Moderator (MDR): MDR-Erik Wood

Guest Speaker (SPK): SPK-Satish and SPK-dogbert

MDR-Erik Wood: Hello everyone, welcome to the Java Developer Connection Discussion Forum. I'm here in the studio with Satish Dharmaraj and our distinguished mystery guest, Dogbert. We will be talking about the JavaServer. We are now ready to accept questions from the audience!

SPK-Satish: Hi everyone.

JohnEng: In terms of performance, how does Jeeves square with the other "traditional" servers?

SPK-Satish: On 10baseT networks, JavaServer Beta is about 85% of the throughput of Apache Netscape. JavaServer Beta has some scalability problems on higher throughtput networks, but we are going to fix this for FCS. Our performance should be comparable to Apache for FCS.

terrywong: Can we expect a server development kit, to develop general purpose servers, to be available in the near future?

SPK-Satish: Absolutely. We are currently in the process of defining these APIs and they will be available for developing general purpose servers. These APIs are used in Beta to build our HTTP server - but not all of them are exposed. We will have a Beta version of the server toolkit APIs with our FCS. This will have APIs for admin, security, thread management, session management, and connection management.

JohnEng: Following up on my earlier question -- when you mentioned the performance figures, are you running the JavaServer using JIT? If so, what kind of performance improvements did you see with the code that has been passed through a JIT compiler?

SPK-Satish: The numbers we got were without a JIT. We do not have a decent 1.1 JIT yet to compare numbers.

SPK-dogbert: I am online. On the subject of JITs, I don't expect JavaServer to get a big win from them. If we have architected the server correctly, then we should be I/O bound, spending most of the time in the kernel.

MDR-Erik Wood: You're all free to ask questions, so please send them in. In the meantime, here's one for Satish. The Beta version of the Java Server was just posted to the world for download. What are some of the new features that we see in the Beta version?

SPK-Satish: A brand new swanky admin tool that lets you dynamically configure the server. Servlet reloading is automatic, so servers do not have to be restarted when servlets get recompiled. Servlet security sandbox is now defined, and an access control list can be used to describe the capabilities of the servlet signer. JDK 1.1 code signing support is used for this. SSL session caching improves the SSL performance. Improved logging support. These are some of the features in Beta

TomChavez: Does the JavaServer run on all platforms? Using which JVMs?

SPK-Satish: JavaServer will run on all platforms that support JDK 1.1. JDK 1.1 is currently only available on Win32 and UNIX platforms. Whenever it is available on other platforms, the server will run with no modifications (the wonders of Java--write once, run everywhere!)

squierts: The JavaServer supports servlets, which are basically server side applets. Briefly, what are some of the advantages of using servlets over traditional CGI?

SPK-Satish: Servlets are extensible, multi-platform, and extremely efficient compared to CGI, because, servlets are loaded once, become part of the server, and reused each time they are invoked. With CGI, a process is forked and exec'ed each time.

turbogek: What is the estimated FCS release date? And is the server stable enough now to be used in preliminary development?

SPK-Satish: We cannot give out any hard estimates for FCS, but it will be out in the second quarter of this year. As far as the server stability--yes, it is very ready for preliminary development. It is feature-complete and has no major bugs or stability problems.

squierts: Follow-up to servlets: I can then use all of the cool features in the Java JDK (RMI, JDBC, Reflection, etc.) in my servlet code?

SPK-Satish: Yes - that is the idea - you get the entire Java platform with servlets. There is a JDBC example, and an RMI example with our Beta release. So, yes - you get all the goodies from the JDK with servlets.

MDR-Erik Wood: Security is one area that is highly important to the Web and to web servers in particular. Can you talk about the security features of the JavaServer? Is it fully SSL (Secure Socket Layer) supported?

SPK-Satish: The Java Server Beta is fully SSL-3.0 compatible. It also has SSL caching. We support BASIC and DIGEST (MD5)-based authentication We support ACLS (Access Control Lists). We have defined a flexible finer-grain access control mechanism that is used to define the servlet sandbox. Servlet signing capability is included - so servlets can be signed, and signers can be assigned capabilities via the Admin tool.

MDR-Erik Wood: Specifically, how is security implemented for servlets? Are servlets as secure as say, CGI scripts?

SPK-Satish: Servlets are either local or remote. Local servlets are trusted and have all capabilities (i.e. read and write to disk/network etc.). Remote servlets should be signed using JDK 1.1 code signing support. Signers are assigned privileges that define the sandbox, within which all servlets that have that particular signer runs. Privileges are like permissions: to read/write to disk, read/write to sockets, permission to even load the servlet into the server. So remote servlets operate within a sandbox - a sandbox that is flexible and can be defined for each signer using the Admin tool (so it's not "all-or-nothing" permissions as it is for applets in 1.1 - it is more finer-grained than that).

MDR-Erik Wood: Thanks to everyone for the questions, and to Satish and Dogbert for being part of the JDC Discussion Forum.

SPK-dogbert: This is dogbert saying so long!

MDR-Erik Wood: Erik Wood signing off. The forum is now unmoderated.