adb - getting inside your Android simulator

I've been working with persistent state between launches of my Android application and wanted to easily inspect my application data between launches. I discovered the power of the Android Debug Bridge or adb tool. In short a dev tool that lets you hook up against a running Android simulator.

You'll find it in your sdk folder under platform-tools. On my machine:
C:\Program Files (x86)\Android\android-sdk\platform-tools\adb.exe

A few handy commands:

- List currently running devices:
>adb devices
List of devices attached
emulator-5554   device

- Launch a terminal shell against a running device
>adb -s emulator-5554 shell

Then you can do your ordinary linux stuff like cd, ls, cat etcetera to get to know your Android device.
My happiest discovery was that the preference file you fetch and save via the SharedPreference API:
SharedPreferences settings = getSharedPreferences("OthelloLegendsPrefs", 0);

are located under the path
/data/data/se.noren.android.othello/shared_prefs/OthelloLegendsPrefs.xml

and is a simple XML file which you can inspect and edit.

So, to pull a file from the simulator to your development computer
>adb -s emulator-5554 pull <remotefile> <localfile>

Similarly, to upload a file to the device
>adb -s emulator-5554 push <localfile> <remotefile>

For more info on adb, http://developer.android.com/guide/developing/tools/adb.html.

How to get character encoding correct on Google App Engine

Character encodings can be a primary trigger for stomach ulcers. My Swedish web applications deployed on Google App Engine have had great difficulties to behave when presented with user input containing for example Swedish characters Å, Ä and Ö.

So here's a recipe for treating such characters with respect.

• Don't use ISO-8859-1 as character encoding. Just don't.
• Instead specify you JSP's to use UTF-8 with something like 

<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>

However, this might not be enough unfortunately. Current browsers might not set a character encoding even if specified in the HTML page or form.

So if you aren't already using Spring, add spring-web to your application and add one of the Spring filters first in your filter chain.

<filter>

   <filter-name>SetCharacterEncoding</filter-name>

   <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>

   <init-param>

       <param-name>encoding</param-name>

       <param-value>UTF-8</param-value>

   </init-param>

   <init-param>

      <param-name>forceEncoding</param-name>

      <param-value>true</param-value>

   </init-param>

</filter>

<filter-mapping>

   <filter-name>SetCharacterEncoding</filter-name>

   <url-pattern>/*</url-pattern>

</filter-mapping>

That's all folks.

Mapping DNS domain to Google App Engine application

I have been working on a small application for promoting and selling books on popular science. I made a prototype and bought a domain name so I can setup all trackers and Amazon Affiliate accounts. I deployed the prototype as a Google App Engine application. Using GAE you can have a site up in 3 minutes.

When you deploy your GAE app, it will automatically get DNS mapped as yourappid.appspot.com. So in my case the app resides as http://popularsciencemedia.appspot.com in the Google cloud. From the Swedish DNS supplier Loopia I had bought the domain popularsciencemedia.com and now simply wanted to DNS remap popularsciencemedia.appspot.com to my own http://www.popularsciencemedia.com.

This is not as easy as you might think! The obvious solution would be to create a DNS CNAME entry with an alias to reroute traffic to www.popularsciencemedia.com to http://popularsciencemedia.appspot.com but but Google won't allow that. So I thought I'd write a few lines on how you do it to avoid you from the same misery. The purpose here is to map www.popularsciencemedia.com since Google App Engine only can be mapped to sub domains. www is good enough for me.

• You need to sign up for Google Apps for you application. Go to https://www.google.com/a/cpanel/domain/new and enter your registrered domain name and fill in the forms. You will in this process create a system user for this Google App. In my case I created the user admin@popularsciencemedia.com. Google Apps let's you create emails, calenders and much more for your app.
• This process will need you to verify that you own the domain. There are several ways to do this, I thought the easiest way was to add a Google verification code in the DNS registry as a TXT entry. The DNS record now looks like this. If you can't create TXT records with your DNS provider Google has other mechanisms for verifying that you own the domain.

$ORIGIN popularsciencemedia.com.
$TTL 300
@ SOA ns1.loopia.se. registry.loopia.se. (
    1312117911
    3H ; Refresh after three hours
    1H ; Retry after one hour
    1W ; Expire after one week
    1D ) ; Minimum one day TTL

@    IN 3600 NS ns1.loopia.se.
@    IN 3600 NS ns2.loopia.se.

@    IN 3600 A 194.9.94.85
@    IN 3600 A 194.9.94.86
@    IN 3600 TXT google-site-verification=Uy4magKHIasdeEOasdgs6b7qYt8tR8

*    IN 3600 CNAME ghs.google.com.

www    IN 3600 CNAME ghs.google.com.

