnić w IE 7 (http://blogs.msdn.com/ie/archive/2006/02/14/532211.aspx):
    1. E7 includes an enhanced experience for sites that include upcoming higher assurance SSL certificates including the lock icon with a green filled address bar. Along with other browsers, the Certificate authority industry is working with us towards a tougher SSL standard for the enhanced experience. This past Sunday and Monday, we met to work on the standard with the American Bar Association here in San Jose. The certificate authorities who coolaborated with us this weekend include Geotrust, Verisign, Identrus, Comodo, Cybertrust, Go Daddy and X-Ramp. To see what the experience will be like, you can try out the enhanced experience by downloading a test root certificate and then visiting our demo site using IE7 Beta 2 Preview. If you think your site should have this experience, contact your certificate authority to learn about their plans to offer higher assurance SSL certificates that will be recognized by the IE7 address bar.
    2. In the upcoming Beta 2 release, IE7 will let users sign into web sites using visual "InfoCards" rather than passwords. This eliminates a number of common attacks because when no password is typed, there is none to be stolen (and none to forget). The "InfoCard" system uses certificates to make it harder for imposter sites to pass themselves off as genuine.
    3. IE7 checks the signatures on downloaded programs such as ActiveX controls and executables to make it easy for customers to identify your code. If you distribute software over the internet, you should sign your code with a valid code signing certificate.
  4. Funkcjonalność usunięta z IE 7 (http://msdn2.microsoft.com/en-us/ie/aa740486.aspx):
    1. Offline Favorites--Offline Favorites and Scheduled Offline Favorites have been removed from Internet Explorer 7. Internet Explorer supports RSS feeds, which provide scheduled updates to web content and offline reading of this content. For more information about RSS feeds, read the RSS Blog.
    2. Scriptlets--Internet Explorer 7 disables Dynamic HTML (DHTML) scriptlets by default. (Scriptlets were phased out in Internet Explorer 5). They can be re-enabled by system administrators by changing the advanced settings in the Internet Control Panel. To change the setting, open Internet Explorer, click Tools, and then click Internet Options. In Internet Options, click the Advanced tab, and then scroll down to find Allow Scriptlets. If you are a developer and your programs rely on scriptlets, we recommend that you use more efficient DHTML behaviors. Disabling scriptlets by default is done to deemphasize unsupported technology in Internet Explorer.
    3. ActiveX controls--The new Internet Explorer 7 ActiveX Opt-In feature disables ActiveX controls on a user's machine. When the user visits a webpage that is trying to use a disabled ActiveX control, they see an Information bar to enable the control. Controls which were used in Internet Explorer 6 before upgrading to Internet Explorer 7, along with some pre-approved controls, are not disabled.
    4. Channel Definition Format (CDF)--All CDF support was removed from Internet Explorer 7 and replaced with the RSS feed reading experience. Feeds that the user is subscribed to are available to other applications through the RSS Platform. For details, read the RSS Platform.
    5. DirectAnimation--All DLLs to support the Internet Explorer DirectAnimation component were removed in Internet Explorer 7.
    6. XBM-- XBM, an imaging format designed for X-based systems, is no longer supported.
    7. SSL--Support for weak SSL ciphers was removed from Windows Vista and support for SSLv2 was disabled for Internet Explorer 7 on all platforms.
    8. BASE Element--Internet Explorer 7 strictly enforces the BASE element rule, as documented in the HTML 4.01 standard. We no longer allow BASE tags outside of the HEAD of the document. The standard specifies that the base element must appear within the head of the document, before any elements that refer to an external source.

    9. window.opener and window.close--Internet Explorer 7 no longer allows the window.opener trick to bypass the window.close prompt. Browser windows cannot close themselves unless the windows were created in script. This security enhancement no longer allows browsing to a random site when the main browser window closes unexpectedly.

