ColdFusion Alive

Mike Chytráček talks about “Lucee Migration (8 CFML code moving tips)” in this episode of ColdFusion Alive Podcast with host Michaela Light.

“...but we had migrated everything over and all new clients went to Lucy all new applications went to Lucy. And within I'd say maybe two years, we had probably 95% of our clients might get it off, some clients still required it”.

https://youtu.be/DsSjRD68H70

Show notes

What is Lucee?

Why did you migrate to Lucee?

2018 switch from ACF  to Lucee

Adobe Licensing fishing call and new licensing model per application with $10ks extra cost.

“SaaS” due to Mura

Per core licensing beyond 2.

Easy trial migration. 

Faster too!

Worked great with both MS-SQL and MySQL

95% clints moved to Lucee

5% don’t understand open source or the support model

Challenges with the migration

Unsupported tags

CFfileupload

CFPDF

Websockets

CFspreadsheet

Arrays and structs passed by reference in Lucee (vs by value)

Scope overwriting for URL scope

ORM

Fixed by removing the ORM and replacing with straight SQL

How Java classes are handled and created

OSGI

EHcache

Requires setup

PDFs

Using wkHTML2PDF and JPG pixel perfect

Via CFexecute

Json keys - Linux and Windows - case issue - ACF uppercases the keys, Lucee keps original case

Results of the migration

CF Admin per site

Mura and Masa CMS built on Lucee

Themes and page builder

Preside CMS

Ortus Box tools

Cost

Esp with more cores

Cloud easy - no licensing issue

Faster to “buy” - no wait on licensing portal of ACF

Runs faster

Smaller install / load profile

Support - via Slack or Lucee forums

Less server issues with Lucee than ACF recently

Regular (monthly) Lucee point update, easy rollback

Why are you proud to use CF?

WWIT to make CF more alive this year?

What are you looking forward to at CF Summit?

CF and AI

CF Camp

CF IDE ideas. AI thoughts. 

 

Mentioned in this episode

Lucee migration guide

Calling Java from Lucee

Masa episode

Preside CMS episode

Copilot episode

Unity pay per download

Listen to the Audio

Bio

Mike Chytráček

Owner

Mike first taught himself how to program on the Commodore 64 he received as a Christmas present in 1984.  He was soon fascinated by the concept that you could plug your computer into a phone line and have the computer connect to other computers where you could meet new people and share ideas.

 It only seemed like a natural progression when he first discovered the internet in 1994.  While simultaneously nurturing an IT career, he learned how to develop applications for the internet While working for a Chicago area dealership, he launched one of the first car dealership websites in the area (for 1998) and the only dealership that had it's inventory listed and updated daily.  In 2000 he went to work for a small development company, SGSNet, in the Chicago area where he met future partner, Jeff Meister, and worked with clients like Ty, Gatorade, Carr Futures and Wilton Industries.  In 2003 that small company was bought by Whittman-Hart, and by 2005 Mike and Jeff left Whittman-Hart to form Ignite Solutions and many clients followed them; Wilton Industries, Quaker/Gatorade, Dehnco to name a few.

Mike is married with two children and in his spare time enjoys music, reading and spending as much time fishing the surf in the outer banks of North Carolina.

Links

Website: http://www.ignitesolutions.com

Mike Chytráček | LinkedIn

Interview transcript

Michaela Light 0:01

Welcome back to the show. I'm here with Mike Chaya tech are gonna total balls up your name there. So how do you pronounce it? It's a Triassic. SCI Triassic. It's like a silent that sounds so sci fi and modern.

Yeah, that's how you pronounce it here wouldn't be how do you pronounce it or my grandparents pronounced it? Oh, so we'll talk about that a little later where it comes from. But this episode, we're going to be talking about Lucy migration and the adventures you had when you migrated a whole bunch of apps from Adobe ColdFusion, to Lucy, and lots of tips and tricks for people who are thinking of doing that. And some tools you can use to make your life easier for some of the challenges that come with it. And we'll we'll talk about why you migrated and the benefits you got from it. So welcome, Mike. Thanks for having me. And Mike has been doing cold fusion for more or less forever.

He got started programming on a Commodore 64. I don't think they've ever had ColdFusion run on a Commodore 64. But they probably should do. I'm sure. Brad would would be keen to get it running there. He's got it running on a Raspberry Pi.

Mike Chytráček 1:12

Well, if you can get it running on 64k A memory, I'd be really asked, I'd be impressed to well, you know, they've been making the Lucy, you know, install smaller, and it's down to about 50 megabytes. So yeah, 64k might be a bit of a challenge. But maybe someone listening is up for that challenge. But you now have a cold fusion consulting company calls ignite solutions, and you help our clients with their cold fusion apps. And you've also got two children and you enjoy playing. Do you play music? Or you listen to music? I wasn't quite sure from your bio. I'm not most of us music, mostly. But I'm not very good. Oh, well, maybe maybe 2024 Is the you will become better guitar you never know.

Read more

 

Michaela Light is the host of the CF Alive Podcast and has interviewed more than 100 ColdFusion experts. In each interview, she asks "What Would It Take to make CF more alive this year?" The answers still inspire her to continue to write and interview new speakers.

Michaela has been programming in ColdFusion for more than 20 years. She founded TeraTech in 1989. The company specializes in ColdFusion application development, security and optimization. She has also founded the CFUnited Conference and runs the annual State of the CF Union Survey.

 

Join the CF Alive revolution

Discover how we can all make CF more alive, modern and secure this year. Join other ColdFusion developers and managers in the CF Alive Inner Circle today.

Get early access to the CF Alive book and videos

Be part of a new movement for improving CF's perception in the world.

Contribute to the CF Alive revolution

Connect with other CF developers and managers

There is no cost to membership.

Denny Springle talks about “ColdFusion Legacy app - Is a Refactor Better than a Rewrite?” in this episode of ColdFusion Alive Podcast with host Michaela Light.

“Refactoring is a way of taking in modernizing code that already exists, and bring it up to speed with generally modern best development practices. So you know, some object orientation, data modeling type of thing, as well as you know, either using a framework or building an application framework yourself, that hits all of the major obstacles that are that a framework will do for you generally”.

https://youtu.be/_assa85CJQc

Show notes

Why is refactoring vs rewriting important today?

vs 3rd option - leave the legacy app unchanged…

Risks and rewards for each, best approaches

Security, hacking risk and biz reputation

Dev elegy to spaghetti

Old style code with CF tags (vs CFscript 

Tech debt

Urge to rewrite

What does refactoring mean?

Modernize existing code in place in production app

Adding/improving framework 

Improving datamodel

Incremental improvement that is always working

Opportunity to get into the depths of the code and business logic 

Reuse 

Security

Performance

Feature flags

New Ben Nadel book on this coming out soon

House in dark analogy

What does rewriting mean (really)?

Understanding all the business logic and intelligence up front (and documented!)

What really is the biz problem being solved

No original devs or business users left 

May be to a new language, platform, database, OS/Cloud provider

Or may be the same language, new version/upgrade. 

Recreate data model

What are the risks and disasters of rewriting that you have seen?

He was the “rewrite kid” in younger days

Underestimate analysis time for understanding business logic

Underestimate time for coding and testing

Risk of project failure 

Users don’t accept the radically changed system or UX

Now is is the “refactor” man

He as seen 1 successful rewrite out of 5

Worse odds than Russian roulette!

Always 90% done

 After 6 mos “we are 90% done boss”

After another 6 mos “we are 90% done boss”

Rewrite tips

Extensive testing period, including beta testers (actual users)

Only do when simple biz logic or well documented biz logic or big changes in business (merger or regulation change)

Allow long shake down period after release

If possible do slow rollout (how good SaaS work)

Walk us through your ColdFusion refactor process?

