Apparently it was Apache Web Server’s 15th birthday yesterday – congratulations to anyone who’s ever been involved in the project. I doubt any would have thought that 15 years on, Apache would have become the dominant Web Server on the Web and the foundation of one of the most successful and recognized Open Source forges. For a history of the Apache Web Server and the Apache Software Foundation, head over to the ASF Blog.

Red Hat has been a supporter of Apache Web Server for a long time and has shipped and supported a version in its Red Hat Enterprise Linux for as long as I’ve been noodling with it. Last year we started shipping a standalone, multi-platform distribution as well – JBoss Enterprise Web Server. Earlier today we released the latest version of it and expanded our support for Apache HTTP Server to 14 different Operating System / architecture combinations. The exact component versions are listed here and there’s more information in the Release Notes. If you’re deploying Apache HTTP or Tomcat at scale – Red Hat also supports management of Apache HTTP Server and Tomcat alongside all JBoss products via JBoss Operations Network.

The JBoss AS team moved to a more rapid and incremental release cycle with the 6.x family and the second milestone was released today (release notes, download, repo.). The release was lead by Brian Stansberry and new features include :

• Servlet 3.0 / JBoss Web 3.0
• JPA 2.0 / Hibernate 3.5
• JAX-RS 1.0 / RESTEasy 2.0
• Microcontainer 2.2

More detail in blogs from Ales, Brian, Steve and Rémy. Congratulations to Brian on another on-time release and good luck to Jason and team for the next milestone release in a couple of months time.

Zallinger’s “March of Progress” from wikipedia.

I’ve been part of the Java ecosystem for long enough to see and be part of every Java EE / J2EE release to date. I still have a Forte SynerJ box-set somewhere – we claimed it as the first fully integrated J2EE 1.2 App Server and IDE – that was around 1999 and I was part of Sun for every subsequent release up to Java EE 5.

With the final votes in for Java EE 6 and with the year and decade coming to an end – it seems a fitting time to look back and see how far the Java EE platform has evolved :

• J2EE 1.2 (1999) – announced just short of 10 years ago was the first attempt to create an umberalla specification to cover some existing web-tier, messaging and data access technologies (JDBC, Servlets, JTA, etc.) as well as the new middle tier technology – EJBs.
• J2EE 1.3 (2001) – was from my recollection the first broadly adopted and deployed version, it added Connectors (a standard way to connect to back-end ‘legacy’ systems), some rudimentary support for XML Web Services and a pluggable security layer. EJBs got a major overhaul.
• J2EE 1.4 (2003) – added JMX, a gaggle of specs. to support Web Services (JAXR, JAX-RPC). I think around this time – everyone had written their first App. using EJB’s and had learned that combined with CMP (Container Managed Persistence) they weren’t exactly getting the productivity boost they were hoping for. I think J2EE 1.4 was the “Vista” of Enterprise Java – over-engineered and ultimately underwhelming.
• Java EE 5 (2006) – A name change and some new hope – mandatory XML deployment descriptors gave way to annotations, persistence took a lesson from the de-facto ORM solution – Hibernate. There was an alternative to, ahem, RPC-style Web Services with the inclusion of JAX-WS.
• Java EE 6 (2009) – It’s been a while in the making and had a bad start but after ten years I think we now really see the start of a cohesive platform with a common programming model via CDI (JSR-299) and many of the criticisms leveled at the platform have been answered.

Java EE 6 also defines the new Web Profile – this is essentially a slimmed-down EE focussed on web applications. I think it’s much more than that – I think it’s an opportunity to really redefine the Enterprise Java platform and shed some of the legacy APIs. While the backward compatibility that EE dictates has been good – it’s also contributed to some bloat in the platform.

