As we are enjoying the last few weeks of summer, I’d like to take time to share with you an update on Curl’s business and the enterprise RIA market in general.

Overall, 2008 has been an exciting year for us. We’ve made some great strides in further developing our product set as well as expanding our business. We productized two of our three
open source projects, executed on our Eclipse strategy, and released our Run Time Environment (RTE) for the Macintosh, as well as support for Ubuntu.

Also, we unveiled Curl Nitro, the next version of our RIA platform, which brought with it enhanced desktop capabilities to enterprises. We released a few really cool sample applications to showcase the data visualization and online/offline capabilities of that product, so I highly recommend you check them out.

At the beginning of 2008, we predicted that this would be the start of an explosion of enterprise RIA, and this has truly been the case so far. The market is heating up with vendors, while companies and consumers alike demand richer user interfaces, stronger security, and higher performance. The enterprise has really felt the push, and we are right there to support them with thefeatures they need. This increase in demand also is reflected in the growth of our developer community, as we experienced an increase here of 456 percent.

In particular, as I have been meeting with customers and prospects, here are the common themes I have heard from them:

- Curl's visualization functions plus high performance gives us a competitive edge in our business.

- "Curlization" is a process to replace spreadsheet-based client-serverapplications to RIAs with lower total cost of ownership.

- Curl is ahead of Adobe Flex in several areas like security, performance, and programmer productivity.

- Curl has a proven track record as a RIA platform for enterprises, while others are just starting.



Below I have included a snapshot of the news announcements we have issued during the last several months, a sampling of the great media coverage we’ve received, and links to some of our most interesting blog entries from the Curl Developer Center for you to reference. I hope you find this update helpful in your research, and I welcome any comments or questions you might have.


News
ANNOUNCEMENTS
· Curl Releases New Web-Based Training Courses, August 20, 2008
· Curl Announces General Availability of Curl Development Tools for Eclipse, August 5, 2008
· Curl Announces General Availability of Its Curl Data Kit - July 7, 2008
· Curl to Provide Rich Internet Application Technology to University of Hawai'i at Mānoa, June 26, 2008
· Curl Nitro Demo Application Visualizes Facebook Social Graphs, June 23, 2008
· Curl Showcases Curl Nitro Through New Sample Application, June 16, 2008
· Curl Announces Public Beta Availability of Eclipse-Based RIA Development Tools, June 9, 2008
· Curl Makes Rich Internet Application Run Time Environment for Macintosh Generally Available, June 3, 2008
· RIA Technology Benchmark Test Finds Curl Outperforms Adobe Flex 3, May 28, 2008
· Curl Embraces Desktop RIA With 'Nitro' Product Release, April 21, 2008
· Curl Announces Support for Ubuntu for Enterprise RIA Platform, April 15, 2008
· Curl Joins Eclipse Foundation and Announces Eclipse Strategy, April 7, 2008
· Curl Delivers First Open Source Product with Web Services Development Kit, March 4, 2008

CURl IN the news
· RIA company curls up with Eclipse, SD Times, August 6, 2008
· Curl completes embrace of Eclipse IDE, NetworkWorld, August 4, 2008
· How to sort out Ajax and RIA frameworks, SearchSOA.com, July 30, 2008
· The Architect's Role, Dr. Dobb’s Journal, July 1, 2008
· Overview of the Curl Enterprise RIA Platform, InfoQ.com, June 13, 2008
· Curl Adds Runtime Support for Mac Environments, PC World, June 3, 2008
· Curl 6 outperforms Flex 3 on CPU-intensive benchmark, InfoWorld, May 28, 2008
· Who Will Win the Next Battle for the Desktop?, AJAXWorld, April 27, 2008
· Curl's Nitro Takes Aim at Adobe AIR, InformationWeek, April 15, 2008
· RIA War Is Brewing, eWeek, April 11, 2008
· Product review: Curl 6.0 enriches the rich Internet toolkit, InfoWorld, April 7, 2008
· Curl: Rich Internet Apps get richer, Computerworld, March 13, 2008
· Curl ships commercial version of its open source web services dev kit for RIA Platform, ZDNet, March 4, 2008
· Curl linking rich Internet applications, SOA, InfoWorld, February 29, 2008

CURl BLOG POSTS
· Curl is now in the Top 4, August 12, 2008
· Backward Compatibility and Curl, August 1, 2008
· Quarantined by default, secure by design, July 28, 2008
· The Batmobile, Lamborghini, and my Suburban, July 23, 2008
· Enterprise RIA - real examples in use, June 13, 2008
· How big is your source code?, June 12, 2008
· Does RIA platform performance matter?, May 30, 2008
· For Curl, Security is Job #1, May 29, 2008
· Questions to ask your RIA Vendor, May 20, 2008
· Why Criminal Hackers Will Love Adobe AIR, April 16, 2008
· Seven nice things about the Curl Platform, March 25, 2008
· Why Is an Enterprise RIA Platform Different?, February 13, 2008

