The 10 Most Important Security Controls Missing in JavaEE .

JavaEE has some excellent built-in security mechanisms, but they don’t come close to covering all the threats that your applications will face.  Many common attacks like Cross-Site Scripting (XSS), SQL Injection, Cross-Site Request Forgery (CSRF), and XML eXternal Entities (XXE) aren’t covered at all.  You can prevent your web applications and web services from being vulnerable to these attacks, but it’s going to take some work and testing.  Fortunately, the Open Web Application Security Project (OWASP) has issued the “Ten Most Critical Web Application Security Risks” report.
Let’s take a look at how these important risks apply to JavaEE web applications and web services:

1. Injection 

- Injection happens any time a developers takes  untrusted information, such as request.getParameter(), request.getCookie(), or request.getHeader(), and uses it in a command interface.  For example, SQL injection happens if you concatenate untrusted data into a regular SQL query, like “SELECT * FROM users WHERE username=‘“ + request.getParameter(“user”) + “‘ AND password=‘“ + request.getParameter(“pass”) = “‘“;  Developers should use PreparedStatement to keep attackers from changing the meaning of queries and taking over database hosts.  There are many other types of injection such as Command Injection, LDAP Injection, and Expression Language (EL) Injection, and all of them are devastatingly dangerous, so be careful when sending data to these interpreters.

2. Broken Authentication and Session Management

 – JavaEE has support for authentication and session management, but there are many ways to go wrong here. You’ll have to make sure that all authenticated traffic goes over SSL, no exceptions.  If you ever expose a JSESSIONID it can be used to hijack a user’s session without their knowledge.  You should rotate the JSESSIONID when the user authenticates to prevent Session Fixation attacks.  And you should avoid the use of response.encodeURL() which adds the user’s JSESSIONID to the URL where it can be more easily disclosed or stolen.

3. Cross-Site Scripting (XSS)

 - XSS occurs when JavaEE developers take untrusted information from the HTTP request and put it in the HTTP response without proper contextual output encoding.  The attacker can use this behavior to inject their scripts into a website where they can hijack sessions and steal data.  To prevent these attacks, developers need to perform context-sensitive output encoding.  If you’re putting data into HTML, use &#xx; format. Be sure to quote your HTML attributes, as unquoted attributes can be terminated with many different characters.  If you’re putting untrusted data into Javascript, URLs, or CSS, use the appropriate escaping technique for each.  And be very careful when dealing with nested contexts, such as a URL in Javascript in an HTML attribute. You'll want an encoding library like OWASP ESAPI to help.

4. Insecure Direct Object References 

– Anytime your application exposes an internal identifier, such as a database key, a filename, or hashmap index, attackers may attempt to manipulate those identifiers to access unauthorized data.  For example, if you pass untrusted data from the HTTP request to the Java File constructor, the attacker may use "../" or null byte attacks to trick your validation. You should consider using indirect references to your data, to prevent this type of attack. The ESAPI library has support for ReferenceMaps that facilitate this indirection.

5. Security Misconfiguration 

– There are a lot of security settings in modern JavaEE applications and frameworks like Struts and Spring. Be sure you have reviewed them and set things up the way you want.  For example, beware the <http-method> tag in a <security-constraint>.  This indicates that the security-constraint only applies to the listed methods, allowing attackers to use other HTTP methods, like HEAD and PUT, to bypass the entire security constraint.  Most likely you should delete <http-method> tags from your web.xml.

6. Sensitive Data Exposure – Java has extensive cryptographic libraries, but they are not easy to use correctly. You should find a library that builds on top of JCE to provide easily and safely usable cryptographic methods. Some examples are Jasypt and ESAPI.  You should be using strong algorithms like AES for encryption and SHA256 for hashes.  Be careful with password hashes as they can be reversed using a Rainbow Table, so use adaptive algorithms like bcrypt or PBKDF2.

7. Missing Function Level Access Control

 – JavaEE supports both declarative and programmatic access control, but many applications still choose to create their own scheme. Frameworks like Spring also have annotation-based access control primitives. The most important thing is to be sure that every exposed endpoint has the appropriate access control check, including web services.  Don’t assume that your client can control anything, as attackers will access your endpoints directly.