• Notice the additions. The TXT entry maps against the value you get from the Google App sign up. This makes it possible for Google Apps to verify that you own the domain you claim to own. Then, add also a CNAME mapping to ghs.google.com for the subdomain www since this is the sub domain we want to use.
• Now to to your Google App account, go to something like https://www.google.com/a/cpanel/popularsciencemedia.com. Under Sites-> Services -> YourAppId (App Engine) there should be a possibility to add a new address under the domain you have registrered. 
• I add www so my app is mapped as www.popularsciencemedia.com.
• After a waiting a very short while all DNS changes seems to be working and I can surf to http://www.popularsciencemedia.com/

Profiling an Android application tutorial

I'm spending some spare time on an Android Reversi game which could need some performance tuning. After figuring out how the tooling works for Android profiling it works like a charm.

There are two ways to profile an application, using the debugging server DDMS or manually decide which parts of the code base are interesting for inspection. DDMS could be useful if you are inspecting code you might not be able to recompile. DDMS can also be used to inspect memory usage and more.

The easiest approach however is to use the debug interface provided by the Android API in your sources to specify when to start generating profiling information and when to end.

public int[] alphabeta(Board b, int maxDepth, long maxTime) {
      
      Debug.startMethodTracing("othello_profiling");

      // Here goes code to profile
  
      Debug.stopMethodTracing();
      return result;
   }

Run your program and you'll see in the VM logs when the profiler kicks in. (As usual the performance of your app in the emulator will sink to the bottom when profiling is enabled)

Now you got your profiling info written to the SD card of your Android emulator device. If you run into permission issues when writing to the SD card, add something like this to your Android Manifest.

<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />     

To fetch the file to your development computer use the adb tool that comes with the Android SDK. On my Windows machine I did something like this.


C:\Program Files (x86)\Android\android-sdk\platform-tools>adb pull /sdcard/othello_profiling.trace c:\temp\othello_profiling.trace
126 KB/s (2266911 bytes in 17.491s)


The tool traceview can interprete the file.

C:\Program Files (x86)\Android\android-sdk\tools>traceview.bat c:\Temp\othello_profiling.trace


Voila! You get a profiling view similar to what you get from common profilers like JProfiler, hprof etcetera. Here you can see each methods execution time and which parents and children methods it has connection to and much more.

Theres more you can do with the trace file. Traceview can also show you each threads exectution and calls in chronological order. You can simple zoom in on the interesting parts.

You may also want to try the tool dmtracdedump to create graphs over your call stack. See the Android documentation for more information.

Dropbox - is it safe to put you files in the cloud?

I really like the simplicity of sharing files with Dropbox. I haven't gone full circle yet, but I have been moving a substantial part of my personal stuff there.

I hadn't thought much about the security of it, but when listening to Steve Gibson and Leo Laporte on the Security Now podcast (http://www.grc.com/securitynow.htm, or search for it on iTunes) examining Dropbox, I got an eye-opener that you can't assume an awesome service to by definition have awesome security. 

First of all, Dropbox have claimed that not even their employees are able to see your data. Great! But in a recent change in the terms of agreement it says that the authorities due to US regulations can ask Dropbox to decrypt your data in certain crime investigations. Allright, I'm a good guy so that's not a problem for me. But that means that Dropbox must keep my encryption key in their vaults instead of me doing a client side encryption/decryption of my data. Interesting, that means that a bad apple Dropbox employee also have the possibility to look at my data without my knowledge. Not to mention what would happen if Dropbox would lose the table of private keys in some master planned hacking or insider heist.

So, the lesson should be. If you have some valuable or sensitive data, you should probably encrypt it before even dropping it into Dropbox.

Well, that applies to companies or people with more valuables than family photos like me.

Issue two might be more concerning, Derek Newton, http://dereknewton.com/2011/04/dropbox-authentication-static-host-ids/, has looked into how your Dropbox client authenticates against the cloud service. It seems like all you need is a config file which is set up at install time. That file contains your hostid which is your authentication token against Dropbox. The bad thing is that if someone by social engineering, a trojan or other malware gets a copy of this file, they can access your Dropbox account from any machine. Changing your password is not enough since this is an access token. You must remove your own machine as a valid host from Dropbox to stop the bad guy from using your account. Most probably you won't even know someone is eavesdropping on you.

These guys also seems to trust the cloud a bit too naively
https://forums.aws.amazon.com/thread.jspa?threadID=65649&tstart=0

Twitter integration using OAuth

So my Rankington application hosted on Google App Engine wants to read tweets containing mentions of keyword 'rankington' and also update the status of the Twitter system user Rankington on certain occations. There are loads of Twitter APIs out there for Java. Here's a short guide on how get going with Twitter4j and some handy knowledge of OAuth.

