Simon Horwith's Blog - ColdFusion

php.org is written in ColdFusion

Mon, 21 Jun 2010 15:38:00 -0400

I just thought it was too surprising and funny not to post - http://php.org/ appears to be written completely in ColdFusion.

Doh!

A Few Thoughts About Various Programming Languages

Tue, 11 May 2010 17:40:00 -0400

In my role leading development shops, I am constantly having to learn and evaluate new programming languages and tools in order to keep us current as well as in order to discover better ways to accomplish goals. As a developer, I am also constantly learning simply because I want to get better at what I do, I love what I do, and learning new languages is a fun and rewarding undertaking. From time to time, someone writes a blog entry or gives a conference presentation about the importance of knowing more than one language... of not being a 'one trick pony'. I was reading Sean Corfield's recent blog post about Clojure and realized that I've never written about my recommendations or opinions of various languages that I've used or evaluated... until now. In no particular order, here are several of the technologies that I know and my thoughts about them:

Python
- I've recently been spending a decent amount of time learning and using Python - it's very fast and powerful, and is syntactically one of the most concise and elegant languages I've ever seen... it's VERY readable and the more I use it, the more I like it. Python is definitely one of my favorite languages.
Java
- I've used Java off and on since 1995, and somehow keep ending-up having to use it on projects from time to time. The language has gotten larger, faster, and for the most part, better over the past decade and a half - I found the language improvements in Java 5 particularly useful in that they clearly tried to make it easier to do what you want in your code. That said, I don't find Java programming particularly clever or challenging and on many projects I see, deployment is a terribly painful process. Java applications tend to have ridiculous file/directory structures and I'm not a huge fan of how strict it is. Java is everywhere and does have a huge job market, so it's worth knowing for those reasons... but it would never be my first choice of languages to use based on any merits other than the large talent pool and number of open source projects.
PowerShell
- Powershell is probably the coolest new thing I've seen in a long time. For those of you unfamiliar with it - it's a fully OO scripting environment for Windows (runs on .NET) and is free from Microsoft. The syntax is slick and simple, and the power you can pack into a single line of code makes it a no-brainer for anyone who needs or wants to administer a Windows network or machine. With powershell, windows finally has a shell that's better and more powerful than those available on nix systems. Bottom line: if you use Windows you REALLY should learn Powershell.
PHP
- PHP is yet another free technology - we use PHP and CF for most of our projects, and I like PHP a lot. A long time ago, some people called PHP "poor man's ColdFusion"... well, I think it's more true today than it was back then. It's simple, lightweight, and fast... and development times really aren't much longer than with CFML provided you're not trying to do something that CF does out of the box that there's no PHP module to do. I don't see it having many advantages over CF aside from price, the huge talent pool, and the number of open source projects. There's a good job market for PHP but those jobs don't typically pay as well, so I'd learn it because of it's popularity but I wouldn't choose a career focused exclusively on it.
Flex/ActionScript
- I've used Flex since beta 1, and I enjoy seeing how it evolves with each new release. I don't particularly like programming with ActionScript for the same reasons I don't like Java - but unlike Java, I do love the end result you get with Flex... enough to want to do it. No technology to date that's tried to compete with Flash has been compelling enough to use in lieu. There's also a great job market for Flex - especially here in New York City, and it's one of the top 3 or 4 technologies I'd recommend learning to anyone who wants a successful web development career right now.
ColdFusion
- I've used CF since the beginning and continue to use it heavily. It's not the best performing technology available but it performs well enough for most needs. No, it's not free, but development/debugging time is rapid enough to easily justify the cost. These days, CF's closed architecture and code base is a real turn-off for me personally, but it's the lack of talent (and the poor quality of most "talent") that is it's only solid turn-off from a business perspective. The native support for Flex is probably its most compelling unique feature... that, and it's rapid development nature. It's a good choice when you want a very robust user-friendly platform in a turn-key solution.
LISP
- LISP is, hands down, personally my favorite language. Five or six years ago I set-out to spend 6 months of my free time teaching myself LISP, and I enjoyed it so much that I just never stopped. The syntax took a little getting used to, and emacs takes even longer to get used to - which is probably the most annoying part of learning LISP (I haven't found a better free IDE for LISP yet). LISP is beautiful in the simplicity of its design - most notably in the interchangeable nature of code and data. It is definitely the most expressive and flexible language I've used - as well as the most powerful. Be warned; it takes a while to un-train yourself and learn how to really harness the power of LISP (particularly of macros and, if you're new to it, thinking in functional terms). I also, surprisingly, find the implementation of OOP in LISP (CLOS) much nicer and cleaner than that of any other language. I strongly recommend learning LISP. Not because there's a huge job market for it (there isn't) but because it puts other languages into perspective and because it WILL make you a better developer (I've learned more from 'tinkering' with LISP than any other language).

So, those are the main languages I've played with and developed feelings for recently (within the past 2 years). It's worth noting that there are other languages I left off for brevity. I've also been getting back into JavaScript these days - I have a new appreciation for it's functional nature and closures, and I think JQuery is pretty slick. I've taken a pretty good look at Objective C - it's a decent language but not worth learning unless you want to do a lot of Apple development. I've also played around with Clojure - which is essentially a pseudo-LISP implementation for the JVM - I liked it, but prefer to use 'pure' LISP... though it's attractive being able to write LISPy code that I can run on a JVM, since Java is everywhere. There are a few other languages I haven't had time to take a good enough look at yet but hope to very soon. Specifically, I'm interested in looking at Scala and Caml... and I've begun learning some Haskell and hope to dig into that a little deeper.

