You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by Brad Cox <bc...@virtualschool.edu> on 2001/04/05 00:55:46 UTC
Re: "Just say no to JSP" Re: [Fwd: Tomcat may reveal script
source code by URL trickery]
At 11:24 AM -0700 04/04/2001, Jon Stevens wrote:
>I love the article title:
>"Just say no to JSP"
Glad that change made it in. DDJ wanted "Just say no to HTML". Arggh.
>I'm so happy to see that more and more people are waking up to the fact that
>JSP is bad. I'm also happy to see you worry about form validation issues.
>That is a problem that we are currently solving in Turbine right now. It is
>called "Intake". :-)
I'll try to make some time to check that out.
>It is sad to me that you:
>
>#0. Apache/JServe. Can't spell the product name correctly even though it has
>been around for 4+ years. :-)
Sigh. Yet another typo. I really thought we'd caught them all.
>#1. Confused "Turbine" with "add programming language features to HTML".
>
>#2. Confused "WebMacro" and thus Velocity with "add programming language
>features to HTML".
>
>If you spend time with the products, you would see that isn't the case and
>you might actually retract your statements.
You've touched a nerve here. This is the amount of time that gets
consumed installing web based infrastructures.
Maybe Turbine is an exception and I certainly hope so. I'll pick on
Tomcat here because the wounds are still fresh from spending a whole
week on what should be a trivial task; porting a running webapp from
a deployment server running Linux 6.2 to the server from hell; a
hacked "virtual" implementation of FreeBSD at HostPro.com.
I should point out at the outset that this isn't to assign blame but
to point out a problem... namely, the complexity that developers must
deal with to get a working infrastructure in place. My application
uses Apache, JServ, Java, and the servlet engine from Tomcat. Period.
No taglibs, no JSP, no XML, nothing. Yet it took a whole week to get
even this on the air, even though I've been through the tomcat
configuration process dozens of time by now and had working config
files to start with.
Much of the problem was expecting the user (me) to translate
exception backtraces into what should be done to correct the error.
The first problem I hit was a NullPointerException while reading
request parameters. Why? I've no idea. An unfamilar JRE was
preinstalled so guessing, I installed plain ol' JDK1.1.7 and that
seemed to fix it.
Next problem was various JServ failures, none clearly explained by
the errors, and none explaining what what was wrong and how to
correct it in the config files. Then most of the week worrying about
why Tomcat wasn't recognizing my servlet context.
I've a bunch of ideas for partial solutions but I'll hold off on
those to see whether there's any agreement that there's a problem
here.
>I have more comments, but no time right now and this probably isn't the
>right forum anyway...
I'd be grateful to hear them when you get a moment.
--
---
Brad Cox, Ph.D.; bcox@superdistributed.com
Phone: 703 361 4751 Cell: 703 919-9623
http://superdistributed.com: A new paradigm for a new millinneum
RE: "Just say no to JSP" Re: [Fwd: Tomcat may reveal scriptsource code by URL trickery]
Posted by Paulo Gaspar <pa...@krankikom.de>.
I sure had my "little" flames with Jon, but that is a very important
thing I learned from him.
I agree that the problem is there - not enough error info - and I had my
share of such problems, but this is open source, so, you can fix it.
OTOH, some developers can still learn a bit from this kind of feedback
and pay a bit more of attention to providing good debug info.
Have fun,
Paulo Gaspar
> -----Original Message-----
> From: Alex Fernandez [mailto:afm229@tid.es]
> Sent: Thursday, April 05, 2001 10:03
>
>
> Hi Brad!
>
> ...
>
> I'm about to answer in Jon's favorite manner (hope you don't mind, Jon):
> Ok, it seems to be a problem. Why don't you fix it?
>
> ...
>
> Un saludo,
>
> Alex.
>
Re: "Just say no to JSP" Re: [Fwd: Tomcat may reveal scriptsource code
by URL trickery]
Posted by Alex Fernández <af...@tid.es>.
Hi Brad!
Brad Cox wrote:
> I should point out at the outset that this isn't to assign blame but
> to point out a problem... namely, the complexity that developers must
> deal with to get a working infrastructure in place. My application
> uses Apache, JServ, Java, and the servlet engine from Tomcat. Period.
> No taglibs, no JSP, no XML, nothing. Yet it took a whole week to get
> even this on the air, even though I've been through the tomcat
> configuration process dozens of time by now and had working config
> files to start with.
