Browser Helper Objects: An introduction

Browser Helper Objects commonly called as BHO are, as name suggests, objects or components that helps you to utilize the browsers capabilities. It’s basically a dll (Dynamic Linked Library) that gets registered into your system, of course with your permission.

It’s basically a add-in to your browser. The most common browser helper object is the Google toolbar in Internet Explorer. You can search your queries directly from the toolbar. BHOs are used extensively by the marketing folks to pull in the advertisers. What they actually do is create BHOs that can track the traffic in one site. This piece of information is very useful for the advertisers looking for the users to a particular website.  They can track the information such as the kind of users, what they are interested in and so on.

There are lots of such BHOs today, collecting, tracking one information or the other.  Despite of being so helpful, a few can be malicious as well. Some BHOs gets installed in your system and then can take advantage of your browsing data. For example some BHOs are mainly interested in bank sites, where in the BHOs trap the user’s credentials and send it across to its owner/s.  I think you would know the rest of the story!

The BHO api (application programming interface) exposes loop holes and hooks that allows these malicious BHOs to access the page’s DOM (Document Object Model) which facilitates the BHO to control the page navigation

.

Microsoft provides apis for creating your own BHO.

In order to make sure your system does not fall prey to these malicious BHOs, you need to make sure you permit only trusted installations on your system.

Remember SECURITY is incomplete without “U”….

Power of Groovy and FreeMarker

Here I will tell you folks how Groovy and FreeMarker can be used to reduce the software turn around to a great extent. While working on enterprise applications, for coming up with your business logic you'd most probably work on technologies like Java, C++ or even Python. After building the logic, for the view part you would probably work on some GUI based languages for rendering the view. So, if you're responsible for developing both the Business layer and the View, you'd need to first build the business layer and then the view. It's not a parallel process. Yet another case would be you would only design the business layer and the UI programmers would design the view. In this case, the UI Programmers are still dependent on you. So, only after the Business layer development is complete will the UI programmers start building the view. Again, this is not a parallel development. 

Now pitches in Groovy and FreeMarker. Groovy is best suited for Java programmers as it drills down to a .class on compilation. It's got the power of both scripting and server side programming. FreeMarker is a template engine which renders wonderful view. So, here's the thing - The Server side programmers would develop their business logic at the same time while the UI Programmers develop their view. This enables parallel development. It reduces the total time for software produce to almost 50% less than what it used to be in earlier scenarios. 

Try out Groovy and FreeMarker and let me know if you like it and concur to the above.

Managed Debugging

Debugging is a process of analysing the dumps of the application. Dumps can be of different types-crash, hang, etc.  This debugging plays a major role in support of any product that any company ships. This also helps in determining the further improvements in the code base for future releases.

Debugging can be of two types-unmanaged and managed. Unmanaged is the one which involves the application written in unmanaged language for example C++ or VC++. Managed code on the hand involves the applications written in managed code-all supporting the .Net framework(C#, VB, etc.)

Unlike unmanaged debugging which involves analysing the dump files written in unmanaged code(C, C++), managed debugging is relatively easy. Most of the work will be done for you by the CLR (Common Language Runtime). Even the crashes, hangs are very limited in case of the managed application. Thanks to the CLR and the efficient Garbage collector provided by the .Net framework.

WinDbg is the tool that I generally use for debugging the crash, hang dumps. For managed debugging you will have to load the symbols first. You can do this using the following command.

.sympath SRV*D:\symbols*http://msdl.microsoft.com/download/symbols

This will load the Microsoft symbols.

Next process is to load the extension that provides the commands for managed debugging. This extension is called SOS. To load the extension use the following command

.loadby sos mscorwks

This will load the SOS extension. From now on you can use the command provided by the SOS for analysing the dump files.

You can find the commands here. 

Save your code from Java Decompilation

I took a break from the core, bottom-most almost hardware types kind of code - You know what I mean, to a little bit of securing my Java code. I used to work on a framework which was written in Java - A good one - robust, fast, highly scalable and even light. The problem with that framework was that it could easily be hacked - I mean decompiled. So, what I've seen many doing is, they rip code from such amazing frameworks and ship it as their own. I know it's not ethical but that's what happens many of times. So, how do you save yourself from such cheap yet occurring incidents of Java Code Decompilation? 


Of course from a bird's eye view, there needs to be some sort of locking implemented on your code or even encryption may be. To go about protecting your Java source code, we need obfuscators which helps us solve our problem. Obfuscators are good but really suck sometimes from the point of view of optimization. It's terrible that you write super optimized code and then pass it through some sorta machine and then it's all gone. It becomes junk again. So, while saving your code from decompilation, please do ensure that you're using the write obfuscator which still keeps your code optimized.


One another solution to protect your source code is to use Encrypted Jar Files. Well, I would not use this as a first option because of the process involved in encryption and decryption which is expensive. But well, this is a solution to save your code too!




Third option would be to compile your code directly to Platform specific Assembly. This destroys the entire motive of Java - Platform Independent. 


My Advice - Use a good obfuscator. Choose it wisely.




Here is Zelix Obfuscator which is good. Try it. Do some trials on various obfuscators and choose one which matches your code environment.

Improve Coding standards using Coding Kata

Improve Coding standards using Coding Kata

Kata means “form” in Japanese. Coding Kata is an approach where in you improve your coding standards, style, etc. by continuously working on a given problem. I know it is difficult to find time in your daily work routine, but trust me this will improve your coding to a great extent. (Try to find at least 1 hour per week for this, which would suffice).

Kata is generally used in Karate.  Karate has set of Kata. Kata are basically set of kicks and punches that you perform in a pattern. Idea behind this is to develop the pattern so thoroughly that, in emergencies you use technique to save yourself effectively. 

Similar to the karate, we use Kata in day to day programming. What you actually do is, follow certain standards, styles on a day to day basis so that you become thorough with this. Practice makes perfect. More you practice more thorough you become with this. When you face a real life problem, code automatically flows through you. And mind you, the code will be of good quality.

In order to learn or use TDD, we make use of Kata. The principle behind this is, you need to code the Test before coding the actual production code. Firstly, you will write failing test (what scenarios my code might fail) and then write the passing test (all success scenarios).

You start developing the test project. Gradually adding code to the production project that makes this test pass.  Eventually you will end up in the production code which is perfect (well almost!).  For example start with simple problems, for instance, Stack. Every week you try to improve the Stack. You should delete the previous week’s code and start afresh. 

Using TDD in your day to day work improves efficiency and makes the code more maintainable.

Data Structures with Java

Data Structures with Java

Today, I tried exploring the world of data structures using Java; it's time complexity, JVM's behavior when it comes to core dumps (as against c++). I found a very interesting part. I found that though there is no complexity of use of pointers in Java, it is very advantageous to use pointers while implementing non-linear data structures like Trees and Graphs. 

So, here's the question - How do I use simple, powerful language like Java but yet get the advantages of C++'s time optimization capabilities? One approach towards this is to use the Java's Native API. Though this still has overheads of two stack calls (One to load the library and the other to call the native function), I feel this approach is far better than actually implementing the data structure algorithm in Java.