As we are enjoying the last few weeks of summer, I’d like to take time to share with you an update on Curl’s business and the enterprise RIA market in general.

Overall, 2008 has been an exciting year for us. We’ve made some great strides in further developing our product set as well as expanding our business. We productized two of our three
open source projects, executed on our Eclipse strategy, and released our Run Time Environment (RTE) for the Macintosh, as well as support for Ubuntu.

Also, we unveiled Curl Nitro, the next version of our RIA platform, which brought with it enhanced desktop capabilities to enterprises. We released a few really cool sample applications to showcase the data visualization and online/offline capabilities of that product, so I highly recommend you check them out.

At the beginning of 2008, we predicted that this would be the start of an explosion of enterprise RIA, and this has truly been the case so far. The market is heating up with vendors, while companies and consumers alike demand richer user interfaces, stronger security, and higher performance. The enterprise has really felt the push, and we are right there to support them with thefeatures they need. This increase in demand also is reflected in the growth of our developer community, as we experienced an increase here of 456 percent.

In particular, as I have been meeting with customers and prospects, here are the common themes I have heard from them:

- Curl's visualization functions plus high performance gives us a competitive edge in our business.

- "Curlization" is a process to replace spreadsheet-based client-serverapplications to RIAs with lower total cost of ownership.

- Curl is ahead of Adobe Flex in several areas like security, performance, and programmer productivity.

- Curl has a proven track record as a RIA platform for enterprises, while others are just starting.



Below I have included a snapshot of the news announcements we have issued during the last several months, a sampling of the great media coverage we’ve received, and links to some of our most interesting blog entries from the Curl Developer Center for you to reference. I hope you find this update helpful in your research, and I welcome any comments or questions you might have.


News
ANNOUNCEMENTS
· Curl Releases New Web-Based Training Courses, August 20, 2008
· Curl Announces General Availability of Curl Development Tools for Eclipse, August 5, 2008
· Curl Announces General Availability of Its Curl Data Kit - July 7, 2008
· Curl to Provide Rich Internet Application Technology to University of Hawai'i at Mānoa, June 26, 2008
· Curl Nitro Demo Application Visualizes Facebook Social Graphs, June 23, 2008
· Curl Showcases Curl Nitro Through New Sample Application, June 16, 2008
· Curl Announces Public Beta Availability of Eclipse-Based RIA Development Tools, June 9, 2008
· Curl Makes Rich Internet Application Run Time Environment for Macintosh Generally Available, June 3, 2008
· RIA Technology Benchmark Test Finds Curl Outperforms Adobe Flex 3, May 28, 2008
· Curl Embraces Desktop RIA With 'Nitro' Product Release, April 21, 2008
· Curl Announces Support for Ubuntu for Enterprise RIA Platform, April 15, 2008
· Curl Joins Eclipse Foundation and Announces Eclipse Strategy, April 7, 2008
· Curl Delivers First Open Source Product with Web Services Development Kit, March 4, 2008

CURl IN the news
· RIA company curls up with Eclipse, SD Times, August 6, 2008
· Curl completes embrace of Eclipse IDE, NetworkWorld, August 4, 2008
· How to sort out Ajax and RIA frameworks, SearchSOA.com, July 30, 2008
· The Architect's Role, Dr. Dobb’s Journal, July 1, 2008
· Overview of the Curl Enterprise RIA Platform, InfoQ.com, June 13, 2008
· Curl Adds Runtime Support for Mac Environments, PC World, June 3, 2008
· Curl 6 outperforms Flex 3 on CPU-intensive benchmark, InfoWorld, May 28, 2008
· Who Will Win the Next Battle for the Desktop?, AJAXWorld, April 27, 2008
· Curl's Nitro Takes Aim at Adobe AIR, InformationWeek, April 15, 2008
· RIA War Is Brewing, eWeek, April 11, 2008
· Product review: Curl 6.0 enriches the rich Internet toolkit, InfoWorld, April 7, 2008
· Curl: Rich Internet Apps get richer, Computerworld, March 13, 2008
· Curl ships commercial version of its open source web services dev kit for RIA Platform, ZDNet, March 4, 2008
· Curl linking rich Internet applications, SOA, InfoWorld, February 29, 2008

CURl BLOG POSTS
· Curl is now in the Top 4, August 12, 2008
· Backward Compatibility and Curl, August 1, 2008
· Quarantined by default, secure by design, July 28, 2008
· The Batmobile, Lamborghini, and my Suburban, July 23, 2008
· Enterprise RIA - real examples in use, June 13, 2008
· How big is your source code?, June 12, 2008
· Does RIA platform performance matter?, May 30, 2008
· For Curl, Security is Job #1, May 29, 2008
· Questions to ask your RIA Vendor, May 20, 2008
· Why Criminal Hackers Will Love Adobe AIR, April 16, 2008
· Seven nice things about the Curl Platform, March 25, 2008
· Why Is an Enterprise RIA Platform Different?, February 13, 2008