Events Tradeshows and Conferences
Curl will have representation and/or executive speaking sessions at the following tradeshows. Please let us know if you plan to attend any of these events and if you’re interested in scheduling a briefing:

· Rich Client Experience, Washington, DC, September 4-5, 2008
· Web 2.0 Conference & Expo 2008, New York City, Sept. 16-19, 2008
· AJAXWorld 2008 West,San Jose, CA, October 20-22, 2008
· SD Best hPractices,Boston, MA, October 27-30, 2008
· InfoQ QCon, San Francisco, CA, November 19 - 21, 2008

There now appear to be quite a number of different search engines on the internet now that index open source code repositories and allow you to search them. Some of the more popular engines are Google code search, Koders, and Krugle. Unfortunately, non of these engines list Curl as a supported language or index any of the recent open source Curl projects. Update: Google Code does now appear to index Curl code, but still does not include it in their list of languages. You can restrict your search to Curl files by including the following in your query: file:\.[dmsx]?curl$

The best ways to change this situation are to make more user requests to those sites asking to support Curl and to create more open source Curl projects to index. So if this feature is important to you, consider visiting one or more of those sites (or if there is some other site you prefer, let us know in a comment) and request Curl support (or second an existing request). Here are some links:

Google Code Group
Koders feedback form
Krugle Forum: Feature Requests

And if you have some Curl coding projects sitting on your computer, why not go ahead and create an open source project so others can see what you are up to? If you do, we have found that both SourceForge and Google Code are good choices for free project hosting. SourceForge has been around a lot longer and is more fully featured, but makes you jump through more hoops. My own Zuzu project is hosted at Google, and I have been happy enough with it so far.

Update: since Google does appear to index Curl files, you should probably explicitly submit your repository to Google for indexing if you want it to show up:

http://www.google.com/codesearch/addcode

Curl outperforms ActionScript by a factor of 8 to 10

Curl was designed from the beginning so that Curl programs could be compiled to very high quality native code. We have always been proud of the performance of Curl programs, and have made claims of "unmatched performance".

Performance claims should be substantiated by repeatable tests. So we decided to do a performance comparison to quantify how two platforms compare when executing some computationally demanding code.

One of the new components in the Flex 3 Framework is the JPEGEncoder class. That functionality is used to good effect in the AIR SalesBuilder demo to drop a "snapshot" of the dashboard display onto the users desktop. However, the Salesbuilder demo script does warn about a delay when you start dragging.

JPEG encoding seems like an ideal test case since it's a computation that many people do all the time, which makes this computation more interesting than any synthetic benchmark. At the same time, this computation really measures the inherent performance of the language that the algorithm is written in, because even the inner loops are all written in the same language: there is no escape to library routines that might be written in a different language with different performance properties.

In fact, the original motivation for implementing a JPEG encoding algorithm in ActionScript was to illustrate the substantial performance improvements achieved in ActionScript 3 compared to earlier versions.

So we translated this ActionScript program to Curl in the straightforward way and compared the resulting performance for three images ranging from small to moderately large. These are the results that we observed:

	Curl time	Flex time	Image size	Megapixels	Output file size
Small image	0.16 seconds	1.72 seconds	700 x 933	0.65	72 kB
Medium image	0.46	4.43	1170 x 1560	1.83	195 kB
Large image	1.36	11.69	2560 x 1920	4.92	511 kB

The performance comparisons were done between Curl version 6.0 and Flex 3, running on a Dell XPS M170 computer (2.26 GHz, 2 GB RAM, Windows XP SP2).

These results show that Curl retains a substantial advantage in raw execution speed, by a factor of about 8 to 10. We attribute this mainly to the fact that ActionScript is derived from a language that was not architected to be able to be compiled to efficient code, while the Curl language was.

This difference will be important in any application that needs to do data processing or visualization specified by logic in the application itself, which cannot be delegated to predefined, optimized libraries that are already included in the underlying platform.

From the viewpoint of programmer productivity, it is also interesting to note that compiling the JPEG encoder (only about 600 lines of code) took about 8 seconds for the ActionScript implementation using the Flex 3 SDK, and produced a 170 kB SWF file. The Curl implementation requires no compilation step before the 22 kB Curl file is deployed to a Web site, and the just-in-time compilation that occurs when the Curl application is used took less than a quarter of a second.

