Recently PaloAlto Networks published a survey Social Networking Usage Explodes In Businesses Worldwide that found 27 different social networking applications in use across 95% of the participating organizations.  The survey findings are based on actual analysis of application traffic, not survey questions. The following chart from the report shows that the most prominent use is Instant Messaging at 50%.

The survey makes the point that applications are not threats ? yet they carry risks.

"The adoption of Enterprise 2.0 applications is being driven by users, not by IT. The ease with which they can be accessed, combined with the fact that newer (younger) employees are accustomed to using them, points toward a continuation of this trend. The somewhat disconcerting fact is that users do not take into account the business and security risks that these applications present. Looking at the 202 Enterprise 2.0 applications found, 70% can transfer files, 28% are known to propagate malware, and 64% have known vulnerabilities."

All this points to increased security risks as more enterprise 2.0 applications see more pervasive adoption.  As we have previously pointed out it is important that developers and IT operations both understand best practices with regard to security.  Jeffrey Hammond points out in his paper on Securing Rich Internet Applications that is is important to understand the 3 Attack Surfaces: Server-side, Communication-stream and Client-side.  In this post I'll focus on the client-side. 

RIA frameworks use a Sandbox model the protect clients from malicious code.  It is important to realize however that not all sand boxes are created equal.  While Ajax, browser based applications use the browser's sandbox, RIA frameworks like AIR, Silverlight and Curl use their own security model and permit access to the local machine.  It's natural that developers want to take advantage of the broader capabilities at RIA frameworks offer over the browser based sandbox but they need to be aware of how their decisions effect the vulnerabilities that these frameworks introduce.

To give administrators and application developers the most control over security for creating and deploying Enterprise 2.0 applications Curl supports both un-privileged and privileged modes executing in the browser and on the desktop.  This is in contrast to AIR that allows only un-privileged in the browser and only privileged on the desktop.  The follow table shows the differences between Curl and AIR privilege options.

(Cross posted from the Zuzu Curl blog)

Upon expanding the test cases for my tree classes in ZUZU.LIB.CONTAINERS, I discovered that in one degenerate case involving a pessimally balanced splay tree, attempting to serialize the tree using the default compiler-generated serialization routines resulted in a stack overflow. The problem was that I had a test case that accesses each element in the tree in order before attempting to clone the tree using serialization. For most self-balancing trees, this is not a problem, but for splay trees, this results in a tree that is as unbalanced as possible -- essentially just a long linked list. Because the compiler-generated object-serialize method recursively serializes the classes fields, serializing the tree nodes blows up the stack. This is a potential problem when serializing any linked data structure that may have arbitrarily large depth.

The way around this problem is to implement an explicit non-recursive object-serialize method and object-deserialize constructor for affected classes. The general algorithm is fairly simple:

1. Iterate non-recursively over the nodes in the datastructure. For each node, temporarily null out its pointers and serialize the node normally. The SerializeOutputStream will remember the objects and will not dump them out again if the same object is serialized later.

2. If the number of nodes was not known in advance, serialize out a sentinel value to delimit the end of the nodes.

3. Iterate over the nodes again in the same order and serialize the fields in order.

When deserializing, just reverse this process.

The following example demonstrates this problem for a simple linked list data structure. Note that in the linked list case the algorithm only requires a single

iteration because the next pointer is always just the next element to be serialized. To see the stack overflow, comment out the object-serialize and object-deserialize members.

Example

Note how I used the class version as an optimization to avoid serializing an extra null for each instance.

Fixing this for my tree classes was a little bit more complicated but the principle is the same. You can see my changes here.

One thing I have always liked about Curl is the lack of an independent compile/link step. You can run Curl applets directly from source code just using the Curl RTE, which will compile and link the code dynamically as needed. This gives Curl the immediacy and flexibility of scripting languages like JavaScript while retaining the performance of a compiled language. It also means that you can run Curl applets directly from a source code repository with a web interface that can be configured to return the appropriate Curl applet MIME type (text/vnd.curl). Luckily for me, Google Code provides such a repository, so I am able to configure applets in my ZUZU libraries to be run directly from the repository.