    10. Changes that affect modal or modeless dialogs created from script--Modal or modeless dialogs created from script in Internet Explorer 7 might seem to be slightly bigger than their Internet Explorer 6 counterparts. This is caused by a change to the behavior of the dialogWidth and dialogHeight properties, which now set and retrieve dimensions of the content area of a dialog (from Internet Explorer 7 and later). It will no longer be necessary to calculate the area lost by elements of a dialog’s frame. Information on these changes will be posted on the Internet Explorer Blog.

    11. Generic Spoofing Risk Reduction in Internet Explorer 7--The window.prompt script method is blocked and the gold Information bar is displayed by default in Internet Zone for Internet Explorer 7. The helps prevent websites from spoofing things such as the logon screens of other websites. This is a new security enhancement for Internet Explorer 7.

    12. WWW-Auth--Internet Explorer 7 changes the precedence rules for WWW-Auth. Previous releases of Internet Explorer used the first header encountered. Internet Explorer 7 uses the first header except when the header is Basic. Internet Explorer 7 uses Basic authentication if no other authentication mechanism is present.

    13. HTTPOnly Cookies--HTTPOnly cookies can no longer be overwritten from scripts.

      _SEARCH--The _SEARCH sidebar is disabled by default in Internet Explorer 7. It is now a setting and can be turned by checking Enable websites to use the search pane in the Advanced tab of the Internet control panel.

      View Source--The view-source protocol no longer works in Internet Explorer 7.

      Gopher Protocol--Support for the Gopher protocol was removed at the WinINET level. (Gopher support was turned off by default in Internet Explorer 6.)

    14. window.external.ImportExportFavorites--window.external.ImportExportFavorites has been removed in Internet Explorer 7.

      Telnet--The Telnet protocol handler is no longer supported in Internet Explorer 7.

    15. SysImage URL Scheme--The SysImage URL Scheme has been removed from Internet Explorer 7.

      Status Bar Scripting--Scripts will no longer be able to set the status bar text through the window.status and window.defaultStatus methods by default in the Internet and Restricted Zones. This helps prevent attackers from leveraging those methods to spoof the status bar. To revert to previous behavior and allow scripts to set the status bar through window.status and window.defaultStatus, follow these steps:

      1. Open Internet Explorer, click the Tools button, click Internet Options, and then click the Security tab.
      2. Click Internet or Restricted sites, and then click the Custom level button.
      3. Scroll down to Allow status bar updates via script, select Enable.
      4. Click OK until you return to Internet Explorer.
    16. Security Settings for Script Access to the Clipboard--New security-related updates for Microsoft Internet Explorer 7 include a change in the default security settings for Script Access to the clipboard. Sites using scripts to access the clipboard in the Internet and Trusted sites zones will receive a prompt that will inform the user that their clipboard is being accessed by script. The prompt will require user permission to continue. Giving permission will allow the website to save information to the clipboard, and read any existing information from the clipboard. This security setting is designed to help prevent the possibility of information disclosure through script access to the clipboard.
    17. Installing Internet Explorer 7 with The Microsoft Windows Server® 2003 operating systems with Service Pack SP1 (SP1)--The home page will be reset to the secure page (res://shdoclc.dll/hardadmin.htm).
    18. Upgrading from Internet Explorer 6 to Internet Explorer 7 on Windows Server® 2003 operating systems with Service Pack SP1 (SP1)--Users upgrading from Internet Explorer 6 to Internet Explorer 7 on Windows Server® 2003 with the setting Enhance Security Configuration turned on might notice that the machine will not be set to the correct Enhanced Security Configuration (Internet Explorer Hardening) defaults for Internet Explorer 7. To change the settings back to the correct defaults, an administrator should turn OFF Enhanced Security Configuration and then turn it ON again. To do this,
      1. Open the Control panel.
      2. Select Add/ Remove Programs.
      3. Locate the Enhanced Security Configuration option.
      4. Turn it OFF.
      5. And now turn it ON again.
      6. Your server settings would be set to the correct Enhanced Security Configuration defaults for Internet Explorer 7.
    1. Active Desktop--Active Desktop has been removed from Windows Vista. It is still available on 32-bit versions of Windows 2003 Server and Windows XP SP2 with reduced functionality. The following features have changed:
      1. Synchronization of Active Desktop with online content is no longer supported.
      2. The ability to restore Active Desktop if software or the operating system stops responding is no longer supported.
      3. The Active Desktop item’s window does not show the title of the webpage (it shows the address of the webpage).
      4. For a webpage restricted by Content Advisor, the Action Cancelled page is not displayed.
  1. Skype 3.2 Gold - nowe możliwości.
  2. Concept Draw - witryny http://www.giveawayoftheday.com/
  3. Ciekawe programy -www.dobreprogramy.pl

