Case 1:19-cv-11278-RGS Document 33-10 Filed 01/23/20 Page 1 of 12
`
`
`Exhibit J
`
`
`
`
`
`
`
`
`
`
`
`

`

`
`
`
`
`Case 1:19-cv-11278-RGS Document 33-10 Filed 01/23/20 Page 2 of 12
`
`🔎
`
` Sign In | Register
`
`NEWS
`To jar or not to jar?
`Get the lowdown on using Java Archive (jar) les -- including pros and cons
`
`By Todd A. Webb
`JavaWorld |
`JUL 1, 1998 12:00 AM PST
`
`With browsers that support Java 1.1.x gaining in market share, more developers will be
`exploring the use of Java Archive (jar) les. Before you open a jar of worms, you should know
`some of the gotchas involved in using these les. These gotchas can affect most aspects of your
`project -- from how you write your code, to the service your end-users get.
`
`Jar les are an excellent tool to help overcome some of the hurdles that Java faces, such as
`packaging software and making a program trusted. They also have drawbacks -- including
`potentially longer download times, the need to put in extra work to retrieve resources, and a
`lack of universal support. You need to know the pros and cons and what you want to accomplish
`with your Java program before you decide whether or not to use jar les.
`
`The history of jar
`
`The Java language makes it easy for the developer to pull together a great many resources and
`objects for building software. A Java developer can end up with a heavily populated directory
`structure that often must be made available over the Internet. Anyone familiar with the HTTP
`protocol knows that a separate HTTP request must be made for every le. This small overhead
`becomes a big performance issue as the number of les that must be downloaded increases.
`
`https://www.javaworld.com/article/2076712/to-jar-or-not-to-jar-.html
`
`1/8
`
`

`

`From the beginning, a mechanism was needed to simplify deployment of these classes and
`Case 1:19-cv-11278-RGS Document 33-10 Filed 01/23/20 Page 3 of 12
`improve performance. Sun settled rst on the zip le format as dened by PKWARE, and the
`core Java classes are still distributed in zip format. Additionally there was a need for small,
`modular software components (now known as JavaBeans) that could be packaged into a single
`le and imported into an integrated development environment (IDE) -- such as Symantec's
`Visual Café, IBM's Visual Age, or JBuilder by Inprise (the company formerly known as Borland).
`
`These IDEs needed a little more than just a bundle of resources in a zip le, however. They also
`needed to know more about the classes -- for example, which classes were beans, and which
`provided support. It was decided that a manifest le would be used for this information, and
`that the name of the zip le should reect the availability of the manifest le. A zip le
`containing the le /meta-inf/manifest.mf was used and dubbed the Java Archive le or jar -- the
`standard distribution format for JavaBeans.
`
`Jar les also offered a solution to other vexing problems. Java was built on the philosophy that
`it's better to build an overly secure application and relax security as needed than it is to build a
`low-security system and try to patch it on demand. The sandbox model used by browsers is very
`restrictive, and doesn't allow developers to do some things that could be very useful, even very
`low risk things, such as reading and writing to a single le on the client machine. A mechanism
`was needed to allow certain code to perform these operations, so the idea of trusted applets
`was adopted. Since it would be extremely cumbersome to try to mark every class le as trusted,
`the logical choice was to wrap them all into one le and mark that one le as trusted. That le
`has the sig extension -- the digitally signed version of jar.
`
`When and how to use jar
`
`To decide whether or not jar is for you, consider the following:
`
`Your target market
`
`Security
`
`Performance
`
`https://www.javaworld.com/article/2076712/to-jar-or-not-to-jar-.html
`
`2/8
`
`