Agile sprint

Reusability (and maintainable)

A data model

Move to Common code, objects

Remove Deadwood code, tables, indices, and data

Move to a MVC framework

Why - code organization to Model, View and Controller parts of your code

MVC is a standard in most modern languages

Separating View code lets Switch out front ends - web vs mobile

Easier for UX coders to edit the View code without messing up the CFML code logic or SQL queries

Readability

FW/1 - lightweight

ColdBox - more features and ecosystem

CFWheels

Legacy non-maintained CF frameworks

Fusebox

Model Glue

REST API

REST API is a modern programming pattern

Many 3rd party REST API

All modern web programming languages use them

CF makes consuming or providing REST API incredible easy

One parameter in your CFC object!

Encapsulation of data model and business logic

Different front ends, same API

Not a microservices fan any more

Can become clunky and numerous

Cloud resources and cost go through the roof

Documentation may be lacking

Amazon Prime case study of moving away from microservices

Is Amazon moving away from microservices?

The migration of the Audio-Video Monitoring Service from Microservices to Monolith was a significant change in Amazon Prime Video's architecture. The new architecture utilizes AWS services such as ECS and Amazon EC2 for scalability and flexibility which helped in improving operational efficiency and reducing costs.

In the case study, Amazon Prime Video moved away from serverless components, not necessarily microservices. The team found that the serverless components in their architecture, such as AWS Step Functions and Lambda, were causing scaling bottlenecks and increasing costs. By removing these serverless components and simplifying their architecture, Amazon Prime Video was able to achieve significant cost savings.

Tall servers - lots of RAM and CPU

Why are you proud to use CF?

Started as a sys admin at Java shop and CF was easy to learn and be productive

The business impact of CF RAD coding, features in CFML work better

Continuous improvement and modern features of CFML 

Less code for same results as other languages

CF Community rocks

Modern ecosystem around CF

Friendly competitors 

ACF and Lucee

Other language

WWIT to make CF more alive this year?

More CF developers learning modern methods and design patterns such as MVC, REST API

And teaching and sharing to others

Use ChatGPT, Google and YouTube for learning

Ask in CF community for help

What are you looking forward to at ITB 2024?

Very approachable speakers

Intermate / family gathering event

Mentioned in this episode

132 ColdFusion Hosting options with Dakota Clum and Ryan Brown

Amazon Prime microservices and serverless case study 

Pete 111 CFCasts episode

https://teratech.com/podcast/cfcasts-behind-the-scenes-with-eric-peterson/

Into The Box conference

https://teratech.com/podcast/into-the-box-coldfusion-conference-2022-new-details-revealed-with-gavin-pickin/

https://teratech.com/into-the-box-conference-is-coldfusion-modern-or-dead///////

CFCasts

Listen to the Audio

Bio

Denard Springle

Software Systems Engineer, Mentor, Trainer, Learner

Denard Springle is a polyglot developer that has been engineering software for just over three decades with a focus on ColdFusion and Java development for the past two. As a lifelong learner who has been mentored by some of the best developers in the business, Denard regularly shares his knowledge and experience with others at conferences, user groups and online venues with a strong focus on application engineering using modern best practices. 

Links

Denard Springle | LinkedIn

https://github.com/ddspringle 

Interview transcript

Michaela Light 0:01

Welcome back to the show. I'm here with Danny. And springle is his last name, you may have heard of him, he used to be a very regular speaker. And he's just back on the conference circuit for ColdFusion. We're going to be talking about refactoring versus rewriting, which is incredibly important, because I have seen a lot of coffee developers and CIOs shoot themselves in the foot in this and will reveal which of the two options is more dangerous. I guess there's a third unwritten option, which is do absolutely nothing with your legacy app, which is another dangerous option.

Michaela Light 0:35

So welcome, Danny, those who don't know him.

Michaela Light 1:18

Welcome, Danny.

Michaela Light 1:24

You know, for a lot of people listening have some legacy ColdFusion app. And they may be thinking of rewriting it, or refactoring, or maybe they're not thinking about it at all, and they're just gonna leave it alone. Right. So there are three typical options there. Why is this such an important topic? You know, this year?

Denny Springle 1:48

I think that, for me, personally, I think that the, the decision to refactor or rewrite these be considered carefully, and need to know what all the risks and rewards are for each method. And understanding the different ways of approaching those. I think that that is an important distinction to make between the two approaches to getting what you want out of your application.

Michaela Light 2:28

That no, that makes sense. I mean, people may have, you know, they may think they're supposed to do it a certain way, but they haven't thought through what are the possible risks and rewards? Then what about the unspoken stepchild of you just leave your legacy app in the corner and don't be the new improved? The right that

Denny Springle 2:47

That will ultimately lead to it being hacked nine times out of 10? Yes, unfortunate. Unfortunately, if you if you leave an app alone for too long, it will, it will develop flaws that nobody knew were there until years later. So if you don't, if you don't maintain those things, and you run that risk, surrender, yes, you run the risk of not delivering the tools that you need to whoever your end users are, whether that's internal clients, or external clients were what have you, you know, you run the risk of even losing customers by not continuing to improve your application. So there's definitely a lot of risks of leaving it alone as well.

Read more

 

Michaela Light is the host of the CF Alive Podcast and has interviewed more than 100 ColdFusion experts. In each interview, she asks "What Would It Take to make CF more alive this year?" The answers still inspire her to continue to write and interview new speakers.

Michaela has been programming in ColdFusion for more than 20 years. She founded TeraTech in 1989. The company specializes in ColdFusion application development, security and optimization. She has also founded the CFUnited Conference and runs the annual State of the CF Union Survey.

 

Join the CF Alive revolution

Discover how we can all make CF more alive, modern and secure this year. Join other ColdFusion developers and managers in the CF Alive Inner Circle today.

Get early access to the CF Alive book and videos

Be part of a new movement for improving CF's perception in the world.

Contribute to the CF Alive revolution

...

Monte Chan talks about “GitHub Copilot & AI-Assisted Coding (Unlocking ColdFusion's AI Potential)” in this episode of ColdFusion Alive Podcast with host Michaela Light.

Modernize Your CF App

“It is an AI pair programming tool. So this helps test your programming that basically, there's another person but in this case is a AI tool, if you will, so but you will be doing most of the typing. But then that will also give you some code suggestions, if you will. And to help you with coding. So sometimes can be a short one liner, or could be one whole block of codes. So you can save a lot of typing.”

https://youtu.be/nk27Pr03lXg

Show notes

What is Github Copilot?

An AI pair programmer.

Essentially, Copilot is Auto Complete on steroid. When Copilot generates the codes, it does not know what it is writing.  It is simply trying to predict the next word(s) based upon the information that it has.

Works with VS Code, Visual Studio, NeoVim/Vim, and JetBrains IDEs via extensions

https://docs.github.com/en/copilot/overview-of-github-copilot/about-github-copilot-for-individuals 

Who makes it?

Microsoft who own Github

Why should CFers use Copilot

Helps you write code faster especially when it generate a whole block of code

Write better code esp if your give it self-documenting variable and function names

Can help with JavaScript, CSS and SQl too

Improves a junior developer’s weak area more than it improves a senior developer. 

“Copilot makes you better at what you’re good at and lets you quickly master what you’ve yet to learn.”

“Among developers who use GitHub Copilot, 88% say they are more productive, 74% say that they can focus on more satisfying work, and 77% say it helps them spend less time searching for information or examples.” from https://github.blog/2022-09-07-research-quantifying-github-copilots-impact-on-developer-productivity-and-happiness/

Any reasons to not use it?

Trained on codes found in public repositories – The accuracy of the generated codes depends on the amount of codes in their respective public repos.

The quality of the codes may or may not be good 

It takes the name of your file, the codes before and/or after the cursor in the current file, the currently open files in your IDE, and the codes in the files linked to the current file in context when trying to provide code suggestions.  In other words, as you are building your projects, the accuracy rate should increase.

