I happened to notice today that the 8.01 release notes end with this reference: "Portions include technology used under license from Autonomy", and later it lists "TVirtualStringTree". These made me wonder: who/what were Autonomy and TVirtualStringTree?

I did a little digging, and hadn't seen anyone else write about these (it seems) in the CF blogopshere, so I'll share what I found. They're nothing dramatic.

Autonomy=Verity

In the first case, I guess I just missed the news, but back in 2005, Autonomy acquired Verity. (Seems like the acquisition last month of MySQL by Sun. Doesn't appear to have been too significant in the grand scheme. The tools continue to be known by their former company names.) Also, more digging found that this had been mentioned in the 8.0 release notes as well, but I just hadn't noticed it. FWIW, there was no mention in the CF7 notes/docs that I could see.

TVirtualStringTree in Report Builder?

What about TVirtualStringTree? Well, that isn't as obvious. It appears to be a Delphi component, and the only thing I can think of that's written in Delphi that might have been updated for 8.01 would be the CF Report Builder. Perhaps Dean Harmon or someone else from Adobe can confirm that guess. It's not important, of course.

Just one of those "things that make you go hmm" (to the younger folks out there, that's a reference to a bit from the old Arsenio Hall show of the early 90s. Gosh, now I know how my parents must have felt when they'd talk to me about the the Jack Parr show, when I was a teen in the 70's!)

PS: Searching the CF blogs

BTW, I said I hadn't seen any mention of this in the CF blogosphere. Was I going only on my memory? Heavens, no. I don't at all claim to have read most (or even 10%) of all many, MANY blogs out there on CF. It's great that there are so many, and that we have so many CF blog aggregators. But even then, none let you search all the past blog entries (at least it seems to me, as I searched for some text on that entry in all the aggregators and none found it).

So how does one do a quick search of most CF blogs? Well, last year I created a Google Custom Search Engine I call CFSearch. It lets me (and you)search only CF-related blogs and other resources. There are other CF CSEs out there, and I wrote about them back when I created mine.

I make a bookmark link for my CSE so that I can do such a search easily. Hope you'll consider doing the same.

Here's a tip about an error others may hit when configuring CF with IIS on Vista. I'll clarify that I'm on CF8, Vista SP1, and may possibly have installed some .NET 2.0-based apps or products, all of which could have contributed to this issue. YMMV.

UPDATE: I have an update on this: the reason I had the issue was not related to SP1. And it wasn't that I'd "installed a .NET 2.0 app" since I installed Vista. Rather, it turns out that it was because I'd restored from backup some files into my IIS docroot that included a web.config that DID have .NET 2.0 config entries. Even so, this could happen to others, or to others who DO install .NET 2.0 apps, so I leave it for others to consider.

I'd been running Vista for a while on my development machine, and though I'd installed CF8 on it without problem, I chose at first to use the built-in web server to start (both with the standalone and multiserver deployments of the CF8 Developer edition.)

Today I decided to hook it to IIS. Since I'd not made the choice to use IIS on install of CF 8, I of course used the web server configuration tool (start>programs>adobe>coldfusion 8>web server configuration tool). Though I'm on Vista Ultimate and could define more than one web site (a nice bonus of the Ultimate and Business editions all Vista editions, without needing to buy a Server edition of Windows), I had not defined any beyond the default web site. (Update: I spoke today with Bill Staples, one of the folks in charge of IIS 7, about this whole issue, which is when I realized it came about from me doing the restore. Anyway, he said that the support of multiple sites is something in all editions of Vista. Nice.)

(One interesting thing that happened was I got a popup telling me that CF would need a few minutes to configure itself with IIS 7. I took a screenshot of the window that popped up but lost it from the clipboard. Perhaps someone else will see it and can comment here what it says, to help those doing searches later. But as it said, after a couple of minutes it did take.)

Error on first CFM page request

But when I requested my first CFM page, I got a big ugly IIS 7 error page (an HTML page), the crux of which reported:

Yikes. It went on to provide various details on the problem as well as some workarounds. The gist was that the system.web httphandlers entry in the config files had something that was no longer compatible with the new, default "integrated mode" of IIS (defined as the "managed pipeline mode"). What had CF done? How would I best resolve it?

Quick and dirty workaround: Change mode to "classic"

One of the workarounds described changing the "mode" for the "managed pipeline mode" from "integrated" to "classic". This is defined in the site's application pool, which you can modify in the IIS manager (selecting "application pools", then the app pool (by default, the "default web site" uses "DefaultAppPool"). See the screenshot here.

Sure enough, changing it to "classic" made the problem go away, but that may not be the best solution.

