Re: Suggestion for handling LF/CRLF EOL conversions.

2010-01-17 Thread Preston L. Bannister
This is kind of old ground. :) For a Windows .BAT / .CMD file when checked out on Unix, LF is more pragmatic as an EOL marker (as you might want to edit the text, but are not going to execute the script). The same logic applies for a shell script checked out on Windows (where CR LF as EOL is usefu

Re: Why are manager session tokens generated with MD5 by default?

2009-01-06 Thread Preston L. Bannister
First, note that any session-id provides only the flimsiest sort of "security". Proper authentication was described a long time ago: Needham, Roger; Schroeder, Michael (December 1978), "Using encryption for authentication in large networks of computers.", *Communications of the ACM* *21* (12):

Re: Why are manager session tokens generated with MD5 by default?

2009-01-05 Thread Preston L. Bannister
How would you reverse a session-id from an MD5 hash? The exploit used to forge an SSL certificate will not help you. The MD5 exploit is irrelevant to this particular usage. Lots of links and discussion: http://www.schneier.com/blog/archives/2008/12/forging_ssl_cer.html If you are connecting to *a

Re: Tomcat-Lite - part 1

2008-08-30 Thread Preston L. Bannister
I for one happen to think this is a great idea (generally). More specifically, for at least one small web application (where Tomcat is stripped down and embedded), I have been tempted to strip out the servlet support code (for a number of reasons).

Re: New Tomcat release? Out of the box bundle with Harmony?

2007-11-08 Thread Preston L. Bannister
On Nov 8, 2007 12:59 PM, Henri Gomez <[EMAIL PROTECTED]> wrote: > 2007/11/8, Preston L. Bannister <[EMAIL PROTECTED]>: > > Yes, any such bundle should be under Harmony, not Tomcat. > > Why not Tomcat ? > If you are looking at Harmony, you are (or should be) ex

Re: New Tomcat release? Out of the box bundle with Harmony?

2007-11-08 Thread Preston L. Bannister
Yes, any such bundle should be under Harmony, not Tomcat. Speaking as an application developer, the (outside?) chance that a customer could go to download Tomcat, and end up with Harmony - this does not make me happy. At least until I have a *lot* more confidence in Harmony. Tomcat is expected t

Re: Are Sticky Sessions really necessary?

2007-11-03 Thread Preston L. Bannister
On 11/3/07, Len Popp <[EMAIL PROTECTED]> wrote: > > But isn't the purpose of session replication to allow different > servers to handle the session? If not, what's it for? > This discussion touches on a bit of philosophy, and a set of design decisions built into the code, and no longer relevant.

Re: Memory usage Tomcat 3.3 vs 5.5

2006-04-25 Thread Preston L. Bannister
So ... rather than something small and fiesty ("Tomcat") perhaps the name should be mega-gozo-zilla-raptor-cat, or similar? Truth in advertising. :) On 4/25/06, Jess Holle <[EMAIL PROTECTED]> wrote: > > Remy Maucherat wrote: > [snip] > > It is completely irrelevant compared to the memory usage o

Re: Tomcat & JDK for PDA arm processor

2006-04-23 Thread Preston L. Bannister
How small does it need to be? If you really need a full HTTP + servlets configuration then it might be easier to use one of the smaller Jetty configurations ( http://jetty.mortbay.org/ ). Do you really need servlets (i.e. is this webapp meant to run anywhere)? Dropping the standard servlet interf

Re: Challenges for Java hosting

2006-04-09 Thread Preston L. Bannister
Again, the main question is which target you are trying to hit. Are you aiming at Java web hosting where a hosting service would offer Java to *all* their customers? Are you aiming at Java web hosting for any (or nearly any) existing Java web application? In the first case you are aiming at the

Re: Challenges for Java hosting

2006-04-06 Thread Preston L. Bannister
's way into Linux. I'm pretty sure copy-on-write in fork() was in SunOS, but I don't know about Solaris. On 4/6/06, Leon Rosenberg <[EMAIL PROTECTED]> wrote: > > isn't it easier to give each user a pre-configured lightweight but own > tomcat? > > leon > &

Re: Challenges for Java hosting

2006-04-06 Thread Preston L. Bannister
Well, that is one definition of "real applications". There are other definitions. :) On 4/6/06, Tino Schwarze <[EMAIL PROTECTED]> wrote: > > On Thu, Apr 06, 2006 at 09:15:17AM -0700, Preston L. Bannister wrote: > > > You have to consider how (or if) to al

Re: Challenges for Java hosting

2006-04-06 Thread Preston L. Bannister
Ideas? Yes, and it's very simple - use fork()! Obviously this is not going to work on Windows, but for the case of Java hosting, we largely don't care. Let's put this in perspective. Quite a few hosting providors (mine included) run PHP in CGI mode. Any less expensive solution is competitive.

Re: never say never...

2006-02-22 Thread Preston L. Bannister
At the risk of getting meta on everyone, I have to point out that something(?) similar seemed to happen to the CVS development several years back. I tuned out for a few years, and it seems like the entire (active) development group turned over. Maybe there is some sort of Anti-Pattern lurking in

Re: never say never...

2006-02-20 Thread Preston L. Bannister
A disclaimer here - I used to have committer status (and might still). On 2/20/06, George Sexton <[EMAIL PROTECTED]> wrote: > > As far as how to structurally fix the tomcat group, my only feeble > suggestion would be to permit "TOMCAT USERS" to recall or fire committers. > Perhaps then some of the

Re: Who is working on the ISAPI connector code?

2005-12-14 Thread Preston L. Bannister
It is not as yet clear if "IIS 5 compatibility isolation mode" is needed or all that is needed. The user experience seems to be all over the map. We're working on it... Folks run IIS for a variety of reasons, many of which make sense. NTLM authentication is one - the mod_auth_sspi module used in

Re: Who is working on the ISAPI connector code?

2005-12-13 Thread Preston L. Bannister
So - in other words there are no toes to step on :). Unfortunately recommending Apache2 over IIS is pretty much a non-starter in my world, so a working IIS connector is needed (at least to bring server-side Java into this world). On 12/12/05, Tim Whittington <[EMAIL PROTECTED]> wrote: > > The I

Who is working on the ISAPI connector code?

2005-12-12 Thread Preston L. Bannister
After downloading the isapi_redirect.dll 1.2.15, found the VERSIONINFO contains 1.2.14 (and "1.2.14dev"), which is going to confuse the heck out of our support folks (when the code reaches the field). Downloaded and recompiled 1.2.15 after updating the version information, and in the process notic