Does it copy your code to add to its store of code?

Controversy over where the code comes from - copyright issues?

Business version has option to only use code from a your own private GitHub repo

Tips on using Copilot

Be precise and provide details

Be descriptive to your file names, variable names, function names, …etc.

Keep file tabs open especially those files which are relating to the current file.

Keep in mind that Github Copilot is like an Auto-Complete on steroid.  It does not have an idea in which language you are writing.  

The suggested code may not have the correct syntax (ex. Missing a bracket, missing a semicolon, …etc.) or the suggested variables/functions may not exist.

So! Read and test the code generated!

Github Copilot is trained on data found in public repositories.  

So! Put more ColdFusion codes in public repositories.

ForgeBox? Mirror into public GitHub or write an extension

Explain code

Simple bug fixing

Translate code to/from other programming

Demo

Pricing

30 day trial

$10 per month for individuals; $19 for business license per user/mo

Copilot Business comes with Copilot Chat

More on features and differences between individual and business versions https://docs.github.com/en/copilot/overview-of-github-copilot/about-github-copilot-for-individuals 

Has Copilot changed the way your team approaches coding or collaboration?

Helps with common coding standard use and formatting

CF lint

For teams new to AI-assisted coding, there's often a learning curve. 

What advice would you give to other CIOs or development leads considering such a tool?

How much time to learn and get used to it? A hour to learn. A week to get used to it. 

Future of Copilot

Github Copilot X recently announced.  X is a placeholder.  Essentially, it is a family of projects/products which utilize the Github Copilot technology to give a more complete programming experience. 

GitHub Copilot X is a set of technical preview features that extend the original Copilot with chat and terminal interfaces, support for pull requests, and early adoption of OpenAI's GPT-4.

https://github.com/features/copilot 

“The “X” represents a placeholder for where we intend GitHub Copilot to become available, and what we expect it to be capable of doing (e.g. “Copilot “, “Copilot “). It is extending the product from one experience, code completion, to X experiences across the developer’s workflow. GitHub Copilot will always need to be so much more tomorrow than what it currently is today.

Additionally, The “X”, indicates the magnitude of impact we intend to have on developer achievement. Therefore, it’s a statement of intent, and a commitment to developers, as we collectively enter the age of AI. We want the industry to be confident in GitHub Copilot, and for engineering teams to view it as the neXus of their future growth.”

Copilot Chat – Chat-GPT like.  Comes with Individual license now.  Needed to join waitlist before.

Copilot Voice – formerly known as Hey Github. Need to join waitlist.  Program using natural language.

Copilot CLI, Copilot for PR, Copilot for Docs, …etc.

View them at www.githubnext.com  

Need a Github account for all of this.

Microsoft adding Copilot to their other software apps such as Office

https://blogs.microsoft.com/blog/2023/03/16/introducing-microsoft-365-copilot-your-copilot-for-work/ 

Maybe SQL Server too?

Update from Monte: Github Universe is happening right now.  Github Universe is a conference which talks about everything that is going on with Github.  They made their sessions available to the public two hours after the respective sessions are over.  I have watched some of those.  Github Copilot is the emphasis on all of those that I watched. 

There is this session which talks about Copilot specifically.  https://www.youtube.com/watch?v=AAT4zCfzsHI.  It talks about how to integrate our own data to work with Copilot.  You are more than welcome to watch the presentation in its entirety.  However, I want to bring your attention to the presentation starting at around 33:45 mark of the clip. 

The presenter gave an example of how DataStax (a database service provider) created this agent plugin to utilize Copilot Chat to return information specific to DataStax. 

Having said all these, the reason why I brought this up is to answer one of the questions you asked me in the podcast.  How can we make the Copilot experience better?  In addition to the ones that I mentioned in your podcast, now, we can create a plugin to return CF information to the developers.

Looking forward, how do you see AI tools like Copilot shaping the future of ColdFusion development? Do you believe these tools will become integral to the language's evolution or remain as supplementary aids?

Mark Tataka CF AI preso

Adaptation curve

Pace of change

Other AI coding tools

FusionReactor 11 AI tool for performance tuning

ChatGPT

Have to copy and paste code into ChatGPT while Copilot directly sees your code in your IDE (including other related tabs)

Google Bard

AWS CodeWhisperer 

Why are you proud to use CF?

The generosity of the CF community helping other CF devs in groups or conferences

WWIT to make CF more alive this year?

More people sharing their knowledge

What are you looking forward to at the next CF Summit?

New features in ACF 2024

More AI integrations and features

Mentioned in this episode

Github YouTube Channel: https://www.youtube.com/@GitHub 

VS Code YouTube Channel: https://www.youtube.com/@code 

Microsoft Developer YouTube Channel: https://www.youtube.com/@MicrosoftDeveloper 

Github Next: https://githubnext.com 

Github Universe: https://githubuniverse.com 

Other AI coding tools https://www.codium.ai/blog/10-best-ai-coding-assistant-tools-in-2023/ 

Listen to the Audio

Bio

Monte Chan

Monte is a ColdFusion Web developer with 20+ years of web development experience in areas such as education software, health insurance, church web sites, pregnancy care centers, FinTech, and other businesses. 

He is a Senior ColdFusion Developer at CF Webtools. He has used ColdFusion since version 4.5 back in 1999. Has developed web applications which were used in many different industries (ex. Health insurance, education, finTech, e-commerce…etc.) He was one of the co-managers of Alamo ColdFusion User Group.

Links

Monte Chan | LinkedIn 

Monte Chan/Geek Talk | YouTube

Monte Chan | Facebook

Say in message that you do ColdFusion

Email: [email protected] (but you may get a quicker response if you send me a message in Facebook Messenger)

Interview transcript

Michaela Light 0:01

Welcome back to the show. I'm here with Monty Chan, from sea of web tools. And we're going to be talking about an exciting new AI tool for ColdFusion. While and other languages, which is GitHub copilot, welcome, Monty,

Monte Chan 0:16

Both. Thank you. So we are a big fan of this podcast. And it's a great honor to be on this podcast.

Michaela Light 0:25

I am glad we finally got you on. I noticed you were posting on your LinkedIn about the CF summit talk you gave on using copilot ColdFu

Dakota Clum and Ryan Brown talk about “ColdFusion Hosting options (what to consider when choosing a CF host)” in this episode of ColdFusion Alive Podcast with host Michaela Light.

“......you shouldn't have to be trapped with one hosting option or one provider. So when we think about the AWS are the answers of the world, when there's a need for those specific resources are specific tooling and libraries, we want to be able to support that. So, to your point, there's no kind of lock in, or anything like that you shouldn't do one or the other, you should keep all the options open to you. ”

https://youtu.be/fwMKwg_J2QM

Show notes

What is new in CF hosting this year?

Adobe is moving to an annual release schedule

Investment in CF

Adobe committed 10 years of support

What to consider when choosing a CF hosting?