Standardizing ColdFusion

Thu, 25 Feb 2010 11:20:00 -0400

I recently wrote (http://www.horwith.com/index.cfm/2010/1/6/can-coldfusion-handle-enterprise-applications about the lack of predictable behavior in CFML - something that I think is a terrible shame and is personally my biggest complaint about the product. I was a little worried that this sentiment isn't being expressed too often or with much vocal strength by many other developers, but was happy to read Alan Williamson's recent post on the topic at http://alan.blog-city.com/cfml_conventional_wisdom.htm. Alan went a step further and created a Google Group for the topic as well.
When defining a language there are two traits to be concerned with: syntax and semantics. I'd like to see an Extended Backus Naur Form (EBNF) definition for the language syntax. This would give developers a reliable syntax specification for the language, engine implementers a specification to code off of and the ability to claim compatibility with an official language version, and IDE developers an easy industry approved method for syntax recognition. Semantics, i.e. the meaning behind the syntax, is more difficult to define and there are several languages for doing so (all essentially based on mathematical notation and logic). I don't know whether we need a formal semantics definition or if a more 'plain English' language specification or hyperspec would suffice. My guess is that a plain English language specification would serve the purpose (similar to the ANSI Specification for Common LISP or SQL).
The issue in any event, is that Adobe owns the most original and most popular ColdFusion Server on the market, so without their support I have to question the usefulness of any specification - syntactic or semantic. Remember how difficult it was to code cross-browser sites in the 90's because Microsoft and others refused to strictly enforce support for the official HTML specification? You ended up having to do all sorts of crazy hacks from browser to browser. Well, that's essentially what's happening, and will continue to happen, to server side CFML unless all the server vendors agree to support some common language definition.
It's time for Adobe to decide whether or not they want ColdFusion to be a platform that rivals the other server-side web technologies not only in capabilities but in popularity, or if they want to continue developing it as a proprietary product with a niche following. They do a fine job innovating the product and integrating it well with Adobe (and other) technologies, but in today's IT world I don't think that's enough. If the community of developers and customers is to significantly grow and thrive, the evolution of the platform must be driven by an open group. This model worked for Java and for PHP... and I believe it is the key to ColdFusion's ensured success for many years to come. I'm not suggesting Adobe gives the server away, nor that they couldn't add proprietary extensions in order to give themselves competitive edge (as I'm sure other vendors also would), only that the product should be one of a group of products from various vendors who are all adhering to one specification and who support a unified customer base. I know that, especially for Adobe, it's just not that easy... but it's also not impossible. I'd love to see someone from Adobe chime in on this topic.

State of CF in India

Sun, 14 Feb 2010 08:33:00 -0400

A little over a year ago I blogged about the complete unavailability of ColdFusion books in bookstores in India (http://www.horwith.com/index.cfm/2009/1/16/namaste-coldfusion). I am writing again from my annual pilgrimage to 'Mama Hindustan' and thought I'd follow-up and see how the market has changed. I believe that the availablity of books about a particular programming language is a reasonably good reflection of the popularity and job market in a region, though I don't know of any real data that backs-up that claim.

One year later, the number of book stores in Delhi is about the same, but there are a greater number of much larger book stores (similar to Borders and Barnes and Noble in the U.S.) and the size of the 'computer' section in these book stores is much larger than last year. A few of them are comparable in size to the computer section in a large bookstore in the U.S. That said, I could not find a single copy of any book about ColdFusion. I found this a little surprising for three reasons:

I'm under the impression that there's a decent job market for CF developers in India.
These computer sections didn't only carry books about very common technologies - I found books about pretty much every language, theory, and computer-related topic I could think of - including very obscure and outdated technologies.
One large bookstore even had an entire 'Adobe' subcategory (made up of 6 large shelves of books) in their computer section

Whether or not CF has a job market here, it is clearly much less popular than in the other countries I've visited. If I had to generalize about what technologies are the most popular (and most available) in book stores, it would be (in order):

Java
.NET
PHP
Flash/ActionScript

I'm sure most people, like myself, don't find this very surprising. Also worth noting is that the most significant difference between the computer book inventory this year vs. last year - hands-down there is a significant increase in and dominance of PHP books. One other thing I noticed, which did surprise me a little, was that there are far more Oracle books than SQL Server books on the shelves... I'm not sure why, but I expected the opposite.

Can ColdFusion Handle Enterprise Applications?

Wed, 06 Jan 2010 15:04:00 -0400

There are a few common reasons given whenever a company says they don't want to use ColdFusion or a developer says "Oh, ColdFusion isn't a REAL programming language". One of these claims is that ColdFusion can't handle large scale enterprise applications. The majority of ColdFusion developers, especially the fanboys, immediately take offense and dive into a passionate discourse on the merits of ColdFusion, blah, blah, blah. I've done my fare share of CF-Evangelism over the years, and I do still believe that the merits of the platform make it a great solution a lot of the time... but I'm much more technology-agnostic these days than I was in my youth, and as I fall in love with other languages because of their merits, I find myself reflecting and sometimes re-evaluating my feelings about ColdFusion. In this entry I'd like to share my thoughts about CF: the good and bad, some advice for developers and companies, and some stories about recent real-world experiences I've had.

