Blackberry launched their App World in India a few a days ago, and so I went ahead and did a bit of look into.

First thing. Paid apps are not available. Only free apps. While this may be a good thing to draw more people in, there are a whole lot of users willing to spend money to buy some great paid apps. Allowing paid apps would have also given Indian Developers a platform to showcase their India Specific Blackberry apps.

Anyway, over to free apps.

I downloaded quite a few of them and here’s a list of the must haves.

1. BEIKS Keyboard Locker. This locks your BB screen automatically after a certain interval. So no more pocket calls to people whose names begin with A! BEIKS is actually not a separate application, but just adds an option to the default Keyboard locker. To configure BEIKS go to Options>Keyboard Locker from your home screen.
2. Uber Twitter. The best twitter client as of now. Get it.
3. Viigo. RSS News Reader. A RSS Reader for BB. It also integrates with Google Reader. So you can read all your Google Reader feeds from inside Viigo.
4. Dictionary. Built by dictionary.com this adds a dictionary to BB. However note that it will connect to the internet to fetch the meanings of words. But a handy application for all occasions.
5. Facebook. Built by RIM themselves this brings Facebook to BB. Quite a nice application. Much better than the application Nokia offers through it’s 5800 Express Music.
6. Snaptu. Snaptu is really a collection of Widgets. You have widgets for facebook, twitter, cricinfo, EPL Scores. Here’s a screenshot.
   
7. Quick Pull Free. This one reboots the device and frees memory. Using it once a day should be enough to keep your BB fit and fine.

All the above are in addition to the apps I have already mentioned in a previous blog post.

I have written a lot about the negative aspects of Facebook over the past few weeks. My chief concerns were that

1. Facebook in the last few years have allowed in a lot of spoky and shoddy advertisers. Some of these are openly and brazenly duping a lot of people.
2. Facebook is sharing too much data about our personal lives and the conversations that we have with our friends with it’s partners.
3. Facebook is closed. You can get your photos, videos and other stuff in, but will not be able to export them out of Facebook.

But while all of the above is true, I have decided to comeback. Why? I will give you 2 reasons.

1. The alternatives to Facebook are dying. Orkut takes forever to load my scrapbook. Hi5 is designed to look like horse shit.
2. My friends are leaving Orkut, Hi5, MySpace in droves. A lot of these are like people I have known since we were 5 years old.

So given Facebook still works reasonably well (it at least loads and works unlike Orkut) and that I am loosing touch my friends, makes me come back to Facebook.
Of course, there is twitter. But a lot of my friends still don’t tweet at least not actively. For me twitter and Facebook complement each other. They don’t compete.

But I have a mission to accomplish this time around. I will test and develop a set of conduct guidelines for me and my friends. Our aim is to avoid this. I will be publishing our Facebook conduct guidelines over the next few weeks that will try and solve or alleviate some of the privacy and data portability related problems that I have listed above.

In the past few weeks, I have been to a few new eateries in Kolkata. While some where good others were, well not so good. The trend that I am seeing is that there is a definite leaning towards Indian Food. Kebabs are in and Chieeenich Chicken is out. Bengali isn’t doing well either.

Ok so here’s the first one, and do remember that these are generally all buffet lunches that we tried out

1. Sigree, at Silver Spring. Only two items in Starters, one a Chicken Kebab and the other a Mutton Kebab (This one was delicious). Main course was ok. The choice of items isn’t as varied as Flame and Grill but not as limited as Barbequeue Nation either. Food tastes good, but nothing special. Desert was ok, but not great either.There are again just 2 items in the desert. One thing about Sigree at Silver Spring is that parking space here is quite adequate unlike the mess that is Barbequeue Nation at Sector V. Overall a nice experience for Rs 300 per head.
2. Five Rivers at Mani Square Mall. Heard a lot about this place and so had high expectations. Unfortunately I was left completely disappointed. We ordered Mutton Rogan Josh with some other Chicken curry. For a restaurant which says it serves authentic Punjabi and Kashmiri food the Rogan Josh was far from authentic. It was cooked in mustard oil and it definitely had onion or garlic in some form. Most Kashmiri food that I am aware of are cooked without garlic or onion, or am I wrong? The ambiance of the place is good, but the prices are too high for the quality they serve. A lunch for two will set you back by Rs 900-1200 at the very least. Take my advice, there’s a Flame and Grill just next door. Try that!
3. Barbequeue Nation, Saltlake, Sector -V. They have upped their prices quite a bit since they started , but at 325+taxes its still a decent bargain for the quality they serve. I have been there a number of times, over lunch and dinner both and their level of service has always been bad. Their staff just don’t seem to be interested in doing anything. Having said that, if you can be patient, the food they serve isn’t bad at all. In fact the kebabs are plentiful and tastes good as well. Main course is ok, but not great. Ask them to serve roti, at your table. Their biryani tastes awful. Desert is really good with about 5 items to choose from.