Events Tradeshows and Conferences
Curl will have representation and/or executive speaking sessions at the following tradeshows. Please let us know if you plan to attend any of these events and if you’re interested in scheduling a briefing:

· Rich Client Experience, Washington, DC, September 4-5, 2008
· Web 2.0 Conference & Expo 2008, New York City, Sept. 16-19, 2008
· AJAXWorld 2008 West,San Jose, CA, October 20-22, 2008
· SD Best hPractices,Boston, MA, October 27-30, 2008
· InfoQ QCon, San Francisco, CA, November 19 - 21, 2008

"CIO Insight" magazine did a recent survey of 240 CIO's on which new technologies will boost revenue for their companies.

And guess what? Rich Internet Applications(RIA) ranked as Number 2 (23.6%), right after SOA (23.9%).

Last year, I had mentioned in an interview with Dr. Dobbs about RIA as the low hanging fruit for the enterprises to embrace Web 2.0 for business benefits. Jeffrey Hammond of Forrester Research mentioned in a keynote address at WebBuilder 2.0 last December that for enterprises to endorse Web 2.0, the future is now. He also mentioned that 32% of the enterprises surveyed by Forrester were using or considering RIA. Therefore, the CIO Insight survey showing RIA as second highest in priority to boost revenue does not come as a surprise.

Curl's RIA Platform has been used by over 300 enterprises and many have shown quantitative benefits to their business, over the client-server applications. The requirements to use RIA at the enterprise level is very different and much more stringent. They are looking for industrial-strength attributes such as high performance, extreme reliability, very high security, and big-time scalability. I recently blogged about what questions companies need to ask RIA vendors. Just getting a Flash video stream is not good enough for business-critical applications.

Earlier this year, Curl was awarded the best RIA Platform by InfoWorld. The proof is always with real deployment and benefits by customers.

Mike Vizard of eWeek refers to this survey in his recent blog. He covered the importance of RIA and mentioned Curl as a vendor to watch last December.
When it comes to Enterprise RIA, Curl clearly is the defacto leader.

I had briefly reported from the Web 2.0 Expo last week. Here is an overall summary of the event.

I have been going to all the Web 2.0 events since they started back in 2005. It's quite remarkable how fast the attendance has grown. There used be just one conference in November. Due to its popularity they made it into two events - We 2.0 Expo in April and Web 2.0 Summit in October. The one in the fall tends to be much more technical. The expo is broader and the attendance is much larger. The success of this event has prompted the organizers (O'Reilly & company) to have similar events in New York, Tokyo, and Europe since 2007.

For those who are confused by the term Web 2.0, you are in good company of many. Ambiguity is the name of the game here. The phrase Web 2.0 was coined to explain the evolution of the Web to being a serious platform for the future applications, as opposed to the first phase (Web 1.0) where static pages were delivered and user-interactivity was quite limited. Also it was architecturally poor and slow to perform with all the page refreshes. Web 2.0 deals with asynchronous access to servers, polling data to the client cache for continuous feeding (e.g. Google Maps), hence it feels like a local desktop application. The phrase Ajax was coined 2 years ago to highlight the asynchronous aspects, even though the underlying technology remains the same - HTML, Javascript, CSS, DOM, XML,..

During 2005 and 2006, almost all the attendees at the Web 2.0 events were young kids working on start-ups like Flickr, YouTube, MySpace, etc. During last year's Web 2.0 Summit, the first session was with Marc Zuckerberg, the 23 year old who founded Facebook. The same night, the dinner guest was the 73-year old Rupert Murdoch, head of News Corporation and owner of MySpace. During my first attendance back in 2005 Fall, I felt like a fish out of water. There were no large enterprises including my former employers like IBM or Oracle. I could not recognize anyone from my generation. No gray hair from the client-server era. But it was lots of fun watching the kids re-invent the same issues some of us had worked on years back. Topics like stateful applications, transactional integrity, secure commits to the database, good scalability when numbers rise fast, were all being revisited. I call this "Back to the Future". So all the discussions centered around the "consumer space". It's like the boom-years of 1997-2000 when Jeff Bozos of Amazon said, "profit,? I spell that as Prophet." People started talking about another "bubble" around Web 2.0. No one seemed to care about "monetization" or "business value".