czwartek, maja 10, 2007

Co nowego w czwartek:

  1. W betanews - nowa wersja Yahoo widgets
  2. Część pierwsza świetnego tutoriala do uruchomienia na platformie AIX środowiska PHP/JAVA - ciekawe czy będą nastepne? Są dwa sposoby na uruchomienie tych dwóch technologii: "There is no convenient direct link between Java and PHP technology—they are two different technologies using completely different logic, binary, and deployment environments. However, one way that you could enable both systems to communicate with each other is to employ Service-Oriented Architectures (SOAs) and Web services to exchange information. In this example scenario, you would expose your Java application through a series of Web services. The PHP application would then act as a Web services client to communicate with the Java Web services interface.

    The other alternative is to use the PHP Java Bridge, which provides a direct object interface that allows you to share Java and PHP code directly within the same application."

  3. Nowy atak SUN w kierunku upowszechnienia Java w środowisku NetBeans - powstaje wersja 6 (oferowana jako early access na konferencji JavaOne), która umożliwi uruchamianie JavaScript i Ruby (JRuby w środowisku JVM). Język JS będzie potraktowany jako pełnoprawny obywatel w tym RAD. Ogólna dostępność - koniec 2007.
  4. Zalecenia odnośnie jak tworzyć w JS (autorstwa doświadczonego programisty Mat Kruse)
  5. Nowy rywal dla Google Apps - "Bringing OpenOffice to the Internet,” Mahdi Abdulrazak, Chief GravityZoo Evangelist, proclaimed to me."
  6. Ciekawe linki z VFP - http://www.cetus-links.org/oo_visual_foxpro.html - duże zasoby do sprawdzenia (źródło - http://www.foxclub.ru/)
  7. http://www.computerworld.com.au/index.php?id=1472160102&eid=-301 - dywagacje na temat PostgreSQL prowadzone przez autora.
  8. Nowy, ciekawy portal dla PHP - http://www.codewalkers.com/ coś ala developershed (http://www.devshed.com/c/a/Oracle/Data-Manipulation-and-More-for-HTML-DB-Applications/)
  9. Stosowanie MS SQL 2005 z produktami Expression - http://www.sqlservercentral.com/articles/articlelink.asp?articleid=2993
  10. Tutorialsy na różne tematy - http://www.tutorialdownloads.com/tutorials/C%20SHARP/C%20sharp-books-shelf1.html
  11. Dev shed na teamt Flex-a
  12. Zrozumieć JS - http://www.devshed.com/c/b/JavaScript/