It’s interesting to see how the size of the Java EE spec. has changed over the years (assuming size of the spec. is a reasonable indicator of complexity)

• J2EE 1.2 weighed in at just 140 pages;
• J2EE 1.3 added about another 25% (174 pages);
• J2EE 1.4 increased it by almost 40% (246 pages)
• Java EE 5 actually bought the page count down by 10%;
• and the last draft of the Java EE 6 spec. I read only added about 6% (236 pages) – despite some pretty major enhancements.

Despite several rounds of consolidation and various acquisitions – vendor support has remained impressive. There were 18 J2EE 1.2 certified servers, and even seven years later there were still 13 (for Java EE 5). I’d be surprised if there weren’t at least 10 vendors supporting Java EE 6 at some point – even after Oracle has assimilated BEA and Sun.

Despite its huge adoption, Java EE and the process by which it is defined (the JCP) has drawn a lot of criticism. Releases have often fallen short of expectations, been perceived as overly complex or taken too long to deliver; but despite the criticisms nobody can deny that Java EE has been a huge success. Java EE is not just a specification – its grown into an entire category of the software industry. I can think of no other technology that has bought so many competing vendors together to define such a broad and widely use platform.

I’m sure the JCP isn’t perfect and I’m sure vendor politics gets in the way of progress from time to time and Sun’s stewardship of Java hasn’t been flawless but step back and try to imagine what our industry would be like without an open and collaborative Java ecosystem. It will be interesting to see whether Oracle take a different approach (as they’ve suggested in the past) when they become the new stewards of Java. Let’s hope hey continue to encourage collaboration and diversity.

The various expert groups that define the Java platform is not, as many suggest, completely controlled by big vendors. My own company Red Hat is not an industry behemoth, there are divisions and offices within companies like IBM and Oracle that are bigger than Red Hat and JBoss, the middleware business unit of Red Hat is only a part of the entire company. Despite that – Red Hat has demonstrated yet again it’s willingness to punch way above it’s weight and has had an influence on Java EE disproportionate to it’s size. Congratulations to Gavin King, Pete Muir, Sacha Labourey. Emmanuel Bernard, etc for tirelessly pushing for simplicity in the EE platform.

JBoss AS 6 Milestone 1 is out and includes some of the key Java EE 6 features. Releases seem to be coming pretty frequently so you’ll see more EE 6 feature appearing over time.

• Open Source is mainstream and it’s being used extensively to support customer facing, business and mission critical functions.
• Reduced TCO and no up-front license cost are still the major drivers for open source adoption but they’re closely followed by - vendor independence (and specifically MS independence), Quality, Innovation and Convenience / Flexibility. Or as Forrester [1] put it “OSS isn’t just cheap – it’s good and cheap”.
• The main inhibitors to adoption – ‘security’ and ‘lack of support’ and risk of patent / copyright infringement seem to be much less of a concern than a year ago. The suggestion seems to be that these risks are offset by working with commercial open source vendors or experienced System Integrators.
• The rate of Open Source adoption differs between categories of software – Application Development, Server OSes, Databases and Middleware have high adoption whereas Reporting / BI, SOA, Desktop and Security – adoption is much lower but adoption is moving rapidly up the stack.
• North America and Canada are  still behind Europe (excluding the UK) in adopting OSS; adoption is higher in larger organizations; and different industries are adopting OSS at different rates for different areas in the stack.
• Technology isn’t the only thing being adopted – principles and governance of open source is also being adopted in IT and development organizations. This is something I’ve already witnessed a few times.

OK, a little bit more detail from each of the reports.

The first report was prepared for Bull by Forrester [1], and specifically focusses on European and North American companies who have already adopted OSS. I especially like the following, so forgive the repetition :

OSS isn’t just cheap — it’s good and cheap. Only a minority of respondents said that OSS hasn’t met their quality expectations. A vast majority (i.e., 92%) said that their quality expectations have been met or even exceeded. The satisfaction regarding cost was on a similar level at 87%.”

