How to choose tools for Java Code revision from point of view of security - java-security

I'm starting in this matter of reviewing and auditing code of java programs and web applications and I would like to use several tools in this area. And there are a lot of information and a lot of tools so it is very difficult to choose one.
Orientation and professional point of view of real specialist in the area

Related

Create VST plug-ins [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
We don’t allow questions seeking recommendations for books, tools, software libraries, and more. You can edit the question so it can be answered with facts and citations.
Closed 1 year ago.
Improve this question
I want to create a third-party plug-in for Serato (a software for DJs).
I searched in their site and I saw that Serato supports VST (VST2) plug-ins. So my question now is what should I read in order to create a VST plug-in?
Thank you in advance.
A good starting point would be the wikipedia site for VSTs, just to get the basics if you are not familiar with this technology, first you need to know the creators of the VSTs: Steinberg.
VST SDK is a set of C++ classes based around an underlying C API. The
SDK can be downloaded from their website.
Therefore I would recommend starting with something simple. Let’s review a few options:
JUCE
This technology is trending for a few reasons, like their homepage says:
With support for PC, Mac and Linux, JUCE is the perfect tool for
building powerful and complex applications. JUCE also supports the
development of plug-ins: VST, AU and AAX. Run your desktop
applications on mobile! One-click deployment to Android and iOS
(requires Android Studio and XCode) Adjust the user interface of your
application with the Projucer live coding engine Use the best audio
performance available on iOS and Android.
So the pros of this technology are the big community, multi-platform and that is free, at least for non-commercial developments (then if you want to sell it you have to pay). The cons would be that you need to have a little more than the basics of C++ to get started, fortunately there are a lot of tutorials on their page, youtube and the internet, the community is growing so if you have issues you can always ask.
SynthEdit and FL SynthMaker
If you don’t want to get into the code that fast you can start practicing with these, as they don’t require programming expertise, or only a few basics.
SynthEdit is a framework and a visual circuit design that allows you
to create your own synths with only drag & drop without programming.
Therefore giving you the flexibility of using your DSP algorithms
inside the modules.
This is cool if you want to start going quickly, this currently has a cost you can check on their official website.
FL SynthMaker, aka Flowstone, comes free with FL studio. It has a straightforward drag-and-drop graphical interface and a wide range of components. You can use it to code modules and DSP in Ruby and comes with loads of examples to get started quickly and its capacity to assist you in creating a prototype within a short time is a plus.
FLowstone is a programming application that is used to create virtual
instruments effects and computer control of external hardware without
the need to write basic code. The instruments and effects you create
in SynthMaker can be used in FL Studio as 'native' plugins and shared
with other FLowstone users.
MAX MSP
Max, also known as Max/MSP/Jitter, is a visual programming language for music and multimedia developed and maintained by San Francisco-based software company Cycling '74. Over its more than thirty-year history, composers, performers, software designers, researchers, and artists have used it to create recordings, performances, and installations.
The Max program is modular, with most routines existing as shared
libraries. An application programming interface (API) allows
third-party development of new routines (named external objects).
Thus, Max has a large user base of programmers unaffiliated with
Cycling '74 who enhance the software with commercial and
non-commercial extensions to the program. Because of this extensible
design, which simultaneously represents both the program's structure
and its graphical user interface (GUI), Max has been described as the
lingua franca for developing interactive music performance software.
SOUL
The SOUL project is creating a new language and infrastructure for
writing and deploying audio code. It aims to unlock improvements in
latency, performance, portability and ease-of-development that aren't
possible with the current mainstream techniques that are being used.
SOUL unlocks native-level speed, even when hosted from slower, safer
languages. The SOUL language makes audio coding more accessible and
less error-prone, enhancing productivity for both beginners and expert
professionals.
Maximilian
Is a cross-platform and multi-target audio synthesis and signal processing library. It was written in C++ and provides bindings to Javascript. It's compatible with native implementations for MacOS, Windows, Linux and iOS systems, and client-side browser-based applications. The main features are:
sample playback, recording and looping
support for WAV and OGG files.
a selection of oscillators and filters enveloping
multichannel mixing for 1, 2, 4 and 8 channel setups controller
mapping functions
effects including delay, distortion, chorus, flanging granular
synthesis, including time and pitch stretching atom synthesis
real-time music information retrieval functions: spectrum analysis,
spectral features, octave analysis, Bark scale analysis, and MFCCs
example projects for Windows and MacOS, using command line and
OpenFrameworks environments
example projects for Firefox and Chromium-based browsers using the
Web Audio API ScriptProcessorNode (deprecated!)
example projects for Chromium-based browsers using the Web Audio API
AudioWorklet (e.g. Chrome, Brave, Edge, Opera, Vivaldi)
Extras
A few months ago I found this community that is focused on audio programming. They also have a Youtube channel with hundreds of tutorials and a discord server where you can ask questions, and even show your projects or even get a job. If you are interested. It’s called the “The audio Programmer”
Hope this helps you get started. I know there are a lot of option out there and this might confuse you at the beginning but I hope this little guide helps you choose a good starting point depending on your needs and goals since every technology offers different things.