Download Twitter4j from http://twitter4j.org/en/index.html. If you wish to do only reads against Twitter you don't need to authenticate in any way, but if you wish to post status updates or similar you must provide credentials for the Twitter user you are using. In the past you could authenticate against the Twitter REST APIs using user/password but this has been shut down by Twitter since August 2010. So don't try that via the Twitter4J API which has not deprecated that code yet.

OAuth

Twitter is now using OAuth as access mechanism. If you are familiar with OpenID you could compare OAuth to OpenID in the sense that OpenID is a decentralised identification infrastructure, whereas OAuth solves authorisation in a decentralised way. OAuth is a RFC under standardization of the IETF. For example the Google Docs API and other Google APIs have recently added OAuth as access restriction mechanims for their REST APIs.

An example of using OAuth would be that you have some resources on a site A, say some private photos. You wish to let another site B access those photos in order to incorporate them into a photo stream or whatever, but you don't want to hand your identification credentials for site A to site B for obvious security reasons. Instead you wish to delegate authorisation to site B to access resources on site A.

What will happen is that site A and site B shares a common OAuth secret. Without going into the handshaking details you will surf against site B and an authorisation request will redirect you to site A where you will be asked to grant site B permission to the appropriate resources. Once redirecting back to site B, an OAuth token will be handed to site B which can be used from now on to access precisely the set of resources granted from site A using the access token. Check out the RFC if interested at http://tools.ietf.org/html/rfc5849.

Twitter4J and OAuth

So, in our case, Twitter is site A and Rankington is site B (service provider and client). To create the shared secret which will be generated by site A (= Twitter), go to http://twitter.com/oauth_clients/new and create a pair of secret keys. A consumer key and a consumer secret. 

A very basic test of this could be:

public class TwitterBridge {
    
    private static String key = "abcaasdkj1231231lkj123";
    private static String secret = "asdkj7987asdjl12312lkj4323423423";
    
    public static void main(String[] argv) throws TwitterException {

        Twitter twitter = new TwitterFactory().getInstance();
        twitter.setOAuthConsumer(key, secret);
        RequestToken requestToken = twitter.getOAuthRequestToken();
        System.out.println(requestToken.getAuthorizationURL());
        
        // Breakpoint here and update value of pin from what
        // what you get in browser when surfing against
        // authorisation URL above.
        String pin = "7117195";
        
        AccessToken accessToken = twitter.getOAuthAccessToken(requestToken, pin);
        
        System.out.println("Token: " + accessToken.getToken());
        System.out.println("Token secret: " + accessToken.getTokenSecret());
        
        Query query = new Query();
        query.setQuery("rankington");
        
        QueryResult queryResult = twitter.search(query);
        
        List<Tweet> tweets = queryResult.getTweets();
        for (Tweet t : tweets) {
            System.out.println("From: " + t.getFromUser());
            System.out.println("Time: " + t.getCreatedAt());
            System.out.println("Text: " + t.getText());
        }
        
        twitter.updateStatus("New tweet!");
    }
}

So put in your consumer key and secret in the code above as key and secret. Then debug these lines of code.

System.out.println(requestToken.getAuthorizationURL());

will print something like
http://api.twitter.com/oauth/authorize?oauth_token=51IMwiqF8MfEdcNDZxzUgV3guqCpQK6VbFZasdl

Open that link in a browser and you will be prompted
to identify yourself against Twitter, unless you are logged in automatically. In the same dialog you allow the client application "rankington" to access Twitter in your stead.

A bit confusingly, we login as user "rankington" on Twitter and allow application "rankington" access. This is just conincidence that the names are the same in this example.

When granted access, a verification code will be shown. Copy this code and either rerun the Java program or insert it into via the debugger as the variable "pin".

Continue to run the program and the Twitter4J API will verify the pin code against the Twitter REST API and receive an access token. We print this and it will look something like

Token: 45335176-3NEtmOsdfsacZROM9ow3sdfsdfHm5dfu0ShNGTdN2CKw
Token secret: nOXQish8asfasiq4tZINEOJuDasdYDQC4dBJiAM3k

All good. These are the important values which we can use to create a new AccessToken in the future.
The end of the program makes a query for tweets concerning status updates containing "rankington". That would print:

From: rankington
Time: Sun Apr 17 01:10:48 CEST 2011
Text: Rankington alpha is out! Follow progress at http://macgyverdev.blogspot.com
#rankington

And in the end, the program makes a status update in the name of the Twitter user "rankington".

