We are well represented at this huge show second year in a row. Last year, at this forum, we re-launched Curl for the US market. I am not sure if there are more people attending this time, but its quite a crowd.

The keynote sessions are somewhat under-whelming. Yesterday, Mark Andreessen (Mozaic/Netscape fame) was quite good, remembering how he and Vint Cerf created the idea of cookies on the back of an envelope over a weekend. He wondered how such ideas, supposed to be temporary fixes, have sustained for fifteen years. When asked about security exposures, he said, of course these technologies will suffer security threats. I am now listening to Jonathan Schwarz, head of Sun, the ponytailed CEO, preaching the gospel of open source and why he acquired MySQL for a billion dollars. He says, there are 70,000 downloads of MySQL every single day. He likes to reach that number to sell other Sun platform stuff. There are quite a few new start-ups, all doing something on photos, or social networking. Andreessen's new company "Ning" provides a platform to create your own social networking. Monetization and business value are terms used more frequently. Several conversations during lunch or breakfast centered around "how do these companies make money?'.

Another interesting phenomenon at the show is the presence of all kinds of companies not seen before at this forum. Juniper Networks (a supplier of routers, hubs,..), HCL (a consulting company from India), Nokia (supplier of phones), etc. I did not see a booth from Google, or Apple, or Facebook. They don't need any marketing at this forum. For the first time, I saw IBM and Oracle at big booths pushing I don't know what. Everyone seems to claim some offering or some links with Web 2.0. It is such a amorphous phrase that anyone can claim to be a Web 2.0 company. Great marketing for O'Reilly group.

We had quite a number of visitors during last two days. This time, the visitors seem more engaged and ask more in-depth questions. Occasionally, you hear someone asking "what do you do and what's RIA?". Many people like our Facebook contact graph demo as a desktop application on Curl Nitro. The visual picture of circles moving around is fascinating. Thanks to Doug for creating such a great demo.

Now, let me hear what Jonathan Schwarz is saying. Oops..he just said, "The network is the computer, but data is the currency". What a wisdom! He has to justify MySQL as a good investment.

Adobe has released their new AIR product with much fanfare about letting developers "use proven Web technologies to build rich Internet applications that deploy to the desktop and run across operating systems." The grand vision that's being promoted is that AIR is pioneering the application development model of the future, where cross-platform applications will be developed using a platform-independent tool such as AIR, and then deployed across the Web as downloadable gadgets that can be installed on any computer.

The concept is attractive, but there are several weaknesses in the way AIR implements it. One of these weaknesses is performance: while the speed of AIR's execution engine may be fine for gadgets, will performance that is still an order of magnitude slower than native code be acceptable for serious applications like Adobe's own Photoshop? (Note that the recently released Photoshop Express service is not an AIR application; it's a server-side application with a Flex front end.) A second weakness is the complexity of the AIR execution architecture: will future application developers really find AIR's conglomeration of JavaScript and ActionScript execution engines to be a more tractable development platform than a single, coherent, object-oriented execution environment? But the weakness I want to address today is AIR's security architecture.

Security is a central issue for any mobile code execution platform. When a user loads an application from a server, unless the user is able to verify the authenticity of the application and the trustworthiness of the application's provider, it is only prudent to assume that the application could be malicious. This is why Web browsers execute the JavaScript on a Web page inside a security sandbox that prevents the script from stealing information or damaging files even if it is malicious.

Some advanced mobile code platforms, such as Java and Curl, provide a sandbox for garden-variety untrusted applications, as well as a means for eliminating the sandbox restrictions for applications that a user determines can be trusted. Since trusted applications will have full access to the user's machine and network, it is very important that their origin can be authenticated. This is typically done by requiring that a trusted application be digitally signed by its provider, using a certificate issued by a recognized certification authority such as Verisign. This architecture extends the range of a platform, in a safe way, so it can handle a spectrum of application requirements that includes the features of typical desktop applications, many of which require fuller access than can be granted to an untrusted application running in a sandbox.

The designers of AIR obviously wanted to play in the desktop application space, so AIR applications have full access to the machine they are running on. But it seems that the AIR designers were unwilling to give up on also being a platform for casually loaded Internet gadgets, even though they did not see fit to give AIR a sandbox for running untrusted applications. The result is a mongrel security architecture that may impose costs on a lot of innocent people over time.

In a nod to the authentication requirements for trusted applications, Adobe says that all AIR applications must be signed. But the nod is an empty gesture, because AIR does not require signatures to be based on a certificate from a recognized certification authority! If you want, you can create your own certificate out of whole cloth and sign your AIR application with that! I have to guess that Adobe did this because they didn't want to cut themselves off from the casually loaded Internet gadget domain, and they weren't willing to require that the creators of such gadgets go through the process of obtaining a legitimate certificate.

Yes, if an AIR application's certificate is self-signed, AIR displays the publisher as "UNKNOWN", "giving the user pause as to whether they should continue." But what detective work is the user expected to do? How many users will actually be able to do it? It seems more likely that if Adobe's dreams for AIR are realized, a generation of users will be trained in the habit of clicking "Install" for fully privileged AIR applets of unauthenticated provenance. Adobe has already begun this training program by posting a large number of self-signed AIR applications on the Adobe AIR Marketplace, including the DiggTop feed reader, twhirl Twitter client, and Google Analytics Reporting Suite, just to name a few.

The resulting situation will be a bonanza for criminal hackers. AIR will become the first truly cross-platform tool for distributing malicious applications. Macintosh and Windows, home and business computers will all be equal-opportunity targets for Trojan horse attacks, keystroke loggers, etc., truly realizing the dream of "write once, hack everywhere!"

Adobe can't have it both ways. Casually loaded Internet gadgets need to run in a security sandbox. Trusted applications need to be rigorously authenticated. Adobe needs to stop pretending that their self-signed application model provides a secure basis for running casually loaded applications with full privileges.

Today we announced our membership in the Eclipse foundation. We also detailed our plans to base our developer tools on the Eclipse framework. You can read the details of our approach in a note I posted back in February. Our Eclipse based product will be called the Curl Development Tools for Eclipse or CDE and our exiting IDE will be become the Curl Classic IDE.

Out first CDE release which will be available in the summer will include all the functionality of the Curl Classic IDE, including the Curl language sensitive editor, debugger, search, deployment capabilities, Visual Layout Editor and much more. Future releases of the CDE will integrate the Curl Visual Layout Editor into the Eclipse framework as a Design Perspective, and substantially improve other programming productivity features such as error highlighting in the source-code editor, language sensitive navigation, refactoring and code assistance.