Join Central Alabama ColdFusion User Group - cacfug.org

Be Productive.
Ask questions - Come to a meeting

• Help ColdFusion developers share, learn, hone, and practice their craft.
• Promote ColdFusion - the language of innovation - as a key to agile business.

3 May Meeting

Krystal's! And CF 9!

5 April Meeting

Malaise

1 March Meeting

Lockdown Guidance

Much of the advice centers around locking down the operating system and file permissions. There's no need to repeat that here. For the web server and ColdFusion, it was interesting that Adobe recommends:

• Creating a separate SSL-protected web site for the administrator instead of assuming that the loopback IP is safe from attack.
• Preventing almost all access to /CFIDE.
• Disabling JRun admin server console when not in use.
• Placing the ColdFusion server on a separate platform from the web server, or having a proxy decide whether to pass external requests to the web server or to ColdFusion. (It's not clear how this proxy setup would work.)
• Creating a non-default virtual directory reference that points to what would be the contents of /CFIDE/scripts and changing all pages that use something here to point to the virtual directory. (The example has the virtual directory pointing to the default physical directory /CFIDE/scripts. It's not clear that that's was what was intended. And, it's not clear how this change helps.)
• Telling the web server and ColdFusion to ignore file types you don't plan to use. This is a multi-fold process: tell the web server to ignore (filter out) requests for those file types, remove the handlers that tell the web server to to pass those file types to ColdFusion (handlers that ColdFusion installation adds by default), tell ColdFusion to ignore these file types. Caution: if you remove the handler but forget to tell the web server to filter out the file type, the web server will display the raw text of such files. A related caution is to point unused CFCs to CFForbidden servlet. If you just delete the servlet mapping, the CFC source will be displayed: not what you want to have happen.
• Setting the timeout to a somewhat low value (e.g., 60 seconds). Pages expected to need more time can set a different limit with the cfsetting tag.

• The recommendation to store client sessions in cookies or "none" instead of in a database. The client should only store a pointer to the session; you can't trust client content. To be fair, it should be pointed out that this document also recommends that J2EE session variables be used instead of native ColdFusion session variables. Still, the recommendation to trust the client doesn't make sense.
• It was interesting to consider that ColdFusion data source users can be restricted so they can execute only specific SQL commands (such as select) and not others (such as alter, grant, etc.).

2 February Meeting

Arrays

ColdFusion "arrays" are not arrays in the traditional sense. They do not consist of a list or lists of consecutively numbered cells. They are not spreadsheets or solid structures of (for example) X by Y by Z cells. They are not even nested lists.

The usual way of conceputalizing relationships is through a spreadsheet or cube arrangement. If you immerse a cube into liquid (representing server memory), it would displace X by Y by Z cells of volume, even though many of its cells aren't used.

The best three-dimensional analogy for a ColdFusion array may be berries on a bush that has many branches of varying lengths. Only the individual berries (cells) you have defined will exist, as far as ColdFusion is concerned. If you immmerse such a bush into liquid (representing server memory), it only displaces space for the cells you have defined, not for every cell in the matrix.

ColdFusion arrays conserve memory. No space is wasted on undefined cells, not even on pointers to them.

However, to use this advantage effectively, we have to understand that using ColdFusion arrays has to be a little different from using arrays defined by other languages.

Most familiar programming constructs to access arrays usually expect data to be stored as if it were in a spreadsheet or cube. That works fine when memory is reserved for every cell, even the unused ones.

However, this approach it fails with ColdFusion arrays. When code encounters an undefined cell (as it will very quickly), it dies with an error.

You could use the arrayset function to predefine all of the cells for a given dimension of an array in order to treat a large array as a big cube. That's one approach to handling this situation. However, it's wasteful. It would waste the space that ColdFusion is trying to conserve by default.

Almost as bad would be to use cfparam to hunt for data; it will fill a cell if it doesn't exist, but at least it won't fill an entire dimension at once.