Better Solution: Migrating the .NET settings in a single, simple step

I did some digging and found one blog entry with a good bit of info, and he seems to assert that this is just a breaking change in IIS 7 for ASP.NET 2.0 apps.

He also made the case for not using the workaround above (changing the mode to "classic"), as it could cause loss of many of the nifty features that IIS 7 adds. Instead, he proposed that one should instead seriously consider the option to upgrade the .NET 2.0 app config entries to work properly in integrated mode. Turns out this is just a simple command line command:

I had set the mode back to "integrated" to confirm that the error came back (it did), so I then dropped to the command line (using start>run and entering "cmd") and pasted that line verbatim (right-click and paste, not ctrl-v) onto the command line (again, since I'm using the "default web site"). It came back with 2 lines in response:

I then re-requested my CFM page, and it worked, so that seems the solution.

Since I knew I didn't have any custom-written .NET 2.0 apps on my machine, I knew there was no great risk to me doing this. (I had not myself built any .NET 2.0 apps of my own, but I may well have downloaded and installed some app that's built on it. So it's possible that if you have not, that you will not ever get this issue. I'm offering it for those who may, so they can find it on a web search.) (See my update at the top of this entry.)

The blog entry also implies that this may be an issue for SP1, so perhaps others who are not yet on SP1 won't have seen this problem yet. If anyone reads this who is not on SP1 and it solves things for you, do let us know in the comments. (Bill Staples also confirmed that this was not an issue new to SP1.)

Hope this has been helpful for someone.

PS Please, I'm not interested in any snide comments about the wisdom/folly of using Vista. Like others, I have my reasons for doing so, and I've been very satisfied with it so far. I share the above for others in the Vista boat, whether by their choice or others'.

I had the distinct pleasure of being interviewed for the second time on the ColdFusion weekly podcast (last time in Oct '06). Some may know that Matt and Peter are starting to do interviews of speakers presenting at the upcoming cf.Objective() conference, and I happened to be the first in the lineup. The interview is up as this week's podcast.

In the 45 minute talk, we discuss both talks I'll be doing at the conference, first "Hidden Gems in the CF8 Monitor" and then "Step Debugging in CF 6/7/8". The first is a condensation of my 4-part series of articles in the Adobe DevCenter, where I highlight the most compelling tips, tricks, and traps I found. I think many will be surprised by them, and in the interview I share several from the talk.

Matt also asked me about how it compares to FusionReactor and SeeFusion, and I shared my thoughts for why there's a place for all, and along those lines (of how competing things fit together), he also asked me my thoughts on the open sourcing of BD/J2EE.

Of course, one of the things I clarified was that I left New Atlanta nearly 2 years ago (next week). Many seem not to have gotten that memo! But I explain more, including why I'm not so sure it will light the world on fire as a "free CFML engine" though it may well help a lot of people, so check out the discussion if you're interested in that topic.

I also shared some news that I've never blogged about nor spoken much about: the fact that when the roles of CF Product Manager (when Tim stepped down 2 years ago) and CF Evangelist (when Ben knew a few months ago that he was moving up to lead all the Evangelists in Adobe) first became available, I had the distinct honor of having been asked first (so I was told) if I wanted those roles. It's hard for that not to sound self-aggrandizing, which is why I've not mentioned it publicly, but I mentioned it in the interview to make the point to listeners that I really am all about CF now, and that plenty of folks at Adobe did realize I was still very much a CF community guy all along.

Anyway, I explained that I didn't take the roles simply because in the first case, the product manager role, it would have involved relocation to Boston (love Atlanta's weather too much, plus I was enrolled in an Atlanta-based seminary at the time). In the second case, Ben's role, it would have been awesome, but we all know it involves a LOT of travel. My wife and I just didn't want to be apart so much and so often (and again there are those seminary studies). It was tough to say no, but as I mentioned in the interview, of course Adobe got great folks for the roles ultimately, in Jason and Adam, respectively.

The interview concluded with my discussion of the Step Debugging talk I'll give at cf.o. I explained how it will cover both the CF8 Debugger (useful only on CF8) and FusionDebug (which can run on 6, 7, and 8). I explained (as I have many times) how though they're both based on Eclipse, that needn't be a show-stopper.

I explained how FusionDebug even offers an installer that bundles Eclipse, CFEclipse, and FusionDebug all at once, which is a great help for those challenged to install it (though it's also available as an add-in). I noted that the CF8 debugger is available only as an add-in, which can be a challenge to some, but I pointed out (as I have previously) that my 25-page chapter on the CF8 debugger, in the CFWACK, is available online. That should really help those who've been challenged to get started with the CF8 debugger. Anyway, I'll explain a lot more about using the debugger, and when/why/how one should, in the talk at the conference.