We've attached the Curl and Flex sources so you can see the exact source code that we compared, if you are curious.

We look forward to your feedback and to any suggestions how this comparison study can be improved.

References

The JPEGEncoder is now part of the Flex 3 framework. The SalesBuilder demo uses an earlier, open source version, from the as3corelib project. The Curl code was transliterated from as3corelib; the reported Flex timings used the Flex3 framework.

The as3corelib code originated in an internal experiment intended to illustrate the performance advantage of the (then, new) AS3 virtual machine. That experiment adapted a free C implementation written by a Rumanian student, Cristi Cuturicu. In fact, the Flex 3 documentation references his paper about the JPEG algorithm.

Flex 3: http://livedocs.adobe.com/flex/3/langref/mx/graphics/codec/JPEGEncoder.html
as3corelib: http://code.google.com/p/as3corelib/source/browse/trunk/src/com/adobe/images/JPGEncoder.as
Original Actionscript: http://www.kaourantin.net/2005/10/more-fun-with-image-formats-in-as3.html
Original C: http://www.yov408.com/html/codespot.php?gg=47
Salesbuilder: http://coenraets.org/air/salesbuilder/salesbuilder_script.pdf

I had briefly reported from the Web 2.0 Expo last week. Here is an overall summary of the event.

I have been going to all the Web 2.0 events since they started back in 2005. It's quite remarkable how fast the attendance has grown. There used be just one conference in November. Due to its popularity they made it into two events - We 2.0 Expo in April and Web 2.0 Summit in October. The one in the fall tends to be much more technical. The expo is broader and the attendance is much larger. The success of this event has prompted the organizers (O'Reilly & company) to have similar events in New York, Tokyo, and Europe since 2007.

For those who are confused by the term Web 2.0, you are in good company of many. Ambiguity is the name of the game here. The phrase Web 2.0 was coined to explain the evolution of the Web to being a serious platform for the future applications, as opposed to the first phase (Web 1.0) where static pages were delivered and user-interactivity was quite limited. Also it was architecturally poor and slow to perform with all the page refreshes. Web 2.0 deals with asynchronous access to servers, polling data to the client cache for continuous feeding (e.g. Google Maps), hence it feels like a local desktop application. The phrase Ajax was coined 2 years ago to highlight the asynchronous aspects, even though the underlying technology remains the same - HTML, Javascript, CSS, DOM, XML,..

During 2005 and 2006, almost all the attendees at the Web 2.0 events were young kids working on start-ups like Flickr, YouTube, MySpace, etc. During last year's Web 2.0 Summit, the first session was with Marc Zuckerberg, the 23 year old who founded Facebook. The same night, the dinner guest was the 73-year old Rupert Murdoch, head of News Corporation and owner of MySpace. During my first attendance back in 2005 Fall, I felt like a fish out of water. There were no large enterprises including my former employers like IBM or Oracle. I could not recognize anyone from my generation. No gray hair from the client-server era. But it was lots of fun watching the kids re-invent the same issues some of us had worked on years back. Topics like stateful applications, transactional integrity, secure commits to the database, good scalability when numbers rise fast, were all being revisited. I call this "Back to the Future". So all the discussions centered around the "consumer space". It's like the boom-years of 1997-2000 when Jeff Bozos of Amazon said, "profit,? I spell that as Prophet." People started talking about another "bubble" around Web 2.0. No one seemed to care about "monetization" or "business value".

Zimbra got a standing ovation in the fall of 2005 when it displayed its email with pop-ups as you mouse thru the content. Yahoo bought Zimbra for $300m, but its future inside Yahoo is clouded as much as Yahoo's own future. This year, I noticed a remarkable shift. Suddenly large enterprises are everywhere. IBM had a big booth. So did Oracle. Juniper networks, HCL, Nokia, all had large booths. Even the sessions were full of speakers from large corporations. The classic "social-networking-is-the-future" crowd was also there, but they seemed less in number.

This is good for us at Curl, as we position our solution for the enterprise, serious to deploy the business-critical applications on the new web platform. We gave over 120 demos to visitors in our booth. Many of the visitors asked serious questions this time. Some have tried to implement complex visualization apps. via Adobe Flash, or via one of many Ajax frameworks, but were highly disappointed with scalability and functions. Programmer productivity is a key factor. Rapid prototyping is also crucial for creating proof points. Gone are the days of long development cycle. Getting users involved during the design process is key to success. Cul renders itself well to these approaches. We need to continue aggressively with our "awareness campaign" for the enterprise crowd.