The Good
There are some things that make ColdFusion a terrific platform. Deployment is a breeze compared to most other programming languages. CFML is not a perfect language, but it is a simple language that makes most programming tasks easy to tackle. This tends to make rapid development easier to accomplish and lends itself particularly well to iterative, agile development practices and all that comes with it (like refactoring). This, coupled with the server error reporting and a few programming language constructs, also means that debugging ColdFusion applications is relatively painless and quick compared to other languages. Speaking directly to the questions of performance and scalability, it is possible to write applications that perform very well and scale exceptionally well with ColdFusion. For example, we (at Nylon Technology) recently successfully developed and deployed a large scale content management system across multiple servers and server instances. This CMS manages gigabytes of content (tens of thousands of pages) and has a lot of remarkable features (workflows, a robust permissions based security API, etc.).

The Bad
There are a few negatives about ColdFusion that should not be ignored. ColdFusion and CFML's ease of use means that you don't have to be a rocket scientist to use it. As I said, this is a strength, but it is also a weakness. There are far too many poorly developed CF applications "in the wild" and far too many "ColdFusion Developers" aren't good "Software Developers". I'm not saying all developers should have a degree in computer science, but more CF Developers should have a better understanding of the ramifications of the code they write, the limitations of the environment they're writing software in, and how to design ("architect") and develop applications that are not just modular, but easy to read, maintain, and extend. Sub-par programmers and poorly written applications will give any programming language a bad reputation. Coupled with the relatively small pool of available talent, it's no wonder some companies want to shy away from ColdFusion, is it?
So let's assume that good developers do create a well-written Enterprise ColdFusion application and have tweaked the hardware and JVM so that they know those won't factor-in as negatives - will it scale and perform well? The three second answer is "maybe... it might and it might not".
The Adobe ColdFusion Application Server is a commercial product and, as such, is a "black box". You write your code and save it somewhere that CF can see, and it "does it's magic" and spits out the results. If you don't like the results, you can change your code and try again, but you can't change what's inside that black box (i.e. the server internals). The most you can do is optimize the Application Server (CF and J2EE) and runtime (JVM) but not the way the server actually works with your code. This is obviously a problem if it turns out that some built-in ColdFusion function or tag is what's killing performance.
Though our client is happy with the CMS I mentioned earlier, along the way we did encounter several (performance related) stumbling blocks that were not the fault of the hardware or software architecture, but ColdFusion itself. One of the things that the CMS does is work with Objects (CFCs) a lot - and constructing/populating thousands of objects comes at a price. The CMS has a caching architecture that in simple terms boils down to storing CFC instances in a structure, using the ID of the content as the key name. We found that as the number of objects in memory grew, performance crept to a complete stand still - the server eventually died, as more and more threads timed out waiting for the threads that were accessing the structure keys to complete their job. Turns out that not caching the instances was the fix - but why? Because of a bug in ColdFusion that as far as I know, was first reported by David Sheldon on his blog at http://cfdumped.blogspot.com/2006/09/bad-hash-function-causes-problems-with.html. Maybe this bug doesn't affect the majority of applications, but for applications that need to store a large number of values in a complex data type, structures are not an option. One of the few fundamental data types in CF is broken - that's a big deal. I believe this issue was addressed in a CFMX 8.01 hotfix this year, but I haven't confirmed... and I personally think it's unacceptable for that bug to be made public knowledge and not be fixed for 2+ years.
We recently had another performance related issue with the application. The unique IDs of search results from a SQL statement are stored in a string and that string of IDs persisted and used for pagination. This is necessary because re-running the query isn't an option and storing the entire recordset would use far too much memory. So, the approach is right... but performance is abysmal (to the point that internal server errors are thrown) when lists get large - sometimes they're as large as 150,000+ (remember, this is an enterprise application and we need to work with huge volumes of data). The code that kept crashing looked something like this:



for(j = 1;j lte listLen(daList);j++){
     test = listGetAt(daList,j);
}

OK, so you're thinking, "Remove the listLen() call from the loop condition" - right? We did, and it got a little better but would still time out sometimes and would be very slow other times. That code looks like:



tmpVal2 = listLen(daList);
for(j = 1;j lte tmpval2;j++){
     test = listGetAt(daList,j);
}

Turns out that listGetAt() is just a horribly inefficient beast. Temporarily replacing the list with an array and then accessing indeces in the array worked like a charm and made an exponential difference to performance:



tmpVal3 = listToArray(daList);
tmpVal2 = arrayLen(tmpVal3);
for(j = 1;j lte tmpval2;j++){
     test = tmpVal3[j];
}

