As we are enjoying the last few weeks of summer, I’d like to take time to share with you an update on Curl’s business and the enterprise RIA market in general.

Overall, 2008 has been an exciting year for us. We’ve made some great strides in further developing our product set as well as expanding our business. We productized two of our three
open source projects, executed on our Eclipse strategy, and released our Run Time Environment (RTE) for the Macintosh, as well as support for Ubuntu.

Also, we unveiled Curl Nitro, the next version of our RIA platform, which brought with it enhanced desktop capabilities to enterprises. We released a few really cool sample applications to showcase the data visualization and online/offline capabilities of that product, so I highly recommend you check them out.

At the beginning of 2008, we predicted that this would be the start of an explosion of enterprise RIA, and this has truly been the case so far. The market is heating up with vendors, while companies and consumers alike demand richer user interfaces, stronger security, and higher performance. The enterprise has really felt the push, and we are right there to support them with thefeatures they need. This increase in demand also is reflected in the growth of our developer community, as we experienced an increase here of 456 percent.

In particular, as I have been meeting with customers and prospects, here are the common themes I have heard from them:

- Curl's visualization functions plus high performance gives us a competitive edge in our business.

- "Curlization" is a process to replace spreadsheet-based client-serverapplications to RIAs with lower total cost of ownership.

- Curl is ahead of Adobe Flex in several areas like security, performance, and programmer productivity.

- Curl has a proven track record as a RIA platform for enterprises, while others are just starting.



Below I have included a snapshot of the news announcements we have issued during the last several months, a sampling of the great media coverage we’ve received, and links to some of our most interesting blog entries from the Curl Developer Center for you to reference. I hope you find this update helpful in your research, and I welcome any comments or questions you might have.


News
ANNOUNCEMENTS
· Curl Releases New Web-Based Training Courses, August 20, 2008
· Curl Announces General Availability of Curl Development Tools for Eclipse, August 5, 2008
· Curl Announces General Availability of Its Curl Data Kit - July 7, 2008
· Curl to Provide Rich Internet Application Technology to University of Hawai'i at Mānoa, June 26, 2008
· Curl Nitro Demo Application Visualizes Facebook Social Graphs, June 23, 2008
· Curl Showcases Curl Nitro Through New Sample Application, June 16, 2008
· Curl Announces Public Beta Availability of Eclipse-Based RIA Development Tools, June 9, 2008
· Curl Makes Rich Internet Application Run Time Environment for Macintosh Generally Available, June 3, 2008
· RIA Technology Benchmark Test Finds Curl Outperforms Adobe Flex 3, May 28, 2008
· Curl Embraces Desktop RIA With 'Nitro' Product Release, April 21, 2008
· Curl Announces Support for Ubuntu for Enterprise RIA Platform, April 15, 2008
· Curl Joins Eclipse Foundation and Announces Eclipse Strategy, April 7, 2008
· Curl Delivers First Open Source Product with Web Services Development Kit, March 4, 2008

CURl IN the news
· RIA company curls up with Eclipse, SD Times, August 6, 2008
· Curl completes embrace of Eclipse IDE, NetworkWorld, August 4, 2008
· How to sort out Ajax and RIA frameworks, SearchSOA.com, July 30, 2008
· The Architect's Role, Dr. Dobb’s Journal, July 1, 2008
· Overview of the Curl Enterprise RIA Platform, InfoQ.com, June 13, 2008
· Curl Adds Runtime Support for Mac Environments, PC World, June 3, 2008
· Curl 6 outperforms Flex 3 on CPU-intensive benchmark, InfoWorld, May 28, 2008
· Who Will Win the Next Battle for the Desktop?, AJAXWorld, April 27, 2008
· Curl's Nitro Takes Aim at Adobe AIR, InformationWeek, April 15, 2008
· RIA War Is Brewing, eWeek, April 11, 2008
· Product review: Curl 6.0 enriches the rich Internet toolkit, InfoWorld, April 7, 2008
· Curl: Rich Internet Apps get richer, Computerworld, March 13, 2008
· Curl ships commercial version of its open source web services dev kit for RIA Platform, ZDNet, March 4, 2008
· Curl linking rich Internet applications, SOA, InfoWorld, February 29, 2008

CURl BLOG POSTS
· Curl is now in the Top 4, August 12, 2008
· Backward Compatibility and Curl, August 1, 2008
· Quarantined by default, secure by design, July 28, 2008
· The Batmobile, Lamborghini, and my Suburban, July 23, 2008
· Enterprise RIA - real examples in use, June 13, 2008
· How big is your source code?, June 12, 2008
· Does RIA platform performance matter?, May 30, 2008
· For Curl, Security is Job #1, May 29, 2008
· Questions to ask your RIA Vendor, May 20, 2008
· Why Criminal Hackers Will Love Adobe AIR, April 16, 2008
· Seven nice things about the Curl Platform, March 25, 2008
· Why Is an Enterprise RIA Platform Different?, February 13, 2008

