One thing we're seeing in the Java world

The agency set up prisons under its covert action authority. Under U.S. law, only the president can authorize a covert action, by signing a document called a presidential finding. Findings must not break U.S. law and are reviewed and approved by CIA, Justice Department and White House legal advisers.

Six days after the Sept. 11 attacks, President Bush signed a sweeping finding that gave the CIA broad authorization to disrupt terrorist activity, including permission to kill, capture and detain members of al Qaeda anywhere in the world.


It could not be determined whether Bush approved a separate finding for the black-sites program, but the consensus among current and former intelligence and other government officials interviewed for this article is that he did not have to.

Rather, they believe that the CIA general counsel's office acted within the parameters of the Sept. 17 finding. The black-site program was approved by a small circle of White House and Justice Department lawyers and officials, according to several former and current U.S. government and intelligence officials.

A separate but often conflated issue is whether to use configuration files or code on an API to wire up services. For most applications that are likely to be deployed in many places, a separate configuration file usually makes most sense. Almost all the time this will be an XML file, and this makes sense. However there are cases where it's easier to use program code to do the assembly. One case is where you have a simple application that's not got a lot of deployment variation. In this case a bit of code can be clearer than a separate XML file.

A contrasting case is where the assembly is quite complex, involving conditional steps. Once you start getting close to programming language then XML starts breaking down and it's better to use a real language that has all the syntax to write a clear program. You then write a builder class that does the assembly. If you have distinct builder scenarios you can provide several builder classes and use a simple configuration file to select between them.

I often think that people are over-eager to define configuration files. Often a programming language makes a straightforward and powerful configuration mechanism. Modern languages can easily compile small assemblers that can be used to assemble plugins for larger systems. If compilation is a pain, then there are scripting languages that can work well also.

It's often said that configuration files shouldn't use a programing language because they need to be edited by non-programmers. But how often is this the case? Do people really expect non-programmers to alter the transaction isolation levels of a complex server-side application? Non-language configuration files work well only to the extent they are simple. If they become complex then it's time to think about using a proper programming language.

One thing we're seeing in the Java world at the moment is a cacophony of configuration files, where every component has its own configuration files which are different to everyone else's. If you use a dozen of these components, you can easily end up with a dozen configuration files to keep in sync.

My advice here is to always provide a way to do all configuration easily with a programmatic interface, and then treat a separate configuration file as an optional feature. You can easily build configuration file handling to use the programmatic interface. If you are writing a component you then leave it up to your user whether to use the programmatic interface, your configuration file format, or to write their own custom configuration file format and tie it into the programmatic interface



Among the first steps was to figure out where the CIA could secretly hold the captives. One early idea was to keep them on ships in international waters, but that was discarded for security and logistics reasons.

CIA officers also searched for a setting like Alcatraz Island. They considered the virtually unvisited islands in Lake Kariba in Zambia, which were edged with craggy cliffs and covered in woods. But poor sanitary conditions could easily lead to fatal diseases, they decided, and besides, they wondered, could the Zambians be trusted with such a secret?