The least wasteful way is to take typical code used to access an array and place that code inside a cftry-cfcatch block. This way, the code can be made to ignore the error that occurs when it tries to read an element that doesn't exist, and it works without wasting memory.

5 January Meeting

Business Structure

Subchapter S's Biggest Drawback - Hobby Loss

• A Subchapter S corporation is subject to the same Hobby Loss provision as almost all forms of business. With some exceptions, if a business doesn’t turn a profit three years out of five, then the IRS calls it a “hobby.” Losses you passed through to your personal taxes for that five-year period suddenly do not count, and the IRS will look back and tax you for those years as if your previously reported losses did not reduce your personal income.
• A regular corporation is always presumed to be trying to make a profit. It could run for years at a loss without raising an eyebrow. This is its only substantive advantage if you don’t expect a large number of shareholders.

Subchapter S's Biggest Plus - Profit

• A regular corporation’s profit does not have to be reported on your tax return until you take the profit out. However, it gets taxed at about 21% in the meantime (15% by Feds; a little over 6% by Alabama). You pay personal income tax on top of that when you finally take the money.
• Subchapter S profit passes through to you when it’s earned. However, it won’t be much when you're starting off, and it will only get the 6+% extra taxation by Alabama (plus your personal tax rate). Subchapter S loss generally passes through to you when it’s incurred.

Won’t Matter - Passive Income

• To the extent that a Subchapter S corporation receives income that it didn’t actively earn, it will have to pay taxes on that amount: the 21% mentioned above as for a regular corporation. However, you’re probably not planning to do that to a great extent.

Won’t Matter - Wages

• No difference. The company’s portion of your Social Security reduces the company’s profit. The rest comes out of your salary just as always. You do have to pay yourself a salary, and it must be “reasonable.”

Won’t Matter - Conference Expenses and Travel

• No difference. If it benefits the corporation, the corporation can pay for these and then deduct them as business expenses [subject to some reasonableness caps].

Won’t Matter – Education (and associated travel)

• If you paid your own expenses, only the portion above a percentage of your income would be deductible. If you let the company instead (as mentioned above), your income doesn't affect the deductibility to the company.

How Does the Money Flow?

• You can contribute assets to stock: tables, chairs (really). You’ll want to invest at least a token amount; you have to take special action if the “stock basis” drops below zero.
• You can loan money to the business. This is probably better (for obscure tax reasons) that bulking up the stock. Pay personal taxes on the interest the company pays you (when it actually pays you back). The interest is an expense to the company.
• When you feel like taking profit (other than wages) out of the company (and it actually makes a profit), you pay personal taxes but not payroll taxes on that distribution.
• If the company can’t afford to pay you wages at first....
  • Some lawyers say that you can stop drawing a salary as long as you don't pay yourself a distribution.
  • A conservative thing to do would be to continue to at least pay the taxes on a reasonable wage (both sides of the payroll tax) and defer the rest until the company can afford your services. Remember that taxes pierce the corporate veil; you are *personally* liable for payroll taxes; they survive even bankruptcy (even your bankrupcty).

8 December Meeting

Free-for-All

2 December: Montgomery Nativity

3 November Meeting

postgreSQL

6 October Meeting

Log In

Here are a couple of entries...

Bare Bones

• Have Application.cfm check a list of permitted pages for unauthenticated users: login page and gate page. If the user is not authenticated and an interpreted cookie does not contain the desired value, use cflocation to dump the user to the login page.
• Provide a login form for the user. Set the action to be handled by a separate "gate" page.
• At the gate page:
  • If the login is wrong, use cflocation to send the user to the login page.
  • If the login is right, store the desired cookie and do a meta refresh of the gate page to itself.
• At the gate page, if the desired cookie is present - it will be if just set - use cflocation to go to the application menu.
• On the other hand, if "referer" at the login page was the login page - it won't be the gate page; because, cflocation makes it seem as if the user never arrived at the gate - tell the user the login was wrong.

