Moderator (MDR): MDR-Andrea
Guest Speaker (SPK): SPK-connie and SPK-driscoll
MDR-Andrea: Hello and welcome to Java Live. Today we have Connie Weiss and Jim Driscoll from the JavaTM Web ServerTM team. Perhaps you've had a chance to download the Java Web Server 1.1 Alpha, and have some questions. Go ahead and start sending them in, and we'll get started.
scotthut: What would be the advantages of using Java Web Server? I see integration of the environment as the main advantage. I also could see a nice client/server chain of servers taking the place of today's normal client/server applications.
SPK-connie: We believe there are two major advantages to using the Java Web Server. One is servlets, which we have been working hard to make ubiquitious to every server. But the Java Web Server is designed to run and administer servlets easier than the others. And because servlets are JavaTM, they allow developers to write their code once, and run on any platform, which is the second major advantage. We also see a lot of our users developing servlets as middleware, for instance, as a front-end to a database, which again is portable across platforms.
evaala: I've installed Java Web Server 1.1. There does not seem to be any documentation regarding the html generation package (sun.server.webserver.html). Does this package exist in 1.1. If so, is it possible to get some documentation for it?
SPK-driscoll: We shipped with APIdocs for the HTML package, I'm not sure what kind of documentaion you are looking for. Are you looking for largescale examples? If people out there have been using the HTML package, and have comments on it, we'd like to hear them. We're considering changing it significantly for Beta.
evaala: All the API docs that I've received with Java Web Server 1.1 regarding the HTML package is one page that is titled sun.server.websert.html. There is nothing else on the page except this title.
SPK-connie: That's a problem. There should have been content on the pages. We will fix that as soon as possible. If you let us know your email address, we'll contact you directly. We'll also notify the interest list (jserv-interest).
dkornbluh: If I develop servlets for the Java Web Server, will my code be portable to Netscape enterprise, or other vendors' servers? Also, what kind of cooperation is taking place between SunTM and other vendors on the servlets API? For example, IBM's WebRunner claims compatibility, but they have "extensions" in their API. Will Sun adopt these?
SPK-driscoll: There are already several servlet compatability packages for various servers. Native support is coming for Apache, and I've heard Netscape has announced servlet support in an upcoming version. As for WebRunner, this is the first I've heard of extensions—I'll check them out. Addressing compatability, we will be releasing a servlet compatability test as a part of the Java Compatability Kit.
dkornbluh: What is the recommended technique for debugging servlets?
SPK-driscoll: We'll be addressing servlet debugging in upcoming releases. For now, we recommend using a lightweight servlet runner like srun. You can run with println to check on the state, or run the the actual sun.servlet.http.HttpServer class in a step debugger with the number of threads turned down to a minimum.
bentcd: I understand that the Java Web Server is a full-fledged web server. Are there any plans for minimal-size servers—for use in environments with little memory, such as Java-based microchips?
SPK-connie: Yes, some work is being done in this area, but there are no product announcements yet.
tony: Could you give us some links to web sites that are using the Java Web Server?
SPK-connie: Point your broswer to www.netcraft.co.uk, which will give you a listing of over 160 sites using the Java Web Server.
hubick: Are the HTTP classes unified between Java Web Server and HotJavaTM, and is it possible for me to use them to write my own HTTP clients and servers with different functionality? Can we expect any API synergy between JavaSoft and the Jigsaw project at the W3C?
SPK-driscoll: The classes address different needs: the client and the server. We offer a source product for writing servers in general. We are looking into other product possibilities. As for synergy between JWS and Jigsaw, the primary author of Jigsaw now sits two doors down from me, so the possibility is certainly there.
scotthut: Could you add to the README for the libserver.so in the future? The difference between libserver.so and libjsafe.so and isn't extremely clear. Although I am not certain about the libjsafe.so library.
SPK-driscoll: libjsafe.so contains all the SSL and crypto code. libserver.so contains all other OS-specific code.
SPK-connie: I will pass this request on to our doc writers as well.
dkornbluh: Is there a usenet forum for Java Web Server? Any other web sites or discussion groups that might be a source of support?
SPK-connie: comp.lang.java.programmer and our interest list jserv-interest@javasoft.sun.com will keep you up to date on what is going on with the Java Web Server.
JoeSam: I'm sure that efficiency is critical in a server product. Do you have any general tips, techniques, or discoveries that would be applicable and helpful to Java application developers?
SPK-driscoll: We learned several interesting performance tricks writing the JWS. Most are already commonly known: avoid synchronization, if at all possible, and use bytearrays instead of strings when you can. One addition to this list, that isn't commonly known is when writing very, very fast multithreaded code, avoid creating new objects as much as possible.
jhunter: Currently if a servlet calls System.exit(), it kills the entire Java Web Server. Are there any plans to make the Java Web Server more reliable by installing some simple security manager—even for locally-loaded servlets? And if so, wouldn't that make it more difficult for a servlet to act as an RMI client, since it couldn't use the (necessarily restrictive) RMISecurityManager. Is there a good solution here?