Zimbra got a standing ovation in the fall of 2005 when it displayed its email with pop-ups as you mouse thru the content. Yahoo bought Zimbra for $300m, but its future inside Yahoo is clouded as much as Yahoo's own future. This year, I noticed a remarkable shift. Suddenly large enterprises are everywhere. IBM had a big booth. So did Oracle. Juniper networks, HCL, Nokia, all had large booths. Even the sessions were full of speakers from large corporations. The classic "social-networking-is-the-future" crowd was also there, but they seemed less in number.

This is good for us at Curl, as we position our solution for the enterprise, serious to deploy the business-critical applications on the new web platform. We gave over 120 demos to visitors in our booth. Many of the visitors asked serious questions this time. Some have tried to implement complex visualization apps. via Adobe Flash, or via one of many Ajax frameworks, but were highly disappointed with scalability and functions. Programmer productivity is a key factor. Rapid prototyping is also crucial for creating proof points. Gone are the days of long development cycle. Getting users involved during the design process is key to success. Cul renders itself well to these approaches. We need to continue aggressively with our "awareness campaign" for the enterprise crowd.

In summary, I was not that surprised with the evolution of Web 2.0 towards more "enterprise focus". The same phenomenon was also visible at the AjaxWorld in New York during March. There were more discussions on "building RIA outside Ajax", as people realize the deficiencies of Ajax frameworks.

Adobe has released their new AIR product with much fanfare about letting developers "use proven Web technologies to build rich Internet applications that deploy to the desktop and run across operating systems." The grand vision that's being promoted is that AIR is pioneering the application development model of the future, where cross-platform applications will be developed using a platform-independent tool such as AIR, and then deployed across the Web as downloadable gadgets that can be installed on any computer.

The concept is attractive, but there are several weaknesses in the way AIR implements it. One of these weaknesses is performance: while the speed of AIR's execution engine may be fine for gadgets, will performance that is still an order of magnitude slower than native code be acceptable for serious applications like Adobe's own Photoshop? (Note that the recently released Photoshop Express service is not an AIR application; it's a server-side application with a Flex front end.) A second weakness is the complexity of the AIR execution architecture: will future application developers really find AIR's conglomeration of JavaScript and ActionScript execution engines to be a more tractable development platform than a single, coherent, object-oriented execution environment? But the weakness I want to address today is AIR's security architecture.

Security is a central issue for any mobile code execution platform. When a user loads an application from a server, unless the user is able to verify the authenticity of the application and the trustworthiness of the application's provider, it is only prudent to assume that the application could be malicious. This is why Web browsers execute the JavaScript on a Web page inside a security sandbox that prevents the script from stealing information or damaging files even if it is malicious.

Some advanced mobile code platforms, such as Java and Curl, provide a sandbox for garden-variety untrusted applications, as well as a means for eliminating the sandbox restrictions for applications that a user determines can be trusted. Since trusted applications will have full access to the user's machine and network, it is very important that their origin can be authenticated. This is typically done by requiring that a trusted application be digitally signed by its provider, using a certificate issued by a recognized certification authority such as Verisign. This architecture extends the range of a platform, in a safe way, so it can handle a spectrum of application requirements that includes the features of typical desktop applications, many of which require fuller access than can be granted to an untrusted application running in a sandbox.

The designers of AIR obviously wanted to play in the desktop application space, so AIR applications have full access to the machine they are running on. But it seems that the AIR designers were unwilling to give up on also being a platform for casually loaded Internet gadgets, even though they did not see fit to give AIR a sandbox for running untrusted applications. The result is a mongrel security architecture that may impose costs on a lot of innocent people over time.

In a nod to the authentication requirements for trusted applications, Adobe says that all AIR applications must be signed. But the nod is an empty gesture, because AIR does not require signatures to be based on a certificate from a recognized certification authority! If you want, you can create your own certificate out of whole cloth and sign your AIR application with that! I have to guess that Adobe did this because they didn't want to cut themselves off from the casually loaded Internet gadget domain, and they weren't willing to require that the creators of such gadgets go through the process of obtaining a legitimate certificate.

Yes, if an AIR application's certificate is self-signed, AIR displays the publisher as "UNKNOWN", "giving the user pause as to whether they should continue." But what detective work is the user expected to do? How many users will actually be able to do it? It seems more likely that if Adobe's dreams for AIR are realized, a generation of users will be trained in the habit of clicking "Install" for fully privileged AIR applets of unauthenticated provenance. Adobe has already begun this training program by posting a large number of self-signed AIR applications on the Adobe AIR Marketplace, including the DiggTop feed reader, twhirl Twitter client, and Google Analytics Reporting Suite, just to name a few.