Of the 3 listed above, I would rank Sigree as the best. You can get in and get out easily. There’s ample parking space. Food isn’t fantastic but is definitely above average. The place isn’t over crowed, and therefore it’s pretty easy to find a quiet corner. Although we only tried the buffet, we were pleasantly surprised that they serve it on the table. So unlike Barbequeue Nation there’s no Ration Shop Line at the ice cream stand!

There are two choices

Jasypt

Here are the cardinals rules of storing user passwords, and these not only apply to Java but to all other programming language as well.How to encrypt user passwords.Read this before going any further

To summarize, you must use an secure hashing algorithm which which allows for a random salt as an input, and one which hashes the resultant output at least 1000 times.

The generic form of any secure hashing works like this.

Generating a Hash

salt = GET salt
hash_bytes = algo("data to hash",salt,number of rounds)
hash_string = base64 ecnode(hash_bytes)
store(hash_string)

You supply a salt using any random salt generator. The number of rounds must be more than 1000. This is to make brute force reversal computationly expensive. The algorithm therefore takes 3 parameters the data itself, the random salt, and number of rounds. The resulting hash is in bytes. The raw bytes however cannot be stored easily to databases. Therefore we convert it to a hexadecimal string which can be easily stored.

Checking passwords

submitted_password = GET passwords
hash_bytes = algo(submitted_password,salt,number of rounds)
hash_string = base64 ecnode(hash_bytes)
stored_hash = GET stored hash
IF hash_string = stored_hash
	password is valid

Checking a password involves generating the hash again from the submitted password and then comparing the hash to the stored hash. The basic premise is that the same password, with the same salt and using the same number of rounds always generates the same hash.

However Jasypt makes all this super easy. It hides all that complexity. Here’s how you use it.

import org.jasypt.util.password.*;

import java.util.*;

/**
 * @author $Author$
 * @version $Revision$
 *          Created on Oct 8, 2009-3:01:49 PM
 */
public class JasyptDemo
{
	private static final String username = "testuser";
	private static final String userpass = "testpass";
	private static LinkedHashMap<String, String> database = new LinkedHashMap<String, String>();

	public String encryptPassword()
	{
		StrongPasswordEncryptor passwordEncryptor = new StrongPasswordEncryptor();
		String encryptedPassword = passwordEncryptor.encryptPassword(userpass);
		storePasswordForUser(username, encryptedPassword);
		return encryptedPassword;
	}

	public boolean checkPassword(String username, String submittedPassword)
	{
		StrongPasswordEncryptor passwordEncryptor = new StrongPasswordEncryptor();
		String encryptedPassword = database.get(username);
		return passwordEncryptor.checkPassword(submittedPassword, encryptedPassword);
	}

	public void storePasswordForUser(String username, String hashedPassword)
	{
		// use jdbc to store the username and hashed password in the database.
		database.put(username, hashedPassword);
	}

	public String getPasswordForUser(String username)
	{
		// use jdbc to retrieve the password for this username,
		return database.get(username);
	}

	public static void main(String[] args)
	{
		JasyptDemo encrypter = new JasyptDemo();
		encrypter.encryptPassword();

		JasyptDemo checker = new JasyptDemo();
		System.out.println("Passwords Matched " + (checker.checkPassword(username, userpass)));
	}
}

What Jasypt does is that it stores the salt inside the hash itself. This means there is no need to store the salt seprately. You just store the hashed password and retrieve it each time for comparision when the user supplies their login credentials. It can’t get easier than this.

JBcrypt

If you thought Jasypt was simple there something even simpler than this. It’s called JBcrypt. JBcrypt is a Java implementation of OpenBSD’s Blowfish password hashing scheme. Here’s example of using JBcrypt.

