Best way to use Constractor

I had been working as consultant for about two months already. One interesting thing I found in those days regarding how to use consultant effectively.

1. Hire technical expert as technical leader, so other team members can learn from him. This way is better than hiring a trainer. This works very well if this company run into a new technical area.
2. Hire Junior consultants doing heavy load and lower technical tasks. Also those works are perfect for outsourcing.
3. Team members should include both full-time and contractors. A team contains only contractors will face long term maintainability issues in the long run. Some one in the team should audit the quality.

"Knowledge can be conveyed, but wisdom is only earned by experience of trying"

Check List for new project before coding

I recently read a article talking about check list before coding, it is very interesting, please check the link

Mutable and Immutable Objects for Java

Below it is a nice article regarding this topic.

what is portalet and portal (JSR168)

Please reference this article.

4 mistakes regarding tomcat

I just read a article regarding tomcat, please check.

About session security

Today I read a good article regarding session security, I want to share with you.

Please click for article

Below it is the summary.

Always regenerate a session ID (SID) when elevating privileges or changing between HTTP and HTTPS.
Check for suspicious activity and immediately destroy any suspect session.
Store all session information server-side, never store anything except the SID in the client-side cookie.
Confirm SIDs aren't from an external source, and verify the session was generated by your server.
Don't append the SID to URLs as a GET parameter.
Expire sessions on the server side, don't rely on cookie expiration to end a user session.
Use long and unpredictable session IDs.
Properly sanitize user input before setting headers with them.
When a user logs out, destroy their session explicitly on the server.
Check your session configuration.
Force users to re-authenticate on any destructive or critical actions.

Spring singleton and prototype

Recently I was asked something regarding spring singleton, below are some of my thought.

1. First Spring singleton is not same as java singleton. For example.

SampleBean beanOne = (SampleBean)context.getBean(“sampleBean1”);
SampleBean beanTwo = (SampleBean)context.getBean(“sampleBean2”);

Evern in spring application context, samepleBean1 and sampleBean2 refer to the same implementation, they are still not the same.

In Java singleton, they are the same thing.

2. For exmaple:
SampleBean beanOne = (SampleBean)context.getBean(“sampleBean”);
SampleBean beanTwo = (SampleBean)context.getBean(“sampleBean”);

Under singleton scope, beanOne is the same as beanTwo.
Under prototype scope, beanOne <> beanTwo