The example of listLen() brings up a good question - is there something wrong with that code or is it fair to say that ColdFusion is to blame? Rather than answering directly, I'll describe how I view the roles and responsibilities of CFML and the (ColdFusion) server, as well as my own complaints/disappointments with each. We'll start with the language - CFML. The CFML programming language is not the problem - in fact I think it's a good language (note that by "CFML" I mean "CFML and CFSCRIPT"). When I first heard about the CFML advisory panel, though skeptical, I did think it was a good idea - I still do. However, what I believe we truly need is a real language specification - one that states how the built-in tags and functions are to be implemented. Of course, since Adobe owns the server, though they've put together an advisory board, they have not published the language as a public specification. I would be pleasantly surprised if they did. There are several good examples of how a language specification is implemented and of the benefits that come from a public spec. One example is ANSI SQL - if a vendor says they support it, you are assured that your SQL will work. Another good example is ANSI Common LISP - the specification states exactly what (and in many cases how) vendors must implement the language. If you write your applications in Common LISP, you know exactly what to expect from implementation to implementation. Unlike CFML, for which a public specification could easily be made, the ColdFusion Server is a product owned by an entity and it wouldn't be fair (or make sense) to publish a standard defining how to write the server. Perhaps there is a solution, though. At a high level, the server is responsible for serving two primary functions: it is a compiler and it is a runtime platform. Perhaps it does not make sense to have an open standard that states how the runtime must work internally (beyond a specification for the side effects and behavior of the CFML language constructs), but a specification for how the server works as a compiler, if expressed at the language construct level and as part of a CFML specification, is plausible. For example, in my first list code snippet I pointed out that the listLen() in the for loop condition (for(j = 1;j lte listLen(daList);j++)) was causing a serious performance problem because it's evaluating on every pass... but there's no reason that the server, when compiling that CFML, couldn't have introspected the contents of the loop and determined that it was safe to compile it as byte code that evaluates a number (instead of the actual expression) on each pass. "Compiler Optimization" is something I've learned a lot about in my continuing education and experimentation with LISP - and it's something that the Adobe Engineering team should be focused on. I'm not saying they aren't (I really don't know) - I know they do focus on making the internal server code faster (the actual tags/functions) and the compilation process faster, but I do not know if they look at ways to optimize the actual results of the compilation process (rather than the code those results executes). A language specification that defines the compiler behavior for some, if not all, of the language would be a huge benefit to all.

The bottom line is that in the Enterprise, ColdFusion absolutely can perform and scale very well - but that no matter how great the hardware, how tweaked the VM and servers, and no matter how well written and well architected the code base, a very resource intensive application may perform poorly for no reason other than what can only be nicely described as "quirks in the server".

Framework F - My New Subway Project

Tue, 15 Dec 2009 11:42:00 -0400

A while ago I posted several common sorting and searching algorithms implemented in CFML (http://www.horwith.com/index.cfm/2009/7/10/coldFusion-searching-and-sorting-algorithms). The code, documentation, blog entry, etc. were all written over the course of a couple of months during my 45 minute commute to and from work on the New York City Subway. As a side note - it's very interesting some of the conversations people strike-up with you when you write code on the subway. Now that I finished that, you may be wondering what my next "subway project" is? I'm writing a framework.

Yes, that's right - "a framework". I'm sure people will have a few questions - the framework is still in it's early stages so I don't want to say too much. That said, I've tried to address some of the questions that people might have about the project and/or its objectives:

Question: Why a framework?

I hate to call it a framework to be honest - frameworks tend to centralize control of your application whereas what I'm working on simplifies architecture without actually telling you how to glue the pieces of your project together. That said, theoretically this code base could be used as a framework that glues an entire application together, so I decided to use the "f" word.

Question: What are the objectives of this framework?

There are a few very specific objectives of this framework. The first objective, and reason I wrote it, is to encourage and allow CF developers to take a more functional approach to programming ('functional' in the 'functional programming' sense). There are three business needs that this framework addresses - it will have a short and easy learning curve, functionality expressed with it should be easy to test, and functionality built with it should be easy to maintain. In addition, the framework must be lightweight and fast, and it must be non-obtrusive. You must be able to drop this code into any application and use it as much or as little as you want without penalty. A more technical description of the main objective is to simplify the architecture of applications by encouraging use of 'pure' (no side-effect) functions and, if desired, an OO aproach based on using objects only to represent the business domain (data). This is realized by centralized function library management and a few encouraged practices (all documented, of course).

Question: Why functional programming?

The more I play with functional languages and try to build applications in a functional way, the more I appreciate the benefits attained by doing so. I've seen many projects go south and many developers produce poor product simply because the company, tech lead, and/or developer try to do everything according to the notion that Object Oriented Programming is "the best and only way". Often times they also don't even fully understand OO, which makes matters worse. Though the framework encourages a functional approach, OOP has some good qualities and I've tried to also encourage using those qualities in order to simplify the process of designing and building applications. Before any functional purists speak out, I should state for the record that this framework only attempts to offer some of the benefits of functional programming that have been enjoyed by some developers for 50+ years... ColdFusion is an imperative language, CFML is not equipped to offer true functional features, and I cannot change the way the server works under the hood.

Question: Is there a feature list for the framework?