// Hash a password for the first time
String hashed = BCrypt.hashpw(password, BCrypt.gensalt());

// gensalt's log_rounds parameter determines the complexity
// the work factor is 2**log_rounds, and the default is 10
String hashed = BCrypt.hashpw(password, BCrypt.gensalt(12));

// Check that an unencrypted password matches one that has
// previously been hashed
if (BCrypt.checkpw(candidate, hashed))
	System.out.println("It matches");
else i
	System.out.println("It does not match");

Comparision Between JBcrypt and Jasypt

Now comes the fun part. Which is more secure Jasypt or JBcrypt?

Well, out of the box and both are as secure and may be as fast. Bcrypt’s strengths and weaknesses are outlined in this paper “A Future-Adaptable Password Scheme” by Niels Provos and David Mazières. On the other hand StrongPasswordEncryptor uses SHA-256 as it’s hashing algorithm. No you do a search of SHA256 VS Bcrypt and decide which to use. I am not suggesting anything.

Jasypt is also configurable. The ConfigurablePasswordEncryptor allows to you change the hashing algorithm. For example let’s use SHA-512. But since the JDK does not supply a SHA-512 hashing algorithm, you can use the setProvider(“provider name”) method of the ConfigurablePasswordEncryptor to set the JCE provider as Bouncy Castle which does support SHA-512.

Here’s how you use ConfigurablePasswordEncryptor with BouncyCastleProvider and SHA-512 as the hashing algorithm.

import org.bouncycastle.jce.provider.*;
import org.jasypt.util.password.*;

import java.util.*;

/**
 * @author $Author$
 * @version $Revision$
 *          Created on Oct 8, 2009-3:01:49 PM
 */
public class JasyptDemo
{
	private static final String username = "testuser";
	private static final String userpass = "testpass";
	private static LinkedHashMap<String, String> database = new LinkedHashMap<String, String>();

	public String encryptPassword()
	{
		ConfigurablePasswordEncryptor passwordEncryptor = new ConfigurablePasswordEncryptor();
		passwordEncryptor.setProvider(new BouncyCastleProvider());
		passwordEncryptor.setAlgorithm("SHA-512");
		String encryptedPassword = passwordEncryptor.encryptPassword(userpass);
		storePasswordForUser(username, encryptedPassword);
		return encryptedPassword;
	}

	public boolean checkPassword(String username, String submittedPassword)
	{
		ConfigurablePasswordEncryptor passwordEncryptor = new ConfigurablePasswordEncryptor();
		passwordEncryptor.setProvider(new BouncyCastleProvider());
		passwordEncryptor.setAlgorithm("SHA-512");
		String encryptedPassword = database.get(username);
		return passwordEncryptor.checkPassword(submittedPassword, encryptedPassword);
	}

	public void storePasswordForUser(String username, String hashedPassword)
	{
		// use jdbc to store the username and hashed password in the database.
		database.put(username,hashedPassword);
	}

	public String getPasswordForUser(String username)
	{
		// use jdbc to retrieve the password for this username,
		return database.get(username);
	}

	public static void main(String[] args)
	{
		JasyptDemo encrypter = new JasyptDemo();
		encrypter.encryptPassword();

		JasyptDemo checker = new JasyptDemo();
		System.out.println("Passwords Matched " + (checker.checkPassword(username, userpass)));
	}
}

Which one of Jasypt or JBcrypt do I use? I use JBcrypt, because it is just one Java File. However Jasypt is more than just one algorithm. It’s a complete framework. Just make sure that you don’t use the BasicPasswordEncryptor as this uses MD5 as it’s hashing algorithm. Use the StrongPasswordEncryptor class or the ConfigurablePasswordEncryptor class instead with SHA-512 as the hashing algorithm. Do also remember that SHA and MD5 type algorithms are fixed cost algorithms while Bcrypt is not.

Summary

Use JBcrypt.It only does one thing but does it right. Use Jasypt when you want to have a more fine grained control of the entire process.

Traditional all purpose programming languages like Java, C# and PHP have long been the subject of flame wars in the web development community over these years. They have been backed by standard bodies, big corporations and in some cases millions of die hard fans.

The big corporations have inevitably build entire software development stacks around them. Most notably there is Microsoft with its Windows, Sql Server, VB and .Net portfolio or IBM with its Java, Webshpere,DB2 combination. Sun, Oracle and Redhat also offer competing stacks. PHP on the other hand is thought to be a part of LAMP “the build your own stack” which SMEs and startups find so attractive.