CF support at app level, server layer, 

Responsible esp

updates/hotfix support and proactive patch

CF admin access

All major release of ACF supported and able to rollback to older version during migration if needed

Security

Reliability

Security

Patching

WAF firewall

End point protection

ColdFusion Hosting options

AWS/Google/Azure

Docker containers

Easier clustering on the fly, pay only for time needed

Scalable pricing but harder to budget 

VPS Cloud 

Your own server

Resize on the flip

Faster and easy backup and restore and cloning

Dedicated server

Pay monthly

Shared

Cheaper, but other users can use up resources / crash server

On prem, managed, co-location

Your own ACF license

More control of physical server - he organization rule or in

Load balancing

Cluster CF servers

Cluster database servers

Azure SQL Database

Geo-failover

Caching front end such as CloudFlare

ACF Licensing on your own versus a cloud provider

Adobe cloud license

Bring your own license

CPU Core count

ColdFusion Tuning & Optimization

ColdFusion Installation & Configuration

Config of CF server and JVM

Patches of CF, Java, Windows

JVM memory use

Tuning to your app

CF package manager

Support

Patch & Hotfix support

Dedicated box - they self support as their

VPS level has best support

Shared level has worse support, as the money is not there to pay for it

Might as well self host using Docker and DigitalOcean

ColdFusion Upgrade Protection

Access to new versions for migration testing

Lucee vs ACF

Older versions 

Need for AWS specific features

Docker and Kubernetes 

Backups

Backup strategy and retention time

Onsite and offsite

Disaster recovery (DR) plan

Server, CF server settings, CF code, Database

Protection against ransomware attacks

Test your restores and DR plan

Cost vs Downtime

Future of CF hosting

More CF adoption 

Multi-cloud

Annual release cycle and new features

App hosting pre-tuned vs genetic CF hosting

AI

FusionReactor AI features

CF AI features for security and performance and tuning

Mentioned in this episode

ColdFusion Hosting: How To Choose the Best One 

Fun stories about different xByte customer experiences

Listen to the Audio

Bios

Dacota Clum

Dakota is CTO at xByte Hosting with a specialization in cloud and dedicated infrastructure solutions. He is responsible for delivering secure and innovative solutions that helps organizations reach scale. With a strong focus on customer satisfaction and innovative problem-solving, Dakota possesses a passion for helping organizations adopt enterprise cloud solutions.

Links

LinkedIn: https://www.linkedin.com/in/dakota-clum/

Email: [email protected]

 

Ryan Brown

CMO for xByte hosting

Ryan graduated from Virginia Tech with an Accounting Information Systems degree and has been in the I.T. industry for 28 years. His career began talking to customers about their business needs as a sales engineer for an ERP software company. Since then, he has ventured into product management, marketing, and multiple leadership roles. Beyond knowledge of both software and hardware technologies, he has an expertise in understanding business’ needs and finding the right solution.

Links

LinkedIn: Ryan Brown | LinkedIn 

Email: [email protected]

Interview transcript

Michaela Light  0:01  

Welcome back to the show. I'm here with Dakota Clum and Ryan Brown from ex byte. And we're going to be talking about cold fusion hosting options and what you should be very careful of when picking a cold fusion host. And what's new in the ColdFusion hosting world this year? So, welcome, Dakota and Ryan.

Dakota Clum  0:23  

Thank you. Thanks for having us. 

Michaela Light  0:25  

And Dakota isn't CTO xByte hosting. He's been involved in ColdFusion hosting for over 15 years. And he loves helping organizations with enterprise cloud solutions. And Ryan has been doing it for 28 years. And he's the Chief Marketing ops officer for x y hosting. So great to see you both here. And I'll put their emails and LinkedIn and any other good links that we dream up into the show notes at teratech.com. So I guess I'm curious what is new in ColdFusion hosting this year?

Ryan Brown  1:03  

I mean, we are xByte, that's, that's new. We're new on the scene shaking things up a little bit. So we, we've got tons of experience backing us. But we're, we're I guess we're new to the company is new to the scene. So we're now at the beginning of this year, coming out there shaking things up. And then, of course, Adobe moving to one release every year. That's, that's exciting. 

Michaela Light  1:03  

Yes, I learned that in a previous episode with Kishore from Adobe. What are both of your reactions to the shift annual releases?

Read more

Michaela Light is the host of the CF Alive Podcast and has interviewed more than 100 ColdFusion experts. In each interview, she asks "What Would It Take to make CF more alive this year?" The answers still inspire her to continue to write and interview new speakers.

Michaela has been programming in ColdFusion for more than 20 years. She founded TeraTech in 1989. The company specializes in ColdFusion application development, security and optimization. She has also founded the CFUnited Conference and runs the annual State of the CF Union Survey.

Join the CF Alive revolution

Discover how we can all make CF more alive, modern and secure this year. Join other ColdFusion developers and managers in the CF Alive Inner Circle today.

Get early access to the CF Alive book and videos

Be part of a new movement for improving CF's perception in the world.

Contribute to the CF Alive revolution

Connect with other CF developers and managers

There is no cost to membership.

Gert Franz, Charlie Arehart, Ben Nadel, Mark Drew, and Zac Spitzer talk about “Lucee 6” in this episode of ColdFusion Alive Podcast with host Michaela Light.

“Welcome to the podcast. We’re coming here live from CF camp in Munich, Germany. And we are going to be talking about Lucee 6, the new release of Lucee CFML. And we’ve got some amazing experts here. Mark Drew who's done a lot of Lucee coding at distro kid. Then we’ve got Charlie Erehart, the ColdFusion troubleshooting expert giving an independent view on Lucee. Then we’ve got Ben Nadal all the way from New York City. And he's the top blogger among ColdFusion people according to our annual survey, and then we got good friends from Lucee Association, Switzerland, coming up at the end, but not least. And on the other screen, if you're watching on video, we have some of the attendees from Sierra camp when we open the set. Yay, go attendee. And we'll be opening up to audience questions later in the show. So why don't we just start by just going through each of the four panelists, and I'm just want to ask you, what are you most excited about in Lucee 6?”

Show notes

What are you most excited about the Lucee 6 release?

It is released! (after 2019 announcement at CFCamp 2019) and years of covid it is finally released :-) 

Java integration, easier paths, tag islands

Listeners: query, email, HTTP progress etc

Do want we want to do and add to Lucee independent to ACF

CFconfig, container friendly, cloud friendly now

Fast startup (<1 second), warm up containers

Startup with only One Context halves the startup time

Removed old cruft for flash etc (see shrink label in Lucee jira)

Webinfo folder outside the webroot - more secure - smaller and faster

Pete Freitag Fuseless lamda helped on this

Warmenable = 1 to pre-load these folders

Dot CFS files - pure cf script

How is CFCamp?

Lucee 6 New features

Thread debugging

What does “thread debugging” mean?

Switch to Json configuration - Json config (moved from XML)

Reload config at runtime

Future Json 5 support eg comments https://luceeserver.atlassian.net/browse/LDEV-4583 

Features of Ortus CFconfig built into the Lucee CFML language

ACF can export config to Json too as of ACF 2021

12 factor apps https://12factor.net/ 

some config in environment variables

Eg for production, qa containers

CFtimeout tag

Control how long a section of code runs before forced time out

Raffle Q: How long have each panelist being involved in web devel

Mark 1992 

Charlie 1995 mainframe web dev then CF 1.5

Ben 1999 summer intern CF

Gert 2000 with CF

Michaela 1994 Gopher, HTML, PERL 1997 CF

Raffle Q: What is the oldest domain you registered?

Mark markdrew.com - but no lost it and wants it back

Sold miny.com for much money

Charlie systemanage.com

Ben girls and many other domains

Gert gertfranz.com

Michaela teratech.com 1994

Audience 1995 free domain

Spaces and whitespace in code

Ben use lots

Mark loves spaces

Tabs vs spaces

CFlint on compile to reduce java byte code size

Smaller footprint on disk, less memory, faster startup

Removed unused old Java libraries from default 

Warm up  - expand library images

Performance improvements

DX - Developer experience 

Better error messages

Community driven project

for improving DX

For reporting and fixing issues

How to contribute to Lucee

contributing to the code and docs

Testing the new release

Support contracts to contribute money

Zac works for 80% for Pixl8, 20% for Rasia purely on Lucee 

UX on download page to ask for help

Patreon 

Share about how good Lucee is on your blog, social media

Comment on public forums so the question and answer are google

Dev bottom up, CTO top down (more expensive)

Raffle Q: What is older: CF, PHP, JS

PHP is 4 days older than CF and older than JS by several months

ASP is similar age

CGI and PERL are several years older

Single context mode

What does “single context” mean?