I'm about to answer in Jon's favorite manner (hope you don't mind, Jon):
Ok, it seems to be a problem. Why don't you fix it?
> Next problem was various JServ failures, none clearly explained by
> the errors, and none explaining what what was wrong and how to
> correct it in the config files. Then most of the week worrying about
> why Tomcat wasn't recognizing my servlet context.
Would adding a 'try{} catch() {}' help solve your problem?
> I've a bunch of ideas for partial solutions but I'll hold off on
> those to see whether there's any agreement that there's a problem
> here.
Then, turn those ideas into patches and send them along. No need for
agreement, just an itch to scratch.
I don't want to play the wise guy here, it's just that (at last) the
meaning of voluntary work has entered my stubborn head. As in those old
jokes about screwing a bulb: when there's 100 users complaining about a
problem, there's 10 people talking about how to correct it, and one that
actually does something. The volunteer is the 1 in 111 that screws the
bulb.
For me, Tomcat has worked perfectly (esp. v3.3), and so I cannot justify
my working on it. But, as a consequence, I don't either complain about
the product -- in fact, it's got my highest praises.
Un saludo,
Alex.
Re: "Just say no to JSP" Re: [Fwd: Tomcat may reveal script
source code by URL trickery]
Posted by Jon Stevens <jo...@latchkey.com>.
on 4/4/01 3:55 PM, "Brad Cox" <bc...@virtualschool.edu> wrote:
> Glad that change made it in. DDJ wanted "Just say no to HTML". Arggh.
Yucky.
>> I'm so happy to see that more and more people are waking up to the fact that
>> JSP is bad. I'm also happy to see you worry about form validation issues.
>> That is a problem that we are currently solving in Turbine right now. It is
>> called "Intake". :-)
>
> I'll try to make some time to check that out.
I find it funny that you decided to group Turbine and Velocity and Webmacro
into this big statement about (Yet another language) yet you didn't even
really check it out first. That is bad journalism IMHO.
> Sigh. Yet another typo. I really thought we'd caught them all.
Those are just the spelling mistakes...there are plenty of other typo's in
that article.
>> #1. Confused "Turbine" with "add programming language features to HTML".
>>
>> #2. Confused "WebMacro" and thus Velocity with "add programming language
>> features to HTML".
>>
>> If you spend time with the products, you would see that isn't the case and
>> you might actually retract your statements.
>
> You've touched a nerve here. This is the amount of time that gets
> consumed installing web based infrastructures.
What does that have to do with any of the above? In fact, if you really take
the time looking at Velocity, you will see that we have included complete
documentation (written by a professional tech writer), numerous working
examples, demo Velocity applications bundled with both versions of Tomcat
all ready to go, etc.
Yes, Turbine needs more work on the examples and documentation front, but it
isn't a released product yet (we plan on a JavaOne release) and will
definitely have much improved documentation and examples before we release.
We are also putting a huge amount of effort into creating a Turbine EE
system that is a bundle of everything you need to get started. It is called
the Turbine Developers Kit (TDK).
[rant removed]
> I'd be grateful to hear them when you get a moment.
I'd be grateful if you would take the time to investigate our solutions (ie:
Velocity and Turbine) before you bash them or decide that they are not
worthy.
:-)
Maybe your next article can be about how much you like Velocity and/or
Turbine.
:-)
-jon
Re: "Just say no to JSP" Re: [Fwd: Tomcat may reveal script
source code by URL trickery]
Posted by Jon Stevens <jo...@latchkey.com>.
on 4/5/01 5:01 AM, "Mark T. Harris" <mt...@yahoo.com> wrote:
> And of course, to debug JSP code, you really have to go after the generated
> servlet.
Well, read the whole essay...but here are a few good chapters relevant to
the above:
<http://jakarta.apache.org/velocity/ymtd/ymtd-generation.html>
and
<http://jakarta.apache.org/velocity/ymtd/ymtd-error-handling.html>
and
<http://jakarta.apache.org/velocity/ymtd/ymtd-sampleapp.html>
thanks,
-jon
--
If you come from a Perl or PHP background, JSP is a way to take
your pain to new levels. --Anonymous
<http://jakarta.apache.org/velocity/ymtd/ymtd.html>
Re: "Just say no to JSP" Re: [Fwd: Tomcat may reveal script source code by URL trickery]
Posted by "Mark T. Harris" <mt...@yahoo.com>.