There are some specific technical features and tools I have, or am, implementing - this list won't change (it could grow) but I may not necessarily push it live with everything complete. The feature list, in no particular order, is:
- Mount function libraries which can then be called as if they were defined locally
- Mount individual functions from libraries
- Dynamically load libraries or functions for use
- Allow global functions to be overridden by more local (session and request level) functions
- Allow functions to be dynamically defined (and loaded for use)
- Ability to chain function calls and to call function chains
- Ability to define failover method for function/chain calls
- Simplified domain object use by using a generic DTO base class
- Simplify library and DTO creation via a lightweight object factory
- Simplify testing with a simple unit testing tool

Question: What version(s) of ColdFusion will this framework support?

I'm writing the framework to run on CF 8 and above. There are a few language features in CF 9 that would make a couple things easier for me or faster for you, but the trade off isn't worth it.

Question: What will the framework be called?

I don't know - names aren't my thing. It's just some code I'm throwing out there. That said, I have to call it something (internally in the code if nowhere else) so for now it's "Framework F". No, not "F" for "functional"... the idea for this framework came to me while I was riding an F Train one morning.

Question: What will the framework cost?

As with everything else I code for fun and post on my blog - this code is costs nothing. I don't know if I'll release it with any license or put it anywhere special besides a link to it here on my blog. I also don't know if I'll maintain it or add to it ever. I'm writing it for my own professional use, so as I need to modify it I will, and if I do something I think others would find useful by all means I'll post an update. Otherwise, if people use it and like it and someone wants to take "ownership" of it, or simply use and abuse it in whatever way they choose, they're welcome to. I don't like the "black box" aspect of frameworks, and I have deliberately gone out of my way to make the code base for this framework as short and simple as possible so that people can reach in and pull out its guts and play.

I don't have a date in mind yet as far as when it will be done - I'm working on several side projects for fun, reading several books, and working on "real work" for clients all at once... but I'm trying to squeeze-in time for this project whenever I can. I wrote the core several months ago and then put it down for several months, but I am going to try and get back to finishing it off soon. Sean Corfield has graciously agreed to look at it, do some testing, and provide feedback as soon as I have it ready for him - I asked Sean to do the initial review because he not only has CF Expertise and Framework experience; he also has experience/knowledge of functional programming languages and functional programming as an approach. Anyone interested in gaining early access to the code base before I'm ready to release it to the wild should email me at simon at horwith dot com or shorwith at nylontechnology dot com. As I said above, I'm writing this my my own real world use, and I have no intention of making it publicly available until I've used it enough to know that the kinks are worked out, that it's useful, and that it's documented well enough.

Flex Camp Wall Street in New York Next Week

Fri, 13 Nov 2009 12:34:00 -0400

If you're a Flex developer in New York and don't know about it yet, there's a 2 day Flex Conference called 'Flex Camp Wall Street' (http://flexcampwallstreet.com/) on November 16 and 17 that at $49 to attend, looks like a great deal for attendees (what else can you do in New York for less than $50??)

I'll be presenting on ColdFusion/Flex integration at the conference on Monday.

Figleaf Takes Adobe Training Online

Fri, 23 Oct 2009 10:16:00 -0400

Fig Leaf Software (http://www.figleaf.com, an award winning Adobe Training Partner, is taking their training online - they're offering free training via the web for several Adobe products. Nice job, guys!
You can register and find out more at: http://training.figleaf.com/tutorials/

CF 8.01 Cumulative Hotfix 3 JVM Compatibility Problem

Wed, 02 Sep 2009 11:37:00 -0400

One of our staging environments is running CF 8 multi-server and has instances running CF 8.01 and instances running CF 7 - all running on 32 bit Windows Server 2003. If you look at the system reqs for ColdFusion (http://www.adobe.com/products/coldfusion/systemreqs/#coldfusion) on 32 bit windows, JDK 1.4.2_14, 1.5_13, and 1.6_04 are supported. If you want to run all instances on one JDK, using JDK 1.4.2_14 makes the most sense, as CF 7 does not support JDK 1.5 or 1.6.

After applying CF 8.01 Cumulative Hotfix 3 (http://kb2.adobe.com/cps/511/cpsid_51180.html) to a CF 8.01 server instance, the instance appears to start, but any requests for CF pages that you make result in a 500 error with the following description: "coldfusion.server.ServiceFactory$ServiceNotAvailableException: The Security service is not available.". Switching to the JVM that installs by default with CF 8 makes the error go away.

Unfortunately, the hotfix tech note does not currently mention that it breaks the CF 8 compatibility with JDK 1.4.2_14 and the system reqs doc still states that CF 8 supports this JDK. The CF 8.01 cumulative hotfix 2 did not break this JDK compatibility. My advice to anyone thinking of upgrading to CF 8.01 Cumulative HF 3 is to first confirm that the server instance(s) you plan to update are at least running on JDK 1.5_x or above.

Is Adobe the Next Microsoft?

Thu, 06 Aug 2009 12:02:00 -0400

Adobe could be the next Microsoft... and that's not necessarily a compliment. Today, ZDNet News published an article titled "Is Adobe the next (pre-2002) Microsoft?" in which they compare the rising number of security holes being found and exploited in Adobe Flash Player and Adobe Acrobat Reader with the problem Microsoft had with vulnerabilities being exploited in their products years ago. It was so bad that among many circles, suggesting Microsoft products as a solution to whatever requirements you needed to meet was grounds for public humiliation. Their products were known targets and it was understood by many that using certain MS software was risky. No software is really 100% safe, but Microsoft took it seriously and became very proactive about addressing the (technical and image) issue both internally before software is released and publicly when a vulnerability is found. The article does give Adobe credit for being proactive and doing a reasonable job addressing vulnerabilities when they're found, but doesn't hide an opinion that Adobe still has a way to go.