Vs current multi-context in Lucee (and one context in ACF)

Faster server startup

Web sites each have one

Fixing bad CFML defaults

Eg CFLocation AddToken = False is now default

Can set in application.cfc for any parameter eg CFMAIL, Datasource

Local mode

CFtimer tag - to time sections of code, returns the time taken

Favorite Lucee features

Cfscript islands

Pricing

Speed

To what level should Lucee diverge from ACF (if at all)?

Backwards compatibility

Both Lucee and ACF adding new features and learning from each other

Zac and Mart Takarta coordinate improvements

Community evangelists 

Audience comment - backwards compatibility is important 

Enterprise ACF vs open source Lucee

What was the first open source CFML engine

Early version of BlueDragon CFML? No

Smiths project from Switzerland

Mentioned in this episode

Lucee site

116 Lucee 6 Release Features, Behind-the-Scenes, With Zac Spitzer

12 factor apps https://12factor.net/  

Lucee 6 demos for CFCamp  https://github.com/lucee/CFCamp2023

Lucee support contracts

Listen to the Audio

Bios

Gert Franz

Gert was born in 1967 and lives in Switzerland since 1997. He is one of the key people behind Lucee. Back in the late eighties, he studied astrophysics in Munich but switched to later IT as a profession and programmed for several companies in the past as a database administrator and system analyst. Gert spoke a lot at all major conferences in the past and will for sure in the future. He is now a fellow at DistroKid.

Links

Email: [email protected]

Website: http://rasia.ch/

Twitter: https://twitter.com/gert_rasia  

LinkedIn: https://www.linkedin.com/in/gert-franz-4056807/ 

 

Charlie Arehart

A veteran server troubleshooter who’s worked in enterprise IT for more than three decades, Charlie Arehart (@carehart) is a longtime community contributor who as an independent consultant provides short-term, remote, on-demand troubleshooting/tuning assistance for organizations of all sizes and experience levels (carehart.org/consulting).

Links

Twitter: https://twitter.com/carehart

Facebook: https://www.facebook.com/carehart

LinkedIn: https://www.linkedin.com/in/carehart

Web: http://carehart.org/

 

Ben Nadel

Ben Nadel is the technical co-founder of InVision App, Inc - a digital product design platform used to make the world's best customer experiences. As the original CTO, Ben now spends his days as a Principal Engineer, leading maintenance and development efforts on InVision's legacy platform. This includes systems monitoring, database optimization, instrumentation, back-end work, front-end work, product ideation, and research-and-development. He envisions himself as a champion of the User Experience; and often advocates for the User even in the face of internal opposition.

Outside of work-hours, Ben wakes up at 5 am, seven days a week, so that he can attempt to stay on top of the rapidly changing world of web development. He uses these early-morning hours to read, conduct experiments, and write articles for his blog, BenNadel.com, which he has been running since 2006.

Links

LinkedIn: Ben Nadel | LinkedIn

Blog: Ben Nadel blog

 

Mark Drew

Mark Drew has been programming CFML since 1996, and even though he has had forays into Perl, ASP and PHP, he is still loving every line of code he has crafted with CFML. 

He has been a strong advocate for open source, having worked on CFEclipse, Railo and now Lucee, as well as a number of other projects. He tries to create a pull request a day, to keep the bugs at bay.

By day he helps other developers as the lead devops engineer at DistroKid, making sure that the carefully crafted artesanal code goes from laptop to server in the shortest time whilst keeping all its flavour. By night he develops games with CMD:Studio. 

He has been known to do a podcast too! called the Localhost Podcast in which we talk all about the web. He also talks about the process of making games on the Level Design Podcast

Links

Twitter: https://twitter.com/markdrew

LinkedIn: https://www.linkedin.com/in/mdrew

CFML Slack

Email: [email protected]

https://anchor.fm/leveldesign

https://localhost.fm/

 

Zac Spitzer

Senior Software Engineer @ Rasia

80% Technical Lead  @ Pixl8

20% Community Manager @ Lucee Association Switzerland

Originally from Melbourne, Australia

Lives in Berlin, Germany

CFML Developer since 1996, Allaire CF 2.0

Links

https://twitter.com/zackster

https://dev.lucee.org/u/zackster/

https://github.com/zspitzer

Email [email protected]

 

Interview transcript

Michaela Light  0:01

welcome to the podcast. We’re coming here live from CF camp in Munich, Germany. And we have going to be talking about Lucee 6 the new release of Lucee CFML. And we’ve got some amazing experts here. But Mark true. who’s done a lot of Lucee coding at distro kid. Then we’ve got Charlie Earhart, the ColdFusion troubleshooter shooting expert or giving an independent view on Lucee. Then we’ve got Ben Nadal all the way from New York City. And he’s the top blogger among ColdFusion people according to our annual survey, and then we got good friends from Lucee Association, Switzerland, coming up at the end, but not least. And on the other screen, if you’re watching on video, we have some of the attendees from Sierra camp when we open the set. Yay, go attendee. And we’ll be opening up to audience questions later in the show. So why don’t we just start by just going through each of the four panelists and I'm just want to ask you, what are you most excited about in Lucee 6?

Gert Franz  1:09

That it’s here.

Well,...

Kishore Balakrishnan talks about “Adobe CF Summit 2023” in this episode of ColdFusion Alive Podcast, with host Michaela Light.

“We’re going to be talking about CF summit in Las Vegas and what's new and what you need to know about that.”

Show notes

What are you looking forward to at CF Summit in Las Vegas in October 2023?

ACF 2023 released - detailed sessions on new features

Networking with other CFers and Adobe CF engineering team

What performance improvements will be presented?

AI-powered solutions coming in ACF 2024

Adobe is moving to annual release cycle due to the speed of tech change, including AI

Adobe are looking for customers to give ideas for new features too

What is the importance of the summit for CFers?

Becoming a certified CFer

Access to 50+ training videos and take an exam during the Summit or later at a time of your choosing

24 hours of video-on-demand training

Constant updates of new topics are added

Topics and Speakers

Keynote speaker -  Vivek Kumar, Senior Director of Engineering

Call for speakers is open

Sponsors

FusionReactor

xByte

Media3

TeraTech

Dates

Mon 2 - Tue 3 October 2023 main conference

Monday evening event

Wed 4th for the certification

Location

The Mirage Hotel, Las Vegas, Nevada

Student pass

Free to high school and college students

Includes all the conference sessions, networking and t-shirts etc

Need student id

Does not include the evening event (due to alcohol being served there)

Does not include hotel room

Application form on the CF Summit website coming soon

Cost

Session Pass - $99

Access to all sessions & workshops on October 2nd and 3rd

Access to all keynotes, panels, workshops & speaker Q&A

Access to first-day party 

Professional Pass - $199

Access to all sessions & workshops on October 2nd and 3rd

Access to all keynotes, panels, workshops & speaker Q&A

Access to first-day party 

Access to ColdFusion Certification training on October 4th

Registration

Register | CF Summit 2023 (adobeevents.com)

CF Summit India

This is returning!

In early December in Bengaluru, India

Mentioned in this episode

TeraTech Blog post CF Summit

CF Certification

TT ACF 2023 blog post

https://cfsummit.adobeevents.com/ 

Free Student Pass

Listen to the Audio

Bio

Kishore Balakrishnan is a Director - Product and Growth Marketing at Adobe with a Master Degree in Computer Applications. At Adobe, he held roles of a Quality Manager, Program Manager and Senior Product Marketing Manager before becoming the Product and Growth Director. He enjoys being the 'voice of the customer' within the organization, liaise with the sales team to facilitate the selling process and clearly communicate the why, what and when to the marketplace for CF. He lives in Bangalore with his wife and kid. Kishore loves his long runs and cooking.