Full-Featured

• This approach starts with a splash page that when its image is clicked leads one level down so that subsequent movement between directories can be all on the same level: "mat" for the welcome area, "act" for the active site, and so on. Have Application.cfm in the welcome area enable session management.
• Let the destination of the splash page image delete a login cookie and define username and password as empty.
• Provide a login form (whose action could lead to the current page).
• If the login is correct:
  • Add the user's ID and role to the session in memory.
  • Store the session key (cfid and cftoken) and the user's ID in a urlEncoded, encrypted cookie whose contents have been obfuscated.
  • Include the main menu in the active area.
• Don't let ColdFusion write its default session ID coookies. Instead, have Application.cfm in the active area set defaults, decrypt the cookie, find the session in memory that matches both the User's ID and session key found in the cookie (or bounce the user), and get the user's role from the session in memory. Have Application.cfm set the variables (not the actual URL) for url.cfid to the desired cfid and url.cftoken to the desired cftoken. Then have it enable session management; this sequence will cause ColdFusion to "continue" the session they represent.
• Now that the user is authenticated, enable menu items appropriate for the user's role.

1 September Meeting

ColdBricks

Getting started with ColdBricks was straightforward except for one thing: the directory path is case-sensitive. I had unzipped it into a directory named "ColdBricks". The images in the administrative application for ColdBricks would not render until I renamed the directory "coldbricks" (all lower-case).

Unfortunately, that's as far as we got. Tomcat and ColdFusion still have "issues." And, attempts to use CF Administrator return "the requested resource is not available." It was an unproductive exercise, this time around.

4 August Meeting

Apache Tomcat

Selection. Even though ColdFusion 9 is being pushed by Adobe, its lack of some functionality for some operating systems suggests that it's not quite mature. So, ColdFusion 8 (already downloaded) was chosen for use. Apache Tomcat 7.0.19 seemed stable; so, it was picked.

Installation. Tomcat for generic Microsoft Windows rapidly installed. It was allowed to install in its default location (under Program Files) except that some directory names were shortened for convenience. CF 8 was installed with the WAR file option. All components were loaded except for Adobe LiveCycle Data Services; this platform could barely cope with the services it currently had. RDS was enabled (for directory browsing from CF Administrator).

Smoke Test. In the time remaining for the meeting, Tomcat provided a working Web server (at http://127.0.0.1:8080), and it did it with one-fourth as much memory as JRun had used. There wasn't time to configure Tomcat to work with ColdFusion, but this was a good start. And, a link for instructions on now to have the two talk was found: http://www.adobe.com/support/coldfusion/j2ee/phase2-tomcat-deploy.html.

Later Results: ColdFusion on Tomcat

rem Set a few variables.
set JAVA_HOME=C:\Program Files\Java\jre1.6.0
set CF_HOME=C:\Program Files\Apache\Tomcat7\webapps\cfusion
set CF_WEB_INF=%CF_HOME%/WEB-INF
rem Concatenate binary file directories into a single variable.
set CF_SHARED_LIB=%CF_WEB_INF%/cfusion/lib
rem The following variable must be on a single line.
set CF_SHARED_LIBS=%CF_SHARED_LIB%;%CF_SHARED_LIB%/_nti40/bin;%CF_WEB_INF%/cfusion/jintegra/bin;%CF_WEB_INF%/WEB-INF/cfusion/jintegra/bin/international
rem Add libraries for binary files to the Windows system path.
set PATH=%PATH%;%CF_SHARED_LIBS%

rem Set JVM options to enable sandbox security (all on one line).
set CF_SECURITY_JVM_OPTIONS=-Djava.security.manager
-Djava.security.policy="%CF_WEB_INF%/cfusion/lib/coldfusion.policy"
-Djava.security.auth.policy="%CF_WEB_INF%/cfusion/lib/neo_jaas.policy"