The second report is Actuate’s annual Open Source survey [2]

I’ve only read the North American report and a I presume there’s more detail specific to France, UK and Germany. The report drills down into established open source technologies – Linux, Eclipse, Tomcat and JBoss and it’s nice to see JBoss included along with other Open Source mega-brands like Apache, Linux, MySQL and Eclipse . JBoss adoption in North America is 14.7% and Germany 22.1%  but in France it’s much lower at only 5.7% – while other technologies remain pretty constant. Any thoughts as to why JBoss adoption is so much lower in France or whether this is a bug in the survey  ?

The third and fourth tomes are from IDC [3,4] The first part outlines the key drivers and inhibitors to the adoption of Open Source.  The second part has some very nice detail on how open source technology is ‘acquired’ and how it’s supported and serviced. It demonstrates how a tiny little company called  Red Hat has managed to compete with and in many cases lead some much more established (ie. older) and significantly larger companies in the distribution and support of Open Source technology. That said – you can’t help but accept that without huge companies like IBM, Oracle and HP – distributing and supporing Open Source technology – it wouldn’t be as successful or as established as it is today.

As I keep saying – money makes the world go round and that’s true for the world of Open Source too.

[1] Open Source Paves The Way For The Next Generation Of Enterprise IT, Forrester Consulting, November 2008

[2] ACTUATE / Survey Interactive :Annual Open Source Survey, North America Edition, 2008

[3] IDC 2008 Industry Adoption of Open Source Software, Part 1 : Usage Drivers and Inhibitors

[4] IDC 2008 Industry Adoption of Open Source Software, Part 2 : Project Adoption

And that, so I’ve been told, was a guiding principal behind the re-architecture of JBoss AS 5.0.0 which was released last week. We don’t know what kinds of applications and services people will be deploying in five years time; we don’t know what frameworks, languages or programming models they’ll be using but we do know that they’ll need to access some ‘core services’ such as data-access, transactions, caching, clustering, messaging, deployment, management, monitoring, etc. And we know we need a modular and flexible core to bind those services together in ways that make sense for the languages and programming paradigms and deployment topologies of the future.

We also know that a single monolithic developer platform for all applications and all customer workloads is not going to be sufficient. At the same time inflicting multiple platforms on the operations organizations who are responsible for the 90% of the application lifecycle that isn’t development is also unreasonable. The operations people see the platform very differently from developers – they don’t want to a new operational footprint everytime a new framework or language comes along – they want stability and consistency.

If this all sounds like vacuous marketing drivel – let’s take a real-life lucid example. Bob McWhirter has been integrating Rails and JBoss using the power of the AS 5 architecture. He’s written some custom deployers, created some shims and a little glue code to integrate existing services and the results are pretty interesting. A powerful Rails environment – without too many compromises for the Ruby developer yet at the same time something that the operations people will be happy with too – ie. a standard JBoss run-time that behaves just like the other JBoss deployments whether they’re Java EE / Seam based or Spring or POJOs. And check out the “web” configuration – another example of what’s not only possible but actually pretty straightforward to acheive with the Microcontainer and modularized services in AS 5.

I think the next couple of years will demonstrate that AS 5.0 has been a wise investment as other vendors will struggle to retool and stretch their run-times to meet customer demands for increased choice and flexibility.

Seam 2.1 was released a couple of weeks ago and in fact there’s already an update (Seam 2.1.0 SP1). Major updates in Seam 2.1 are :

identity management framework with ACL style permissions, an Excel reporting module, an embellished and more flexible seam-gen, first class support for Wicket, built-in support for URL rewriting and a technology preview of JAX-RS (REST) support through the RESTeasy project.

The really big news last week was that JBoss ON (Operation Network) has finally been open sourced as the Jopr project (I’m trying to like the name – honest). JBoss ON is a sophisticated management platform for the JBoss Middleware stack and it’s based on Project RHQ (A collaboration between Red Hat and Hyperic).