8. Cross Site Request Forgery (CSRF) 

- Every state-changing endpoint needs to verify that requests are not forged. Developers should put a random token in each user’s session and then verify it when requests arrive. Otherwise, attackers can create "attack" pages by including malicious IMG, SCRIPT, FRAME, or FORM tags that link to the unprotected application. When the victim views such a page, their browser will generate a "forged" HTTP request to whatever URL is specified in the tag, and will automatically include the victim’s credentials.

9. Using Components with Known Vulnerabilities

 – Modern JavaEE applications have hundreds of libraries. Dependency resolution tools like Maven have caused this number to explode in the past five years.  Many widely used Java libraries have known vulnerabilities that can allow a web application using them to be completely subverted.  The solution is to stay on top of your libraries and keep them up to date. Don't just run a single scan, as new vulnerabilities are released every day.

10. Unvalidated Redirects and Forwards 

— Anytime your application uses untrusted data, such as a request.getParameter() or request.getCookie(), in a call to response.sendRedirect(), the attacker may be able to force a victim’s browser to an untrusted website designed to install malware.  A similar problem exists with forwards, except that the attacker may be able to forward himself to unauthorized functionality, such as administrative pages.  Be sure to carefully validate redirect and forward targets. You should stay on top of these problems continuously. New attacks and vulnerabilities are identified all the time. Ideally, you'll integrate security checks into your existing build, test, and deployment process.

To check your applications for these problems, try the FREE Contrast for Eclipse plugin. It’s not a simple static analysis tool.  Instead, C4E takes advantage of the Java Instrumentation API to monitor everything in your application related to security.  C4E even does full data flow analysis in realtime, so it can trace data from the request through a complex application.  For example, imagine that your code takes a parameter value, base64 decode it, store it in a map, put the map in a data bean, store the bean in a session attribute, fetch the bean value in a JSP and insert it into the webpage using EL. Contrast for Eclipse will trace that data and report the XSS vulnerability.  Even if you are using complex frameworks and libraries.  No other tool comes close in terms of speed, accuracy, and ease of use. You can find Contrast for Eclipse in the Eclipse Marketplace.  Then just go to the Servers tab and “Start with Contrast” — we’ll do the rest.

Source : http://java.dzone.com/articles/10-most-important-security

What is the Best Programming Language to Learn in 2014 ?

It’s been a year since I revealed the best languages to learn in 2013. Once again, I’ve examined the data produced by Jobs Tractor who analyzed more than 45,000 developer jobs advertised on Twitter during the past twelve months. The results:

Java	8,731
PHP	8,238
Objective-C	5,859
Java for Android	4,312
SQL	3,553
JavaScript	3,154
Ruby	2,937
C#	2,549
Python	1,587
C++	1,273
C	685
ActionScript	674
ASP.net	492
Perl	224
Scala	143
Visual Basic	92

The main changes since last year…

• PHP and Java have switched places but both remain in high demand.
• Java for Android has overtaken SQL and is closing in on Objective-C.
• JavaScript has overtaken Ruby.
• Python has risen two places.
• ActionScript has dropped two places.

Take this survey with a large pinch of salt. Then add pepper, ketchup and numerous other condiments. I’m not convinced Twitter is a reliable source of job-related data and regional differences can skew results.
A recent survey by the online course provider Lynda.com for Mashable produced the following list of languages in order of popularity:

1. Java
2. C
3. C++
4. C#
5. Objective-C
6. PHP
7. Python
8. Ruby
9. JavaScript
10. SQL

The usual suspects are there but, again, results will be biased by the topics offered and the site’s target audience (primarily newer developers).
Industry analyst RedMonk has taken a different approach and determined language popularity by examining the frequency of projects on GitHub and questions on StackOverflow:

1. JavaScript
2. Java
3. PHP
4. C#
5. Python
6. C++
7. Ruby
8. C
9. Objective-C
10. CSS

Don’t take this too literally; a language could score higher if it’s more problematic than others. I’m also surprised to find CSS on the list — although due to pre-processors like Sass, LESS and Stylus, CSS tends to be viewed more as a programming language nowadays. That said, if CSS is considered a programming language, where are HTML and SQL?

Source : http://www.sitepoint.com/best-programming-language-learn-2014/

7 Fascinating Changes That Can Shape the Future of Programming .

Programming as a discipline is based on cold logic, math and precision. You might think something as ambiguous as ‘trends’ will not be associated with something as practical ‘programming’, but in this particular case, you are wrong.  The world of programming like many others is evolving continuously and there are changes happening that have the potential to shape its future.
So, what are these changes that have the ability to shape the future of programming? Let’s take a look:

1.  Coding on Cloud

The buzz that surrounded cloud computing is now coming good on its promise. It is fast turning out to be the one technology that small, mid-size or large business enterprises cannot do without. Cloud computing removes the need for storing data on in-house systems and helps migrate this data to virtual servers in the Cloud.

Forrester, an analyst group expects global cloud computing market will grow from $35bn (£22.5bn) in 2011 to around $150bn by 2020, and for good reason. It brings a slew of benefits to the table. Programmers have taken to the Cloud like a duck to water. Coding on Cloud is a hot new trend that is all set to become the norm in the future.

Coding on cloud has made it possible for programmers to work remotely. It offers more flexibility in terms of the device, platform and technologies they choose to work with; they don’t need a high performance device to power all the programming tools they need. All they need to do is access the IDEs easily available on the Cloud to start coding.

As long as their device has an internet connection, they can code from any device. Also, with IaaS, they don’t have to worry about investing in expensive infrastructure as that can be accessed from the Cloud as well. Moreover, the fact that they are working in the cloud environment means distance isn’t a barrier to regular collaboration between different teams.

In fact, Cloud facilitates real-time collaboration between developers working from diverse remote locations.Programmers have just begun to explore the benefits of cloud and there is absolutely no doubt that its use will keep growing in the future vis-à-vis programming.

2.  Arrival of Hack

This year in March, Facebook introduced a new language called Hack for the HipHop Virtual Machine (HHVM).It is the hipper new version of PHP - a widely used open source general-purpose scripting language that is especially suited for web development.
So, why did Facebook introduce Hack?
Good question.

PHP has limitations - experienced programmers will tell you that its rapid prototyping attribute complicates development and maintenance of large code bases.It is to address this concern, Facebook engineers introduced Hack.
One of the chief characteristics of this language is gradual typing that allows programmers to write both static and dynamic code that can inter-operate in the same file.

But that’s not all, it also makes it easier to manage code and eliminate errors. Unlike PHP, Hack runs on Facebook’s HHVM which uses just-in-time compilation to boost program performance.These benefits give an indication that in time Hack will become the language of choice for developing websites.
What’ more, and this is a crucial point, in order to encourage programmers to migrate from PHP to Hack, Facebook is providing conversion tools.

3.  Swift from Apple

This year at the WWDC developer event, Apple launched a new programming language called Swift for iOS and OS X to develop lightning-fast apps. The purpose of Swift is to make it easy for developers to write a reduced code that is leaner and cleaner. By introducing Swift, Apple is trying to ensure, more and more developers can easily come up with high performance iOS apps that pass Apple’s strict quality guidelines.

No prizes for guessing, iOS developers are gung-ho about this language, which means its future is in very good hands. Apple claims Swift "is the first industrial-quality systems programming language that is as expressive and enjoyable as a scripting language." There are tons of improvisations available in this new programming language which will clearly reflect in all the new iOS apps that are built using Swift, and which will be richer from the UX and technical point of view.

For Apple, Swift  is yet another way of telling the programming world at large that the company is committed to pushing the technology envelope when it comes to app development and at the same time wants to make the job of programmers easier.

4.  Apache Hadoop Stands Tall

There’s a lot of buzz about ‘Big Data’ lately. There is a very good chance that you are either aware of this term or better yet, are using Big Data to make important business and marketing decisions.  As can be imagined, it can get extremely difficult to handle and analyze all the data that is at your disposal.

That’s where Apache Hadoop comes into picture. It processes an avalanche of big data easily. It is a platform which provides both distributed storage and computational capabilities. Large Web 2.0 companies like Google and Facebook uses Hadoop to store and process data. Hadoop provides a framework that lets programmers write code which can process huge amounts of unstructured data; this allows programmers to focus on data that is related to their business needs only. There is every chance that the next big ticket discovery in programming will happen from this particular combination of Big Data and Hadoop.
Let’s wait and watch.

5.  Wyvern Programming Language is Coming

Programmers, at times, are required to use multiple languages to complete a project. But this, typically, leads to coding errors which create software vulnerabilities that can easily be attacked by criminal hackers.To get around this problem, Carnegie Mellon University is doing some fantastic research on Wyvern programming language; a host language that lets developers roll five programming languages into one to develop secured mobile and web applications. It is currently in the prototype stage.