Links

LinkedIn Kishore Balakrishnan | LinkedIn

Twitter https://twitter.com/kishore31

Email [email protected]

Episode transcript

Michaela Light 00:01

Welcome back to the show. I’m here with Kishore Balakrishna from Adobe. And he’s the head of marketing for ColdFusion. And we're going to be talking about CF summit in Las Vegas and what’s new and what you need to know about that. Welcome Kishore.

Kishore Balakrishnan 00:21

Thanks, Michaela, Thanks for having me. And it was a pleasure talking to you.

Michaela Light 00:26

Yes. Good to see you again. And he’s done a lot of things in Adobe, he’s been the Quality Manager, program manager. And currently, he’s the product and growth Marketing Manager for ColdFusion. So and he’s been involved in CF. He’s been with ColdFusion for like at least 10 years now.

Kishore Balakrishnan 00:49

Yes. Bein in ColdFusion for 10 years. Yes.

Michaela Light 00:52

They should give you some award, you know.

Kishore Balakrishnan 00:56

I will let my manager know, Michaela. Definitely. Yeah, Toby has been very good to me.

Read more

Michaela Light is the host of the CF Alive Podcast and has interviewed more than 100 ColdFusion experts. In each interview, she asks "What Would It Take to make CF more alive this year?" The answers still inspire her to continue to write and interview new speakers.

Michaela has been programming in ColdFusion for more than 20 years. She founded TeraTech in 1989. The company specializes in ColdFusion application development, security and optimization. She has also founded the CFUnited Conference and runs the annual State of the CF Union Survey.

Join the CF Alive revolution

Discover how we can all make CF more alive, modern and secure this year. Join other ColdFusion developers and managers in the CF Alive Inner Circle today.

Get early access to the CF Alive book and videos

Be part of a new movement for improving CF's perception in the world.

Contribute to the CF Alive revolution

Connect with other CF developers and managers

There is no cost to membership.

Guust Nieuwenhuis talks about “MASA ColdFusion CMS (new open source Content Manager)” in this episode of the ColdFusion Alive Podcast with host Michaela Light.

"he’s joining us to talk about MASA CMS, a new CMS launched about a year and a half ago. It’s a fork out of the famous Muira CMS. And we’ll talk about why you even want to use a CMS at all, we’ve got some astounding statistics out of the confusion. State of the Union survey will be run every year that I think are important regarding this.”

Show notes

What is MASA?

ColdFusion Entrepreneur CMS

What is a CMS?

Content Management System

Store content in a database rather than hard coding in CF files

Letting users at your organization edit content directly

Avoids delays from developers updating content

Or users editing CFM files directly and creating bugs in your code

Workflow and control of content updates

Why use a CMS?

Better control of content edits

Safer 

Better features

What CMSes do CFers use?

State of CF Union survey 

Why MASA?

Introduction to MASA CMS

Roots in Mura CMS (open source version 7.1)

1.5 years ago fork from Mura

Rebrand

Legal check

Removed commercial software dependencies so it is 

GPL 2 license 

Source, docs and discussion hosted on GitHub  

Mura changed to closed source in version 10

Enterprise Content Management

Features

User roles, Workflow, version sets, content staging (previous draft)

EU website store sales rules

Security

Features of MASA CMS

UX easy to use

Documentation  

https://docs.masacms.com/ 

New Admin file browser

Layout manager - WYSIWYG drag and drop modules into your content page

Inline edits

Themes

Look and feel of while site, CSS, colors etc

Custom modules

Plugins

Non-visual functionality customization

Admin functionality

Modules

Visual element with code

Widgets 

Text box

Image gallery

Video

Etc

Events

Rich event lifecycle 

Clear naming convention

Many hooks to let you customize MASA using custom plugins

Eg OnBeforeContentSave, OnAfterContentSave

OO approach is good for MASA and not required

ORM and beans

API

Front end JavaScipt access to MASA via API

Adobe API

M-tag 

When creating content in Masa CMS you use the [m] tag for rendering dynamic content. This is a very powerful way to access CFML and Masa functionality. Call CF custom functions from your content. 

Workflows

Create a custom group workflow

MASA statistics

Thousands of content pages

Hundreds of content editors/approvers

Mura backward compatibility

Very easy from the latest Mura open source version (7.1) - just a config file

For earlier versions of Mura, you need to update a bit more in the code.

Guust’s company can help with this. 

Future MASA versions have semantic versioning (https://semver.org/) eg 7.4.1

Major version number = 7

May have breaking changes or big changes

A minor version number with the Major = 4

No breaking changes

Batch version number within the Minor = 1

Small bug fixes

Ember.js is a good example of version numbers

6-week minor version release cycle

When enough changes they roll up all the minor versions to a new major version with depreciations of old features. 

Deployment options on different infrastructure

ACF

Lucee

Cloud and Docker

MySQL, SQL Server, Progress, Oracle

Test suite 

What is the plan for new features?

Roadmap

Headless CMS

Content Mobile

Decoupled CMS

Static content edited via admin in a separate site

How many versions does MASA have so far?

Support agreements

MASA cloud hosting

Going to CFCamp

Mentioned in this episode

MASA CMS

MASA GitHub

Masa CMS Documentation

API Manager Mike Brunt episode 

TechEmpower CF test suite Brad  

Listen to the Audio

Bio

Guust Nieuwenhuis is a Full Stack Web Wizard with experience in a wide range of technologies. Over the last couple of years, he has been involved in projects for various clients like the European Commission, NSHQ (NATO), Adobe, AS Adventure Group, NS (Dutch railways), CZ Groep, Proximus, Avery Dennison and Mediagenix.

Through We Are North, we do ‘Customization-As-A-Service'. We don’t build from scratch: we find the best solutions out there and tailor them to our customers’ business needs. In doing so, we never lose sight of the goal of the client.

In his free time, he plays the double bass and drums, crosses the forest on his mountain bike and coaches the youth at their local football club (where he is a board member as well). He likes spending time with his wife and two kids or meeting friends for a chat, game or drink.

If he still has some time left, he mainly spends it behind his computer to fulfill his hunger for the latest trends in IT.

Links

Guust Nieuwenhuis | LinkedIn

MASA Website 

Website We Are North

CFML slack channel DM

[email protected]

Interview transcript

Michaela Light 0:01

Welcome back to the show. I'm here with Guust Nieuwenhuis, I didn't totally mangle up your duck short Belgium name is it Dutch or Belgium?

Guust Nieuwenhuis 00:07

I'm a bit of both mixture there.

Michaela Light 0:09

And he's joining us to talk about Massa CMS, a new CMS launched about a year and a half ago. It's a fork out of the famous Muira CMS. And we'll talk about why you even want to use a CMS at all, we've got some astounding statistics out of the confusion. State of the Union survey will be run every year that I think are important regarding this. And we'll also look at what's in Mac features in masa, what’s coming up in the future and why it's some really cool software. So welcome, Guust.

Guust Nieuwenhuis 0:51

Thank you. Thanks for having me.

Michaela Light 0:53

Yes, it's good to see you here. If you don't know him, he's a full-stack web wizard according to his bio. I don't know what a web wizard is. But it sounds exciting. And he's been doing cold fusion forever. Working in Europe, the EU and NATO and Adobe and all kinds of clients they have. And his company, we are north. They do customization as a service. So they help customize solutions. And get your apps running using cold fusion and property master as well. And he is an amateur musician, as well as a coach at the local football club. So welcome ghost,

Guust Nieuwenhuis 1:37

local soccer club for Euro-Americans.

Michaela Light 1:41

Oh, for the Europeans listening to soccer for the Europeans or the Americans.

Guust Nieuwenhuis 1:46

Yeah, let's not get that discussion started. Otherwise, it will be no time for Master CMS anymore.

Michaela Light 1:53

Yeah. So what is Master?