There’s a subproject of Jopr called Embedded Jopr which is the basis of the new console for JBoss App Server – this is a significant improvement over the current Web Console and JMX Console and should be a welcome addition to users who are familiar with IBM WAS and Oracle WLS. This first version only suport JBoss AS 4.2 (ie. EAP 4.3) but work is underway to support AS 5.0.

I’d recommend downloading and having a quick play – it takes just a few minutes to get up and running (even for me).  If you don’t have the time there are some screenshots and a short (15 min) video here. There’s also more detail on Ian Springers blog.

Originally uploaded by sharps

With a bit of trimming, a swap-file and a new build – I now have Fedora 10 running pretty reliably on the OLPC. I wouldn’t call it snappy exactly but it’s a start.

Fedora is running off a writeable live image (using a 4Gb SD Card) which also hosts the swap-file. The poor little XO only has 256Mb RAM and is very low powered so having Firefox eat up 40Mb is a problem – might have to find a replacement

I just signed up for the performance testing team as part of the Fedora on OLPC test effort. Now things are up and running reliably it will be interesting to see what tweaks can be made to improve the performance.

As such there were only a couple of items in my del.icio.us queue this week – here they are.

First up – SpringSource have announced their new support model for Spring Framework (also see thread on TSS). Spring Source has a God-given right to make money from the Spring Framework – they’ve invested in it and now they’re looking for their return. I also respect their transparency in communicating their intention. What I’m not sure about is their approach. Converting ‘users’ to ‘customers’ has to be about pull, not push; about carrot not stick. I think Spring Source might force some users to become customers but they’ll likely piss-off their overall installed-base in the process; and their installed-based is their future pipeline.

There’s a chunk of text in VMWare’s latest 10-Q filing dedicated to their, er, position on Open Source. Of course the statement ‘Our use of “open source” software could negatively affect our ability to sell our products and subject us to possible litigation.’ wouldn’t be necessary or true if they’d understood both their obligations to and the overwhelming benefits of Open Source in the first place.

Manik has a good introductory article at DZone on the challenges of achieving performance and scale. I’ve worked on a number of big (multi-year) projects where we didn’t effectively account for Moore’s law and worked hard to solve tough scale, throughput and performance problems that didn’t exist by the time we deployed and commissioned the system.

Government and commercial organisations… should use open source applications with great caution”

absolutely true – but also true for software developed under any model with any license.

Open source projects should adopt robust security practices from their commercial counterparts.”

for some reason Fortify believes that commercial software is the benchmark for software security – though doesn’t provide any evidence of that, nor does it provide any detail what those practices are. Many commercial software companies are proprietary and closed and lack transparency – so we really don’t know if they’re better or worse. I’d also suggest that commercial / proprietary software companies can learn a lot from open source – and indeed many have.

But here’s the real issue and the irony – Fortify could not write this report for closed, proprietary products – they would not be able to include proprietary products in this report. it’s just not possible. That should be a real concern.

IMO – the recent report from Coverity offers a much more balanced view of security defects in open source

On the whole – the report was pretty positive on JBoss. Firstly, Red Hat sponsored projects did pretty well in their static analysis. As you can see from the chart – the vulnerability density for JBoss AS and Hibernate were the lowest of the projects analysed.

Secondly – our sponsored projects benefit from Red Hat’s security response team and their best practices, in addition JBoss has it’s own security expert – Anil Saldhana.

Since the report was published we’ve also taken action to ensure Red Hat’s secalert mail alias is more prominent in more places.

Finally – I should add – we take security pretty seriously and invest pretty heavily – we have to do this because our customers demand it. One example is that JBoss EAP 4.3 is currently undergoing Common Criteria Evaluation at EAL 2+ – that a pretty serious and long term commitment.

Update – I noticed that Fortify has a blog “… a place for place for discussion and feedback, both positive and negative” unfortunately they’ve blocked comments – so maybe not.