This programming language will provide a way to safely use multiple programming languages within the same program so programmers can use the language that is most appropriate for each function. Since, it improves security  it is highly suitable for developing high-assurance applications. Due to the many benefits of Wyvern, there is every chance that the future of programming rests on its shoulders.  Think about it, why would any programmer not use this language?

6.  GPUs will replace CPUs

Applications are getting more and more complex and their code is taking up a lot of memory. The CPU just cannot satisfy the need of developers for processors that can run applications hundreds of times faster. Enter GPU. The dedicated memory of GPUs is 5-10 X the bandwidth of CPU memory. Post GPU, applications are undergoing a powerful transformation. GPUs seamlessly run applications that are filled with extensive graphical routines. This means developers aren’t scared of coming up with applications with complex coding, which in the not too distant past would have been considered too ‘system heavy’.

Contrary to the common perception that GPUs are only for gamers, they are today used by programmers who are working in various fields such as physics research, chemical industry, astronomy, aviation, military and many more.The use of GPUs is all set to get widespread in the future; this essentially is good news for programmers. They can now explore the limits of their capabilities.

7.  Age Old Programming Language ‘Java’ Is Not Going Anywhere

Okay, Java is not new, but if there ever was a programming language that has always adapted to the changing needs and demands of its users, it is Java.
It has been around since two decades, and since its arrival it has always been highly regarded as a language that is the foundation of development. It is the favorite language of programmers and its constant evolution has also kept up to speed with the latest developments in mobile technology; today it is also used by Android developers to create amazing mobile apps.

Android is the king when it comes to mobile market share.  In July 2013, over 50 billion apps had been downloaded from Google App Store. Most of these apps are developed in Java using the Android Software Development Kit. This figure proves that Java is a language that is not only used for developing web applications, but also proving its mettle in the highly competitive Android landscape.

As it continues to be a relatively easy to learn language for programmers, Java was, is and will continue to rule the programming world. So, these are the 7 changes that have the potential to shape the future of programming. Each one of them is trying to address a structural weakness in programming or trying to take programming to the next level. So, let’s hope all of them help improve programming as a discipline and take it to new heights.

source : http://java.dzone.com/articles/7-fascinating-changes-can

5 Programming Languages You’ll Need Next Year (and Beyond)

We’ve reached a bit of a turning point in the world of programming. Ten years ago, programmers were moving into dynamic languages. To many of us, those languages seemed like a bit of a fad, even if they made programming easier. But those languages endured, and today we’re developing software with a combination of old and new tools. That creates the potential for confusion: What languages are best to learn if you want to stay employed?
Before diving into which programming languages will likely prove most popular over the next year or two, let’s look at what makes them so different from one another.

Static vs. Dynamic Languages

 

When referring to dynamic languages, the term “dynamic” really refers to the variable types in the language. When you write code and declare a variable, dynamic languages let you change the type of data held by the variable when the program is running; those languages that don’t are known as “static” or “strongly typed.” Languages such as C++ and Java are strongly-typed languages, while JavaScript, PHP, and Perl are dynamic languages.
When you declare a variable in C++, you provide the type of data it will hold (such as integer, float, or string). If you try to store a different type in that variable, the compiler will issue an error and won’t compile the program. The same happens with Java.
But JavaScript, for example, allows you to change types anytime you want, while the program is running. In fact, with JavaScript, you don’t even specify a type when you declare a variable: After you declare the variable, you can store an integer in it, and then later a string, which will replace the existing integer.
Although there was a lot of excitement in recent years over dynamic languages, the concept is roughly fifty years old.

Functional Languages

 

With the excitement over dynamic languages came an increased interest in functional languages. A functional language is one whereby the functions themselves can be stored in variables and passed around as parameters to other languages. Most languages today support some level of functional programming. C++, for example, has always let you pass around pointers to functions. However, other languages such as JavaScript make it much easier to handle functions as objects. As such, people don’t really consider C++ a functional programming language, whereas JavaScript usually is considered one, and Haskell is usually considered the best example of a functional language.