Guust Nieuwenhuis 1:58

What is Master Master? First of all, it's a cold fusion-based content management system. And I think, hopefully, one day, we don't need to mention that anymore. But I still do today. It's a fork from MERA CMS. I think many people in the collision community are familiar with NeuRA. And we, for various reasons, forked from Europe a year and a half ago and created our own version of masa, masa, CMS.

Read more

 

Michaela Light is the host of the CF Alive Podcast and has interviewed more than 100 ColdFusion experts. In each interview, she asks "What Would It Take to make CF more alive this year?" The answers still inspire her to continue to write and interview new speakers.

Michaela has been programming in ColdFusion for more than 20 years. She founded TeraTech in 1989. The company specializes in ColdFusion application development, security and optimization. She has also founded the CFUnited Conference and runs the annual State of the CF Union Survey.

Join the CF Alive revolution

Discover how we can all make CF more alive, modern and secure this year. Join other ColdFusion developers and managers in the CF Alive Inner Circle today.

Get early access to the CF Alive book and videos

Be part of a new movement for improving CF's perception in the world.

Contribute to the CF Alive revolution

Connect with other CF developers and managers

There is no cost to membership.

Mike Brunt talks about “Stopping API security hacks cold (using ColdFusion API Manager)” in this episode of the ColdFusion Alive Podcast with host Michaela Light.

"We're going to be talking about API security and ColdFusion, which you may not have considered. This is a whole other attack service surface that your apps can be hacked by."

Show notes

Why does CF API security matter?

Remote API calls: False assumption that APIs your app calls are secure - but they may not be

Local API - is it secure?

Are they still open but not used

API use

“APIs are extremely popular these days, with an average organization leveraging 15,564 APIs in total, up 201% year-on-year.” From this article in TechRadar, from April 2022.

API use is increasing exponentially, which can expose serious security issues. 

Common API use

Legacy database

Other company’s data eg USP shipping tracking

Blockchain

ChatGPT

Amazon AWS features

And many more

What is API

A portal into the middle of your code functionality and data

Sends and returns XML and JSON

CF API Security attacks

Credential Stuffing: Malicious actors using stolen credentials to gain unauthorized access to API endpoints.  Pay close attention to the origin, rate and frequency of authorization requests.

Cross-Site-Scripting XSS: As we can see, many of these attacks already exist in the website world.  Here malicious actors try to insert subversive scripts (often JavaScript) which can be executed.  In this case, validate all input using character escaping and filtering.

Distributed Denial of Service Attacks DdoS: Impose limits on the amount and frequency of data inputs and outputs.

Injection Attacks akin to SQL Injection: Check, sanitize and validate all the data inputs passed via API requests.  In addition ensure that data delivered via the API does not expose any possible vulnerabilities.

Man-in-the-Middle Attacks: Ensure that all transmitted data is fully encrypted.

Actions to protect your CF app APIs

Inventory All Existing API Endpoints

 - This should be a first step in determining what the attack surface could be. This audit should show the actual requirement of each API endpoint and any vulnerabilities shown in the table above.

Both remote API calls and 

Your own APIs

Look at API Manager monitoring

Scan code for CFHTTP calls and CFCs that expose API

Build API Security For New Applications/Features At The Planning Stage

 - As with the applications themselves, any security concerns should be in the very early planning stages of any new apps or features using API endpoints.

Use Strong Authentication And Authorization On All API Endpoints

 - Ideally, there should be no API endpoints that are not strongly secured, if so, these will be captured by the inventory-audit.

Encrypt All Traffic Via TLS

 - Ideally all traffic passing inward and outward should be encrypted and preferably via TLS.

Use A Minimal Set Of Privileges

 - Ensure that users, systems, devices, processes etc, only have the minimum amount of privileges needed to operate. Again, this should become apparent during the inventory/audit.

Avoid using the database SA/System Administrator user in APIs

Expose Only The Very Necessary Data

 - the task of what data is exposed and passed should be determined via the API endpoint and not any application code. Again allow only totally necessary information.

Validate All Input

 - Validate all data passing in and out of an API endpoint; for instance, if the endpoint only needs integers, there should be no text passing through.

Create And Enforce Rate Limiting

 - Set limits which will reject excess transactions if they are exceeded. For instance 6,000 requests per day, per account; any requests which exceed this number will be rejected. Of course, this should be based on application needs.

Use the API manager throttling features 

Audit All API’s Before Deploying To Production

 - This is to make sure that all necessary code/controls required for development/testing is not still in place when an app is deployed to production.

Use A Web Application Firewall

 – Always a good idea

FuseGuard

API Manager notifications

Performance monitoring

 Useful ColdFusion features

From my experience in ColdFusion and Blockchains these can items be very relevant.

cfajaximport - Controls the JavaScript files that are imported for use on pages that use ColdFusion AJAX

cfajaxproxy - Creates a JavaScript proxy for a ColdFusion component, for use in an AJAX client.

cfclient - Part of the CF11 mobile features for client side (JS) development. Enables output of CFcode to JS.

cfdbinfo – (For oracles, off blockchain data) Lets you retrieve information about a data source, including details about the database, tables, queries, procedures, foreign keys, indexes, and version information about the database, driver, and JDBC.

cfdump – (Classic for error-handling) Outputs the contents of a variable of any type for debugging purposes.

cfhtmlbody - The cfhtmlbody tag can be useful for embedding JavaScript code, or placing other HTML tags that should go at the bottom of the page just before the closing body tag.

cfhtmlhead - Writes text to the head section of a generated HTML page. It is useful for embedding JavaScript code.

cfhttp - Generates an HTTP request and parses the response from the server into a structure.

cfinclude - Includes the content from the referenced file (template). 

cflog – A particularly important utility which writes a message to a log file.

cfquery – Classic for interactions with oracles with off blockchain 

cfsprydataset – Creates a Spry data set; can use bind parameters to get data from ColdFusion AJAX controls to populate the data set.

cfstoredproc – Another oracles related item) Executes a stored procedure in a server database. Itspecifies database connection information and identifies the stored procedure.

cfthread - The cfthread tag enables multithreaded programming in ColdFusion.

cfwebsocket - Includes the required JavaScript files in your CFM template and creates a global JavaScript reference to the WebSocket Object on the client-side.

All of this information came from

Mentioned in this episode

Mike episode on CF and blockchain CFA pod ___

Other CFA pod API manager 

Adobe API Manager podcast 

API Manager download  

http://{IP Address}:9000/admin/login.html

https://helpx.adobe.com/coldfusion/api-manager/api-manager-publisher.html

Getting started with API manager 

Listen to the Audio

Bio

Mike Brunt was born in Northern England in 1948. It was a time of austerity for the British people who had rationing in place due to the effects of the Second World War. He pursued a management career in transportation equipment, becoming Director of Excess Stock at British Leyland Truck and Bus. He moved to the USA in 1989 and eventually took up a career path in technology, coinciding with the emergence of the World Wide Web. Mike then became involved in Teleradiology, working alongside Kodak, Lucent Technologies and GTE. Mike is still deeply involved in technology, being a specialist in capacity planning and tuning for Java systems. He is becoming ever more involved with Blockchain and peer-to-peer-based infrastructure.

Specialties: Java server engineer, Blockchain infrastructure engineer, ColdFusion, networking, database design, server troubleshooting, teleradiology, and web infrastructures.

In addition to his career path, Mike is a composer and musician, having been involved in creating 11 electronic music albums. Mike also paints with well over 100 paintings located in Los Angeles, New Zealand and Eugene, Oregon. Lastly, Mike is a Permaculture Certified Designer and lives on a 5-acre farm in the Eugene area of Oregon.

Mike Brunt is also known as CF Whisperer.