So, though I didn't plan it, I guess this interview was as much a show about how I'm not any one company's guy. :-) Whether it's supporting the CF8 monitor or FusionReactor/SeeFusion, the CF8 debugger or FusionDebug, CF or the other CFML engines, or even the consulting I do (done mostly on my own, but also some for Intergral and for Universal Mind, as I mentioned), I'm out here just trying to help where I can, whoever I can, however I can. :-) I just want to share info or tools and let folks make their own decisions. (In that regard, be sure also to check out my list of 400+ tools/resources for CFers and the CF Meetup that I run.)

Anyway, it took only a few minutes for you to read this entry. I think you'll enjoy the full 45 minute version in the podcast, which you can just click here to listen to the MP3 (no need to have an Ipod!).

Have you started using the CF 8 debugger? Either way, you may have noticed that the documentation on it is rather sparse. Fortunately, there's a relatively new and substantial (25-page) resource that's available online in the form of a PDF.

In the ColdFusion 8 Web Application Construction Kit Volume 2: Application Development, I had the honor of doing the chapter on the CF8 debugger. If I do say so myself, I think that it's a really complete introduction both to installing, configuring, and using the debugger, along with many tips, tricks, and traps--perhaps even a better one-stop resource than the docs themselves.

Best of all, it's one of the chapters that's been made available online. There was fear that Volume 2 would be too big and so a few chapters (mostly on older topics) were put into a 550 page PDF. My chapter is near the back of this PDF.

Also, note that if you have the print version of the book, it's technically chapter 52 of volume 2, but you won't see these online chapters listed in its table of contents. Instead, they appear in the TOC at the start of vol 3 (long story)

Sadly, I couldn't get permission to just cut out this one chapter, so you do need to get the full PDF. You should be able to easily jump to the starting page (using Ctrl-Shift-n), which is page 467 in the PDF, despite the table of contents on the first page which lists it at 471. And of course, you can print just selected pages from a PDF as well.

Either way, I hope you get great value out of the information offered. I'd really welcome your feedback.

(PS I mentioned last week that I'd also done an article on the CF8 debugger in the FusionAuthority Quarterly Update, in their recent CF8 Special Edition. Unfortunately, the FAQU articles are not available online.)

Parts 3 and 4 of my 4-part series on the CF8 Server Monitor are now posted on the Adobe DevNet site. Part 3 was posted several weeks ago, but with the holidays, etc. I just failed to get word out. Part 4 was posted yesterday.

If you've not taken a look at these, you may be missing out. There are some misconceptions about the monitor, and also I think most don't realize that it can do much more than they may suspect. There's precious little documentation (and discussion) about it, so you may find things here you won't find anywhere else.

• Part 1: Using the Server Monitor in development
• Part 2: Using the Server Monitor in production
• Part 3: Automated monitoring and request management with Alerts and Snapshots
• Part 4: Multiserver Monitor, Admin API monitoring, and more

The third and fourth parts, specifically, have the following sections:

Part 3

• Automated monitoring and request management with Alerts
• Substantial diagnostic details with Snapshots

Part 4

• An enterprise dashboard with the Multiserver Monitor
• Programmatic Monitoring with the Admin API
• Tweaking the Monitor in the Settings section
• Miscellaneous aspects of the Monitor

Sure, I've just written about FusionReactor yesterday, and will write still more about the new release. I don't see it incompatible to help people make the most of whatever tool they may use. I've written previously also about SeeFusion. Indeed, I've written previously that that each has their place, even in the face of CF8's server monitor.

I'd like to hear from readers

The DevCenter articles offer a feedback link, but so far I've not gotten any (and they say they will forward any they get). I'd really appreciate hearing from anyone who has read the articles. I really feel that they go way beyond what's available in the docs and help, to bring together information and concepts you might otherwise miss. Has it helped you at all?

Finally, do you ever wonder why some call this area of the Adobe site "DevNet", "DevCenter", and/or some the "Developer Connection"? Well, the URL has devnet in it, but the breadcrumb bar at the top of my articles shows "Home > Developer Connection > ColdFusion Developer Center". Go figure. :-)

Here's a neat hidden gem for CF8 that will delight some: CFMAIL now uses the mail server name you specify in CFMAIL SERVER attribute or the CF Admin mail setup page, in creating the message-id header that's generated when your mail is sent.

Some have lamented that in CFMX 6 and 7, it instead used the name of your server where CF is installed, which might be something like "server1" or "bingo", as in:

This might cause a recipient mail server to flag the mail as spam, if the mail server was a different domain name (like "yourcompany.com"). The bummer was that many found no way to fix this. Sure, in CF5 you could set it in a CFMAILPARAM to set a mail header, but CF 6 and above ignores that.

