development

To ensure the quality and safety of Web applications, security testing is a necessity. So, how do you cover all the different threats-SQL injection, cross-site scripting, buffer overflow, and others? James Knowlton explains how Ruby combined with Watir-both freely available-makes a great toolset for testing Web application security. Testing many common security vulnerabilities requires posting data to a Web server via a client, exactly what Watir does. The Ruby side of Watir, a full-function programming language, provides the tools for querying the database, checking audit logs, and other test-related processing. For example, you can use Ruby to generate random data or large datasets to throw at a Web application. James describes common security attacks and demonstrates step-by-step examples of testing these attack types with Ruby and Watir.

Development teams often are unaware of the commercial impacts of the software improvements they deliver. Often, the prioritization of work is done based on technical, rather than commercial, considerations. Based on a real-world example, this story explores the commercial benefits enabled by delivering in short release cycles and prioritizing according to bottom-line benefits.

A major challenge for software organizations is to create software that can continue to adapt and change over time-a codebase the team can live with "forever." Jeffrey Fredrick and Paul Julius review the concepts and features of CruiseControl, a popular continuous integration tool that provides an architecture for habitable code. CruiseControl is an open source success story, contributed to by more than 200 different developers and downloaded more than 400,000 times. For developers who are tired of brittle code that often must be discarded and rewritten instead of reused, CruiseControl provides valuable lessons and a design that encourages reuse. Jeffrey and Paul discuss inversion of control, dependency injection, separation of concerns, and the role of a project architect in creating habitable code. Although the code examples will be in Java, the principles are language independent.

Joining an agile team can be very challenging-new programming styles, new coding standards, new check-in requirements, new leadership styles, and more. Adding pair programming to the mix can be "the straw that broke the camel's back" or it can be key to team empowerment. Paul Julius has been a dedicated pair programmer since 1999, working on many projects with 100 percent pairing. Paul has distilled a set of positive and negative patterns that can develop when teams attempt pair programming. He begins by discussing the most frequent objections to pairing and then outlines why pair programmers deliver better applications. Paul demonstrates the techniques and skills you-or members of your team-need to become a successful pair programmer.