> I do have all the latest jar files from SUNW, and jakarta-apache. So I
> don't know what the problems could be. My only complaints would be not
> enough debug tools around to be able to single step through new code
> when you are having problems, but I consider that minor at this point,
> given where the tomcat development cycle is.
I've investigated a LOT of reported Tomcat "bugs" where I work that turned
out to be garden-variety bugs in the application (apps not dealing correctly
with bad data, apps exiting the JVM because something unexpected happened,
etc.).
The only issue we've found that didn't appear to be an application bug was
one where CPU usage trended to 100% over the span of an hour or so. This
was on Tomcat 3.2.1/Solaris ?/JDK 1.2.?. The problem vanished when we
switched the environment to JDK 1.3. Given that, we never did take the time
to figure out the exact problem.
Anyhow, the jdb debugger that is included with jdk 1.3 works pretty well for
debugging servlet/JSP code when nothing else is available. The command
interface takes a few minutes to understand, but it does get the job done.
And of course, to debug JSP code, you really have to go after the generated
servlet.
It's not pretty, but it does work.
During development, a lot of people around here use JBuilder to
develop/debug JSP and servlet code. It works well for us.
Re: 'Just say no to JSP' Re: [Fwd: Tomcat may reveal script
source code by URL trickery]
Posted by Jon Stevens <jo...@latchkey.com>.
on 4/5/01 5:35 AM, "Matthew Dornquast" <ma...@webhelp.com>
wrote:
> I could be wrong given I don't know the full context, but the code from the
> article on this page:
> http://jakarta.apache.org/velocity/ymtd/ymtd-generation.html isn't thead
> safe, multiple requests coming in on different threads at the same time
> would cause init() to be called multiple times.
>
> -Matthew
Yup. I think it has already been fixed in Tomcat (along with some other
problems...ie: the double locked checking as well), but that is the example
that is published in Jason's Servlet book that is coming out soon so I
wanted to use that because his book will be going out to hundreds of
thousands of people...
I'm more concerned with illustrating my point in the essay than pointing out
bad generation of code because that is something that can be fairly easily
fixed.
-jon
Re: 'Just say no to JSP' Re: [Fwd: Tomcat may reveal script source code by URL trickery]
Posted by Matthew Dornquast <ma...@webhelp.com>.
I could be wrong given I don't know the full context, but the code from the
article on this page:
http://jakarta.apache.org/velocity/ymtd/ymtd-generation.html isn't thead
safe, multiple requests coming in on different threads at the same time
would cause init() to be called multiple times.
-Matthew
Re: 'Just say no to JSP' Re: [Fwd: Tomcat may reveal script source code by URL trickery]
Posted by Mel Martinez <me...@yahoo.com>.
--- Nick Bauman <ni...@cortexity.com> wrote:
> Read Jon's article about the problems of JSP.
>
> http://jakarta.apache.org/velocity/ymtd/ymtd.html
>
> I read it and it made me rethink a lot of
> assumptions I had made about JSP.
>
Without getting into the larger debate - actually
agree with many of the article's issues - the
following paragraph, though, bothers me:
-------
There are some fundamental issues that are being dealt
with in the generated .jsp template. The first one is
the class name. What happens is that the engine needs
to produce a name that is unique in order to work
around class loader issues that might crop up.
Therefore, each and every time one modifies a .jsp
page, a new file is created on disk in the temporary
directory. Unfortunately, this directory ends up
growing in size until someone decides to clean it up.
The engine could probably do this for you, except then
it might make the mistake of actually removing the
wrong file.
[from
http://jakarta.apache.org/velocity/ymtd/ymtd-generation.html
]
--------
The above paragraph describes a 'fundamental issue'
that has absolutely nothing to do with the Java Server
Pages specification and, rather, entirely to do with a
particular implementation of the specification. As
such, it has no legitimate argumentative value here
and seems quite gratuitous. The statement 'The engine
could probably do this for you, except then it might
make the mistake of actually REMOVING THE WRONG FILE.'
(emphasis mine) is a blatant appeal to fear. I highly
doubt this was intentional on Jon's part, but that is
what it is.
Jon - you do not need to do this to support your
arguments. Please retract this paragraph from the
essay when convenient.
