All posts by Neil Harwani

Interested in movies, music, history, computer science, software, engineering, management and technology
Liferay, Security, Software Security

Security & Cookie links @ www.Liferay.com – Part 1

Leave a comment

List of Liferay security & cookie related links which includes Cookies, XSS, CSRF, OWASP, CORS, SSO, IAM, Service Action Policies and more:

  1. Known vulnerabilities: Known Vulnerabilities – Liferay
  2. Security statement: Security Statement | Liferay
  3. LXC Cloud security: DXP Cloud Security | Liferay
  4. Securing Liferay page: Securing Liferay – Liferay Learn
  5. Help center DXP 7.0: Liferay DXP Security Overview – Liferay Help Center
  6. Help center DXP 7.1: Introduction to Securing Liferay DXP – Liferay Help Center
  7. Administration security: Security – Liferay Learn
  8. Search security DXP 7.2: Installing Liferay Enterprise Search Security – Liferay Help Center
  9. Search security DXP 7.1: Installing Liferay Enterprise Search Security – Liferay Help Center
  10. Securing ElasticSearch DXP 7.3/7.4: Securing Elasticsearch – Liferay Learn
  11. Reporting security issues: Reporting Security Issues – Liferay
  12. Liferay product cookies: Liferay Product Cookies – Liferay Help Center
  13. Cookie list: Cookies list that could be found in a Liferay Portal and their usage – Liferay Help Center
  14. Login cookies: List of Cookies That Are Affected at Liferay Login – Liferay Help Center
  15. Liferay cloud cookies: Liferay Cloud cookies – Liferay Help Center

Email me: Neil@HarwaniSystems.in

Generative AI

Keywords (Glossary) for Generative AI – Part 1

Leave a comment

Here are some important keywords in the ecosystem of Generative AI – Part 1:

  • Transformers
  • Natural language prompts
  • Large language models
  • ChatGPT
  • Bing Chat
  • Bard
  • LLaMA
  • Stable Diffusion
  • Midjourney
  • DALL-E
  • GPT
  • LAMDA
  • BLOOM
  • GitHub Co-pilot
  • NVidia
  • AMD
  • PaLM
  • DeepFakes
  • OpenAI
  • Bias
  • Hallucination

References:

Java

General checklist for performance tuning & go-live in Java – Part 1

Leave a comment

Here is a general checklist for performance tuning & go-live in Java – Part 1:

  • Servers: CPU, Memory, Threads, Network configurations, page size, hardening and more
  • JVM: MBeans, Security, Garbage collection type and settings, Arguments, Heap, Version, Core allotment, Generations and more
  • App server: Thread pool, JDBC/JNDI, Type of connection pooling, Session replication, caching, log rotation, log levels and more
  • Database: Indexing, Thread pool, Privileges, Connections, Top queries/plans and more
  • Network: Latency, DNS, Security, Firewalls/WAF/CDN
  • Other components like search/filestores/integrations/etc.: Caching, thread pools and more
  • VAPT/Security: SSL, OWASP, SAST/DAST, CSP, code quality and more
  • Documentation on architecture, deployment, requirements, design and more
  • APM/Monitoring tools – Instrumentation, gauges and more
  • Thread profiling and heap dumps
  • Service profile for APIs
  • Code optimization
  • Optimum auditing, reporting & SSO/IAM
  • Reusable patterns / architecture styles and designs for performance, usability & security
  • DevSecOps strategy and implementation
  • DR strategy and implementation
  • Regular load & performance tests
  • Horizontal scaling / clustering & vertical scaling
  • Rule of thumb: Work layer by layer and tackle the biggest problems first.

Email me: Neil@HarwaniSystems.in

Liferay

What you should not be doing in Liferay – Part 1

Leave a comment

Here is a list of what you should not be doing in Liferay – Part 1 and also what you should be doing written right next to it in place of the wrong things:

  • Write JDBC calls in portlets. Avoid JDBC calls in portlets. Please explore expando, service builder, dynamic queries and such from Liferay.
  • Run elasticsearch & database in embedded mode in production. This is to be avoided always. For production and especially clustering, use remote elasticsearch and separate database.
  • Use simple filestore for large number of documents. Right from the start prefer using advanced filestore.
  • Forget to switch off developer settings in portal-ext.properties and verbose level of tracing in logs. Please switch off developer settings and verbose level tracing in logs.
  • No performance testing and tuning of system before go-live. Please perform performance testing and tuning including GC / JVM / Caching / etc. for Liferay. Install Glowroot right from the start if possible in central pattern.
  • Not configure security for various parts of the system. Configure SSL, xpack security for search. Explore the security page on Liferay Learn for various configurations. Perform VAPT at the start.
  • Not enabling SSO. If SSO will be required in future, please enable it right from the start so that there are no user problems later. Also, it helps to reduce load on Liferay CPU of encryption.
  • Not refer official documentation. Please refer liferay.dev – forums, blogs, learn.liferay.com, help.liferay.com, help center articles, Liferay Learn YouTube channel and more from the start.
  • Not explore commerce, objects, publications, headless APIs, blueprints, asset library, fragments and such features. Please explore all this right from the start.
  • Not explore benchmarking, performance, compatibility matrix whitepapers. Please explore them before go-live. There are lot of resources under resources section on Liferay.com including case studies, whitepapers and more.
  • Not create go-live, integration, deployment diagram, architecture and such documents at the start. Please create go-live, integration, deployment, architecture, design documents from the start.
  • Check Glowroot only when you face a problem. Instead, check your Glowroot regularly on weekly basis at least.
  • Not size the infrastructure requirements for NAS/SAN for filestore and DR strategy. Please plan your infrastructure requirements in terms of NAS/SAN, servers for Liferay, database, elastic and others like web server before go-live.
  • Not doing regular maintenance. Routinely do maintenance of Liferay, database, Elasticsearch, webserver and more by checking logs, JVM, CPU/memory usage, configurations and more.
  • Not checking your lighthouse score incase of public websites. Regularly optimize your lighthouse score incase of public facing websites.
  • Not have a DevSecOps strategy in place. Please create a CICD pipeline, DevSecOps strategy and implementation with Git style repository to manage things properly.
  • Not have an upgrade plan mapped to quarterly release of Liferay. Please have an upgrade plan mapped to quarterly releases of Liferay.

Email me: Neil@HarwaniSystems.in

Liferay

Performance tuning in Liferay – Part 2

Leave a comment

Following up on the Performance tuning in Liferay – Part 1 post – here are some additional points for performance tuning:

  1. The blue circle in Glowroot slow traces indicates that the transaction is still ongoing whereas yellow indicates it’s completed. Red indicates there is an error.
  2. You can change the JVM gauges as needed to see lot of different types of details of JVM
  3. You can use instrumentation from configuration using type ahead drop down (AJAX style)
  4. You can allocate specific cores to a JVM if need be using an argument on core allotment
  5. You can see thread profiles and take heap dumps from Glowroot itself
  6. Glowroot has sections on errors, queries and service calls
  7. You can get Glowroot to sustain it’s data through restarts using arguments
  8. For frequent garbage collection, check if some queries, etc. are continuously filling up memory and any fine tuning on caching can help
  9. It helps to follow these sections in no particular order and check them regularly: JVM – guages, MBeans (You can search your cache related things here – it’s like seeing things in VisualVM), threads and more, transactions, slow traces (all three areas throughput/etc.), thread profiles (search “blocked” here), queries, service calls, errors, sorting options in transactions, instrumentation, etc.
  10. Latest Glowroot works with Java 11 that is compatible with Liferay for customizations and product usage but not source code compile. This latest Glowroot gives lot many more options especially in transactions.
  11. If you are using Java 8, check if your Glowroot version is compatible with it. Typically 0.13.6 and below are compatible with Java 8 as far as I know.

Email me: Neil@HarwaniSystems.in

Liferay

Performance tuning in Liferay – Part 1

Leave a comment

Expanding on my post here on performance tuning: Post | Feed | LinkedIn

Below are the main points to work on for a performance tuning engagement in Liferay – Part 1.

  • Firstly, we need to find out what is slow: Database, service calls, elastic search, memory is an issue, threads are blocked / waiting, how much memory is a module taking, logs are printing what, etc.
  • Check your configurations as per this post: How to debug Liferay? – Some pointers – Part 1 | LinkedIn
  • Install Glowroot if possible, in central pattern and check following sections in it: slow traces, errors, service calls, threads, heap, instrumentation, configurations and so on for the problem timeframe.
  • You can enable tracing in logs & Glowroot instrumentation on targets. You can also use plugins by Fabian BouchĂ© like for fragment analysis or follow his blogs on www.liferay.dev/blogs for using Glowroot in upgrades.
  • The above will give you hints on what is slow. Especially open the FLAME graphs and threads along with heap dumps to analyze which threads are blocked or waiting, how much memory is allocated to what in slow traces of modules and so on.
  • Then run a load test in simulated environment after checking compatibility matrix to get latest statistics for various scenarios like web content on portlet or in fragment, API calls, integrations, heavy load on Elasticsearch and so on with experimentation on themes.
  • After getting the slow threads and details in flame graphs plus slow traces, if it’s custom code or configuration or DB call or ES which is slow, optimize it like Hikari pool connections or if it’s source code of Liferay, open the GITHUB repo for Liferay portal, check the source code and reach out of Customer Success / Global Services / Support with inferences depending on your engagement in account. Your Customer Success Manager or Sales can guide you on this.
  • GS / CS will work internally in Liferay to get you the best options and / or patches in case they already exist. Many a times this could also have been fixed in a Hot fix or Fix Pack already. Alternatively, configurations could also solve such problems many a times. To check these go to Liferay customer portal and check the changelog for fix packs. You can also refer to Liferay Learn and Help Center for help articles and tutorials.
  • Various areas of performance tuning: Database, HTTP calls, App server, ElasticSearch, Threads, Heap optimization, Caching and more. We will follow up this post with more pointers on performance tuning in Part – 2. A good list of areas is to check in the deployment guide for your version.
  • Thanks to Fabian BouchĂ© David Nebinger and many more at Liferay Global Services / Support / Customer Success and Customer Support / Engineering due to which I am able to compile the above. Above is a compilation of work from many sources internally in Liferay via work with customers & externally which hopefully should help many of Liferay customers and partners. This also serves as a case study on performance tuning.
  • Email me: Neil@HarwaniSystems.in
APM