Are java applets a poor choice for new web content?

I work for a government science based agency that provides a lot of technical information through our website. Web development is not really our strong suit, but we get by. A lot of our current content is delivered via Java applets. Recently we have had feedback from users that they cannot access various bits of the site, because their browsers (primarily Safari and Firefox) have disabled Java due to security issues. Of course this can be fixed in both cases by upgrading and/or changing preferences but it still raises a barrier that might be too high for non savvy users.
So my question is what is the probable future for Java applets? Is this an approach that is likely to become less common and the proportion of browser configurations that can't/won't run them increase? As I mentioned my organisation (and myself) are not web development experts so we don't have a good sense of the trends. Should new content be written in something other than Java applets (our most recently developed content uses JavaScript instead). Should we plan to convert the applets over in response to diminishing support?
The current trend is pretty clearly toward less support of Java applets in client-side browsers. It never really worked very well and there are now better ways of presenting dynamic information in web sites.
Building a new web site today that relies on a Java applet for content delivery would be a poor technology choice.
Using Java applet for content delivery,as pointed out,is indeed a poor choice of Technology.Modern browsers are capable of doing almost anything applets can offer. Hence,the use of applets have become rather redundant nowadays.
Firefox and Chrome are pushing for JavaScript and Native Client and have disabled Java for political reasons, not security reasons. There where a short period of time where some specific versions of the Java Plugin where a security problem. Apple blocked these versions, while FF and Chrome used it as an excuse to disable it completely.
What technology are best pends entirely on your use case. If development time are the most important factor I would say that Applets using the Swing framework are the way to go. You can use the Swing designer in Netbeans to quickly make GUI:s. Also the performance of a Swing based GUI are superior to that of Flash or HTML+JavaScript.
But keep in mind that browser support will be limited, users will get security questions etc, However if the data you are exposing are sufficiently interesting to the user this would not matter.
If I where to design a startup website that needs to work well in all browsers, fit into search engines etc Applets would be a dead end.
If I where to design a complex website that presents data that are already in demand from an existing userbase, I would go for Java Applets.
As a third option you can do both. Make a simplified website using HTML+JavaScript and a more advanced Applet version using Swing. This would be viable option even for sites that need to be attractive to new users, where some materials would be accessible for search engines and a front page would work in all browsers.