Here is an example:

http://zuzu-curl.googlecode.com/svn/trunk/zuzu-curl/LIB/applets/example.curl

(I don't know how to embed an OBJECT tag in this blog infrastructure. See

the version of this post on the Zuzu Curl blog to see an embedded example.)

This example applet takes arguments in the "query" portion of the URL to set the title of the example and to load the initial contents of the example either from another file or from the query itself (as in this case). This allows me to use the same example applet to show different editable examples in my blog. The embedded example applet used in the training section of the Curl Developer's Site uses the same trick; for example, see here.

Look here for instructions on how to configure your Google Code repository to serve Curl applets.  This trick may work on other Subversion-based code hosting services such as SourceForge, but I have not tried it.

Today we announced our membership in the Eclipse foundation.  We also detailed our plans to base our developer tools on the Eclipse framework.   You can read the details of our approach in a note I posted back in February.  Our Eclipse based product will be called the Curl Development Tools for Eclipse or CDE and our exiting IDE will be become the Curl Classic IDE.

Out first CDE release which will be available in the summer will include all the functionality of the Curl Classic IDE, including the Curl language sensitive editor, debugger, search, deployment capabilities, Visual Layout Editor and much more. Future releases of the CDE will integrate the Curl Visual Layout Editor into the Eclipse framework as a Design Perspective, and substantially improve other programming productivity features such as error highlighting in the source-code editor, language sensitive navigation, refactoring and code assistance.

It's day 2 at the WEBBuilder 2.0 Conference here in Las Vegas.  This is our first time at this conference.  Compared to the buzz and hype of Web2.0 Summit and Office2.0 this conference is very low key.  Attendees are here to learn in detail about how they can improve their on-line properties.  Speakers are not the trend setters but the teachers and doers of the web building world.  Sitting next to me is Jeanne Morton from Avon who is here to learn how Avon can improve the way they do business with their partners.  Much of Avon's systems are old and the company is very conservative and reluctant to open up to Web2.0  technologies and social networking. 

Given the audience, Scott Deitzen's first keynote, a sales pitch for Zimbra seemed off the mark.  It is interesting that Zimbra struggled to implement their email application in Ajax - some 250,000 lines of code.  To handle off-line they wrote a fat client.  Isn't this back to a client-server solution.

There must be a lot of companies like Zimbra that think their only option is Ajax and struggle to make that work.  We need to be on a mission to explain there are other RIA options like Curl.  Hopefully our work with Forrester will help.  We'll see today as Jeffrey Hammond is presenting "Technologies of the Future."  I sure hope he mentions Curl.

I thought Mark Lucovsky's presentation on "Interactive Search Applications" was on target for the conference audience.  Mark's is currently at Google and his background includes more than a decade at Microsoft.  Microsoft understands better than any company how to talk to developers and Mark showed that competence in his delivery.  Google's view of the lowest level of web developer is "someone that can cut and paste."  This is indeed lowering the bar but you can immediately see the power in that paradigm.   Mark went through a host of Google Ajax routines that any one can cut and paste into their web page and create sophisticated full function web applications.   Google is now creating wizards that prompt you for defining parameters  then generates the java code for the function.  From there you simply cut and paste and viola - your web mashup!    We should look at doing something similar with our Ajax wrapper for Curl functions.

On to Jeffrey's presentation.

Richard

An initiative in the Mozilla Labs called Prism seeks to put web applications on the desktop, running in their own application windows and behaving more like a rich client application than when run in the browser chrome. It's an interesting idea from a user experience perspective and we'll be keeping a close eye on this project. Prism was initially available for Windows only but has now been released for the Mac OS X and Linux platforms as well. The Mozilla Labs web site describes Prism like this:

Mozilla Labs is launching a series of experiments to bridge the divide in the user experience between web applications and desktop apps and to explore new usability models as the line between traditional desktop and new web applications continues to blur.
Unlike Adobe AIR and Microsoft Silverlight, we're not building a proprietary platform to replace the web. We think the web is a powerful and open platform for this sort of innovation, so our goal is to identify and facilitate the development of enhancements that bring the advantages of desktop apps to the web platform.