Events Tradeshows and Conferences
Curl will have representation and/or executive speaking sessions at the following tradeshows. Please let us know if you plan to attend any of these events and if you’re interested in scheduling a briefing:

· Rich Client Experience, Washington, DC, September 4-5, 2008
· Web 2.0 Conference & Expo 2008, New York City, Sept. 16-19, 2008
· AJAXWorld 2008 West,San Jose, CA, October 20-22, 2008
· SD Best hPractices,Boston, MA, October 27-30, 2008
· InfoQ QCon, San Francisco, CA, November 19 - 21, 2008

Adobe has released their new AIR product with much fanfare about letting developers "use proven Web technologies to build rich Internet applications that deploy to the desktop and run across operating systems." The grand vision that's being promoted is that AIR is pioneering the application development model of the future, where cross-platform applications will be developed using a platform-independent tool such as AIR, and then deployed across the Web as downloadable gadgets that can be installed on any computer.

The concept is attractive, but there are several weaknesses in the way AIR implements it. One of these weaknesses is performance: while the speed of AIR's execution engine may be fine for gadgets, will performance that is still an order of magnitude slower than native code be acceptable for serious applications like Adobe's own Photoshop? (Note that the recently released Photoshop Express service is not an AIR application; it's a server-side application with a Flex front end.) A second weakness is the complexity of the AIR execution architecture: will future application developers really find AIR's conglomeration of JavaScript and ActionScript execution engines to be a more tractable development platform than a single, coherent, object-oriented execution environment? But the weakness I want to address today is AIR's security architecture.

Security is a central issue for any mobile code execution platform. When a user loads an application from a server, unless the user is able to verify the authenticity of the application and the trustworthiness of the application's provider, it is only prudent to assume that the application could be malicious. This is why Web browsers execute the JavaScript on a Web page inside a security sandbox that prevents the script from stealing information or damaging files even if it is malicious.

Some advanced mobile code platforms, such as Java and Curl, provide a sandbox for garden-variety untrusted applications, as well as a means for eliminating the sandbox restrictions for applications that a user determines can be trusted. Since trusted applications will have full access to the user's machine and network, it is very important that their origin can be authenticated. This is typically done by requiring that a trusted application be digitally signed by its provider, using a certificate issued by a recognized certification authority such as Verisign. This architecture extends the range of a platform, in a safe way, so it can handle a spectrum of application requirements that includes the features of typical desktop applications, many of which require fuller access than can be granted to an untrusted application running in a sandbox.

The designers of AIR obviously wanted to play in the desktop application space, so AIR applications have full access to the machine they are running on. But it seems that the AIR designers were unwilling to give up on also being a platform for casually loaded Internet gadgets, even though they did not see fit to give AIR a sandbox for running untrusted applications. The result is a mongrel security architecture that may impose costs on a lot of innocent people over time.

In a nod to the authentication requirements for trusted applications, Adobe says that all AIR applications must be signed. But the nod is an empty gesture, because AIR does not require signatures to be based on a certificate from a recognized certification authority! If you want, you can create your own certificate out of whole cloth and sign your AIR application with that! I have to guess that Adobe did this because they didn't want to cut themselves off from the casually loaded Internet gadget domain, and they weren't willing to require that the creators of such gadgets go through the process of obtaining a legitimate certificate.

Yes, if an AIR application's certificate is self-signed, AIR displays the publisher as "UNKNOWN", "giving the user pause as to whether they should continue." But what detective work is the user expected to do? How many users will actually be able to do it? It seems more likely that if Adobe's dreams for AIR are realized, a generation of users will be trained in the habit of clicking "Install" for fully privileged AIR applets of unauthenticated provenance. Adobe has already begun this training program by posting a large number of self-signed AIR applications on the Adobe AIR Marketplace, including the DiggTop feed reader, twhirl Twitter client, and Google Analytics Reporting Suite, just to name a few.

The resulting situation will be a bonanza for criminal hackers. AIR will become the first truly cross-platform tool for distributing malicious applications. Macintosh and Windows, home and business computers will all be equal-opportunity targets for Trojan horse attacks, keystroke loggers, etc., truly realizing the dream of "write once, hack everywhere!"

Adobe can't have it both ways. Casually loaded Internet gadgets need to run in a security sandbox. Trusted applications need to be rigorously authenticated. Adobe needs to stop pretending that their self-signed application model provides a secure basis for running casually loaded applications with full privileges.