Java Web Framework Prototyping tools

At the moment Iam evaluating java web frameworks. More precisely Iam talking about GWT, JSF2 and apache wicket. One very importent criteria in this evaluation is prototyping.
The prototyping process in my company can be described by the folloing:
The customer can produce GUIs with an easy to use WYSIWYG editor, by drag&drop-ing web components on the corporate predefined website structur. There is also a need for some litte dynamic being like navigation from one frame to another.
So Iam looking for tools. These tools should not only provide nice GUIs but also deliver
some basic code, which can be forwarded to the development. The aim is to avoid missunderstandings between designers and developers as much as possible. More or less the
developers just have to implements the code, but not to implement the optical requirements.
In addition it would be desirable to customize the components thats been used in the WYSIWYG editor. Does anyone know any good tools for the mentioned frameworks (GWT, JSF2, wicket)?
One of the challenges with WYSIWYG tools for UI is that you generally have to pick between rapid prototyping and maintainable code. Even then, as soon as you want to do something that's not supported by the prototyping tool, you can implement it as you would without the prototyping tool, but your round-trip functionality (namely turning your app back into something that can be edited) is broken or crippled unless extra work is done to generate the metadata that the editor needs.
Upgrading between major releases is another issue. Vendors and groups who have developed these tools have a historically spotty record of when they stop supporting older versions, reasonably because of limited resources and sometimes difficult problems with how to track solid innovation happening in the framework itself.
My suggestion instead is to prototype with an RIA prototyping tool like Balsamiq Mockups or use a grid system like 960 Grid to generate rapid prototypes, then use a web development framework that allows your developers to run the code with or without the backend server. Wicket has a tag called that is great for this kind of thing -- web devs can fill a div with stuff that a component should generate, and Wicket devs can wrap the contents of that tag with after they implement it. Both parties can coexist for a long time that way.
Try GWT Designer for GWT.
Introduction
Quick Start Guide
Download
There's nothing like this for Wicket that I know of. The closest you would get to any kind of resource reuse from your customer would be to give them a drag and drop HTML editor - the resulting HTML could then form the basis of Wicket page/panel layout.
if you are planing to use a javascript library, you may use extjs,
http://www.sencha.com/products/js/
they have developed a nice designer
www.sencha.com/products/designer/
there is also a port of ext in GWT
www.sencha.com/products/gwt/
You have to pay for a commercial license if your application isn't open source!

Netbeans RCP vs Eclipse RCP

I would like to start a new project which will make extensive use of plugins. I know that both Eclipse and Netbeans have their respective Rich Client Platforms, both with their respective strengths and weaknesses.
I would like some comments on which the Stack Overflow community prefers.
Also, and most importantly, how easy it is with the respective platforms to write plugins for already existing applications. For example, if I finish my application, and would like to enable 3rd parties to extend it with their own plugins, how does each of these platforms provide functionality for this? Would they need my source to do it, or do these platforms provide plugin APIs towards which 3rd parties can code?
I would like some comments on which the Stack Overflow community prefers.
I lean my preference to Eclipse RCP, mostly because I still think that the IDE itself is the best right now. Eclipse RCP is also more mature, and has more books and documentations on the web. Netbeans RCP is slightly behind with only three books I can find on Amazon.com regarding the platform.
I'm also very eager to see the platform growing with its e4 projects which will simplify a lot of things (from dependency injection to UI customization)
Also, and most importantly, how easy it is with the respective platforms to write plugins for already existing applications. For example, if I finish my application, and would like to enable 3rd parties to extend it with their own plugins, how does each of these platforms provide functionality for this? Would they need my source to do it, or do these platforms provide plugin APIs towards which 3rd parties can code?
I can imagine that the answer for this question will not really be satisfying while both platform are designed to be extensible. They are pretty equals in this department.
The most important thing is to design your application to also be extensible. That is, providing extension points. You don't have to provide source code for that but you can document the extension points. Also, in case you need to provide interfaces, you can just provide the javadoc without the real source.
I repeat my point, designing application using RCP doesn't mean your application will automatically be extensible. You have to also design your application to be so. This won't come easily as you learn the platform for the first time but you will eventually learn about it from experience.
(Note: I'm not speaking for the community here ;) )
The two major differences between Netbeans and Eclipse RCP are:
OSGi (Netbeans 6.9 is only beginning to support it): it is designed to support extensions
Swing vs. SWT (can you app benefit from the native look supported by SWT)
Another factor, as you can read in this blog post is RAP (Rich Ajax Platform), which could help deploy your app on many platform based on one source code. But that may not concern you.
The maven integration is quite good from both side (see the Netbeans-RCP-Maven Hello World article), but the Maven3-Tycho integration is primarily developed on Eclipse.
Again, you might not need those new maven features (or you could use other build management system entirely, like Ivy or Graddle)
Consider if your plugins does really need such complex architecture as eclipse RCP or NetBeans provide. Plugins for RCP or NetBeans can be only created by Java Developers with strong RCP/NetBeans experience. Be aware that you can do (very easy) RCP application that is not pluggable at all. In some cases is better to write your own, maybe less flexible but more friendly way to attach new plugins. You can even do some wizards for them.