SPK-driscoll: This a hard problem that we're working on. At one point, we were discussing sandboxing local servlets, but that's apparently run into some difficulty.
Note that remotely-loaded servlets, including those loaded from localhost, are sandboxed.
evaala: Can a servlet grab inforation about the client that is making the request, such as an IP address or DNS info; which could be used with session tracking, which could then be used to verify that a hacker has not stolen the session? Is this a possibility? Or can a hacker still send false information to the servlet, and still steal the session?
SPK-driscoll: If that kind of security is your concern, SSL is the only answer. A malicious hacker can always spoof IP. It's neither easy nor likely, but it is possible. SSL was designed to deal with exactly this.
SPK-connie: I have a question for the group. Can you tell us what you'd like to see in future releases of the Java Web Server?
As you may know, our 1.1 release has several new features: HTTP 1.1 support, page compilation, session tracking, and HTML generation. We want to make sure that future releases contain the features that you need to develop your web applications.
whitten: Can the Java Web Server run along side of another, preexisting server (e.g. Apache) so that each handles its own domain names (IP)?
SPK-driscoll: Yes, several customer sites tell us this is exactly how they're using our server. You can bind either to a different port number, or to a different IP on the same port.
SPK-driscoll: Has anyone here tried page compilation? How'd you like it?
whitten: If performance becomes an issue (due to increased volume), can the Java Web Server be native compiled for the target machine?
SPK-driscoll: In general JavaSoftTM believes that performance issues can be handled by better VMs, not native code. It would be an interesting exercise to try out a compiled version of our code, but I doubt we'd see much improvment over a good JIT. We're already faster than Apache when running with native threads and a JIT on a two processor Solaris box. 50 million hits a day (our spec number) is far more than most people will ever need.
arybicki: We all know that 1.1 will add session management, and that is great. What helper functionality will 1.1 have to use the session management on "cookie-less" clients?
SPK-driscoll: For clients that don't handle cookies (which at this point is pretty much everybody, unless they deliberately turn off cookie support), we offer URL rewriting.
dkornbluh: How robust is the NT implementation at this point (i.e. Alpha 1.1)? I'm having some fundamental problems that I assumed were due to my inexperience (and they may well be), but I haven't even been able to load the HelloServlet! All of the sample servlets are working, and I can even modify these and see the changes take effect. But any app that I add via servlet administration fails to load. Any clues?
SPK-driscoll: It's hard to say without more information. Are you running as an NT service?
Odds are high that you are missing something fundamental, as you say. Try running it as a user process first, and see if that helps. Also, remember that we ignore the classpath set in the environment. If you have further problems, you can ask the interest list, which I regularly post to.
evaala: I have not used page compilation yet. However, when a .jthml file is converted to a servlet, does this servlet have to be preregistered, or is that done automatically whenever a new jthml file is encountered?
SPK-driscoll: Yes, it's all handled automatically.
tony: Can you give us a little overview of the Server Toolkit. Specifically, why/how would I use it for creating my own Java-based servers, such as FTP, etc.
SPK-connie: The Java Server Toolkit is current a source code product that gives network programmers the ability to write programs with integrated connection, thread management, security, and administration. This is a very expensive product.
We are investigating a lower-priced binary release of the toolkit, but we have no dates yet.
scotthut: I seem to lose connections (stalling), although JIT seemed to speed up everything. The port is for PPC, and we haven't been able to validate it due to non-commercial license. Any ideas?
SPK-driscoll: What OS are you using? I did recently discover a bug that could cause a server stall, but only when there was a serious environmental error (like running out of memory) already.
scotthut: It's a linux port, based on Steve Byrnes.
SPK-driscoll: There's a known bug in the Linux JDK that effects us—there should be a "how to" at blackdown that addresses this.
jhunter: How does this chat applet work? Does it communicate with a servlet?
MDR-Andrea: Check out the article entitled "Burrowing Through Firewalls" (http://developer.javasoft.com/developer/
javaInDepth/burrow/burrow.html) on the JDC site, located in the "Java In Depth" section.
whitten: Can we assume that, in general, performance is not an issue for the Java Web Server? Should we feel confident in using it for sites that will be receiving close to 1 million hits a day? More generally, are there any issues that would preclude the universal use of the Java Web Server for all web sites?
SPK-driscoll: Actually, that's exactly our goal. We'll be announcing a site soon that's using our server for millions of hits a day.
As for limitations, I think our largest is CGI support. We'll be addressing that in an upcoming release.
whitten: Does the Java Web Server handle virtual host aliases without explicit IP numbers for all browsers, or only those supporting HTTP 1.1.?
SPK-driscoll: This is an involved question. We do IP multihoming, and Host: header-based virtual hosts. The second type requires cooperation from the browser, but is supported by Internet Explorer 3.0 and Netscape 3.0, as well as Internet Explorer 4.0 and Netscape 4.0, so most people are covered. Hope that answers you question.
MDR-Andrea: Thanks to everyone for joining the forum today, and thanks especially to Connie and Jim. Come back next week when we will be discussing the new JDK 1.2. Be sure the check the schedule for times and topics. Thanks again, have a great day.