Also, in your discussion on error handling, the fact
that JSP's only catch Exceptions will be changed in
JSP 1.2 spec to include all Throwables. And further,
it could be argued that many of your complaints about
poor compilation error messages are again, an artifact
of implementation (maturity), rather than
specification. However, I (were I to argue such)
would have to concede that in that case the
specification is possibly incomplete (failure to
address standardizing the compile/debug part of the
cycle).
All-in-all, though, I won't argue with the basic
point: Java Server Pages do NOT provide a tool-level
separation between View and Control. And I wish
others would stop pretending that it did.
With my team, I try to stress that JSPs can (and
actually should) be used to implement both View and
Control aspects of MVC and to address this we have
adopted (hopefully) strong standards for how we do JSP
development. There is more to it, but basically we
conceptually separate JSPs into four basic roles:
presentation control, presentation content, request
filtering and pure business. We then enforce naming
conventions and required strategies to development of
JSPs in these roles. I don't claim this is ideal, but
it seems to work very well.
I am interested in template solutions like Velocity,
though and intend to look at it closely.
Cheers,
Dr. Mel Martinez
melaguias@yahoo.com
__________________________________________________
Do You Yahoo!?
Get email at your own domain with Yahoo! Mail.
http://personal.mail.yahoo.com/
RE: 'Just say no to JSP' Re: [Fwd: Tomcat may reveal script source code by URL trickery]
Posted by Carlos Gaston Alvarez <ga...@tournet.com.ar>.
> With my team, I try to stress that JSPs can (and
> actually should) be used to implement both View and
> Control aspects of MVC and to address this we have
> adopted (hopefully) strong standards for how we do JSP
> development. There is more to it, but basically we
> conceptually separate JSPs into four basic roles:
> presentation control, presentation content, request
> filtering and pure business. We then enforce naming
> conventions and required strategies to development of
> JSPs in these roles. I don't claim this is ideal, but
> it seems to work very well.
>
I use jsp only to show data (when possible). I do the control at a servlet.
Chau,
Gaston
Re: 'Just say no to JSP' Re: [Fwd: Tomcat may reveal script source code by URL trickery]
Posted by Mel Martinez <me...@yahoo.com>.
--- Jon Stevens <jo...@latchkey.com> wrote:
> Mel,
>
> Please do not CC me directly as I'm already on the
> list.
Sorry - artifact of how I started the reply (from
browsing the essay). Oops.
> I have filed your
> changes away for when I do my next revision of the
> site (there are several
> other people's comments that I want to integrate as
> well). I hear you and
> you made good suggestions.
>
> Also, I do have to say that those two nits are
> fairly minor given that the
> scope of the entire article is quite large. In other
> words, there is plenty
> of other valid reasons there to not use JSP and that
> those two nits are
> really minor in the grand scope of things. :-)
>
Oh yes, I hope I made it clear that I don't think my
two little nits in any way invalidate the larger
points. I am simply offering them as constructive
ways to improve the argument.
Cheers,
Dr. Mel Martinez
melaquias@yahoo.com
__________________________________________________
Do You Yahoo!?
Get email at your own domain with Yahoo! Mail.
http://personal.mail.yahoo.com/
Re: 'Just say no to JSP' Re: [Fwd: Tomcat may reveal script
source code by URL trickery]
Posted by Jon Stevens <jo...@latchkey.com>.
Mel,
Please do not CC me directly as I'm already on the list. I have filed your
changes away for when I do my next revision of the site (there are several
other people's comments that I want to integrate as well). I hear you and
you made good suggestions.
Also, I do have to say that those two nits are fairly minor given that the
scope of the entire article is quite large. In other words, there is plenty
of other valid reasons there to not use JSP and that those two nits are
really minor in the grand scope of things. :-)
thanks,
-jon
Re: 'Just say no to JSP'
Posted by Paul Speed <Pa...@metrixpoint.com>.
Paulo Gaspar wrote:
>
> Earl,
>
> If you think one should not discuss the merits of JSP here, you should
> not take part on it even if to defend JSP.
>
> If you agree we should talk about the pros and cons of JSPs, it is hard
> to talk about the cons of JSP in a constructive way without pointing
> alternatives. Can one just say it is bad without pointing alternatives
> and still give worthy input?
>
> Or do you just want to talk about the pros?
> =;o)
>
> Clearly, there are some problems with JSPs. Supporting a clear
> separation between logic (scripting) and presentation (templating) is
> not easy to enforce with JSPs. And this is a discussion going on in
> many forums.