In summary, I was not that surprised with the evolution of Web 2.0 towards more "enterprise focus". The same phenomenon was also visible at the AjaxWorld in New York during March. There were more discussions on "building RIA outside Ajax", as people realize the deficiencies of Ajax frameworks.

We are well represented at this huge show second year in a row. Last year, at this forum, we re-launched Curl for the US market. I am not sure if there are more people attending this time, but its quite a crowd.

The keynote sessions are somewhat under-whelming. Yesterday, Mark Andreessen (Mozaic/Netscape fame) was quite good, remembering how he and Vint Cerf created the idea of cookies on the back of an envelope over a weekend. He wondered how such ideas, supposed to be temporary fixes, have sustained for fifteen years. When asked about security exposures, he said, of course these technologies will suffer security threats. I am now listening to Jonathan Schwarz, head of Sun, the ponytailed CEO, preaching the gospel of open source and why he acquired MySQL for a billion dollars. He says, there are 70,000 downloads of MySQL every single day. He likes to reach that number to sell other Sun platform stuff. There are quite a few new start-ups, all doing something on photos, or social networking. Andreessen's new company "Ning" provides a platform to create your own social networking. Monetization and business value are terms used more frequently. Several conversations during lunch or breakfast centered around "how do these companies make money?'.

Another interesting phenomenon at the show is the presence of all kinds of companies not seen before at this forum. Juniper Networks (a supplier of routers, hubs,..), HCL (a consulting company from India), Nokia (supplier of phones), etc. I did not see a booth from Google, or Apple, or Facebook. They don't need any marketing at this forum. For the first time, I saw IBM and Oracle at big booths pushing I don't know what. Everyone seems to claim some offering or some links with Web 2.0. It is such a amorphous phrase that anyone can claim to be a Web 2.0 company. Great marketing for O'Reilly group.

We had quite a number of visitors during last two days. This time, the visitors seem more engaged and ask more in-depth questions. Occasionally, you hear someone asking "what do you do and what's RIA?". Many people like our Facebook contact graph demo as a desktop application on Curl Nitro. The visual picture of circles moving around is fascinating. Thanks to Doug for creating such a great demo.

Now, let me hear what Jonathan Schwarz is saying. Oops..he just said, "The network is the computer, but data is the currency". What a wisdom! He has to justify MySQL as a good investment.

Adobe has released their new AIR product with much fanfare about letting developers "use proven Web technologies to build rich Internet applications that deploy to the desktop and run across operating systems." The grand vision that's being promoted is that AIR is pioneering the application development model of the future, where cross-platform applications will be developed using a platform-independent tool such as AIR, and then deployed across the Web as downloadable gadgets that can be installed on any computer.

The concept is attractive, but there are several weaknesses in the way AIR implements it. One of these weaknesses is performance: while the speed of AIR's execution engine may be fine for gadgets, will performance that is still an order of magnitude slower than native code be acceptable for serious applications like Adobe's own Photoshop? (Note that the recently released Photoshop Express service is not an AIR application; it's a server-side application with a Flex front end.) A second weakness is the complexity of the AIR execution architecture: will future application developers really find AIR's conglomeration of JavaScript and ActionScript execution engines to be a more tractable development platform than a single, coherent, object-oriented execution environment? But the weakness I want to address today is AIR's security architecture.

Security is a central issue for any mobile code execution platform. When a user loads an application from a server, unless the user is able to verify the authenticity of the application and the trustworthiness of the application's provider, it is only prudent to assume that the application could be malicious. This is why Web browsers execute the JavaScript on a Web page inside a security sandbox that prevents the script from stealing information or damaging files even if it is malicious.

Some advanced mobile code platforms, such as Java and Curl, provide a sandbox for garden-variety untrusted applications, as well as a means for eliminating the sandbox restrictions for applications that a user determines can be trusted. Since trusted applications will have full access to the user's machine and network, it is very important that their origin can be authenticated. This is typically done by requiring that a trusted application be digitally signed by its provider, using a certificate issued by a recognized certification authority such as Verisign. This architecture extends the range of a platform, in a safe way, so it can handle a spectrum of application requirements that includes the features of typical desktop applications, many of which require fuller access than can be granted to an untrusted application running in a sandbox.

The designers of AIR obviously wanted to play in the desktop application space, so AIR applications have full access to the machine they are running on. But it seems that the AIR designers were unwilling to give up on also being a platform for casually loaded Internet gadgets, even though they did not see fit to give AIR a sandbox for running untrusted applications. The result is a mongrel security architecture that may impose costs on a lot of innocent people over time.