The stacks themselves are like mousetraps. Once you get in you will find it really difficult to get out. Of course if you chose standards such as J2EE, then shifting from say Oracle to IBM or to Redhat would still be possible.

The Old Web Development Stack

Fundamentally the main parts of a web development stack have been the following

1. An Operating System
2. A Relational Database
3. A set of Developer tools consisting of SDKs, APIs and an Integrated Development Environment like Eclipse or Visual Studio.
4. Documentation, Tutorials and Commercial and/or Community support.

Microsoft have got all of the above. Oracle (now with Sun)  and IBM apart from owning all of the above, can even provide you the required hardware if so you wish. Of course there are companies which are not full stack providers. Like Jetbrains or Adobe which produce kick-ass development tools but are not concerned about the rest.

All that however was the past. That was Web Development 1.0.

The New Web Development Stack

The emerging web development stack however is completely different. Sure it has everything that Web Development 1.0 had, but the way it is packaged and sold is entirely different.

Let me give you a concrete example. Google. Now Google also sells a web development stack but in a different way.
They want you to build Web Applications using their tools and would also like to host them for you. If you are poor they will even host it for free
Their stack consists of the following.

1. Google Web Toolkit or GWT. GWT allows you to build data entry oriented Web Applications at a fairly fast pace. Please remember data entry and workflow oriented software comprise of bulk of enterprise software in use today. Google of course wants us to stop building fat clients like Powerbuilder or VB Apps and replace them with Web Oriented ones.
2. Google App Engine. With it’s Java and Python runtime, what we have here is fast maturing Enterprise SDK. There is persistence through JPA or JDO, messaging with XMPP and caching through Memcache.
3. Google Android. While the success of Android still hinges on the quality of handsets and eventual carrier response, there’s no denying that Android is an exceptional piece of Engineering. With their Dalvik VM Google have managed to attract hordes of Java developers, while at the same time avoid some of the limitations of J2ME.
4. And to finally complete the Jigsaw, all development tools are built on Eclipse and are provided for free.

It’s not just Google, Salesforce, Amazon, IBM are all more or less doing same things. Curiously though Salesforce has gone and created their own programming language named Apex. Will Google respond?

So there you are. The new web development stack does not look fundamentally different from the older one, but here are the key differences.

1. Platform Independence: It’s no longer important where you write your code. You can write GWT code on the Mac using Eclipse and deploy it on the App Engine. For Web Development 2.0 the OS does not matter anymore. The sooner Microsoft and Apple realize this, the better it would be for them.
2. Database: In web development 1.0 the code we wrote to read write data was always limited by the features provided by the database and limitations imposed by SQL. With the new stack, one is no longer limited to the Relational Model. There’s Hadoop+HBase, Big Table, Amazon S3+SimpleDB, Cassandra and many more who offer different options. And yes, have you heard of the NoSQL movement?
3. Pay as you grow: Pioneered by Amazon, this model does not force you to pay upfront fees to web hosts. It does lower the entry barrier considerably. With Google one can host for free up to a limit.
4. Mobile Apps:Having a mobile presence with a customized application and user experience for Android,iPhone and the Blackberry is no longer a luxury. It’s a must.
5. Development Tools:A new development stack requires a new set of development tools. Aptana Javascript Studio is a step in the right direction. GWT plugins for Eclipse are also OK. But we need more of those. Plain Old Ides are passé.

I expect the landscape to evolve over the next few years. There are companies like Amazon who have built massive cloud infrastructures but don’t have mature development tools. Other like Google have good development tools but don’t have nearly the kind of market share like Amazon.

It is going to be an interesting journey.

Here’s what really happened with regards to Shashi Tharoor’s comment on travelling cattle class.

Tweet Post 1
Kanchan Gupta a Delhi based journalist asks this innocent looking question to Sashi Tharoor

Tweet Post 2
To this, Sashi Tharoor gave a typical Tongue-in-cheek answer, which I must say he does often. In fact it is this sense of humor that makes him one of the most followed Indians on Twitter.

Tweet Posts 3
After this answer Kanchan Gupta continues to ask questions to Sashi Tharror about the state of affairs in his ministry.

My interpretation of how the events unfolded is; that Kanchan was either intentionally or un intentionally trying to wind up the Minister regarding over spending and the lack of accountability in his Ministry, which of course could be true or entirely fabricated.
The Minister unfortunately fell for this bait, and hence the “Tweet Back”.