rem Set JVM options for CORBA. Use if vbjorb.jar is not in
rem your JRE's lib/ext directory.
rem set CF_CORBA_JVM_OPTIONS=-Xbootclasspath/a:"%CF_WEB_INF%/lib/vbjorb.jar"

rem Consolidate JVM options.
rem * Use this line if you've configured CORBA
rem set CF_JVM_OPTIONS=%CF_SECURITY_JVM_OPTIONS% %CF_CORBA_JVM_OPTIONS%
rem * Use this line if you haven't configured CORBA
set CF_JVM_OPTIONS=%CF_SECURITY_JVM_OPTIONS%

rem Populate JAVA_OPTS, which will be used by catalina.bat
rem when starting the JVM.
set JAVA_OPTS=%CF_JVM_OPTIONS%


7 July Meeting

Content Management System

The CMS should be open to the developer; since, the developer has to be able to evaluate its risk. Cost is an issue, but it isn't the other only issue. Inexpensive hosts can't let developers add executables or make sweeping changes to their hosting environment. So, the CMS environment has to be installable by the developer without such measures.

The hunt for a Content Management System looked at a half-dozen paid alternatives but eventually settled on a free alternative for further study: ColdBricks.

2 June Meeting

Politician's Sites

In the interests of time, we looked at the site of one lesser-known candiate, Herman Cain, and evaluated the site in light of the support it should be providing to this candidate. Even though the site was apparently provided by a group that works with multiple politicians, it fell short in several areas.

• The Donate Tab wasn't visible unless you had a very wide monitor
• Pages contained a mix of unchangeable text sizes: some too small to be easily read and others oversized.
• The Biography was set up where one had to scroll a page within a page to read it. It was impossible to make it an impromptu flyer from it for supporters to lay on tables, etc. It was even very difficult to highlight the entire bio at once; so, it couldn't even be copied into E-mail or printed as plain text.
• Portions of the Calendar of Events header overlapped the month, the controls to shift between months, and the text of the first event for the month.

Maybe you don't feel you can help at that level. Wherever you are, there are individuals running for local offices. They aren't necessarily well-funded. Your expertise can make a difference. Ditto for local causes. You can help messages you care about be presented clearly, perhaps in a professional manner, so the the Court of Public Opinion will have enough facts to draw a reasonable conclusion (one hopes). You have skills that others lack; use them.

5 May Meeting

Supporting Cast

7 April Meeting

10 March 2011 Meeting

What, then How

3 February 2011 Meeting

Broaden the Base? Almost.

The idea of broadening the focus of the group was anathema to us a few years ago. We lamented the name change in most ColdFusion user groups to Macromedia groups and then to generic Adobe groups. However, at least most people have heard of Adobe, even if they only associate it with frequent updates to Adobe Reader for PDFs.

For now, we'll show how ColdFusion complements other tools for building dynamic Web sites and let the name alone.

6 January 2011 Meeting

"Brush Up Your Shakespeare"

And, the state of the art doesn't stand still. So, if you merely retain your current skills, you're moving backward relative to the state of the art.

On the table were ways to stay in our favorite game even when we're currently being paid to play a different one. It's important to do that to retain your usefulness. As the song says: "Brush up your Shakespeare, and they'll all kowtow."

2 December 2010 Meeting

Everything Old is New Again

Tags that have been part of ColdFusion since CF 4 or earlier have gained new attributes. Patterns adopted years ago to get the "most" out of these tags are no longer necessary or have been supplanted with better ones. A case in point is the venerable CFFORM tag.

4 November 2010 Meeting

Intercepting Proxy - Part 2 (Injection)

However, many's the slip twixt cup and lip. It should have been straightforward - we've created code in the past that compensates for other programmers' weaknesses. But this time, it was tough to select a simple injection to prove the value of the tool. [sigh]

7 October 2010 Meeting

MAC vs. PC

"WINlnet.dll". He looked in vain for "WINLNET.DLL"winInit.dll, copied it into the same directory as Web Scarab, and it worked. Was this just a misunderstanding due to a capital "I" [sounds like eye] looking like a small "L" [sounds like "ell"]? We don't know, but this resolution seemed to work.