Links

Mike Brunt | LinkedIn

Twitter

FaceBook

Instagram

JVM Whisperer

Foodscaping substack 

 

Interview transcript

Michaela Light 0:02

Welcome back to the show. I'm here with Mike Brandt. And we're going to be talking about API security and ColdFusion, which you may not have considered. This is a whole other attack service surface that your apps can be hacked by. Mike has been doing cold fusion for basically forever since version 1.5 25 years ago or there abouts. And he used to work for a company called OLED, which some of you may remember were the people who created the original ColdFusion. Then he worked for Macromedia. I don't if you actually work for Adobe, Mike or not. But he used to fly around the country fixing people's slow ColdFusion servers and did a lot of work for Fortune 1000 companies in the United States, maybe or in other countries, too. He's a Java JVM expert blockchain expert does a lot of troubleshooting kind of stuff. So in addition, he is a composer and musician, and has published 11 albums and painted 100 paintings. And also, he's got a heavy interest in permaculture and self sustainable foods. Rene science man, I would say, Welcome, Mike.

Mike Brunt 1:20

Thank you. That was a rather lovely introduction, man. I appreciate that. Yeah.

Michaela Light 1:25

So you're welcome. What? What does? Why is it so important to look at security of your API's in your ColdFusion apps?

Mike Brunt 1:35

Well, you know, my experience has been a huge threat and said, I've been to many places over many years, you know, in terms of helping people and I've seen the increase in the use of API's. And they, let's look at two ends if we can. So let's look at remote API. So somebody's giving us a client, an API that we can connect to. Most most people that I've seen, and I'm this is not a criticism that they assume that the end the

Guust Nieuwenhuis talks about “Modernizing ColdFusion apps (through evolution, not revolution)” in this episode of the ColdFusion Alive Podcast with host Michaela Light.

"We're going to be talking about modernizing your legacy ColdFusion apps through evolution and not revolution. And we'll explain what that means."

Show notes

Why not rewrite legacy apps?

A feeling (to rewrite) isn’t sufficient

Hot language

Blame the tech stack not the architecture, CTO or the dev team

Dev phrases

Only my language

Only rewrite not refactor - belief than is harder to recode than rewrite 

Tech > business

Delays release

Adds risk of project failure

Lack of written business rules

More bugs and less functionality

Expensive

“Rewrite code from scratch is the single worst strategic mistake that any software company can make” - Joel Spolsky cofounder of Stack Overflow, Fogbugz and Trello

Do nothing option

Build up tech debt

Increase security risk footprint month by month

User dissatisfaction grows

It works after years of tweaks and bug fixing and real world use

Refactor instead

Keep database the same

Incremental improvements vs waterfall

Agile

Just in time refactor improvements - surgical micro rewrite 

Refresh front end with JavaScript frameworks such as React, Vue

Business case driven

Legacy issues

Spaghetti code

Hard to follow

Hard to change

Poor naming conventions for functions, include and CFC files and variables

Poor variable scoping (global variables can be overwritten and are generally dangerous 

Hardcoded “magic” values

Deadwood code

Security issues due to…

Old framework

Unsupported libraries 

Deprecated integrations

No test plan or automated tests

Not documented

Hard to maintain or add new features

Performance issues

Adding features

Better architecture

API exposure for mobile app or partners

Encapsulate functionality

Set a boundary

Microservices

Vs Monolith

Specialized CF Engine package management to remove unneeded CFML features for fast load and running. 

Strangler Fig Pattern

Anti-corruption layer

Document architecture decisions in JIRA

Magic numbers to static variables

Wrapper functions

Event driven architecture 

Code trauma and political reluctance 

Same habits, same mistakes!

Read more

Eric Evans domain driven design

Martin Fowler blog and books 

Strangler Fig Pattern

Anti-corruption layer

Ben Nadel Feature flags 

Links below

Going CFCamp in June

Mentioned in this episode

His CF Summit preso

Joel Spolsky article and quote Things You Should Never Do, Part I 

Eric Evans domain driven design 

Martin Fowler blog and books 

Strangler Fig Pattern

Anti-corruption layer

Ben Nadel Feature flags 

Listen to the Audio

Bio

Guust Nieuwenhuis is a Full Stack Web Wizard with experience in a wide range of technologies. Over the last couple of years, he has been involved in projects for various clients like the European Commission, NSHQ (NATO), Adobe, AS Adventure Group, NS (Dutch railways), CZ Groep, Proximus, Avery Dennison and Mediagenix.

Through We Are North, we do 'Customization-As-A-Service'. We don't build from scratch: we find the best solutions out there and tailor them to our customers' business needs. In doing so, we never lose sight of the goal of the client.

In his free time, he plays the double bass and drums, crosses the forest on his mountain bike and coaches the youth at their local football club (where he is a board member as well). He likes spending time with his wife and two kids or meeting friends for a chat, game or drink.

If he still has some time left, he mainly spends it behind his computer to fulfill his hunger for the latest trends in IT.

 

Links

Guust Nieuwenhuis | LinkedIn

Website We Are North

https://www.masacms.com

CFML slack channel DM

[email protected]

Interview transcript

Michaela Light 0:02

Welcome back to the show. We’re going to be talking about modernizing your legacy ColdFusion apps through evolution and not revolution. And we’ll explain what that means. Later. I'm here with goosed new, new and who's to say your name right there. He's originally from the Netherlands, but he's living in just outside Brussels in Belgium, has been doing cold fusion for many decades now. An old friend of the CF live podcast, welcome, goosed. Thank you. And he's a full-stack web wizard. And he's done lots of projects in Europe, for the European Union Commission, and Adobe and all kinds of cool people. And his company has cooled through that. Through we, our north is my is that right? That doesn't quite make sense. You know, maybe we are north. Oh, I see. I shouldn't have put the word through in there. No worries. Got it. So you do customization as a service, you help improve old apps. So we'll talk a bit about your experience with old ColdFusion apps and improving them instead of doing that terrible Arwood rewriting which we're not going to do people, and we'll explain why you shouldn't be doing that later in the show. So welcome boost.

Guust Nieuwenhuis 1:37

Thank you. Thank you for having me.

Michaela Light 1:39

So I think that's the big question. That's the elephant in the room here. Because everyone talks about rewriting apps, right? That's the hot thing to do. That's what the cool kids do. They're like, oh, we'll rewrite it into No, Jas or we'll rewrite it into dotnet, or whatever the latest and coolest cutting bleeding edge technology is they want to rewrite the app. Right? Why shouldn't people rewrite their legacy apps?

Guust Nieuwenhuis 2:07

Well, it's the way you describe it. It's almost like a face you need to go through as a developer. And there are a few, there probably a few phases, there's this phase where, where your technology is the best, above everything else. But there's also the space where, where you're, you're like totally convinced that everything should be rewritten. And of course, I went through that one as well.

Read more

 

Michaela Light is the host of the CF Alive Podcast and has interviewed more than 100 ColdFusion experts. In each interview, she asks "What Would It Take to make CF more alive this year?" The answers still inspire her to continue to write and interview new speakers.

Michaela has been programming in ColdFusion for more than 20 years. She founded TeraTech in 1989. The company specializes in ColdFusion application development, security and optimization. She has also founded the CFUnited Conference and runs the annual State of the CF Union Survey.

 

Join the CF Alive revolution

Discover how we can all make CF more alive, modern and secure this year. Join other ColdFusion developers and managers in the CF Alive Inner Circle today.

Get early access to the CF Alive book and videos

Be part of a new movement for improving CF's perception in the world.

Contribute to the CF Alive revolution

Connect with other CF developers and managers

There is no cost to membership.

Peter Amiri talks about “CFWheels ColdFusion Framework (new structure and features)” in this episode of ColdFusion Alive Podcast with host Michaela Light. “…CFwheels is another ColdFusion framework. And it was originally modeled after Ruby on Rails. So if you remember back in the early 2000s, when Ruby on Rails came out, it was a complete […]