`

`Separate packaging
`Case 1:19-cv-11278-RGS Document 33-10 Filed 01/23/20 Page 4 of 12
`
`Target market
`
`The rst step in deciding whether to use the jar format is to know your target market. Jar
`already enjoys universal support from IDEs that deal with JavaBeans. However, jar les are not
`universally supported by Web browsers. Jar les were introduced with the 1.1 version of Java. A
`developer should assume that any version of a browser that doesn't run a 1.1 Java virtual
`machine (JVM) will not understand jar les. A signicant number of Internet users still use these
`older browsers. Many software products also have integrated browsers based on older software
`-- such as versions of America Online (AOL) and PointCast that use Microsoft's Internet Explorer
`3.0. The browsers that currently support jar -- and its digitally signed counterpart, the sig le --
`include the latest versions of Netscape's Navigator 4.0x and Sun's HotJava browser 1.1. Even
`Microsoft appears to fully support jar in its latest incarnation of Internet Explorer 4.0x, even
`though it has created a proprietary cab le format that serves the same purpose. If you know
`you need to have backward compatibility with older browsers, you will have to forego using jar
`les. Sorry.
`
`Security
`
`The next consideration is security. If you're deploying an applet, your code will be restricted to
`the sandbox model. If you absolutely must have access to the client's le system, you'll have to
`run your applet as trusted. This requires you to apply a digital signature to a jar le. Your choice
`has been made.
`
`Performance
`
`The next important consideration is performance. Packaging your software in a jar le can either
`speed up performance or slow it down. Take, for example, Sun's popular Swing classes, a subset
`of the Java Foundation Classes (JFC), which are packaged in swingall.jar. Version 1.01 contains
`1,305 les compressed to 3,657 kilobytes. Suppose you have an applet that uses swingall.jar --
`even if you use only one class from swingall.jar, the entire jar le will be downloaded to the
`user before that one class will be extracted and loaded. In other cases, with small numbers of
`
`https://www.javaworld.com/article/2076712/to-jar-or-not-to-jar-.html
`
`3/8
`
`

`

`classes, it may take more time to get the le, uncompress it, and extract the contents than to
`Case 1:19-cv-11278-RGS Document 33-10 Filed 01/23/20 Page 5 of 12
`simply fetch each le individually. As a general rule, if you have a large number of les and you
`can keep them in tight packages (just the les you need at runtime) you are better off using jar
`les for better performance.
`
`Separate packaging
`
`Next, you need to decide if all of your classes should be packaged together. You'll probably
`want to make some of your code available to the world, release some of it only to a certain
`group, and restrict the rest of it to the administrator's use. So package your classes separately.
`You may nd that some packages need to be in jar les and others don't.
`
`Consider all of these things when you're deciding on jar usage. Syzygy Technologies Inc., for
`example, is using jar les to develop a breakthrough computerized time and attendance system.
`In this new product, a server provides access to an employee database using Java database
`connectivity (JDBC). The client software allows employees to securely log into the system across
`the Internet and submit their hours using a Web browser. The client interface requires a large
`number of les, but Syzygy wanted to keep the start-up time to a minimum. In addition, the
`company wanted the option of running the client as a trusted applet in a future version without
`having to change the architecture. Syzygy also used some visual JavaBeans in this product. So,
`what did Syzygy decide to do?
`
`It decided to make the client classes accessible through a Web server, but not through the
`server classes. It would have to package pieces of the software separately, and make a decision
`on how to package each piece.
`
`To run as a trusted applet in the future, the client classes would have to be digitally signed. This
`meant they would eventually have to be packaged in a signed jar le, a transition that would be
`greatly eased if the classes were packaged that way from the beginning. Add to that the fact
`that the software relied on some key technologies in Java 1.1x, meaning backward compatibility
`had already been given up, and the decision to package the client classes in a compressed jar
`le was clear.
`
`https://www.javaworld.com/article/2076712/to-jar-or-not-to-jar-.html
`
`4/8
`
`

`

`The JavaBeans were stripped down to the classes necessary at runtime and packaged by
`Case 1:19-cv-11278-RGS Document 33-10 Filed 01/23/20 Page 6 of 12
`themselves in a compressed jar. This would allow an easy swap if the company's JavaBeans were
`to change. The new jar could be easily specied in the HTML le.
`
`Since the server software would be installed once on the server machine, download time was
`not an issue. However, keeping all the resources in one le really simplied the install process.
`Because the server would rarely be restarted, overhead on startup (i.e., decompressing les) was
`negligible, so Syzygy decided to jar the server resources in compressed format as well. The
`company could have used a zip le, but going with the jar le meant that any Syzygy resource
`would be fetched from a jar, thus keeping resource retrieval consistent. This decision proved its
`merit -- in ease -- when the company had a server resource become a client resource.
`
`Working with jar les
`
`Creating jar les is easy. Packaged with the Java Development Kit (JDK) is a tool named jar. Unix
`users will immediately notice this tool's similarities to tar, a tape archive tool, but jar les are
`essentially zip les. In fact, you will nd that on the command line, jar can unzip most zip les,
`and a program like PKZIP or WinZip can unjar jar les. Like a zip le, a jar le can store virtually
`any other le. The main difference between the zip le and the jar le is the manifest. This is
`used primarily for JavaBeans to let an IDE know which classes are beans. If you are not creating
`JavaBeans, you do not need to worry about the manifest le, as the jar tool in the JDK handles
`this automatically. The most common command for jarring your software is jar cvf. The c tells
`jar to create, the v tells jar to verbosely tell what it is doing, and f tells jar that the next
`argument will be the le name you want. Let's say you have your class les packaged under
`myStuff. You also have some images in an images directory. Your command would look as
`follows:
`
` jar cvf myStuff.jar myStuff/*.java myStuff/images/*.gif
`
`You would need to use \ instead of / on a Windows system. By default, the contents of the jar
`are compressed. If you wanted your les uncompressed, you would just need to add 0 as
`follows:
`
`https://www.javaworld.com/article/2076712/to-jar-or-not-to-jar-.html
`
`5/8
`
`