The ZDNet article is online at http://news.zdnet.com/2100-9595_22-329118.html

A Bit of Advice When Running CF 8 on 64 Bit

Tue, 28 Jul 2009 10:42:00 -0400

By now everyone has probably heard that the optimal JVM and J2EE Application Server settings in any given environment depends primarily on six factors:

What OS you're running on
What hardware you're running on
What application software (CF and J2EE Server) you're running
What JDK version you're running your server instance(s) on
What the typical traffic for your web application(s) looks like
What those web application(s) do

It's true - there's no silver bullet for optimizing a CF/J2EE installation - it is very dependent on all of the variables I listed above, among other factors. That said, I've recently optimized and deployed several applications on the 64 bit version of CF 8.0.1 Enterprise running on top of Windows Server 2003 (64 bit, of course) and have come to two useful conclusions that appear (so far) to be consistent and worth keeping in mind if you ever move, or consider moving, to a 64 bit platform with CF:

If you want to take advantage of what a 64 bit environment can do, have at least two physical CPUs. Though you might think that doubling the CPUs from one to two would cut the average execution time in half, in my experience it generally improves (that is, "decreases") execution time by 75% just by adding a second CPU to a single CPU machine running a 64 bit OS (cores don't appear to make anywhere near as much impact - I'm talking physical CPUs here).
Running several instances with smaller (3 Megs or less) memory stacks tends to perform better than one instance with a big memory heap

Though my testing results have been consistent, please remember the rule about the six variables that determine an optimal configuration... the bottom line is that there's never any guarantee about what works best in a specific environment - only what's proven to work and what's proven not to work.

If you're Having Problems with ColdFusion 8.0.1 - Make Sure You Have Cumulative Hotfix 2

Fri, 24 Jul 2009 13:31:00 -0400

I just wanted to point out that if you're running CF 8.01 and go to the ColdFusion support page (http://www.adobe.com/support/coldfusion/) to get the latest cumulative hotfix, it shows a link to ColdFusion 8.0.1 cumulative hot fix 1 (http://www.adobe.com/go/kb403622) but it should show a link to the more recent ColdFusion 8.0.1 cumulative hot fix 2 (http://kb2.adobe.com/cps/403/kb403781.html). Anyone not aware that hotfix 2 was released could end up installing the older hotfix and go on their merry way, not realizing their server is not actually up to date with the latest patches.

I've made Adobe aware of this and I'm sure it will be corrected in the immediate future.

Advice For Working Around Getting An Error When Creating CF Server Instances on Windows

Tue, 21 Jul 2009 23:32:00 -0400

Ever get an error at the bottom of the page when you try to create an instance (ColdFusion Enterprise, Multi-Server or J2EE configuration) on Windows via the CF Admin that looks something like this?

There was a problem
Message: The specified Directory attribute \servers\cfusion\SERVER-INF\temp\cfusion-war-tmp\{some-UUID}\cfusion.ear\cfusion.war\CFIDE\scripts cannot be deleted.
Detail: You may not have permissions to delete this directory. The exception occurred during a cfdirectory action="delete".

I recently did, and after several minutes of Googling, still didn't find the answer. I also tried several different file system permissions settings at the Windows OS level and got inconsistent results. The one thing that did seem to work fairly consistently is to grant full privileges to the "CREATOR OWNER" user account (as well as whatever account you have the CF Service running under) to the "servers" directory and all its children. Among other things, I initially tried this same tactic on the "{path-to-cfusion-instance}/SERVER-INF/temp/cfusion-war-tmp" directory in which the error occurs but surprisingly found that it works some, but not all, of the time.
On a side note, if you get this error I also recommend turning off Windows Firewall and any other firewall/anti-virus software that might be running, while you're trying to create the instance(s).

ColdFusion Admin Datasource Page Glitch in CF 8

Fri, 17 Jul 2009 20:43:00 -0400

Just experienced this and didn't find anything via Google that described the exact same thing so I thought I'd blog it.
If you leave a browser window open to a CFAdmin datasource details pagelong enough to time out and then click a link, it prompts you to log-in again. When you log in again, you're on the same page you were on before in the admin (the details for the datasource) but the datasource name has now been replaced with "foo?targeted=true" where "foo" is what the actual datasource name is. I'd expect you'd get an error if you actually submitted the page... or you'd rename the datasource, which would cause errors in any applications that use it.

Another Open Letter To The CF Server Team

Thu, 16 Jul 2009 10:52:00 -0400

Nearly three years ago, I wrote an "open letter to the CF server team" in which I listed and briefly described many features that I'd like to see implemented in the server (http://www.horwith.com/index.cfm?mode=entry&entry=9C5F8D69-E081-0478-47FF6F46263B7F5D). The public beta of CF 9 means that in all likelihood they're in the early stages of planning/programming CF 10, so I thought it was high-time I send another letter and share what my wishlist for ColdFusion looks like these days.