Intercepting Proxy

By the time we got the software installed and understood how to make the browser work with the proxy, the meeting was essentially over. It seems that while the browser is working through the proxy, the browser doesn't work normally. Duh!! OWASP gives great examples of what to test for, and we did see (on Don's MAC laptop) cookies, headers, and other things you normally don't spot through a browser. During the meeting, we didn't get to the point of injecting changes using the proxy. We'll have to share our experiences at as subsequent meeting.

2 September 2010 Meeting

Favorite Technical Sites

We surveyed sites that discuss ColdFusion techniques. Here are some you might find interesting.

• http://www.coldfusionjedi.com
• http://www.cflib.org
• http://www.easycfm.com
• http://www.riaforge.com (and click on "ColdFusion")
• http://cookbooks.adobe.com/coldfusion (click "more" when you get there)
• http://www.corfield.org
• http://www.learncf.com
• http://www.quackit.com/coldfusion/tutorial
• http://www.cfcentral.com.au
• http://www.forta.com/cf/links

We couldn't reach agreement during this meeting on which topic to pursue in October, but Marty later turned to Open Web Application Security Project (OWASP) and thought to experiment with an intercepting proxy.

No meetings in July and August!

Life happened to the manager and co-manager simultaneously. For the first time since March 2007, there wasn't a ColdFusion user group meeting in Montgomery. Don had a newborn in his family, and Marty got married!

3 June 2010 Meeting

Why was Marty distracted coming into this meeting? He was on the cusp of a marriage proposal. Now that his favorite person has accepted, maybe he'll be able to concentrate again. Then again, he has this stupid grin that won't wipe off, so we're not sure he's ready to come back to Earth yet.

What's the Buzz?...... ..... .... ... .. . Where's the Buzz?

Searching for ColdFusion in general brings back articles from 2005! Not enough is being written lately (good or bad) [not that we can think of anything bad about CF]. Or, it's not being linked to enough to attract search engines. There's no buzz.

It's unclear why this is so. Wikipedia makes the case that ColdFusion is MORE portable than java. ColdFusion has gained in flexibility and power, and it was the best middleware in existence before now. And, it's free for development (and shared hosts make it cheap for the average joe's deployment).

So have all the interesting problems already been solved through the use of ColdFusion? Or have they gotten too big for a single person to write about?

6 May 2010 Meeting

Has ColdFusion Gotten Too Big?

Yes

One of the virtues of ColdFusion was that it hid details that could otherwise be misused and would have to be debugged. As ColdFusion has gotten larger and larger, the bulk of it has shifted from a declarative language to an object-oriented language, and much of the simplicity has been lost. It used to be that it almost served as its own pseudocode. You could show a functional the raw code, and the commands would be quickly understandable; only the functions would require explanation. Now, the trend is to write code that isn't self-documenting (to put it mildly). Since most of the cost of programming is in maintenance, not initial production, this is a sad trend.

No

As users demand more features, the language has grown to accommodate them. For example, many cross-site scripting attacks use scripts to send users's currently active cookies to a different site. A cookie's HTTPOnly attribute could stop this, but this attribute could not be set in older versions of ColdFusion except by using a custom header to create the cookie: not a simple process. CF9 permits it to be set through the CFCOOKIE tag just as for other attributes. Newer versions of ColdFusion support image manipulation directly instead of forcing programmers to switch languages to do this. The language has grown, but programmers can use (or misuse) its features as they wish. Complaining about language growth is rather like complaining like receiving an extra tool set for Christmas. Sure, you can get most jobs done with the tools on hand, but the new tools won't make it harder and may make the job easier as you get used to them.