`

`Case 1:19-cv-11278-RGS Document 33-10 Filed 01/23/20 Page 7 of 12
` jar cvf0 myStuff.jar myStuff/*.java myStuff/images/*.gif
`
`Now, to see what's in your jar le, you can issue the following command:
`
` jar tvf myStuff.jar
`
`These commands can easily be added to a makele or a Windows batch le to automatically
`build your jar les when your software is compiled.
`
`So now you have your jar le and maybe three jar les from other vendors. You just drop them
`into your classpath and you're ready to go, right? Wrong. For JavaBeans, IDEs may have a
`directory into which you drop all of your jar les so they can be found. But the Java Runtime
`Environment (JRE) does not search every directory in your classpath looking for jar les. For Java
`applications, each jar le has to be specied in the classpath, just like zip les. When you
`specify your jar les in an HTML le, you need not worry; the browser software is smart enough
`to gure this out. All you need to do is place the ARCHIVE tag in the APPLET section, separating
`your jar les with commas:
`
`<center>
`<applet code="myStuff.myApplet" ARCHIVE="myStuff.jar, windows.jar, swing.jar, companyX.jar">
`</applet>
`</center>
`
`Now comes the tricky part. Let's say you've packaged everything inside your jar le along with
`your classes: image les, text les, sound les, and so on. How do you retrieve these resources
`from inside your program? Many programmers have had working software that they later decide
`to distribute in a jar le. They then discover that the software is broken because the resources
`aren't being retrieved. Here's the problem: The JRE looks for class les in the classpath, and it
`looks for resource les in the regular path. Since the jar le is located in the classpath, and your
`resources are in the jar, you now have to nd your resources by way of the classes! Confused?
`Don't worry -- you can use java.lang.Class to get your resources for you.
`
`https://www.javaworld.com/article/2076712/to-jar-or-not-to-jar-.html
`
`6/8
`
`

`

`First you need a reference to a Class object. You can use Class.forName(String) to get to a
`Case 1:19-cv-11278-RGS Document 33-10 Filed 01/23/20 Page 8 of 12
`class in another jar le, but typically your resource is already packaged with the class you're in,
`so getClass() will do. getClass() is a java.lang.Object method, so it can be called from
`anywhere.
`
`Now that you have a Class object, there are two methods you can choose from:
`getResource(String) and getResourceAsStream(String). Let's try
`getResource(String), which will return a URL. The String represents a le name, but
`remember that you're in the context of the class, so any le name you use will be automatically
`prepended with the package path. The following is a helper method to get an image le, a
`common resource in jar les.
`
`/**
` * extra work has to be done in order to get an image from a jar file.
` * This is a convenience method to fetch an image out of the current
` * jar file.
` *
` * @param fileName the name of the image file inside the jar file.
` * NOTE: The package path of this class will be prepended to the
` * filename. E.g., if the package-qualified name of this class
` * is myStuff.myApplet and the resource file name
` * is "images/myFile.gif", the ClassLoader will search the
` * jar file for "myStuff/images/myFile.gif".
` * @return an image built from the file if found, null if the file
` * was not successfully retrieved.
` */
`protected Image getImageFromJAR(String fileName){
` if( fileName == null ) return null;
` Image image = null;
` Toolkit toolkit = Toolkit.getDefaultToolkit();
` try{
` image = toolkit.getImage( getClass().getResource(fileName) );
` }
` catch(Exception exc){
` return null;
` }
` return image;
`}
`
`Page 1 of 2 ▻
`
`https://www.javaworld.com/article/2076712/to-jar-or-not-to-jar-.html
`
`7/8
`
`