Glowroot resources – Part 1

Leave a comment

Here are some good Glowroot resources – Part 1. Glowroot is a lightweight, Open source Java APM. Resources / links / blogs here provide details on how to install Glowroot, what are its two deployment types, how to instrument Liferay with it, how to monitor Liferay during upgrade with Glowroot and StackOverflow links on Glowroot.

Email me: Neil@HarwaniSytems.in

Research

Research Methodologies – Part 1

Leave a comment

Recently I attended a training on Research Methodologies at National Forensic Sciences University, Gandhinagar. Here are the notes via keywords from the same:

  • Philosophy meaning, categories and areas
  • Regional vs. global requirements
  • Questionnaire vs. schedule
  • How to reach a research problem statement and design a questionnaire
  • Literature review 
  • Systematic literature review
  • Bibliometrics – Meta analysis – Know the trends in literature review – trends in domain 
  • Tools for bibliometric analysis
  • Content analysis 
  • Scopus search
  • Hypothesis testing
  • Experiment design
  • Qualitative vs. Quantitative research
  • Overview of statistics and various tests
  • SPSS, MOSViewer, SmartPLS, AMOS, R
  • Factor analysis
  • Structural equation modelling
  • Bayesian statistics
  • Regression
  • Cluster analysis
  • Conjoint analysis

Email me: Neil@HarwaniSystems.in

AIML, Enterprise Content Management

Enterprise Content Management & Artificial Intelligence Use cases – Part 1

Leave a comment
  • Enterprise content management – Wikipedia – Enteprise Content Management on Wikipedia – Enterprise content management (ECM) extends the concept of content management by adding a timeline for each content item and, possibly, enforcing processes for its creation, approval, and distribution. Systems using ECM generally provide a secure repository for managed items, analog or digital. They also include one (or more) methods for importing content to bring manage new items, and several presentation methods to make items available for use. Quoted from WIKIPEDIA.
  • List of content management systems – Wikipedia – List of Enterprise Content Management systems on Wikipedia
  • Artificial intelligence – Wikipedia – Artificial Intelligence on Wikipedia

List of use cases from AI overlapping with Enterprise Content Management:

1. Document classification, automated categorization, tagging and taxonomy

2. Intelligent scanning and capture

3. Handwriting recognition

4. Process / workflow automation & intelligence

5. Recommendations from documents and content

6. Knowledge management

7. Personalization & security

8. Content / image extraction and context creation

9. Automated and intelligent lifecycle management for records, archives and content

10. Document and content analytics

11. Publishing controls

12. Content & document generation

13. Low code ECM

These and more use cases in Enterprise Content Management will get enhanced with AI over the course of next few years.

Email me: Neil@HarwaniSystems.in

Liferay

Language translation options in Liferay – Part 1

Leave a comment

There are two major areas for translations in Liferay:

  1. Web content
  2. Portal itself for its navigation, menus, control panel, forms, portlets, etc. – Localization
  • For web content, there are two major inbuilt options: Using XLIFF files or Liferay interface for manual translation (link provided in references) and automated translation using engines (via API) from Google, Amazon, Azure (link provided in references) and so on.
  • There is an additional area as well for translation integration with products like MoxVeda (link provided in references) where redirections are setup at Web Server level of Liferay and it redirects based on a JAVASCRIPT button to various language translations on MoxVeda server to provide translated content and comes back. All headers and sessions are managed as is. This works both for in-prem and cloud option and is in use by various customers in India.
  • For portal localization, 50 languages are available out of the box and more languages can be added as described in references section link by language properties file with other configurations.
  • Other configurations like unicode and similar in index server (Elastic or SOLR) and database should be considered as needed.

Email me: Neil@HarwaniSystems.in

References: