Curl Blog : Tags : adobe

Recently we wrote about some performance measurements showing Curl to be an order of magnitude faster than ActionScript 3 when executing a JPEG encoding algorithm. Our report hit a nerve with Ted Patrick at Adobe, causing him to question

Who cares about JPEG encoding performance in an RIA anyhow? Is there a single mainstream RIA that uses it?
Are the results of any performance benchmark really meaningful? and
Which is more important anyway, performance or wide deployment?

I'd like to address these points. First, JPEG encoding is important in some of Adobe's own applications. The Adobe AIR Salesbuilder application has a feature that can save a snapshot of your dashboard as a JPEG file on your desktop. The Salesbuilder demo script warns that this operation "can take a few seconds." This usability glitch is directly a function of the JPEG encoding speed that we studied. For a more compelling example, consider the recently launched Adobe Photoshop Express service. It can only run in on-line mode, and processing-intensive operations such as JPEG encoding are handled on the server, but if you ever wanted to create an offline, Adobe AIR style of application like this, JPEG encoding speed would absolutely matter. Given the importance of photo sharing and processing in the Web economy, can we really say that this task is not significant?

But for us, JPEG encoding is just a representative of a much larger set of tasks that a truly powerful RIA will have to do, which require application-specific coding in the inner loops. These tasks cannot be structured as just a series of calls from a scripting language to a set of predefined, pre-optimized modules that are bundled into the RIA plugin. For example, a typical requirement for enterprise dashboard applications is to handle a "data cube" model with thousands of data points in it. (See the Curl Business Intelligence Demonstration on our enterprise demos page for one example.) No RIA platform includes data cubes as a primitive data type, so even the inner loops of the code that distills information from the data cube to the presentation have to be written as part of the RIA application, where they are subject to the same performance laws as our JPEG encoding case study.

Regarding question (2), we think our benchmark test was pretty fair because we just used the same coding structure that is used in Adobe's own code. However, we would welcome any interest from Adobe in improving their ActionScript for JPEG encoding and reporting on the results!

Finally, the value of wide deployment over performance varies a lot depending on your situation. In many scenarios, wide deployment is very important. Heck, we use Flash ourselves to add some visual punch to our corporate home page that all comers can enjoy! For this kind of application, wide deployment often trumps performance and you adjust your ambitions, if necessary, to fit the constraints of the platform.

But Curl has excelled for enterprise applications and is already in use by more than 300 companies, many of them household names, for mission-critical applications. These applications aren't too visible because most of them exist entirely behind corporate firewalls, but they testify that Curl is in fact a trustworthy, industrial-strength platform. For this type of customer, breadth of deployment on the Internet is absolutely not the issue; the capability of the platform to host powerful, responsive applications is.

2 Comments 0 References Permalink Tags: performance, benchmarking, adobe, adobe_flex, enterprise_ria

Adobe has released their new AIR product with much fanfare about letting developers "use proven Web technologies to build rich Internet applications that deploy to the desktop and run across operating systems." The grand vision that's being promoted is that AIR is pioneering the application development model of the future, where cross-platform applications will be developed using a platform-independent tool such as AIR, and then deployed across the Web as downloadable gadgets that can be installed on any computer.

The concept is attractive, but there are several weaknesses in the way AIR implements it. One of these weaknesses is performance: while the speed of AIR's execution engine may be fine for gadgets, will performance that is still an order of magnitude slower than native code be acceptable for serious applications like Adobe's own Photoshop? (Note that the recently released Photoshop Express service is not an AIR application; it's a server-side application with a Flex front end.) A second weakness is the complexity of the AIR execution architecture: will future application developers really find AIR's conglomeration of JavaScript and ActionScript execution engines to be a more tractable development platform than a single, coherent, object-oriented execution environment? But the weakness I want to address today is AIR's security architecture.

Security is a central issue for any mobile code execution platform. When a user loads an application from a server, unless the user is able to verify the authenticity of the application and the trustworthiness of the application's provider, it is only prudent to assume that the application could be malicious. This is why Web browsers execute the JavaScript on a Web page inside a security sandbox that prevents the script from stealing information or damaging files even if it is malicious.

Some advanced mobile code platforms, such as Java and Curl, provide a sandbox for garden-variety untrusted applications, as well as a means for eliminating the sandbox restrictions for applications that a user determines can be trusted. Since trusted applications will have full access to the user's machine and network, it is very important that their origin can be authenticated. This is typically done by requiring that a trusted application be digitally signed by its provider, using a certificate issued by a recognized certification authority such as Verisign. This architecture extends the range of a platform, in a safe way, so it can handle a spectrum of application requirements that includes the features of typical desktop applications, many of which require fuller access than can be granted to an untrusted application running in a sandbox.

The designers of AIR obviously wanted to play in the desktop application space, so AIR applications have full access to the machine they are running on. But it seems that the AIR designers were unwilling to give up on also being a platform for casually loaded Internet gadgets, even though they did not see fit to give AIR a sandbox for running untrusted applications. The result is a mongrel security architecture that may impose costs on a lot of innocent people over time.

In a nod to the authentication requirements for trusted applications, Adobe says that all AIR applications must be signed. But the nod is an empty gesture, because AIR does not require signatures to be based on a certificate from a recognized certification authority! If you want, you can create your own certificate out of whole cloth and sign your AIR application with that! I have to guess that Adobe did this because they didn't want to cut themselves off from the casually loaded Internet gadget domain, and they weren't willing to require that the creators of such gadgets go through the process of obtaining a legitimate certificate.

Yes, if an AIR application's certificate is self-signed, AIR displays the publisher as "UNKNOWN", "giving the user pause as to whether they should continue." But what detective work is the user expected to do? How many users will actually be able to do it? It seems more likely that if Adobe's dreams for AIR are realized, a generation of users will be trained in the habit of clicking "Install" for fully privileged AIR applets of unauthenticated provenance. Adobe has already begun this training program by posting a large number of self-signed AIR applications on the Adobe AIR Marketplace, including the DiggTop feed reader, twhirl Twitter client, and Google Analytics Reporting Suite, just to name a few.

The resulting situation will be a bonanza for criminal hackers. AIR will become the first truly cross-platform tool for distributing malicious applications. Macintosh and Windows, home and business computers will all be equal-opportunity targets for Trojan horse attacks, keystroke loggers, etc., truly realizing the dream of "write once, hack everywhere!"

Adobe can't have it both ways. Casually loaded Internet gadgets need to run in a security sandbox. Trusted applications need to be rigorously authenticated. Adobe needs to stop pretending that their self-signed application model provides a secure basis for running casually loaded applications with full privileges.