środa, maja 09, 2007

Ciekawe artykuły:
  1. http://www.lifetrainingonline.com/blog/how_to_read_people.htm
  2. http://www.devx.com/dotnet/Article/32421/0/page/1 -dekorowanie właściwosci w C#
  3. http://news.zdnet.com/2100-3513_22-6181922.html?tag=nl.e539 - Sun być może na konfrencji JavaOne ogłosi udostępnienie JavaFX script - uproszczonego język skryptowego do Javy
  4. http://www.oracle.com/technology/tech/oci/instantclient/index.html - dostęp do bazy 10gi bez konieczności "zabawiania się" plikami i zmiennymi konfiguracyjnymi.
  5. http://www.javascripttoolbox.com/bestpractices/ - Mathew Kruse - rady dla JS
  6. http://bignosebird.com/ - kolejny poradnik dla webmasterów
  7. http://www.codeproject.com/useritems/C__Instant_Oracle.asp - jak wystartować w C# z programowaniem do bazy Oracle 10gi przy pomocy "instant" oracle
  8. http://davidhayden.com/blog/dave/archive/2006/03/14/2883.aspx - blog dewelopera w C#
  9. http://www.eol.org/home.html
  10. http://www.motherearthnews.com/gallery.aspx?id=113446
  11. http://www.ndesign-studio.com/blog/mac/css-dock-menu
  12. http://brainden.com/logic-puzzles.htm

wtorek, maja 08, 2007

Wtorek 8 maja:
  1. Ciekawe na temat możliwości JS - JavaScript allows you to perform an assignment at the same time as testing if the assignment worked. This can be used inside any conditional, including inside an 'if', 'for', 'while' and 'do - while'.

    if( x = document.getElementById('mydiv') ) {...}
    do {
    alert( node.tagName );
    } while( node = node.parentNode );

    Note that Internet Explorer on Mac will produce an error if you try to do this with an array, when it steps off the end of the array.

  2. To samo dotyczy instrukcji break, podobnie działa continue -
    myForLoop:
    for( var x = 1; x < 5; x++ ) {
    var y = 1;
    while( y < 7 ) {
    y++;
    if( y == 5 ) { break myForLoop; }
    document.write(y);
    }
    }
  3. DHTMLxGrid - dhtmlxGrid is flexible JavaScript grid control with powerful API and Ajax support. It provides client-side solution for displaying, editing and sorting tabular data. Using dhtmlxGrid you can easily create dynamic tables with scroll bars, frozen columns, fixed multiline headers and multiple cell types (text, image, checkbox, radio button, combobox etc.). Smart rendering and paging output allow this grid to work effectively with large datasets.
  4. Biblioteka w JS dla base64 i sprintf (document.writeln('Result: ' + sprintf("Decimal %+05d, Float %07.2f, String '%-10.4s', Hexadecimal %05X", 123, 123, 'abcdefg', 123123));).
  5. To wszystko powyższe wziąłem z http://www.roscripts.com/.
  6. Writing after the page has loaded

    After the page has completed loading, the rules change. Instead of adding content to the page, it will replace the page. To do this, you should firstly open the document stream (most browsers will automatically do this for you if you just start writing). Then you should write what you want, and finally, you should close the document stream. Again, most browsers will automatically close the stream for you. The notable exception here is the Mozilla/Firefox family of browsers, that will continue to show a loading graphic until you close the stream. Some other browsers may fail to render part or all of the content. Just to be safe, make sure you always close the stream.

    <script type="text/javascript">
    document.open();
    document.write('<p>What ever you want to write</p>');
    document.write('<p>More stuff you want to write</p>');
    document.close();
    </script>

    That will remove everything that is currently being shown and replace it with what you write in there. This is the equivalent of moving the user to a completely new page. You should put <html> tags and things like that in there too if you want to use that method.

    You may notice that I close my HTML tags inside the script with a backslash before the forward slash in the closing tag. This is a requirement of the specification (and can cause the HTML validator not to validate your page if you forget it), although all browsers will understand if you omit the backslash.

    However, since you can write HTML with script, you can write style or even script tags with it, making one script import another. If you omit the backslash on any </script> tags that you are writing with the script, the browser will read that as the closing tag for the current script, and your script will fail.

    The same applies to opening or closing comments (although I fail to see why you would want to write comments using a script). These can be written as '<'+'!--' and '-'+'->'. When the script runs, the plus sign tells it to append the strings, creating a valid HTML comment.