So the good news is that CF8 now does use that CF Admin or CFMAIL SERVER value to create the message-id. If I use CFMAIL SERVER="mail.carehart.org"..., for instance, I might get something like:

What about CF 6 or 7?

But what if you're on 6 or 7? Well, there's a solution for you, too, by way of a tweak in the CF startup script (jvm.config) or (less preferably) in code. Since the change for CF 6 or 7 deserves some explanation to do it justice, I'll take that up in a part 2 message next. I'll also lay out the whole problem with the auto-generated message-id and why it's a concern for some.

For now, I just wanted to get this word out to those who understand the problem already that CF8 solves it. Woo hoo.

I wanted to share the availability of a recorded presentation I did a couple of months ago on "Step Debugging in CF 6/7/8 with the CF8 Debugger and FusionDebug". As the title indicates, I cover both the CF8 debugger and FusionDebug (for 6, 7, and 8).

This particular talk was recorded at a joint meeting of two Australian CFUGs in September, though I also presented the talk at CFUnited in June.

Anyway, if you're interested in either or both of these debuggers (or even if you're ambivalent about them), do check it out.

(Though the recording has been available online for some time, the host had left it marked as requiring a username/password. When someone pointed that out, we resolved the problem and that's why I'm pointing it out now.)

I haven't seen much mention of this elsewhere, but I happened upon a new 47-page whitepaper called "ColdFusion 8 developer security guidelines", by Erick Lee, Ian Melven, and Sarge Sargent. It's listed in the Adobe Security DevCenter, which shows it having been posted as of today.

Like other whitepapers that have been put together by Adobe, Macromedia, Allaire, and others, this one offers overviews of key concerns along with proposed best practices.

Is it complete? Does it really need to be?

As with any such document, there will be debate among some readers about whether the practices are always really the "best". It's inevitable. But let's give credit that the authors do try to give a rather brief round up of the features, their options, and the impact of choices.

Just as Ben's famous CF "Certification Study Guide" is a quick summary of key things in CFML (and no substitute for the complete ColdFusion documentation or the WACK books), so too would I argue that this guide is a quick summary of important points to consider. Readers would do well to understand the issues completely, both in terms of the generic concerns they raise and the specifics of CFML features and options. For that, the docs and other books would be great resources.

Still, many readers won't have time for that, so despite the fact that some may pick it apart, it will serve a large percent of the community who might otherwise have no knowledge of the concerns and configuration features. For that, we should thank the authors.

Its sections

The document is divided into the following sections: Authentication, Authorization, CFCs, Session Management, Data validation and interpreter injection, Ajax, PDF integration, .NET integration, HTTP, FTP, Error handling and logging, File System, Cryptography, Configuration, Maintance and References.

Earlier editions, and what's updated in the CF8 guide?

While the guide does focus on CF8, there is another version of the document for those running CF7, the "ColdFusion 7 developer security guidelines". It, too, is by 2 of the 3 authors of the other whitepaper, Erick Lee and Sarge Sargent. It's only 33 pages, and it too is listed at the Adobe DevNet Security Developer Center, where it show it having been updated as of Oct 2007.

You might think that the CF8 guide is updated only to refer to things new in CF8, but in fact I find some things in the CF8 guide that are not in the CF7 guide, but are not new for CF7. Perhaps they decided to expand the CF8 guide in ways that they didn't push back down into the CF7 guide (understandable if time was limited). That means that CF7 developers may want to read the later guide, though they'd have to ignore features that are indeed new to CF8.

For instance, I found a discussion of the trusted cache feature only in the CF8 guide (more on that below). I didn't do a careful comparison of what's different.

BTW, I'll add that I found references in searches both on the Adobe site and Google to a version of the security guidelines at a URL that no longer works. Since I couldn't access it, I was unable to determine how this CF7 version was updated (or if it was simply renamed, to distinguish it from the new CF8 version. Perhaps the authors can comment here if they read this entry.)

Where to offer feedback?

That last comment brings up a concern I have with the whitepapers offered on the Adobe site (and the articles offered on the Developer Center, as well, of which I've been an author recently.) There's no place for folks to leave feedback. It would be nice for there to be a place to have discussions about the things written in such whitepapers or articles. (The Devnet articles do offer a feedback link, but it's one way, not an open discussion.)

I'm sure some will want to comment on or trade best practices regarding the topics in this paper. Also, I'd like to share at least one error I found: in the discussion of the trusted cache feature, it's described as, "Enable Trusted cache in production environments. When enabled, ColdFusion will only server requested templates held in its memory cache. This provides performance gains but also prevents ColdFusion from running hacked or invalid templates."