A bit further down the page, they add:

Prism isn't a new platform, it's simply the web platform integrated into the desktop experience. Web developers don't have to target it separately, because any application that can run in a modern standards-compliant web browser can run in Prism. Prism is built on Firefox, so it supports rich internet technologies like HTML, JavaScript, CSS, and <canvas> and runs on Windows, Mac OS X, and Linux.  And while Prism focuses on how web apps can integrate into the desktop experience, we're also working to increase the capabilities of those apps by adding functionality to the Web itself, such as providing support for offline data storage and access to 3D graphics hardware.

It's an interesting notion and one that has a number of aspects that resonate with the capabilities available today in Curl - from both a development and deployment perspective.

There's some interesting conversation around the announcement already. In an article in the New York Times, Adobe's  Mike Chambers, the project manager for AIR (Adobe Integrated Runtime) is quoted (from his personal blog) as taking some umbrage at the way Mozilla is positioning their effort relative to Adobe's (as well as Microsoft's Silverlight).

"The thing I found odd was Mozilla appears to be building something very similar to Adobe AIR (which is fine and cool), but somehow it is inherently good when Mozilla does it, and inherently evil when Adobe does it," Chambers responded. "AIR is built on top of Web standards and can run existing Web applications and content. It runs on Windows and Mac (and soon Linux), and it also provides additional desktop functionality.

"Is the main difference ... that AIR is being primarily developed by a company, and that Prism is being developed by Mozilla?"

ZDnet's Ryan Stewart, who is also an evangelist for Adobe AIR, also has concerns about the way Mozilla is positioning their effort. This should prove to be an interesting conversation to watch develop. Ultimately, all of these efforts have a long way to go before they'll be ready for serious use in the enterprise.

It's a pretty exciting day here at Curl as we launch this all-new Developer Community site. For the past few months, a team of folks at Curl have worked with The Last Mile Group and Jive Software to create this new center designed specifically for developers interested in learning about how Curl can be used to build Richer Internet Applications. We have incorporated a lot of content into this community site to assist those of you who are new to Curl in getting up to speed as quickly as possible and to support experienced Curl developers by providing access to in-depth technical resources.

Our vision for this site is to promote an ongoing conversation among developers - like all communities, the more you contribute, the better the results. You'll be able to exchange ideas with others who are exploring how to take advantage of the web as a platform for delivering highly usable, responsive, and interactive line-of-business and mission critical applications within their organization or innovative new services and capabilities to customers and partners.

When you register as a community member, you'll have full access to all of the features and capabilities this community has been designed to provide including discussions with other community members and the Curl team, access to training and reference materials, code and application samples (including the Curl source code) you can use to demonstrate the capabilities of the Curl language and Run Time Environment (RTE) and put to use in your own projects. We plan to add more content on an ongoing basis ourselves but we believe that the best ideas will come from people like you who are working to develop real-world solutions to the opportunities and challenges facing your organization. 

As you may have already seen, we've also announced a new Open Source initiative to put development kits for consuming web services, connecting to database resources, and tools to promote best practices in application development into the hands of the community to extend and enhance. Your contributions to this effort will make it possible for everyone using the Curl language and development tools to produce Richer Internet Applications.

To take full advantage of the Curl Developer Community, you should download and install the Curl RTE (available for Windows, Linux, and Mac OS X). With this runtime environment on your PC, you'll be able to take full advantage of the interactive features we've designed in this community site and can also run the Curl applications we've made available here for download to your local machine.

The next step is to download and install the Curl Integrated Development Environment for Windows or Linux which provides everything you need to build, test, and deploy your own Curl applications. The IDE includes a powerful development environment, a visual layout editor, and unique, interactive documentation that makes it possible for you to explore all of the capabilities of the Curl language in real-time as you explore the many features and capabilities available to you. Both downloads, as well as membership in this Developer Community are free.