>
> Now, JSPs are nice for scripting stuff (when you want to code and see
> the result with no compiling/restarts). I even thought of using JSPs
> for the scripting with Velocity for templating!!! And this is not such
> new idea since there are people using JSPs with XSLT for the same
> purposes.
>
> But XSLT just makes things too hard. Too much cost for not enough
> profit. I just converted a XSLT based application to Velocity and I
> sure know what I am talking about.
>
> Maybe JSPs just need something extra for the templating side. Maybe
> JSPs can learn that from Velocity/WebMacro template engines.
>
> And this list is one of the best spots to talk about this. The right
> people read this. * Isn't Tomcat the reference JSP implementation? *
Is is. But the tomcat team doesn't set the spec, it just
implements it.
-Paul
>
> Have fun,
> Paulo Gaspar
>
> > -----Original Message-----
> > From: Earl.Stutes@EAS.San-Jose.CA.US
> > [mailto:Earl.Stutes@EAS.San-Jose.CA.US]
> > Sent: Friday, April 06, 2001 18:48
> >
> > Why has the tomcat-dev list become a Velocity advocacy list??
> > Isn't the purpose of this list supposed to be for communation between
> > Tomcat developers? Is velocity recruiting or something?
> >
> > =eas=
RE: 'Just say no to JSP'
Posted by Paulo Gaspar <pa...@krankikom.de>.
Earl,
If you think one should not discuss the merits of JSP here, you should
not take part on it even if to defend JSP.
If you agree we should talk about the pros and cons of JSPs, it is hard
to talk about the cons of JSP in a constructive way without pointing
alternatives. Can one just say it is bad without pointing alternatives
and still give worthy input?
Or do you just want to talk about the pros?
=;o)
Clearly, there are some problems with JSPs. Supporting a clear
separation between logic (scripting) and presentation (templating) is
not easy to enforce with JSPs. And this is a discussion going on in
many forums.
Now, JSPs are nice for scripting stuff (when you want to code and see
the result with no compiling/restarts). I even thought of using JSPs
for the scripting with Velocity for templating!!! And this is not such
new idea since there are people using JSPs with XSLT for the same
purposes.
But XSLT just makes things too hard. Too much cost for not enough
profit. I just converted a XSLT based application to Velocity and I
sure know what I am talking about.
Maybe JSPs just need something extra for the templating side. Maybe
JSPs can learn that from Velocity/WebMacro template engines.
And this list is one of the best spots to talk about this. The right
people read this. * Isn't Tomcat the reference JSP implementation? *
Have fun,
Paulo Gaspar
> -----Original Message-----
> From: Earl.Stutes@EAS.San-Jose.CA.US
> [mailto:Earl.Stutes@EAS.San-Jose.CA.US]
> Sent: Friday, April 06, 2001 18:48
>
> Why has the tomcat-dev list become a Velocity advocacy list??
> Isn't the purpose of this list supposed to be for communation between
> Tomcat developers? Is velocity recruiting or something?
>
> =eas=
Re: 'Just say no to JSP'
Posted by "Craig R. McClanahan" <cr...@apache.org>.
On Fri, 6 Apr 2001, Jon Stevens wrote:
> on 4/6/01 9:48 AM, "Earl.Stutes@EAS.San-Jose.CA.US"
> <Ea...@EAS.San-Jose.CA.US> wrote:
>
> > Why has the tomcat-dev list become a Velocity advocacy list??
> > Isn't the purpose of this list supposed to be for communation between
> > Tomcat developers? Is velocity recruiting or something?
> >
> > =eas=
>
> Yes!
>
> :-)
>
Velocity advocacy is a fine thing for those interested in it.
Unfortunately, it's off topic for TOMCAT-DEV. Can we please stop drowning
out the legitimate discussions this list is for?
> -jon
>
>
Craig
Re: 'Just say no to JSP'
Posted by Jon Stevens <jo...@latchkey.com>.
on 4/6/01 9:48 AM, "Earl.Stutes@EAS.San-Jose.CA.US"
<Ea...@EAS.San-Jose.CA.US> wrote:
> Why has the tomcat-dev list become a Velocity advocacy list??
> Isn't the purpose of this list supposed to be for communation between
> Tomcat developers? Is velocity recruiting or something?
>
> =eas=
Yes!
:-)
-jon
Re: 'Just say no to JSP'
Posted by Ea...@EAS.San-Jose.CA.US.