Advice for Beginners (Eclipse & Web Application)

I am about to start on a college project (a web application) and I have never used a full-fledged IDE such as Eclipse.
Turbo C/C++, Visual Basic 6,Java Basic, a bit of SQL, ASP, etc is the sort of exposure I have.
What things should I keep in mind before starting my project using Eclipse? Are the tools mentioned appropriate for the project?(If not please give a detailed answer)
Designing - UML (Rational Rose)
Language - Google Web Toolkit
Server - Google App Engine
IDE - Eclipse
Version Control - Subversion or Mercurial?
I would definitely recommend Googling first. There are a number of tutorials regarding Eclipse as it is a very popular IDE. A quick Google search of my own brought up all these results: developing web applications in eclipse
As for other things to consider, if you are developing a web application, you'll need:
web server (Tomcat is a popular one)
possibly a database (MySQL is an open source, easy to use DB)
language (I'm assuming you're going with Java since you are using Eclipse)
Of course, you'll also need to consider how you hook everything together and what technologies you want to use to do that. (Hibernate, Spring, etc) Eclipse itself has a ton of plugins to help bring together all these various aspects.
That list from Wikipedia is a good and comprehensive list, but if you are learning or developing on your own machine, you may not necessarily need all of that.
Hope that helps.
Since it is a web application, then start with the looks of it.
First, layout a template of how your pages should look, that is what users see. If it does not look good, the users will think the application (in its entirety) is also not good (it does not matter if the code behind the view is perfect; it will just make a first bad impression).
Start with that and be consistent with the design in all your pages. SiteMesh is a nice tool to dissociate the looks of the page from the functionality you put in it.
Then think what the application will do and what it will use:
you have a database? (use something like MySQL). With what are you going to access it? (IBatis is nice; Hibernate I think is a bit heavy weight for a first project)
you need a server: Tomcat is easy to use;
are you going for a simple Servlet/JSP approach or you want to use a framework (look at Spring or Struts);
try to find the good ways of writing the application, look at service layers, DAO pattern, DTO, MVC. Also, you must understand how HTTP works.
A lot more could be said.
Ah.. and also use a source repository. It’s a must (even if you work alone on this project).
Eclipse can handle all of these tools, but then so can Netbeans.
For your first project with GWT you should read through this tutorial:
http://code.google.com/webtoolkit/tutorials/1.6/gettingstarted.html
If you don't know Java then you will have some learning to do, and unlike Visual Studio your UI won't be just drag and drop, so it will be a bit harder than you are used to.
Subversion is fine, it is a nice source control, and any IDE will work with it.
Depending on your project would determine if GWT is the best choice though.
I expect UML may be overkill, and if you were following an agile methodology you wouldn't use it.
Your best bet is to get the UI done first, just have it appear as you want, and have some fake results, until you are happy with the look and feel.
Then, start to do the wiring to whatever you need on the backend.
Don't mean to be harping on you, but is Eclipse a must? For myself, in the beginning NetBeans turned out to be a really painless introduction to getting a web project up a running fast. I believe in the beginning one will spend a lot less time fighting the IDE with NetBeans.
A lot of the items from your bullet list NB makes super easy to ramp up as well. Just my $0.2