Yikes. I wonder who wrote that (and who missed it during any review).That's not the purpose of trusted cache at all. It's about whether the server should look to disk to see if a template, once compiled and loaded into memory, has changed on disk. The server always only serves (not the typo, too, "will only server") pages held in its memory cache. Using trusted cache is certainly a performance gain, but I really have no idea what the reference is to "hacked or invalid templates". That makes me think the person writing this has a very wrong idea about the feature. But I'm not meaning to rip the guidelines. As I said earlier, I'm sure that many will find them very useful, and since folks rarely read the docs, it's a nice way to condense into 40+ pages some key points. I'll let others comment here about any other concerns they have. At least it will serve as one place to have such discussion. If there's a better place, I'll welcome people pointing to that.

By now I think most have heard of the new AttributeCollection option available for most tags in ColdFusion 8. It's a cool way to dynamically add attributes to a tag.

One problem, though, is that people seem to confuse its name. I've seen it referred to by different names both in current discussions and in older blog entries. Some of the confusion is understandable.

For the record, it's AttributeCollection, not any of the following:

• ArgumentCollection: this is indeed a legitimate attribute for CFINVOKE, when calling a CFC method or UDF instance, or when used similarly calling an instance created by CFOBJECT or createObject.
• ArgumentsCollection: well, this actually was the name of the attribute as of the Beta of CF 8. Ben wrote about it back then, so some confusion could stem simply from people seeing such older entries.
• Arguments: Again, you may well see some blog entry or email list discussion mentioning this, because this what what the attribute was called in the Scorpio Alpha. There was a lot of discussion on blogs pleading that the attribute be named AttributeCollection instead. In fact, Damon Cooper wrote that there were "69 Beta forum message threads about the proper naming of attributeCollection" in his note on Engineering stats for CF8.
• AttributesCollection: and ultimately, it was named AttributeCollection, but since it was for a while called ArgumentsCollection (with the s) it's understandable that some may made the final attribute name plural.

In case anyone's wondering, they may recognize AttributeCollection as not being new as of CF8. In fact, it's not. It was (us) used on the CFMODULE tag to pass in attributes to a custom tag (and also when calling a custom tag as CF_tagname).

For more on using the new attribute, as well as examples of its use, see the CF docs or blog entries by Ben Nadel and Brian Rinaldi. Those also explain where the tag cannot be used (just a small fraction of tags where it really wouldn't make sense, like CFIF, CFSET, and some others) and also how when you use it, you can't use any other attributes.

Hope that clarification above helps someone.

Have you ever wanted to see the Java source code for the proxy/stub that's created when you invoke a web service from Coldfusion? Well, here's a hidden gem in CF8 (one of dozens I discuss in my "hidden gems in cf8" talk) that does just this.

Curiously, it's only available when you invoke a web service using createObject(), not CFOBJECT or CFINVOKE.

It's enabled using the new ArgStruct argument that I discussed last month.

You may wonder why you have to put it in this argStruct when it's the only key being put in the structure. That's just the way it is. Of course, I could have created the structure using the new implicit array creation syntax, as in:

which replaces 2 lines with 1.

For those who don't care for CFSCRIPT

Of course, you don't need to use CFSCRIPT to use createObject, for those not comfortable with it. I could just as well have done it all in tags, as:

Where the Java source is placed

So where is the Java placed? In the same directory where the java proxy stubs have been placed since CF6: [coldfusion]/stubs/. In the case of the standalone version of CF8, that might be c:\coldfusion8\stubs.

Each invocation of a web service in CF (whether you use the saveJava option or not) will create a directory there, typically in a form like WS729914123 (one for each separate web service invoked by any CFML requests), and within the subdirectories of that directory you'll find class files reflecting the name of the called web service.

If you don't use the saveJava option, you'll see only class files. If you'll see corresponding .java source files for each.

Finally, note that the Java source files will be removed automatically if the web service is refreshed (manually or in the CF Admin) and you call it without the SaveJava option (which also means if you invoke it using CFOBJECT or CFINVOKE).

(*Update*: In the original entry, I said the source would be removed if you called the web service without the SaveJava option, but I should clarify that it's if you do that and you cause the web service to be refreshed, not just any call, since that would use the compiled result of the earlier call unless you told it to do otherwise.)

Still, for those who have long wished to better understand these Java proxy stubs, it's nice that we have the option to see the source if we want to.

Still more to come

There's still more power in CF8 for those that like to tinker with the java proxy/stub generation. More on that in a later entry.