Why has the tomcat-dev list become a Velocity advocacy list??
Isn't the purpose of this list supposed to be for communation between
Tomcat developers? Is velocity recruiting or something?
=eas=
On 6 Apr, Paulo Gaspar wrote:
>> -----Original Message-----
>> From: cmanolache@yahoo.com [mailto:cmanolache@yahoo.com]
>> Sent: Thursday, April 05, 2001 20:57
>
>
>> Arguing what is the best programming language or if interpreted is
>> better than compiled is mostly a waste of time. Some people will
>> prefer to learn VTL, other will prefer to use Java, other will like
>> the XML-like syntax.
>
> Sure. And compiled is still an open option for Velocity.
>
>
>> I think code generation is a good thing, ...
>
> Sure, some template use problems could be easier to debug if there is
> some intermediate source code and a good debugger.
>
>> ... and I prefer using Jsp with Java
>> for quick prototypes and taglibs when possible.
>
>
RE: 'Just say no to JSP' Re: [Fwd: Tomcat may reveal script source code by URL trickery]
Posted by Paulo Gaspar <pa...@krankikom.de>.
> -----Original Message-----
> From: cmanolache@yahoo.com [mailto:cmanolache@yahoo.com]
> Sent: Thursday, April 05, 2001 20:57
>
> ...
>
> Nothing wrong - yet another fine language, and a very nice
> implementation.
> And nothing good either - or I coulnd't find anything revolutionary
> compared with other programming languages or other fine template-like
> systems.
Not revolucionary at all. The Velocity team publicly recognizes the
inspiration from WebMacro.
But the implementation makes a difference. I find Velocity much easier to
control and mold into my own needs. (Clearer source code sure helps there.)
And I am not saying it is perfect.
> Arguing what is the best programming language or if interpreted is better
> than compiled is mostly a waste of time. Some people will prefer to learn
> VTL, other will prefer to use Java, other will like the XML-like syntax.
Sure. And compiled is still an open option for Velocity.
> I think code generation is a good thing, ...
Sure, some template use problems could be easier to debug if there is some
intermediate source code and a good debugger.
> ... and I prefer using Jsp with Java
> for quick prototypes and taglibs when possible.
In my case, using JSP + taglibs in JServ (I still do not have a Tomcat
production server here) is more trouble than using Velocity.
On the other hand, I have a lot of exports to HTML - generation of static
HTML from data in a database - and Velocity gives me a big help on that,
while JSPs....
And then, I would like to be able export most of my site's dynamically
generated pages to static HTML. Many pages don't change often and it is
more efficient to develop dynamically and export to static HTML for
production.
> Costin
Have fun,
Paulo
Re: 'Just say no to JSP' Re: [Fwd: Tomcat may reveal script source
code by URL trickery]
Posted by cm...@yahoo.com.
On Thu, 5 Apr 2001, Jon Stevens wrote:
> on 4/5/01 10:13 AM, "cmanolache@yahoo.com" <cm...@yahoo.com> wrote:
>
> > So we need to fix it :-) After all that's one of the diferences between
> > the zillion templating systems and jsp - a spec with a wide variety of
> > implementations that improve.
> >
> > I do agree with some of Jon's arguments - the spec is not perfect ( but I
> > don't think HTTP spec is perfect either, or HTML or XSLT or even the
> > servlet spec - and for many of those I could list more serious reasons
> > for not using them and choosing a random alternative :-).
> >
> > Costin
>
> I would like to hear what is wrong with Velocity's spec:
>
> <http://jakarta.apache.org/velocity/vtl-reference-guide.html>
> <http://jakarta.apache.org/velocity/user-guide.html>
> <http://jakarta.apache.org/velocity/developer-guide.html>
Nothing wrong - yet another fine language, and a very nice implementation.
And nothing good either - or I coulnd't find anything revolutionary
compared with other programming languages or other fine template-like
systems.
Arguing what is the best programming language or if interpreted is better
than compiled is mostly a waste of time. Some people will prefer to learn
VTL, other will prefer to use Java, other will like the XML-like syntax.
I think code generation is a good thing, and I prefer using Jsp with Java
for quick prototypes and taglibs when possible.