In a nod to the authentication requirements for trusted applications, Adobe says that all AIR applications must be signed. But the nod is an empty gesture, because AIR does not require signatures to be based on a certificate from a recognized certification authority! If you want, you can create your own certificate out of whole cloth and sign your AIR application with that! I have to guess that Adobe did this because they didn't want to cut themselves off from the casually loaded Internet gadget domain, and they weren't willing to require that the creators of such gadgets go through the process of obtaining a legitimate certificate.

Yes, if an AIR application's certificate is self-signed, AIR displays the publisher as "UNKNOWN", "giving the user pause as to whether they should continue." But what detective work is the user expected to do? How many users will actually be able to do it? It seems more likely that if Adobe's dreams for AIR are realized, a generation of users will be trained in the habit of clicking "Install" for fully privileged AIR applets of unauthenticated provenance. Adobe has already begun this training program by posting a large number of self-signed AIR applications on the Adobe AIR Marketplace, including the DiggTop feed reader, twhirl Twitter client, and Google Analytics Reporting Suite, just to name a few.

The resulting situation will be a bonanza for criminal hackers. AIR will become the first truly cross-platform tool for distributing malicious applications. Macintosh and Windows, home and business computers will all be equal-opportunity targets for Trojan horse attacks, keystroke loggers, etc., truly realizing the dream of "write once, hack everywhere!"

Adobe can't have it both ways. Casually loaded Internet gadgets need to run in a security sandbox. Trusted applications need to be rigorously authenticated. Adobe needs to stop pretending that their self-signed application model provides a secure basis for running casually loaded applications with full privileges.

Today we announced our membership in the Eclipse foundation. We also detailed our plans to base our developer tools on the Eclipse framework. You can read the details of our approach in a note I posted back in February. Our Eclipse based product will be called the Curl Development Tools for Eclipse or CDE and our exiting IDE will be become the Curl Classic IDE.

Out first CDE release which will be available in the summer will include all the functionality of the Curl Classic IDE, including the Curl language sensitive editor, debugger, search, deployment capabilities, Visual Layout Editor and much more. Future releases of the CDE will integrate the Curl Visual Layout Editor into the Eclipse framework as a Design Perspective, and substantially improve other programming productivity features such as error highlighting in the source-code editor, language sensitive navigation, refactoring and code assistance.

What makes Curl such a great programming platform? Here are seven things.

Single Platform: The Curl RTE is the same on every platform, in any browser. No need to work around browser quirks and bugs.

Security: Curl has a security model that prevents unprivileged applets from doing arbitrary things on your computer. For safety's sake, we think that most applets should be unprivileged. For commonly needed but potentially insecure operations, such as reading or writing a file, the RTE will ask the user for permission before allowing the operation. This is better than always preventing it and also better than not allowing it at all. It is of course possible to grant applets full privileges, but it's not a step to be taken lightly.

Speed: The Curl RTE compiles an applet to machine code so execution is fast. As an applet is downloaded from your web site it is compiled and evaluated incrementally. Any expression that produces output is shown immediately in the web browser. Class definitions, procedures, packages, and so on are compiled and cached, so subsequent downloads are faster than the first one.

Software Engineering: Curl is the kind of language you want if you are serious about software engineering. Strong type checking is enforced, though you can declare a variable to be of type "any". The language supports multiple inheritence. It has parameterized types (generic classes), as well user defined macros. It doesn't force you to put everything into a class. Development is fast too, because of the large number of useful APIs provided and because the compile time type checking helps you eliminate errors early. Plus when debugging, you don't have to "build" anything. Just edit and reload in the browser.

Single Language: The Curl language is suitable for all of the things that go into a modern web application: Classes, algorithms, data, expressions, events and handlers, text, graphics, forms, tables, and everything else can be expressed in the same language. You don't need to use a messy combination of XML, JavaScript, HTML, ActionScript, and various other languages and formats.

Server deployed: A Curl applet is distributed simply by putting it on a web server. It is updated by updating the files on the web server. It can be is as easy as updating a static web site.

Service Oriented: A Curl applet is the ideal consumer for web services and API's. Any SOAP endpoint can be turned into a Curl package and called directly. REST API's can also be easily handled. Both synchronous and asynchronous requests are supported.

We'll be talking more about these and other advantages of the Curl platform over the next few weeks. Let us know if any of them is of particular interest.

If you're a web developer, download the free IDE (which also installs the RTE if needed) and give Curl a try. You can use Curl for any programming project, even if you aren't planning to deploy it on the web. If you need to do any kind of computation and user interaction, Curl makes it easy. There are extensive examples in the Developer's Guide to get you started.