Garbage Collection

 

In theory, if you write your code correctly, you should never have any bugs. How does that sound for a nice statement? But when you’re working on a huge project with multiple programmers, there’s one bug that seems to creep up a lot: Memory leaks. A memory leak happens when you allocate a variable, finish using the variable, but forget to free up the memory associated with the variable. If a program does this a lot and the program runs for hours, days, weeks, or more, the amount of memory the program uses will continue to grow, until the system crashes. I think most people would agree that that’s bad.
The thing is, in theory, such a thing should never happen: When you’re done with the variable, free the memory. Easy enough, right? Yet people continue to break that rule, partly because it’s not always that easy.

When you store data in a list, and that list gets passed to a function written by somebody else, and some members of the list get copied over into another list, and the original caller doesn’t know that that happened, should the original caller delete the memory or not? It’s not always clear-cut. So language developers have come up with an alternative: Just stop using the variable when you’re done, and the system will notice that the memory is no longer used and clean it up for you. That’s called garbage collection, and it’s an important feature in a lot of newer programming languages. And the idea is sound: If it makes your job as a programmer easier, then you can focus your energy elsewhere in the pursuit of creating great software.

Now I should clarify that there are actually a couple different types of garbage collection: one where the system periodically scans through memory, looking for memory no longer in use; and one where the system keeps tabs on each variable, and as soon as the variable is no longer needed, the memory is deleted. Technically the latter isn’t garbage collection; rather, it’s considered “reference counting,” but the end result is similar in that the variables are cleaned up automatically.

Virtual Machine

 

When Java came along in the mid-1990s, people griped that it wasn’t immediately compiled to assembly language in the same way as C++. Instead, the Java code is compiled down to something called bytecode. Then at runtime, a system called a virtual machine executes the bytecode, sometimes only then compiling it to assembly code. People complained because when it first came out, it was kind of slow—but that isn’t the case anymore. Many languages run with a virtual machine, including Java and C#. Today, these languages pass benchmarks that keep them speedy.

The Languages

 

So what languages should you be learning? We’ve picked five important languages for the next year, ones that will likely see a lot of demand on the jobs front, and included some coding examples. Most of these aren’t new languages either. In addition, we’ve added a sixth language as an “honorable mention.”
JavaScript, HTML5, and CSS3: Technically, HTML5 isn’t a language. But it is a technology that, along with CSS3 and JavaScript, allows you to build Web-based software applications. And don’t be mistaken: You can create real software applications that run in the Web browser.

 The great thing is that, when you do so, your apps can run across devices, including mobile ones. A couple years ago, companies such as Facebook took the jump to creating their mobile apps in HTML5. Unfortunately, they were a bit ahead of their time. The technology wasn’t quite ready, and they went back to writing their apps in native code. But in the past two years, browsers have finally started implementing the best HTML5 technologies. The number of jobs listing JavaScript alone is growing. If you want to secure your future in computer programming, this is a technology you must learn. (Also, as a side note, a lot of big companies are using server-side JavaScript as well in the form of Node.js.)

JavaScript Example

This example demonstrates how you can pass a function as a parameter into another function. I’m creating a function, saving it in a variable, and passing that variable into the setTimeout function. There are many resources on JavaScript; for a nice definitive guide, check out the Mozilla Developer Network. For a nice tutorial, take a look at this website.
var myfunc = function() {

alert(‘hi’);

};
setTimeout(myfunc, 2000);

C#: Microsoft created C# about 15 years ago as a new kind of programming language similar to Java; since then, the platform has grown several times over. The language’s syntax looks a lot like Java (which, in turn, bears similarity to C++). The flagship tool for programming in C# is Visual Studio; while there are premium versions of Visual Studio, there are also several free Express versions.
C# is a strongly-typed language, which runs inside a virtual machine. The original version had little support for functional programming, but Microsoft changed that around 2006 when it added several functional programming features. The virtual machine framing C# includes garbage collection.

C# Example

This example is a class called Program that includes a class function called Main. The runtime calls Main when the program begins. The code creates a strongly-typed variable called x of type integer, and prints out its value. To learn more C#, head over to Microsoft’s official site.
using System;
class Program
{

static void Main()

{

int x = 1000;
Console.WriteLine(x);

}
}

Java: Java is approaching its twentieth birthday, and it has continued to grow and mature. In 2004, a coworker of mine referred to it as a “toy language.” While it might have had some growing pains early on, it is certainly not a toy language: it powers large websites and databases, and the Open Office software suite is written in Java. The language is solid, and the future continues to look bright for it.
Java is strongly-typed language, and runs inside a virtual machine that includes garbage collection. It includes functional features, although isn’t a functional language.