  7. Ciekawe dywagacje na temat funkcji - http://www.howtocreate.co.uk/tutorials/javascript/functions
  8. Zabezpieczenie tarnsmisji -

    Normally, this cannot be done with JavaScript using the Internet alone. You can encrypt text at the user's end and unencrypt it at your end. The problem is that the user has to encrypt it with a password that you know so that you can unencrypt it. They would have to tell you by telephone or post. Alternatively, you could put the password in the source of the page and get the function to encrypt using that key. But this password would have to be sent over the internet in plain text. Even if you did encode it, it would not be too much work for a snooper to crack it. In fact, the encryption could even be broken with brute force techniques. So what do you do?

    The best possible technique would be to create a symmetric encryption key using a twin public/private key pair as with techniques such as Diffie-Hellman or SSL, or use an asymetric public/private key pair and encryption technique as with PGP or RSA. The problem is that in order to prevent brute force cracking techniques, these require the browser to handle numbers as high as 2x10600 or higher. JavaScript is just not natively capable of working with numbers as high as this. As yet, I have found no solution to this, although on http://shop-js.sourceforge.net/ there is an algorithm for emulating large number handling, and an example of JavaScript powered RSA. The technique seems to work and takes only a few seconds to create keys, by using complex mathematics and algorithms (look at the source of crypto.js) to emulate large number handling.

    Even so, if doing the equivalent of RSA (etc.), it is still not possible for the user to verify your identity as with SSL certificates, so it would be possible for a third party to inject their own code and have the information sent to them instead, without the user's knowledge. For the best security, stick to real SSL.

  9. Obiekty z JS - http://www.howtocreate.co.uk/tutorials/javascript/javascriptobject.
  10. Struktura DOM - http://www.howtocreate.co.uk/tutorials/javascript/domstructure

sobota, maja 05, 2007

Nowe pomysły:

  1. Kontrolki webowe zbliżają się w swojej funkcjinalności i wyglądzie do kontrolek natywnych WINDOWS. Tylko wtedy aplikacje typu ajax mogą wyprzeć wszystkie aplikacje client/server.
  2. http://www.owlfish.com/software/simpleTAL/ - TAL-e ale bez narzutu Zope (niestety tylko Python).
  3. Papervision 3D nie był pierwszy - http://www.actionscriptarchitect.com/2007/02/28/flash-video-on-3d/
  4. Jak sterować Visio poprzez VFP - http://www.aksel.com/whitepapers/VisioAutomation.htm
  5. Ciekawa definicja (http://www.higheredblogcon.com/webdev/lawson/index.html): The DIV and SPAN elements, in conjunction with the id and class attributes, offer a generic mechanism for adding structure to documents. These elements define content to be inline (SPAN) or block-level (DIV) but impose no other presentational idioms on the content.
  6. Ciekawy link do VFP - http://www.thefoxshow.com/ i ciekawy blog - http://akselsoft.blogspot.com/
  7. Miejsce gdzie są darmowe szkolenia z technologii MS wspierane przez Dr.Dobbs - http://www.learn2asp.net/?RefID=CMP001
  8. http://weblogs.foxite.com/vassilisaggelakos/archive/2007/04/24/3726.aspx - o rysowaniu przy pomocy GDI+ w VFP.
  9. Porady na temat REPLACE - To summarize, follow these rules when using REPLACE: -
    1. Always use the "IN" clause!
    2. Examine decimal data and decide if boundary checks are necessary before a REPLACE.
    3. _TALLY will let you know if a REPLACE occurred. If you want to be absolutely sure that a REPLACE happened, you can try to ASSERT _TALLY>0 after your REPLACE command. This will alert you while testing your application that a REPLACE didn't occur.
  10. Porównanie implementacji SQL - http://troels.arvin.dk/db/rdbms/
  11. Ciekay blog natemat VFP - http://todmeansfox.blogspot.com/2006_12_01_archive.html
  12. Projekty VFP na codeplex