Recently PaloAlto Networks published a survey Social Networking Usage Explodes In Businesses Worldwide that found 27 different social networking applications in use across 95% of the participating organizations.  The survey findings are based on actual analysis of application traffic, not survey questions. The following chart from the report shows that the most prominent use is Instant Messaging at 50%.

The survey makes the point that applications are not threats ? yet they carry risks.

"The adoption of Enterprise 2.0 applications is being driven by users, not by IT. The ease with which they can be accessed, combined with the fact that newer (younger) employees are accustomed to using them, points toward a continuation of this trend. The somewhat disconcerting fact is that users do not take into account the business and security risks that these applications present. Looking at the 202 Enterprise 2.0 applications found, 70% can transfer files, 28% are known to propagate malware, and 64% have known vulnerabilities."

All this points to increased security risks as more enterprise 2.0 applications see more pervasive adoption.  As we have previously pointed out it is important that developers and IT operations both understand best practices with regard to security.  Jeffrey Hammond points out in his paper on Securing Rich Internet Applications that is is important to understand the 3 Attack Surfaces: Server-side, Communication-stream and Client-side.  In this post I'll focus on the client-side. 

RIA frameworks use a Sandbox model the protect clients from malicious code.  It is important to realize however that not all sand boxes are created equal.  While Ajax, browser based applications use the browser's sandbox, RIA frameworks like AIR, Silverlight and Curl use their own security model and permit access to the local machine.  It's natural that developers want to take advantage of the broader capabilities at RIA frameworks offer over the browser based sandbox but they need to be aware of how their decisions effect the vulnerabilities that these frameworks introduce.

To give administrators and application developers the most control over security for creating and deploying Enterprise 2.0 applications Curl supports both un-privileged and privileged modes executing in the browser and on the desktop.  This is in contrast to AIR that allows only un-privileged in the browser and only privileged on the desktop.  The follow table shows the differences between Curl and AIR privilege options.

Facebook has seen tremendous growth over the year. The Mary Meeker: Facebook Is Eating Your Lunch And Dinner post at All Facebook singles out the statistic from her presentation at Web2.0 that Facebook is the largest share gainer of online usage over the past 3 years.  Indeed at over 300M users, if Facebook were a country it would be the forth largest behind only China, India and the US.

With all the hype on social networking I thought it would be interesting to highlight again our own CurlGraph.  The CurlGraph is a fun application that shows how your Facebook friends are related to each other.  If you are on Facebook I urge you to give it a try and to suggest it to your friends.

I made a brief demo video you can post to Facebook and you'll find the Curl website has instructions on installation.

Yesterday Dion Hinchcliffe lists 22 Power Laws of the Emerging Economy.  It's an interesting post worth a read but I think he omitted one of the most important "The Power Law of Social Networks"  Social Networks themselves are defined by a power curve. Albert-Laszlo Barabasi illustrates this in his book "Linked, The New Science of Networks." This interconnectivity drives the information age where popular nodes can rise up quickly. Like all social networks the Internet has a few nodes with millions of connections and millions of nodes with very few connections. Increasingly 6 degrees of separation is becoming 3 degrees of separation.

Last week we presented a review of the implementation of the Curl eyeDecide application to Jeffrey Hammond at Forrester.  I have posted the presentation here.

Presenting were Doug Mcrae and John Chisholm (Cheese) from Curl and Juhan Sonin from Involution Studios.

As a developer himself, I think Jeffery enjoyed hearing from the people who actually did the work.  I'm sure most of his days as an analyst are filled with discussion of trends and features rather actual design and coding techniques.

Curl eyeDecide was a team effort between Curl and Involution Studios, a top application UI design firm.  The complete team included Juhan from Involution and Doug and Cheese from Curl. It took 6 months from conception to press release that included 4 months of implementation.  That amounted to 30 work weeks and resulted in 20K lines of code.

The development cycle was collaborative and iterative and featured Curl's ability to code and deploy with a total of 50 distinct releases. The development started with connectivity to the data and the UI design was driven by the actual user experience of the testers at each release.

Some key learnings were that design and development should occur over the life of the project in an iterative cycle.  Additionally professional graphic and UI design matters and having Juhan involved in developing not only the looks but the user experience from the beginning was paramount.   Another important lesson is to clearly understand the data, its values and what people will want to do early in the process.

You can get the complete eyeDecide application in source form here.

Recently Rajiv pointed to the lack of publicity Curl garners.  I responed to that thread but I felt it worth repeating as a blog post.

While Curl is owned by SCS a large ($1.6B) Software and Systems Integrator in Japan it is small compared its main rivals Abobe and Microsoft.  With a limited budget we have gained good visibility in the US over the last 2 years.  This includes being named RIA technology of the year in 2008 by InfoWorld.  We have over 400 customers world wide providing real enterprise solutions in large companies like Toyota, SONY and Panasonic. Over the last year we grew the Curl business and will have more interesting use cases to share in the near future.

We have been working with Jeffrey Hammond at Forester to help us position Curl in the RIA landscape.  From Jeffery's inquiry profile Curl is in the mix when enterprises consider RIA technologies.  We expect Curl will be part of an RIA Wave report from Forrester later this year.

Unfortunately with the current economic climate the Curl marketing budget does not support expensive advertising and trade show sponsorships.

But let's not let that dampen our enthusiasm. This developer center represents THE Curl community and we should all take it upon ourselves to spread the word about Curl.  Curl has a great story to tell with very compelling proof points. We have a wealth of marketing material that each of us can use to spread the word. I have been on hundreds of sales calls and I can tell you that our story is well received and people readily see the benefits of Curl through our demos and case studies.