Dear CF Server Team,
It's been a while since I last wrote you, I trust you are doing well? It's been a while since I last sent you a list of requests/suggestions, so I thought I'd reach out and give you a few ideas to implement, debate, and/or laugh about amongst yourselves. In no particular order, they are:

Add J2EE Server Tuning Features
Add Source Control Integration
Give Us More Compiler Control
Improve the Datasource Pool
Give Us Lexical Closure
Add Diff and Merge Functionality
Add Method Overloading
Give Us Modular Deployment (aka "features a'la cart)
Offer Cloud Support
Give Us the Ability to Override/Extend Core CFML Constructs
Improve the Exception Handling Framework
Add an Internal Mail Server
Add Social Networking Support
Expose the Cluster
Improve Performance
Add Content Management Support
Do Not Simply Imitate/Expose Java
Give Us AJAX Framework Flexibility
Let Us Treat Data As Code
Add Support for Regex Lookbehinds
Enhance CFC Functionality

Some Explanations:

Regarding #1
Optimizing the JVM (primarily jrun.xml and jvm.config) makes a massive impact on performance, and the optimal settings varies based on what version of the JVM you are running, what version of CF you are running, how your application(s) are coded, and what hardware and OS you're running on. Unfortunately, only a handful of CF developers know how to tweak these settings. It would be extremely useful if there was a screen in the admin that tries to suggest (and implement) optimal changes to these settings based on current performance and available resources.
Regarding #2
Integration with source control systems so that in the admin you could point an application at a repository and deploy or automate deployments, as well as interact programmatically with the repository from code, would be nice. I'd imagine it'd be relatively straightforward to add an SVN Event Gateway, if nothing else.
Regarding #3
I'd like to see administrators/developers have more control over how code is compiled/executed. CF 8 introduced a checkbox in the admin for turning off type checking for function arguments - I'd like to see more, similar, checkboxes. For example, it'd be nice to be able to turn off case insensitivity, turn off type checking all together, or turn off searching through the scopes for variables that aren't prefixed.
Regarding #4
My understanding is that each datasource defined in the CFAdmin results in one connection in the pool, which is shared by all queries/stored procedure calls that use that datasource. The ability to specify that 'x' number of connections should be in the pool for a single datasource name could drastically improve performance in many applications.
Regarding #5
Currently, we can declare a variable local to a page/CFC, local to a tag, and local to a function. I'd like to be able to declare variables that are local to loops and other constructs. These variable references would have to cascade, so if I have a 'for' loop with an 'i' counter, and in that I have a 'for' loop with a counter 'i', the proper i reference is referenced in the proper location. It would also mean that a loop that references a variable 'foo', which is undefined in that loop, would look first for a 'foo' variable defined in its enclosing loop, which would do the same in turn, and so on until the server is looking at the variables scope of the caller code. I'd also like for the "Compiler Control" feature to include a checkbox in the admin by which I could enforce lexical closure - i.e. restrict access to any shared scopes outside the current available scope (for example - inside a function you cannot access the server, application, session, form, etc. scopes). I'd imagine code compiled this way would perform better, and it would make testing infinitely easier and more reliable.
Regarding #6
The addition of functions to perform a diff or a merge on the contents of arrays and structures would be very useful. The only thing we currently have that's close to this is the ability to structAppend() keys into a structure that doesn't have them (or that are already there if you're willing to overwrite) from another structure.
Regarding #7
Method overloading, i.e. the ability to declare multiple functions with the same name but different argument signatures, would add an enormous amount of flexibility to how ColdFusion applications are built. Among the benefits developers might gain are a more robust form of polymorphism, multiple inheritance, and the ability to break away from the "message passing" paradigm of Object Orientation in favor of a more functional approach to OO - similar to how CLOS implements objects. It would also be fundamental for implementing my suggestion for an "Improved Exception Handling Framework" (see # 11 below).
Regarding #8
I know this is something that marketing/sales would weigh-in on heavily, but rather than having one version of CF at one price that just "includes all" and one version that either limits or disables certain functionality, I'd prefer to see CF support a paradigm by which you pay for and install only the modules you want. If nothing else, the ability to simply turn on and off modules in the admin would be useful. After all, if I have an application that, for instance, doesn't use charting, why should I pay for the performance price of loading the graphing and charting components when my server starts?
Regarding #9
I'd like to see a realistically priced licensing model for running CF in a cloud. My personal feeling is that running CF in a cloud right now really does little more than allow you to do fail-over (which you can already do with load balancers and/or J2EE clustering) and some fancy server hardware upgrading on demand. Ideally, supporting clouds would at some point be complemented by programmatic functionality that allows developers to MULTI-PROCESS page execution to take advantage of the cloud.
Regarding #10
If I want to modify, extend, or override the default behavior of a tag or function that's built-in to ColdFusion, why shouldn't I be able to? I'd like to see the core language (tags/functions) exposed in a namespace that we can access. If, when the server compiled your CFML, it looked first for a function or tag in a local or application namespace, THEN if it's not found looked for the function or tag in it's internal namespace (the one containing the core language that ships), much like the way it searches through scopes to find a variable when you haven't prefixed it, developers could override and extend the built-in language constructs. This would not only make the language much more useful for developers, but would allow Adobe to let the community help define new and improve existing CFML language constructs.
Regarding #11