We look forward to hearing from you – your suggestions, comments, and contributions to this Developer Community are essential to making this resource as valuable as it can be.

This is my first post here, so I should start by introducing myself. I am Christopher Barber, and I have been a software developer/architect here at Curl since 1999. At Curl, I have worked primarily on the compiler for the Curl language and on other internals of the Curl RTE with occasional forays into GUI development (e.g., the Coverage Viewer in the Curl IDE). Prior to joining Curl, I worked on an online brokerage for D.E.Shaw, helped to develop an early web search engine and worked on distributed systems research projects at BBN, and worked on back-office systems for the cellular telephone and credit industries at the company now known as Lightbridge. During my career, I have programmed significantly in COBOL, BASIC, C, C++, Perl, Tcl, Python, and several other languages, but for the last eight years I have been programming almost exclusively in Curl (yes, that's right, Curl is written in Curl!).

In my posts here, I intend to mostly discuss various aspects of programming in the Curl language and runtime environment. Topics will likely include Curl programming idioms, extending the Curl syntax using macros, discussions of open source projects I may be participating in, and "under the hood" examinations of the Curl technology. Today, I thought I would start out by highlighting a few of the attributes of the Curl which most appeal to me as a programmer:

• immediacy - Programming in Curl has the same experience of immediacy I used to get composing HTML pages. All you need to program in Curl, is the Curl RTE and your favorite web browser and text editor. Just type the applet in the editor, save it in a file with a .curl extension and browse the file to run the applet. The RTE will dynamically compile the code from source directly into machine code and run it. While the IDE is quite useful and highly recommended for serious Curl development, it is not strictly necessary, and I often find myself doing without the IDE for simple projects.

• speed - Curl is a compiled language and does not suffer from the inherent performance issues of interpreted languages such JavaScript. Furthermore, the RTE will persistently cache previously compiled packages to avoid unnecessary recompilation. While it is not as fast as highly optimized C code, it is fast enough to allow the Curl IDE to be implemented entirely using Curl code that is dynamically compiled on the client, just like a regular Curl applet.

• markup - Curl is not just a programming language but is also a markup language with all the capabilities of HTML and more. It is easy to write documents in Curl, and in fact all of Curl's documentation is itself written in Curl. Many of our internal design and planning documents are also written in Curl. It is easy to embed executable examples in Curl documentation or write custom table formats and the like. Curl API documentation can be defined directly in the code without having to be hidden in comments using an unrelated syntax such as Javadoc.

• static/dynamic typing - My years of programming in C/C++ gave me an appreciation of the benefits of static typing, specifically the ability for the compiler to find and report type errors at compile-time and to optimize based on type declarations. Likewise, my experience with Tcl, Perl and Python gave me a great appreciation of the flexibility of dynamic typing. The Curl language is fully statically typed but provides an "out" in the form of the abstract any type. Variables of type any may hold any value and may be used as if they were declared with the proper static type. This allows me to mix static and dynamic typing idioms in my code as desired.

• extensibility - The Curl language allows you to extend the syntax extensively by means of a powerful procedural macro system. It is possible to define new control flow syntaxes, create shorthand syntaxes for common idioms, and even to embed other programming language syntaxes in Curl code. Curl's macro system provides some access to the compilation environment, making it possible to write macros that can infer types or do conditional compilation. Much of Curl's standard syntax is implemented using macros.

• multiparadigm - Curl is a language that supports multiple programming paradigms. Programmers are not forced to use an idiom that does not fit either their preferred programming style or the task at hand. In addition to the paradigms already mentioned, Curl supports object-oriented, procedural and functional programming styles. The code underlying the Curl RTE itself is largely object-oriented, but makes use of other styles when appropriate.

Of course, there are many other aspects of the technology and specific features that I like, but I will leave those to future posts.

Christopher