8 April 2010 Meeting

Life Balance

Programming is fun, and you often get paid you it. However, it shouldn't be all you do. Remember the song in which the person telling the story speaks of getting up at night to work on a song while his love wishes he'd come back to bed. He says he'll be right back, but he keeps on working. Programming can be that seductive and just as destructive to relationships if we let it go that far.

Just as some forums have a separate section for all the off-topic stuff, we wrestled with life. One of us is dating again after the death of his wife. Another is preparing with his wife to welcome a new baby.

A couple of quotes (researched later) reflected our mood. Carl Sandburg reminds us: "Time is the coin of your life. It is the only coin you have, and only you can determine how it will be spent. Be careful lest you let other people spend it for you." [multiple sources] When we work to prioritize our lives, we have to consciously set aside time for those we love and refuse to say "yes" to every opportunity that comes our way. We can't help everyone, and we can't do everything, but we can build up treasure that moths and rust won't corrupt and no one can take from us. [Matthew 6:19-20] Programming is a great thing, but it isn't everything and isn't even the main thing.

4 March 2010 Meeting

Employment

Whether starting a new job or grateful to have a job, this dominated our thoughts. Especially in this area, ColdFusion work that pays well can be tough to come by. Most of the work in Central Alabama centers around government employment (car companies excluded) that favors anything Microsoft wants to sell. Moonlighting runs the risk of endless requirement changes disguised as bug fixes. You have to have a certain level of formality to protect both parties. "Lord, give me a job of work to do.... That's all I want, that's all I ask of you." -- Tom Paxton.

4 February 2010 Meeting

Risk!

Just because you can imagine it doesn't mean you should do it. We explored business forms, the Payment Card Industry (PCI) Data Security Standard (DSS), and some Open Web Application Security Project (OWASP) cautions.

Business Forms

How do you know that an individual who comes to your site is authorized to represent a business? How do you know that the business exists? How do you gain a sense of how reliable the business is? How do you satisfy a purchase order? We reviewed Internet-capable versions of answers to these questions normally handled through paper forms or personal interaction.

PCI DSS

Cheap, shared hosts are fine for some purposes, but when you start accepting credit cards, support requirements increase dramatically. You can dodge some of this by having the payment gateway accept the card information directly from the customer, but whatever path you take has an impact on the user experience.

OWASP

The OWASP top 10 critical risks should be required reading for every developer. They change periodically based on impact and on real-world exploitation. A real eye-opener since 2007 is cross-site request forgery (CSRF). Any site your customer browses while his session at your site is still active can pretend to be your customer and will be able to use your customer's credentials (cookies, etc) to do it.

7 January 2010 Meeting

IDEs

It's time to stop relying on Wordpad and nimble fingers. We reviewed several IDEs but settled on Eclipse.

Disk Space

For Marty, the toughest part was moving 45 Gigabytes of family photos to external storage to make room for an IDE.

More Activity...

Looking for previous meetings? Looking for pictures of CFUnited Express/Atlanta - 15 March 2007? They're in the Archives.

Meetings

• Meetings are on the first Thursday of each month from 6:00 to 7:00 PM.
• We meet at 844 Brookland Curve (near Eastdale Mall) in Montgomery AL. See Directions and Map

Group Managers

=Marty= (R Martin Ladner) is a Certified ColdFusion Developer whose weekly series "ColdFusion in Context" was published for two years by "CFTipsPlus.com". See his tips demonstrated at http://futureEC.com/context. Reach him at 334 294-8990 or martin.ladner@knology.net

Don Gilliland is a Certified ColdFusion Developer who reads voraciously, continually seeks increased productivity in design and development, is fluent in several Web languages, and supervises Web-based solutions for Faulkner University in Montgomery, Alabama. Reach him at dgillilandjr@hotmail.com

---

Home Employment Why ColdFusion? Demonstrations Archives Tips Other Groups Local Sites

---