Spring Security 3 hidden feature

April
2nd
2010

These days I’m working with Spring Security 3

SS3 added the Spring Expression Language, a nice way of script boolean conditions into “access” attributes of your URLs and into @PostFilter annotations

The hidden part is that you could have used them even with the security:authorize tag in your JSPs IF they had added the element <expression-handler> as a child of the element <http>
That’s the only missing part since the code to handle it is already there.
So what? I took the spring-security-3.0.xsd, edit it to add the missing element, modified the schemaLocation of my security xml file and voilĂ : SpEL is alive and kicking even on JSPs

I’ve opened a ticket for that: the answer was that they deliberately turned it off for version 3 but no target version is set.

In the meanwhile I’ve also found a problem on the JMX lib of Jetty, and opened a ticket as well. Hope they could fix it asap.

UPDATE: indeed they fixed it! Thx to Michael Gorovoy

Che piacere sentire queste parole…

October
8th
2009

SVN users, secure your web site!

September
29th
2009

After reading this article I found I host one of the site affected by this security issue.

I.e. if your website has “.svn” folders (because you’ve forgot to exclude them from the zip or whatever) than your source code may be exposed to the anonymous users.

Two possible (and simple) solutions:

  1. Exclude “.svn” folders when publishing/deploying
  2. Add this to your Apache2 website configuration
    <Directory ~ ".*\.svn">
      Order allow,deny
      Deny from all
      Satisfy All
    </Directory>

glib-2.20.5 b0rks if compiled with plain -O3

September
3rd
2009

Just one more post for the category Improving Free Software: I’ve run into troubles on my laptop when yesterday I upgraded glib, which caused an infinite loop on a dependent software.

Thanks to a suggestion from Gilles Dartiguelongue, I found that the latest glib fails if compiled with a plain -O3 optimization: the problem was solved by disabling the “ipa-cp-clone” optimization (-fno-ipa-cp-clone).

All the details can be found here.

Filling the MP3 player before going on vacation

August
6th
2009

Isn’t your MP3 player brand new? Would you like to go on vacation with a bunch of music but don’t have enough space?

It’s quite common to buy high definition MP3 today, but they take too much space especially if you don’t need such high quality while having your sun bath.

Lucky enough, you are a geek, so you know what’s a bash script.

So, create you collection, copying your MP3s in a dedicated folder, then run the following command

find -type f ! -name '*.low.mp3' -exec ffmpeg -i {} -ab 128K {}.low.mp3 \;

It will create 128k MP3 version of your collection (converting the format, if necessary)
When done, just delete the high quality version

find -type f ! -name '*.low.mp3' -exec rm {} \;

and copy the remaining on your MP3 player.

Wish you good vacation!

Setting up FoodMart on Mondrian

August
3rd
2009

I don’t know either if I’m stupid or if the Pentaho developers are lacking of effort in helping poor conference speakers like me.

If you want to show someone the features of something, you have to set up a demo. And half the times these demos require data. And if you are setting up a demo for a business intelligence tool, data is essential!

Pentaho provides you with a dataset to use in demos and as a playground (thank you), but it’s quite difficult to set it up. An early adopter may judge this as project immatureness, while Mondrian is all but immature!

That’s what you need to set up the FoodMart database on PostgreSQL before demoing Mondrian (don’t try that with MySQL: it will take hours!)

First, locate a copy of these dependencies: log4j, eigenbase-xom, eigenbase-properties, eigenbase-resgen, commons-logging and postgresql-8.4-701.jdbc4.jar (or a suitable postgres jdbc driver): let’s say you have them in folder “mondrian/lib” and that you are in folder “mondrian”

Then write in a console:

java -cp .:lib/mondrian.jar:lib/log4j.jar:lib/eigenbase-xom.jar:lib/eigenbase-properties.jar:lib/eigenbase-resgen.jar:lib/commons-logging.jar:lib/postgresql-8.4-701.jdbc4.jar
mondrian.test.loader.MondrianFoodMartLoader
-verbose -tables -data
-jdbcDrivers=org.postgresql.Driver
-outputJdbcURL='jdbc:postgresql://localhost/mondrian?user=postgres&password=postgres'
-inputFile=demo/FoodMartCreateData.sql

Then wait for a minute.

Bah, maybe it’s just me, too comfy sat on ant and maven.

Oggi sciopero

July
14th
2009
asd

Aderisco all’appello di Diritto alla Rete contro il D.D.l. Alfano, che cerca di imbavagliare internet

Speeding Firefox/Thunderbird start-up

July
13th
2009

Having found and read this forum thread, I’ve modified the script to:

#!/bin/bash
username=$(whoami)

function check_app {
	proc="$(ps aux | grep $username | grep -v $0 | grep $1 | grep -v grep)"
	if [ "$proc" != "" ]
	then
		echo "!!! Shutdown $1 first!"
		exit 1
	fi
}

function vacuum_mozillas {
	echo "Vacuuming $1..."
	find $2 -type f -name '*.sqlite' -exec sqlite3 {} VACUUM \;
}

check_app firefox
check_app thunderbird
vacuum_mozillas firefox ~/.mozilla/firefox/
vacuum_mozillas thunderbird ~/.thunderbird

echo 'Done!'

While it sensibly improves start up times, don’t expect too much.

Left the CTO chair

May
26th
2009

It started as fresh air and slowly became toxic.

As a technical director, I thought I had the power to steer the technical part of my company but that revealed to be false. My father and his friend are the main providers of the software that let us work. I found it slow, difficult to maintain and evolve and not as productive as the company needed it to be.

I took the long way round and started providing the company with better systems, removing some daily problems.

And then I finally said that: We need to remake this software: why don’t we sit and choose if to start from the most critical parts that add the most value to our business or if to start from the boundaries and make the process slower but more predictive?
And nobody sat.
Not even my father.

It’s a professional and personal failure.

But it finally lets me open to learn something new, to re-join the community I left and to be have a better private life.

Don’t forget the NumberFormat!

May
23rd
2009

Or you’ll get some weird exchange as on today bbc homepage

bbc exchange