Lets all work together to get the word out about Curl. Follow the lead of active community members like Friedger Müffke, Robert Shiplett and Utkal R. Pradhan

If you see and opportunity to comment on an article or blog post please do so.  If you see an opportunity to present Curl at a regional event please do so.    If you need help with putting material together, let me know I can help.

So go forth and spread the word about Curl.

Interesting question coming from Adrian Kingsley-Hughes at ZDNet.

"With news that 92% of Windows PCs are vulnerable to a zero-day attack that Adobe won?t patch until Thursday, is it time to dump Adobe?s Flash player?

And this from Computer World.

"More than 9 out of every 10 Windows users are vulnerable to the Flash zero-day vulnerability that Adobe won't patch until Thursday, a Danish security company said today.

According to Secunia, 92% of the 900,000 users who have recently run the company's Personal Software Inspector (PSI) utility have Flash Player 10 on their PCs, while 31% have Flash Player 9. (The total exceeds 100% because some users have installed both.)"

Adobe admitted to the vulnerability on July 21st in this short blog entry.

Curl and Silverlight are not suseptible to such security holes as both run in secure sand boxed areas.

From the ensuing discussion there is a growing segment for whom the answer is YES.

In a previous article I discussed three areas of business savings to examine when making the Business case for Entperise RIA. This article will examine how Panasonic realized those business savings with their RIA implementation.

Panasonic Voice of the Engineer (VOE)

Aiming to become the number one company worldwide in customer satisfaction, Panasonic is one of the world's most-recognized brand names, largely on the basis of its highly successful Panasonic AVC Networks business segment.

The division manufactures and markets the majority of the company's consumer products, including plasma TVs and LCD monitors, Blu-ray and DVD players, digital cameras, video recorders, home theater systems and many other products. But while Panasonic welcomes strong sales, the reality is that the more diverse and successful its product lines become, the greater the challenge for its service department becomes.

Panasonic AVC's service division has simple objectives: discover and respond to potential quality and safety issues as early as possible in the product lifecycle. And, from the standpoint of safety, ensure absolutely safe operation of all electrical products over the long term. Sounds simple enough, but with an evolving product line that gets ever more complex, Panasonic service technicians have to continually educate themselves on new technologies and new repair techniques. But while it is critical that Panasonic technicians stay up to date with the latest technology improvements and developments, how do you make that happen for a huge global workforce that is responsible for thousands of products and product parts?

Panasonic AVC approaches this challenge through what it calls the Voice Of Engineering (VOE). An enterprise-wide program, VOE encompasses all the initiatives and activities geared toward discovering potential critical issues in product quality by sharing and analyzing information and trends. This includes an ongoing dialog between service technicians in the field and company management to uncover potential quality issues, and nurture and advance repair and servicing capabilities in the field. The company's technological approach to its service challenges was to create an automated system built on the Curl platform to provide its service and support staff with up-to-date repair manuals, parts diagrams, specification sheets, and other kinds of documentation.

Originally launched in 2005, the Service Information Sharing System also allows support technicians and engineers to:

• Use forums and comment areas to share their knowledge of new repair techniques, describe repair cases and support a higher level of customer service across the entire organization
• Through Curl, view information using a variety of methods: graphs, tables, charts with multi-layout format, etc.
• Integrate external document and data formats - Excel, PDF, etc.
• Easily operate system functions using drag-and-drop features, data filtering and graph combining

High Performance and Data Visualization

Panasonic AVC Networks chose Curl as the development platform for its Service Information Sharing System because it provides the ideal environment for live documentation and interactive education. Initially Panasonic AVC used a database application as its service support information system.

Another advantage of the Curl-powered Service Information Sharing System is that it enabled Panasonic AVC to retain the comprehensive information storage capabilities of its existing database system, yet enhance the capabilities of that system with a powerful and flexible front end. Curl makes complicated screen controls possible, surpassing ordinary Web browser capabilities, so Panasonic developers built in the kind of advanced features and functions typically found only in client-server type applications. For instance, the Panasonic system enables users to view documents and related information in a single view. To access documents and files, users browse indexes or use keyword search.

In practice, field engineers and service technicians simply type in keywords, and then narrow down their selections out of the returned list screen. This powerful search tool provides Panasonic field engineers with instant access to the vast amount of repair documentation and related information across the company. VOE Search structures information using syntactic analysis, morphologic analysis and a dictionary tool (tautology or synonym), and displays the associated information ranked against the keyword. The application draws on documents, files and associated information from several databases. The interface supports analytic tools that allow the support engineer to drag a device and drop it into a chart to render an instant analysis of part failures over time giving him an immediate view into likely problems. This level of performance and data visualization saves considerable time and contributes to greatly improved productivity.

Main functionality includes search for repair parts or technical documents, as well as bulletin boards to share the information and analysis views of repair processes. These discussion boards enable users to ask questions and get answers from colleagues and associates around the world. All correspondences on the bulletin board are searchable so it can be listed by the search. As engineers use the application, know-how or information are accumulated organically to speed the maintenance of information.

Low Support Costs - Web Delivery

Despite delivering native client performance and visualization the VOE application is delivered over the web. Curl supports client side data store, which allows the application high performance search without costly round trips to the server. Furthermore, through web delivery application support, costs are considerably lower. With Curl's flexible file-handling properties and standard APIs for external applications, documents can be viewed right within the system interface - there's no need to open new applications such as Excel or Acrobat. In addition, Curl's elastic technology allows users to adjust the size of documents as appropriate. Operations for changing chart type, targeting parts on and off, displaying above or below a certain point, were all designed and implemented to make the interface intuitive and convenient. Further, the application provides a "Repair Trend" view, primarily used by management, which enables them to track service activity by product, product category and date (monthly, quarterly, yearly, etc.) to better understand service issues and uncover potential problems.