So, now we got all ingredients, all keys and secrets for OAuth authority delegation. The piece of code we can use in our real application is the following.

private static String key         = "3649LZ3sasdasdpXWFHkHxaWQQ";
   private static String secret      = "aFOb86GmafgKtTasdasq3CpcwQw7bA";
   private static String token       = "28326asdasdasdD1ZxVDDL5Mqe7H";
   private static String tokensecret = "7Klyasdasdasdwpc8Xbtm0IsiRA";

   public static void main(String[] argv) throws TwitterException {
        
        AccessToken accessToken = new AccessToken(token, tokensecret);
        
        ConfigurationBuilder confBuilder = new ConfigurationBuilder(); 
        confBuilder.setOAuthAccessToken(accessToken.getToken()) 
                   .setOAuthAccessTokenSecret(accessToken.getTokenSecret()) 
                   .setOAuthConsumerKey(key)
                   .setOAuthConsumerSecret(secret); 

        Twitter twitter = new TwitterFactory(confBuilder.build()).getInstance(); 
        
        Query query = new Query();
        query.setQuery("rankington");
        
        QueryResult queryResult = twitter.search(query);
        
        List tweets = queryResult.getTweets();
        for (Tweet t : tweets) {
            System.out.println("From: " + t.getFromUser());
            System.out.println("Time: " + t.getCreatedAt());
            System.out.println("Text: " + t.getText());
        }
        
        twitter.updateStatus("New tweet again!");
    }

You see that we create the AccessTokens needed to authenticate against Twitter using the keys and secrets previously negotiated as a one time routine. The application can now tweet in eternity unless the user revokes the authorisation for the client.

With my basic understanding of OAuth, it feels like a great standard for interconnecting all service providers we got in the cloud. 

Hudson - Continuous Integration for a Google App Engine application

The last blog post described how to configure a Maven project for a Google App Engine application. 

To build and deploy the Maven artifacts you will need some command line hacking.

Hudson CI can be used to escape the command line for all this. Hudson is a continuous integration system for building and testing your projects. It has some cool features as distributed building and much more.

To install Hudson, or Jenkins as the main fork has rebranded it now after Oracle came into clinch with the open source community, simply download the war-archive from either the Jenkins or Hudson web site. My installation is old so I use a Hudson build.You can either deploy it in a web container such as Tomcat or simply use the built in bootstrap. To bootstrap the war archive

java -Dhudson.udp=32850 -jar hudson.war --httpPort=9090 --daemon --logfile=/home/johan/hudson/hudson.log

Access Hudson via http://localhost:8080/.

Goto Manage Hudson -> Configure System and enable Maven under the Maven subsection. Goto Manage Hudson -> Manage Plugins and install the plugins you need. In my case I have installed Cobertura Plugin for code coverage, Findbugs for static code analysis, Maven2 Project Plugin, checkstyle for Java code validation and the CVS plugin. You might need to bring in some sub dependencies like Static Analysis Collector Plug-In, static Analysis Utilities.

Now create a new job, under your job, click Configure and setup appropriate version control config. In my case CVSROOT=:pserver:rankington:xxxx@213.xxx.xxx.xxx:/cvsrepo

and correct CVS module and branch.

Under Build, choose correct Maven installation, probably /usr/bin/mvn. Then setup your Maven build goals. In this case the goals are, enable debug, clean, compile, test, create war archive and generate reports.

-X

clean

package

findbugs:findbugs

checkstyle:checkstyle

This will make Maven checkout your code, compile it, run the Maven plugins for creating xml reports for Findbugs and Checkstyle.

Now add Post-build Actions to integrate these reports into Hudson. Enable Publish Findbugs analysis results from file **/target/findbugsXml.xml

Add similar report integrations by enabling publishing the following reports target/surefire-reports/*.xml for JUnit tests, **/target/site/cobertura/coverage.xml for Cobertura code coverage and so forth. 

 

Now build your Hudson job by clicking Build Now and the Maven goals are executed to checkout, build, test and creates reports of the project. Then the post action goals kicks in and updates the dashboards of Hudson to show the results of the build.

Cobertura allows you to see on a package level the unit test coverage and the possibility to drill down on package and file level. Similar graphs and drilling can be done on Findbugs, Checkstyle and JUnit test reports.

Cobertura reporting on file level

JUnit test reports over time, red indicates test cases have failed during those builds.

Checkstyle reports Java code issues and the interface makes drilling easy.

In this example Hudson will generate a war archive ready for deployment to a web or application server.

The Maven build could be extended to deploy the war at a local server to also run the web tests as a part of the Hudson job.

If you wish to also incorporate production deployment in the Hudson process you could use the Google App Engine scripting possibilities. Add a build step which does something like this to upload your newly built war archive to GAE.

appengine-java-sdk\bin\appcfg.cmd --email user@gmail.com --passin password update myapp/war

The same script can be used to download logs from production via

appengine-java-sdk/bin/appcfg.sh request_logs myapp/war mylogs.txt

Theres a bunch of more handy commands for scripting GAE if you run through the docs at http://code.google.com/intl/sv-SE/appengine/docs/java/tools/uploadinganapp.html.

Next time I'll try to describe what the production environment offers in addition to the local development environment.