The resulting situation will be a bonanza for criminal hackers. AIR will become the first truly cross-platform tool for distributing malicious applications. Macintosh and Windows, home and business computers will all be equal-opportunity targets for Trojan horse attacks, keystroke loggers, etc., truly realizing the dream of "write once, hack everywhere!"

Adobe can't have it both ways. Casually loaded Internet gadgets need to run in a security sandbox. Trusted applications need to be rigorously authenticated. Adobe needs to stop pretending that their self-signed application model provides a secure basis for running casually loaded applications with full privileges.

Today I would like to announce that Robert Shiplett is second Curler (aka Curlr) to receive the Curl MVP award. Robert is a lead developer at Paisley working full-time as a Curl developer on their Governance, Risk and Compliance (GRC) product.

Robert is a programming language aficionado who has, in addition to Curl, worked in Smalltalk, Prolog, APL, and C. He is also a fan of other programming languages including Rebol, SNOBOL, UNICON, IO, and Oz. Robert Shiplett, whose first love is Prolog, professes that he is not a Curl zealot, but a Curl fan. That’s high praise coming from a developer who has learned to use so many programming languages.

In his own words Robert told me:

“… as an expression-based language suited to managing content in web applications, it is difficult to rival Curl - especially for Web-based training. And difficult to rival as an IDE (my other favorite languages have no such IDE ).”

Although Robert spends some of his off time scribbling code in SNOBOL 4 on paper at the dinning room table he also interested in the electric guitar (he has 2 of them), telescopes (he has 13 of those), PC flight simulators (he has all of them), R/C planes, languages (French & German), foreign films, poetry, and playing GO, Chess, and Scrabble.

We are excited to add Robert to the small but growing ranks of MVPs, a status which is very well deserved for what has been a great deal of evangelizing on his part. You will see Robert posting often on the developers center - don’t hesitate to congratulation him! You can read more about Robert’s thoughts on Curl and other topics at his blog “eclectic pencil”.

Congratulations Robert!

About the Curl MVP program:

Throughout the year a few exceptional Curl community members will be awarded MVP status. This is in recognition of those individuals who have made substantial contributions to the Curl community and deserve to be recognized for those efforts. 

The first MVP award was given to Friedger Müffke which you can read about here.

The advantages of being an MVP are many-fold including recognition, elevated status in the community, promotion by Curl, instant beta access, and MVP Board membership. The MVP Board will consult with Curl on a semi-annual basis and have influence on Curl's product direction in the future. MVPs represent a critical feedback channel to the community. It’s at the MVP Board meetings that MVPs also will consider nominations for other MVPs and vote to give those awards to deserving community members.



A Curl MVP is someone who has worked hard in the community to help others, spread the word about Curl through speaking, books and articles, and has contributed to the health and vitality of our community. When the award is given it should be of no surprise to the rest of us – MVPs stand out.



The Curl MVP award is recognition of an individual for having furthered Curl as a platform for Rich Internet Applications. In nearly all cases MVPs have given up their free time to help other community members succeed, which is the very foundation on which our community must be built; helping others to succeed with Curl.

Throughout the year a few exceptional Curl community members will be awarded MVP status. This is in recognition of those individuals who have made substantial contributions to the Curl community and deserve to be recognized for those efforts.

The advantages of being an MVP are many-fold including recognition, elevated status in the community, promotion by Curl, instant beta access, and MVP Board membership. The MVP Board will consult with Curl on a semi-annual basis and have influence on Curl's product direction in the future. MVPs represent a critical feedback channel to the community. It’s at the MVP Board meetings that MVPs also will consider nominations for other MVPs and vote to give those awards to deserving community members.

A Curl MVP is someone who has worked hard in the community to help others, spread the word about Curl through speaking, books and articles, and has contributed to the health and vitality of our community. When the award is given it should be of no surprise to the rest of us – MVPs stand out.

The Curl MVP award is recognition of an individual for having furthered Curl as a platform for Rich Internet Applications. In nearly all cases MVPs have given up their free time to help other community members succeed, which is the very foundation on which our community must be built; helping others to succeed with Curl.

For Curl, Inc. Identifying the first MVP award winner was pretty easy; it goes to Friedger Müffke from Belgium. Friedger was introduced to Curl five years ago when his mother handed him a computer magazine that included coverage the first Curl Programming Contest which took place in 2003 (we hope to have more contests in the future). Friedger learned the Curl platform and has been a supporter and active community member ever since. He wrote a Dr. Dobbs magazine article on Curl, worked on a German language book on Curl (not currently available), and worked on curlbreaker.com a Curl enthusiasts site. You will see Friedger posting and answer questions on our forums – he exemplifies what it means to be a Curl MVP.

Congratulations Friedger! You are the first person awarded MVP status in the Curl community!