The current "try-catch-throw" methodology has some limitations, as do all languages that handle exceptions this way. I'd prefer to see exception handling work more like "conditions" in LISP. It goes something like this: Developers would write functions that handle errors and register them in some way with the server (or just have them available in the current request, I suppose). When developers want to programmatically raise an exception, they would simply throw a CFC instance they've created (the instance would either extend a CF Error object or implement its interface. When an exception occurs (or is raised/thrown programmatically), CF looks for the function who's arguments most closely match the arguments generated by the error. CFML would have some functions that allow the developer not only to re-throw the exception or end handling their, but also to return to the code that was executing when the exception occurred, or immediately after or before where the exception occurred.
Regarding #12
I'm not suggesting that the team implement a full-featured mail server, just a very lightweight outbound-only mail server that maybe has just a few configuration options (like 'from address' and 'port'). So often, developers use CFMAIL to send themselves error emails. This currently isn't an option when there's no mail server available, and often times it is less than ideal to use a mail server that's also being used in production for these 'debugging emails'. A CFINTERNALMAIL tag that only uses the lightweight internal mail server would be great.
Regarding #13
Of all the items on my wish list, I'm least enthusiastic about this one. That said, clients are asking for social networking more and more frequently - whether in the form of integration with sites like facebook or twitter, or by way of some other community building functionality on their site. I haven't put a ton of thought into what this feature would look like (though I know it would have to include data push to AJAX) but I know that requests for social networking functionality are only going to rise, and anything that makes that quicker/easier to do would be great.
Regarding #14
Though there are workarounds for much of this, I'd like to see information about the cluster (if CF is a member of one) and about the J2EE instance CF is running on exposed via some CF functions or built-in variables. Railo added a 'cluster scope' to their server - when I heard about that I thought, "now there's a great idea - I wonder why nobody on the ColdFusion engineering team thought of that yet?"
Regarding #15
Performance is getting better and better with every release it seems, but there's always room for improvement, and improving performance is always a feature I'd like to see in a release.
Regarding #16
So many companies want some level of content management functionality for their intranet/internet applications. I'm not suggestion that the engineering team necessarily implement a completely feature rich CMS inside of CF, but some simple content management functionality would definitely make life easier for a lot of developers and would save a lot of companies money (either by reducing programming hours or avoiding purchasing a commercial product). I wrote a little about this not too long ago (http://www.horwith.com/index.cfm/2008/6/28/would-adobe-integrate-a-CMS-into-ColdFusion)
Regarding #17
This isn't so much a feature request as it is a word of caution/advice. I understand that CF was moved onto a Java platform nearly 10 years ago largely so that the engineering team could take advantage of the vast amount of Open Source code that is available, and I realize that it is also tempting (because it is so quick and easy) to simply drop an Open Source project into the server and expose it with a tag. If there is something CF doesn't do out of the box, and there's an Open Source Java project that does what I need, it's usually not much work to integrate the project into my server library and figure out how to use it myself. For example, whenever I needed image manipulation functionality in CF I always just dropped the Jakarta tag lib on the server and away I went (http://jakarta.apache.org/taglibs/sandbox/doc/image-doc/intro.html). I'm not saying it's not easier now, but it wasn't difficult before, and I rarely had to do it on a project so I'd rather not have the server load those libraries if I'm not going to use them. Also, one benefit of using Open Source libraries directly is that when I can't get them to do what I want, or an error is occurring, I have many more options for troubleshooting and fixing the problem. When it's built-in to the server and it doesn't work the way I want, my hands are tied by the "black box" that is the commercial product, which in the end usually results in wasted hours.
Regarding #18
I think developers would benefit from having more control over what JS libraries are used (and how they are used). Being able to tell CF you want it to use JQuery, or YUI, or 'JS Framework XYZ' would be great.
Regarding #19
The ability to treat data as code and code as data is something I would love to see in CF, though of all the features listed here, I would be most surprised to see implemented. The 'evaluate' function supports similar but limited functionality. I'd like to take any string and be able to treat it like code, with an escape character to delay evaluation. This would be particularly useful in that it would allow developers to work with anonymous functions and would allow code to write code. I realize that the latter use case can be achieved by using the CF 9 Virtual File System, but the feature I'm describing would eliminate the I/O aspect that's present with virtual files all together.
Regarding #20
This one isn't a big deal until you need it, but I can't think of any reason why regular expression lookbehind support has never been implemented, and I wouldn't think that it'd be very difficult to implement.
Regarding #21
The support for CFC constructors and for importing CFCs that were added in CF 9 were big improvements. I think the OO implementation would be rounded-off well if we had support for implicit getters and setters, as well as support for a deconstructor method.

In Closing
I realize that the AJAX framework flexibility, social networking, cloud support, and CMS integration features are the only things on the list that directly help sell servers, whereas the rest are primarily for the benefit of developers. However, performance is also a selling point and is certainly necessary to keep repeat business, and many of these features aid in performance. Aside from my own reasons for wanting them, the remaining features, if nothing else, should make the server more attractive to "seasoned developers", would allow developers to do things they wouldn't think of doing now, and would help argue the case that ColdFusion is a mature (or "serious") language.