`

`Case 1:19-cv-11278-RGS Document 33-10 Filed 01/23/20 Page 9 of 12
`Copyright © 2020 IDG Communications, Inc.
`
`https://www.javaworld.com/article/2076712/to-jar-or-not-to-jar-.html
`
`8/8
`
`

`

`
`
`
`
`Case 1:19-cv-11278-RGS Document 33-10 Filed 01/23/20 Page 10 of 12
`
`🔎
`
` Sign In | Register
`
`NEWS
`To jar or not to jar?
`Get the lowdown on using Java Archive (jar) les -- including pros and cons
`
`By Todd A. Webb
`JavaWorld |
`JUL 1, 1998 12:00 AM PST
`
`◅
`
`Page 2 of 2
`
`Pretty simple. So how does our code handle being run under the sandbox model in an Internet
`browser? The above code works great in HotJava browser 1.1, but Internet Explorer and
`Netscape Navigator have the browser marketshare. Internet Explorer 4.0 will throw a
`java.lang.SecurityException if you try to get a Class object or load a resource from
`another jar le other than the one your current class le came from. As long as we only fetch
`resources from our own jar le, the code should work ne. But Netscape Navigator 4.0 throws us
`yet another curve ball by returning a null from getResource(String). So,
`getResourceAsStream(String) is the only option that works in Netscape. Here's the same
`method modied to work in all three browsers:
`
`https://www.javaworld.com/article/2076712/to-jar-or-not-to-jar-.html?page=2
`
`1/3
`
`

`

`Case 1:19-cv-11278-RGS Document 33-10 Filed 01/23/20 Page 11 of 12
` protected Image getImageFromJAR(String fileName){
` if( fileName == null ) return null;
` Image image = null;
` byte[] thanksToNetscape = null;
` Toolkit toolkit = Toolkit.getDefaultToolkit();
` InputStream in = getClass().getResourceAsStream(fileName);
` try{
` int length = in.available();
` thanksToNetscape = new byte[length];
` in.read( thanksToNetscape );
` image = toolkit.createImage( thanksToNetscape );
` }
` catch(Exception exc){
` System.out.println( exc +" getting resource " +fileName );
` return null;
` }
` return image;
` }
`
`Assuming your images directory exists in a subdirectory of the package path, you could call the
`method above to retrieve an image, using the following line of code:
`
`Image image = getImageFromJAR( "images/myImage.gif");
`
`Conclusion
`
`Jars are a wonderful and welcome addition to the Java language. As with any new technology,
`there are bugs that aren't worked out yet. For example, most versions of Netscape Navigator
`4.0x do not support multiple jar les. Navigator will throw a
`java.lang.NoClassDefFoundError when a class le in A.jar references a class in B.jar.
`Navigator 4.05 and the JDK1.1 support patch for Navigator 4.04 supposedly x this problem, but
`I haven't had time to fully test the latest version. Hopefully, the information in this article can
`help you make the best decisions on when and when not to use jar les. Additional information
`can be found at the URL below. Always remember that in the end there is no substitute for
`doing your own testing and benchmarking -- so jar it up and see for yourself!
`
`Todd A. Webb works as a software engineer for Syzygy Technologies, a computer engineering company in
`San Diego, CA. Todd works primarily as a contractor for Space and Naval Warfare (SPAWAR) under the
`Department of Defense (DoD). Todd has been involved in designing pieces of the Navy's Command and
`
`https://www.javaworld.com/article/2076712/to-jar-or-not-to-jar-.html?page=2
`
`2/3
`
`

`

`Control System in Java and specializes in graphical interface design and computer graphics. Todd is also a
`Case 1:19-cv-11278-RGS Document 33-10 Filed 01/23/20 Page 12 of 12
`project manager for a commercial client/server software application that will take advantage of some key
`Java technologies including JDBC, JFC, JNDI, RMI/CORBA, and private/public key encryption using JCE. Todd's
`outside interests? Spending time with people instead of computers! Other interests include weight lifting,
`aikido, aerobics, swimming, hiking, scuba diving, massage, vegetarianism, business, investing, and aviation.
`There's much more, but as Todd puts it, with software development, there's not much time for a life!
`
`Learn more about this topic
`
`For Sun's JAR Guide, JAR API Reference, and JAR Tools, see
`http://java.sun.com/products/jdk/1.1/docs/guide/jar/index.html
`
`◅
`
`Page 2 of 2
`
`Copyright © 2020 IDG Communications, Inc.
`
`https://www.javaworld.com/article/2076712/to-jar-or-not-to-jar-.html?page=2
`
`3/3
`
`