Costin
Re: 'Just say no to JSP' Re: [Fwd: Tomcat may reveal script
source code by URL trickery]
Posted by Jon Stevens <jo...@latchkey.com>.
on 4/5/01 10:13 AM, "cmanolache@yahoo.com" <cm...@yahoo.com> wrote:
> So we need to fix it :-) After all that's one of the diferences between
> the zillion templating systems and jsp - a spec with a wide variety of
> implementations that improve.
>
> I do agree with some of Jon's arguments - the spec is not perfect ( but I
> don't think HTTP spec is perfect either, or HTML or XSLT or even the
> servlet spec - and for many of those I could list more serious reasons
> for not using them and choosing a random alternative :-).
>
> Costin
I would like to hear what is wrong with Velocity's spec:
<http://jakarta.apache.org/velocity/vtl-reference-guide.html>
and
<http://jakarta.apache.org/velocity/user-guide.html>
<http://jakarta.apache.org/velocity/developer-guide.html>
:-)
-jon
Re: 'Just say no to JSP' Re: [Fwd: Tomcat may reveal script source
code by URL trickery]
Posted by cm...@yahoo.com.
On Thu, 5 Apr 2001, Mel Martinez wrote:
> The above paragraph describes a 'fundamental issue'
> that has absolutely nothing to do with the Java Server
> Pages specification and, rather, entirely to do with a
> particular implementation of the specification. As
And most of the other arguments are in the same category -
bad implementation of the spec.
So we need to fix it :-) After all that's one of the diferences between
the zillion templating systems and jsp - a spec with a wide variety of
implementations that improve.
I do agree with some of Jon's arguments - the spec is not perfect ( but I
don't think HTTP spec is perfect either, or HTML or XSLT or even the
servlet spec - and for many of those I could list more serious reasons
for not using them and choosing a random alternative :-).
Costin
Re: 'Just say no to JSP' Re: [Fwd: Tomcat may reveal script source code by URL trickery]
Posted by Mel Martinez <me...@yahoo.com>.
--- Nick Bauman <ni...@cortexity.com> wrote:
> Read Jon's article about the problems of JSP.
>
> http://jakarta.apache.org/velocity/ymtd/ymtd.html
>
> I read it and it made me rethink a lot of
> assumptions I had made about JSP.
>
Without getting into the larger debate - actually
agree with many of the article's issues - the
following paragraph, though, bothers me:
-------
There are some fundamental issues that are being dealt
with in the generated .jsp template. The first one is
the class name. What happens is that the engine needs
to produce a name that is unique in order to work
around class loader issues that might crop up.
Therefore, each and every time one modifies a .jsp
page, a new file is created on disk in the temporary
directory. Unfortunately, this directory ends up
growing in size until someone decides to clean it up.
The engine could probably do this for you, except then
it might make the mistake of actually removing the
wrong file.
[from
http://jakarta.apache.org/velocity/ymtd/ymtd-generation.html
]
--------
The above paragraph describes a 'fundamental issue'
that has absolutely nothing to do with the Java Server
Pages specification and, rather, entirely to do with a
particular implementation of the specification. As
such, it has no legitimate argumentative value here
and seems quite gratuitous. The statement 'The engine
could probably do this for you, except then it might
make the mistake of actually REMOVING THE WRONG FILE.'
(emphasis mine) is a blatant appeal to fear. I highly
doubt this was intentional on Jon's part, but that is
what it is.
Jon - you do not need to do this to support your
arguments. Please retract this paragraph from the
essay when convenient.
Also, in your discussion on error handling, the fact
that JSP's only catch Exceptions will be changed in
JSP 1.2 spec to include all Throwables. And further,
it could be argued that many of your complaints about
poor compilation error messages are again, an artifact
of implementation (maturity), rather than
specification. However, I (were I to argue such)
would have to concede that in that case the
specification is possibly incomplete (failure to
address standardizing the compile/debug part of the
cycle).
All-in-all, though, I won't argue with the basic
point: Java Server Pages do NOT provide a tool-level
separation between View and Control. And I wish
others would stop pretending that it did.
With my team, I try to stress that JSPs can (and
actually should) be used to implement both View and
Control aspects of MVC and to address this we have
adopted (hopefully) strong standards for how we do JSP
development. There is more to it, but basically we
conceptually separate JSPs into four basic roles:
presentation control, presentation content, request
filtering and pure business. We then enforce naming
conventions and required strategies to development of
JSPs in these roles. I don't claim this is ideal, but
it seems to work very well.
I am interested in template solutions like Velocity,
though and intend to look at it closely.