Java Example

Java and C# are similar in many ways. Here we’re creating a class that includes a main that gets called when the program starts. Like the C# example, we’re creating a strongly-typed variable of type integer, and printing out its contents. To learn about Java, start at the official documentation.
public class HelloWorld
{

public static void main(String[] args) {

int x = 1000;|
System.out.println(x);

}

}

PHP: PHP is a general-purpose language that is easy to use. The language’s syntax bears some resemblance to Java and C++. On a very simple level, it’s used inside a Web page to embed text that might change. For example, you can have a Web page that includes some PHP code that prints out the current date; the final Web page sent down to the browser will have the date showing the PHP code’s original placement. But PHP is much more than just for printing text on a Web page. It includes a massive library for doing everything from reading and storing data in databases (pretty much any database you can think of), to performing scientific calculations, to processing text. The future remains bright for PHP, as jobs continue to abound.
PHP is a dynamic language and runs inside a virtual machine. (However, thanks to a project spearheaded by Facebook, there are also compilers that convert the PHP code to C++ code, which is then compiled.) Since 2009, PHP has included functional programming support.

PHP Example

This PHP code is embedded inside an HTML document. The PHP code sets the current time zone to Los Angeles, and then prints out the current time. The PHP code itself gets replaced by the output from the PHP code. Thus the final web page will say, “Hello! The current time is” followed by the current time. You can start learning PHP at this website.
<html>
<body>
Hello! The current time is
<?php

date_default_timezone_set(‘America/Los_Angeles’);
echo (strftime(‘%c’));

?>
</body>
</html>

Swift: And now for a brand new language: Swift, from Apple. Normally I wouldn’t pick a brand-new language and suggest people start learning it. But this is Apple we’re talking about, and you can already use this new language to create iOS apps. In fact, there are indications that this is going to be the future of programming for iOS. (Be careful, though; there’s another programming language called Swift that is completely separate.) The syntax looks a lot like JavaScript, but without all the semicolons and parentheses in JavaScript.
Swift is a strongly-typed language, that operates inside a runtime with garbage collection.

Swift Example

This code creates a variable called str that holds a string. Although I’m not providing a type for the variable, the language is strongly typed, and the compiler figures out that I’m storing a string; it does so by looking at the right-side of the equal sign. As such, it assigns a string type to my variable. Then the next line prints out the contents of the string. Learn more about Swift at Apple’s website.
var str = “Hello, World!”
println (str)

Honorable Mention:

 

Erlang: Erlang is an older language that was invented in 1986 by engineers at Erricson. It was originally intended to be used specifically for telecommunications needs, but has since evolved into a general-purpose language, and found a home in cloud-based, high-performance computing when concurrency is needed. People are using it to write some really powerful software, such as CouchDB and Riak. The language is a bit unusual in that it doesn’t really look like any other language, and it has some strange ways of handling strings, but it’s pretty easy to learn.
Should you learn Erlang? The reason I bring it up here is because it’s in a bit of a unique situation. There aren’t a lot of Erlang jobs out there. However, if you do master it (and I mean master it, not just learn a bit about it), then you’ll probably land a really good job. That’s the trade-off: You’ll have to devote a lot of energy into it. But if you do, the payoffs could be high.

Erlang Example

For an example in Erlang, I’m going to borrow an existing one. This example comes from this blog that explains a complex “hello world” example. Remember, Erlang is a sophisticated language. If you’re bold and want to go forth with it, check out the aforementioned blog as well as this site.
-module(hello).
-export([start/0]).
start() ->

spawn(fun() -> loop() end).

loop() ->

receive

hello ->
io:format(“Hello, World!~n”),
loop();

goodbye ->
ok

Conclusion

 

Programming positions will continue to grow. There won’t be any shortage of jobs anytime soon. The key is learning the right technology to land you that great job. You can’t go wrong with JavaScript, C#, Java, PHP (and even C++, which I didn’t include on the list). If you want to start learning Swift, you’ll probably see jobs growing in the coming years. And if you really want to get into some high-powered programming, take a look at Erlang, although you probably won’t land an Erlang job immediately. Regardless of which technology you go with, keep studying, keep learning, and master it.

Source : http://news.dice.com/2014/07/29/5-programming-languages-youll-need-next-year-beyond/