Our media, corrupt and ignorant as they are interpreted the entire chain of events differently. They virtually instigated the Congress party into this reaction.

http://timesofindia.indiatimes.com/news/india/Cong-slams-Tharoors-twits-on-cattle-class/articleshow/5020004.cms

What do you think? Is my interpretation wrong?

Now here’s what people have been waiting to hear for a long time.

Google Chrome may be ready for both Linux and Mac. How do I know? Well it’s a guess based on these facts.

1. Flash Integration.Having used Chromium with Flash enabled on both Linux and Mac, I can report to you that it is very stable. You can start stop videos, play Flash based arcade games and so on. There were those pesky scroll problems on pages which had flash movies embedded in them, but those are now gone. Pages scroll like a hot knife through butter now. I haven’t had any crashes due to Flash in quite some time now.
2. Chrome’s Privacy policy changes as reported by Read Write Web.
3. There hasn’t been a update for Chromium for Ubuntu for about 6 days now. Why is that important? Well prior to this, there was a new version of Chromium for Ubuntu available everyday. This has now stopped.
4. The “Options” dialog has no more ToDos left To Be Done.

Having said all of the above, there is still no Java Integration. Would they be releasing this without Java support? I don’t think so.

Let me tell you what I am trying to do. I am trying to build a simple version of Google Analytics that will tell me the following

Must Have

1. The browser and the version of the browser an user is using.
2. The Operating System and if possible the version of the OS they are using.
3. The screen resolution.
4. The plugins their browser supports. (Whether it is Java and Flash enabled or not)
5. The IP (user or proxy) from which the request was made.

Nice to Have

1. The time at which a page was requested.
2. The total time spent by the user on a particular page.
3. Total number of clicks on each out going link.

I have spent almost my entire day today addressing the first 2 points in the “Must Have” category.

The browser property “user-agent” is a can of worms. The specs say this http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.43. The operative word here is that the tokens should appear in their order of importance. Then why does Chrome report it’s “user-agent” string as

Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.203.0 Safari/532.0.

Can’t it just begin with Chrome/4.0.203.0 and put whatever is left in the sentence later on.

A good read on the subject is
http://www.jibbering.com/faq/faq_notes/not_browser_detect.html

So since there is no perfect solution to the subject, I have settled on this compromise.http://www.quirksmode.org/js/detect.html to address point number 1&2.

As for point number 3 this piece of code is good enough.

document.write('<p class="accent">'+screen.width+','+screen.height+'</p>');

Point number 4 can be addressed by using this piece of code.

document.write(navigator.javaEnabled());

I know this is not perfect. A better method would have been to try and run the smallest possible applet on the client’s computer. For reference see http://javatester.org

Now for the remaining which is point number 5 on the list, the remote IP Address can be determined on the server side quite easily in any programming language whether it be Java,.Net or PHP.
The rest will be tackled tomorrow. Stay Tuned.

I bought my first Blackberry a 8520 Curve about 7 days ago and since then I have downloaded over 20 apps.  Some have become my favorite and pretty much indispensable.

Have a look at http://beta.thehindu.com/. The Hindu, one of India’s oldest and most respected newspapers have redesigned their home page and it looks fantastic. Having said that, here are a few things which I would like

1. Typefaces. Serif fonts like “Times” look good when applied at larger sizes. They are appropriate for Headline text. But I would prefer sans-serif for body text. Normal body text is usually smaller in size and serif fonts don’t generally render well at small sizes. For reference have a look at http://www.guardian.co.uk/ and http://www.nytimes.com/. Which site is more readable? The Guardian uses sans-serif for body text while The New York Times uses serif. I would prefer sans-serif anyday.
2. Sections. They have sections like Business, Sports, Arts, Health, Life & Style. Why not color code each section. For example all headlines under Business could be blue in color, while all headlines under Health could be in green and so on. Color coding is a proven way to help people find things faster. Again The Guardian is a good example of this. Their page on environment is in green while their page on money is in purple.

I really don’t want to antagonize The Hindu readers, but http://timesofindia.indiatimes.com/ already has implemented both my suggestions. Of course, The Hindu’s homepage is aesthetically 100 times better. TOI has tried to cram in too much information on their homepage, thereby raising the cognition challenge, whereas The Hindu’s homepage has a nice balance between information and cognition of all that is displayed.

Once again congrats to The Hindu.