Cheers,
Dr. Mel Martinez
melaguias@yahoo.com
__________________________________________________
Do You Yahoo!?
Get email at your own domain with Yahoo! Mail.
http://personal.mail.yahoo.com/
Re: 'Just say no to JSP' Re: [Fwd: Tomcat may reveal script source code by URL trickery]
Posted by Nick Bauman <ni...@cortexity.com>.
Read Jon's article about the problems of JSP.
http://jakarta.apache.org/velocity/ymtd/ymtd.html
I read it and it made me rethink a lot of assumptions I had made about JSP.
> An alternative view!
>
> On 4 Apr, Brad Cox wrote:
>> At 11:24 AM -0700 04/04/2001, Jon Stevens wrote:
>>>I love the article title:
>>>"Just say no to JSP"
> I am really sorry to see folks coming on this list, and also publishing
> to the general web articles deriding JSP and tomcat in particular. I
> have apache-1.3.19 with tomcat-3.2.2b running behind it just fine using
> mod_jk. The application running is an apache soap server This is on a
> redhat 6.2 box. I also have tomcat-4.0 running on port 7070 at the same
> time where I am doing development on a secure email application. I have
> moved my email app back and forth between TC3.2 and TC4.0 with no
> problems. I just drop the war file in the webapps directory and tomcat
> does the rest.
>
> I do have all the latest jar files from SUNW, and jakarta-apache. So I
> don't know what the problems could be. My only complaints would be not
> enough debug tools around to be able to single step through new code
> when you are having problems, but I consider that minor at this point,
> given where the tomcat development cycle is.
>
> I think the tomcat developers for all their good work.
>
> =eas=
> --
> .
> |
> |
> |
> | -
> |
> | * +-------------------------------+
> | | I'd Rather Be Sailing A Laser |
> | -- +-------------------------------+
> | 83345
> |
> | ---
> |
> | Laser.Sailor@EAS.San-Jose.CA.US
> |-----O-------
> | /w---------|
> .------------------------.|=|
> I| |
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
--
Nick Bauman
Software Developer
3023 Lynn #22
Minneapolis, MN
55416
Mobile Phone: (612) 810-7406
RE: "Just say no to JSP" Re: [Fwd: Tomcat may reveal script source code by URL trickery]
Posted by Paulo Gaspar <pa...@krankikom.de>.
> -----Original Message-----
> From: Earl.Stutes@EAS.San-Jose.CA.US
> [mailto:Earl.Stutes@EAS.San-Jose.CA.US]
> Sent: Thursday, April 05, 2001 02:00
>
> ...
>
> My only complaints would be not
> enough debug tools around to be able to single step through new code
> when you are having problems,
>
> ...
JBuilder 4 works just fine for me.
And it works on Windows, Linux, Solaris and other Java platforms.
Have fun,
Paulo Gaspar
Re: "Just say no to JSP" Re: [Fwd: Tomcat may reveal script source code by URL trickery]
Posted by Ea...@EAS.San-Jose.CA.US.
An alternative view!
On 4 Apr, Brad Cox wrote:
> At 11:24 AM -0700 04/04/2001, Jon Stevens wrote:
>>I love the article title:
>>"Just say no to JSP"
I am really sorry to see folks coming on this list, and also publishing
to the general web articles deriding JSP and tomcat in particular. I
have apache-1.3.19 with tomcat-3.2.2b running behind it just fine using
mod_jk. The application running is an apache soap server This is on a
redhat 6.2 box. I also have tomcat-4.0 running on port 7070 at the same
time where I am doing development on a secure email application. I have
moved my email app back and forth between TC3.2 and TC4.0 with no
problems. I just drop the war file in the webapps directory and tomcat
does the rest.
I do have all the latest jar files from SUNW, and jakarta-apache. So I
don't know what the problems could be. My only complaints would be not
enough debug tools around to be able to single step through new code
when you are having problems, but I consider that minor at this point,
given where the tomcat development cycle is.
I think the tomcat developers for all their good work.
=eas=
--
.
|\
| \
| \
| -\
| \
| * \ +-------------------------------+
| \ | I'd Rather Be Sailing A Laser |
| --\ +-------------------------------+
| 83345 \
| \
| ---\
| \
| \ Laser.Sailor@EAS.San-Jose.CA.US
|-----O-------\
| /w\---------|
.------------------------.|=|
\ I| |
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~