Mailing-List: contact dev-help@cayenne.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cayenne.apache.org
To: dev@cayenne.apache.org
From: Aristedes Maniatis <ari@ish.com.au>
Subject: ROP, Hessian and protocol-buffers
Message-ID: <165632c2-7737-ac7f-4abe-fa1a837c0e54@ish.com.au>
Date: Fri, 20 May 2016 13:48:48 +1000
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0)
 Gecko/20100101 Thunderbird/45.1
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
 protocol="application/pgp-signature";
 boundary="ct7F2WRd3jgQwu0nSwEArHqO2EqsTDE4D"
archived-at: Fri, 20 May 2016 03:49:10 -0000

--ct7F2WRd3jgQwu0nSwEArHqO2EqsTDE4D
Content-Type: multipart/mixed; boundary="sUo3Mwwq0cS8Q3TbNU9KvJh1Mosua7WUg"
From: Aristedes Maniatis <ari@ish.com.au>
To: dev@cayenne.apache.org
Message-ID: <165632c2-7737-ac7f-4abe-fa1a837c0e54@ish.com.au>
Subject: ROP, Hessian and protocol-buffers

--sUo3Mwwq0cS8Q3TbNU9KvJh1Mosua7WUg
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

I've realised that Savva and I have been having too much conversation aro=
und this in private and it should be brought back to the list. Here is a =
summary of the great work happening behind the scenes to modernise Cayenn=
e's ROP implementation.

First, let's remember the problems we were having:

1. Hessian (the serialisation tool) hasn't had much love for many years. =
It has bugs. In particular it fails to serialise BigDecimal and Java8 dat=
e objects.

2. The ROP implementation is completely tied into Hessian, and not just f=
or serialisation. It also uses Hessian for the servlet implementation and=
 endpoint declarations.

3. This meant it was hard to add HTTP/2, compression and other things.


So Dima spent time this past January on pulling apart the Cayenne impleme=
ntation and putting it back together again in a pluggable way. Now we can=
 implement different serialisers and different HTTP libraries. That work =
landed in 4.0M3.

Next Savva has been working on protocol-buffers, which is a Google led se=
rialisation library under the Apache license. It is more modern than Hess=
ian and actively developed. It is less likely to have security issues wit=
h lots of people looking at it. It scales really well and is fast.

But protocol-buffers isn't enough, since that library doesn't know how to=
 take an arbitrary graph of objects and serialise them with their relatio=
nships. Another library protostuff sits on top and does that for us. It i=
s also well used and actively developed.

So now we have an almost working Cayenne extension library. Instead of He=
ssian, you can drop this library into your project and have it use protos=
tuff which uses protocol-buffers. But bug remains in protostuff and one o=
f the authors there has been incredibly helpful in sorting it out. Hopefu=
lly a bit of tweaking and testing, and that will be resolved.

The problem and conversation can be seen in these threads. The protostuff=
 people are very helpful.

https://github.com/protostuff/protostuff/issues/176
https://github.com/protostuff/protostuff/pull/177
https://github.com/protostuff/protostuff/pull/180

Now it needs more testing.


In addition, HTTP/2 is complicated with something called ALPN which is al=
l about negotiating the right kind of link. Savva has some example code h=
ere: https://github.com/thinline72/rpc-example  which demonstrates gluing=
 together Spring remote, Jetty HTTP/2 and protostuff.


In the end, we'll have:

* better security (not Hessian)
* faster serialisation (protocol-buffers)
* less network traffic (HTTP/2)
* easier implementation of compression and other filters (pluggable modul=
es)
* simpler to set up


It will be really nice and I look forward to Savva landing this into Caye=
nne.

Ari


--=20
-------------------------->
Aristedes Maniatis
CEO, ish
https://www.ish.com.au
GPG fingerprint CBFB 84B4 738D 4E87 5E5C  5EFA EF6A 7D2E 3E49 102A


--sUo3Mwwq0cS8Q3TbNU9KvJh1Mosua7WUg--

--ct7F2WRd3jgQwu0nSwEArHqO2EqsTDE4D
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iEYEARECAAYFAlc+iSAACgkQ72p9Lj5JECoTjQCeLrNSA1al1x2nnTD2asunkR82
cXcAnRUDvQQX+EAxoR8ig68eD/CbEsEi
=YfYv
-----END PGP SIGNATURE-----

--ct7F2WRd3jgQwu0nSwEArHqO2EqsTDE4D--