Recently PaloAlto Networks published a survey Social Networking Usage Explodes In Businesses Worldwide that found 27 different social networking applications in use across 95% of the participating organizations.  The survey findings are based on actual analysis of application traffic, not survey questions. The following chart from the report shows that the most prominent use is Instant Messaging at 50%.

The survey makes the point that applications are not threats ? yet they carry risks.

"The adoption of Enterprise 2.0 applications is being driven by users, not by IT. The ease with which they can be accessed, combined with the fact that newer (younger) employees are accustomed to using them, points toward a continuation of this trend. The somewhat disconcerting fact is that users do not take into account the business and security risks that these applications present. Looking at the 202 Enterprise 2.0 applications found, 70% can transfer files, 28% are known to propagate malware, and 64% have known vulnerabilities."

All this points to increased security risks as more enterprise 2.0 applications see more pervasive adoption.  As we have previously pointed out it is important that developers and IT operations both understand best practices with regard to security.  Jeffrey Hammond points out in his paper on Securing Rich Internet Applications that is is important to understand the 3 Attack Surfaces: Server-side, Communication-stream and Client-side.  In this post I'll focus on the client-side. 

RIA frameworks use a Sandbox model the protect clients from malicious code.  It is important to realize however that not all sand boxes are created equal.  While Ajax, browser based applications use the browser's sandbox, RIA frameworks like AIR, Silverlight and Curl use their own security model and permit access to the local machine.  It's natural that developers want to take advantage of the broader capabilities at RIA frameworks offer over the browser based sandbox but they need to be aware of how their decisions effect the vulnerabilities that these frameworks introduce.

To give administrators and application developers the most control over security for creating and deploying Enterprise 2.0 applications Curl supports both un-privileged and privileged modes executing in the browser and on the desktop.  This is in contrast to AIR that allows only un-privileged in the browser and only privileged on the desktop.  The follow table shows the differences between Curl and AIR privilege options.

Last week we presented a review of the implementation of the Curl eyeDecide application to Jeffrey Hammond at Forrester.  I have posted the presentation here.

Presenting were Doug Mcrae and John Chisholm (Cheese) from Curl and Juhan Sonin from Involution Studios.

As a developer himself, I think Jeffery enjoyed hearing from the people who actually did the work.  I'm sure most of his days as an analyst are filled with discussion of trends and features rather actual design and coding techniques.

Curl eyeDecide was a team effort between Curl and Involution Studios, a top application UI design firm.  The complete team included Juhan from Involution and Doug and Cheese from Curl. It took 6 months from conception to press release that included 4 months of implementation.  That amounted to 30 work weeks and resulted in 20K lines of code.

The development cycle was collaborative and iterative and featured Curl's ability to code and deploy with a total of 50 distinct releases. The development started with connectivity to the data and the UI design was driven by the actual user experience of the testers at each release.

Some key learnings were that design and development should occur over the life of the project in an iterative cycle.  Additionally professional graphic and UI design matters and having Juhan involved in developing not only the looks but the user experience from the beginning was paramount.   Another important lesson is to clearly understand the data, its values and what people will want to do early in the process.

You can get the complete eyeDecide application in source form here.

Recently Rajiv pointed to the lack of publicity Curl garners.  I responed to that thread but I felt it worth repeating as a blog post.

While Curl is owned by SCS a large ($1.6B) Software and Systems Integrator in Japan it is small compared its main rivals Abobe and Microsoft.  With a limited budget we have gained good visibility in the US over the last 2 years.  This includes being named RIA technology of the year in 2008 by InfoWorld.  We have over 400 customers world wide providing real enterprise solutions in large companies like Toyota, SONY and Panasonic. Over the last year we grew the Curl business and will have more interesting use cases to share in the near future.

We have been working with Jeffrey Hammond at Forester to help us position Curl in the RIA landscape.  From Jeffery's inquiry profile Curl is in the mix when enterprises consider RIA technologies.  We expect Curl will be part of an RIA Wave report from Forrester later this year.

Unfortunately with the current economic climate the Curl marketing budget does not support expensive advertising and trade show sponsorships.

But let's not let that dampen our enthusiasm. This developer center represents THE Curl community and we should all take it upon ourselves to spread the word about Curl.  Curl has a great story to tell with very compelling proof points. We have a wealth of marketing material that each of us can use to spread the word. I have been on hundreds of sales calls and I can tell you that our story is well received and people readily see the benefits of Curl through our demos and case studies.

Lets all work together to get the word out about Curl. Follow the lead of active community members like Friedger Müffke, Robert Shiplett and Utkal R. Pradhan

If you see and opportunity to comment on an article or blog post please do so.  If you see an opportunity to present Curl at a regional event please do so.    If you need help with putting material together, let me know I can help.

So go forth and spread the word about Curl.

In a previous article I discussed three areas of business savings to examine when making the Business case for Entperise RIA. This article will examine how Panasonic realized those business savings with their RIA implementation.

Panasonic Voice of the Engineer (VOE)

Aiming to become the number one company worldwide in customer satisfaction, Panasonic is one of the world's most-recognized brand names, largely on the basis of its highly successful Panasonic AVC Networks business segment.

The division manufactures and markets the majority of the company's consumer products, including plasma TVs and LCD monitors, Blu-ray and DVD players, digital cameras, video recorders, home theater systems and many other products. But while Panasonic welcomes strong sales, the reality is that the more diverse and successful its product lines become, the greater the challenge for its service department becomes.

Panasonic AVC's service division has simple objectives: discover and respond to potential quality and safety issues as early as possible in the product lifecycle. And, from the standpoint of safety, ensure absolutely safe operation of all electrical products over the long term. Sounds simple enough, but with an evolving product line that gets ever more complex, Panasonic service technicians have to continually educate themselves on new technologies and new repair techniques. But while it is critical that Panasonic technicians stay up to date with the latest technology improvements and developments, how do you make that happen for a huge global workforce that is responsible for thousands of products and product parts?

Panasonic AVC approaches this challenge through what it calls the Voice Of Engineering (VOE). An enterprise-wide program, VOE encompasses all the initiatives and activities geared toward discovering potential critical issues in product quality by sharing and analyzing information and trends. This includes an ongoing dialog between service technicians in the field and company management to uncover potential quality issues, and nurture and advance repair and servicing capabilities in the field. The company's technological approach to its service challenges was to create an automated system built on the Curl platform to provide its service and support staff with up-to-date repair manuals, parts diagrams, specification sheets, and other kinds of documentation.

Originally launched in 2005, the Service Information Sharing System also allows support technicians and engineers to:

• Use forums and comment areas to share their knowledge of new repair techniques, describe repair cases and support a higher level of customer service across the entire organization
• Through Curl, view information using a variety of methods: graphs, tables, charts with multi-layout format, etc.
• Integrate external document and data formats - Excel, PDF, etc.
• Easily operate system functions using drag-and-drop features, data filtering and graph combining

High Performance and Data Visualization

Panasonic AVC Networks chose Curl as the development platform for its Service Information Sharing System because it provides the ideal environment for live documentation and interactive education. Initially Panasonic AVC used a database application as its service support information system.

Another advantage of the Curl-powered Service Information Sharing System is that it enabled Panasonic AVC to retain the comprehensive information storage capabilities of its existing database system, yet enhance the capabilities of that system with a powerful and flexible front end. Curl makes complicated screen controls possible, surpassing ordinary Web browser capabilities, so Panasonic developers built in the kind of advanced features and functions typically found only in client-server type applications. For instance, the Panasonic system enables users to view documents and related information in a single view. To access documents and files, users browse indexes or use keyword search.

In practice, field engineers and service technicians simply type in keywords, and then narrow down their selections out of the returned list screen. This powerful search tool provides Panasonic field engineers with instant access to the vast amount of repair documentation and related information across the company. VOE Search structures information using syntactic analysis, morphologic analysis and a dictionary tool (tautology or synonym), and displays the associated information ranked against the keyword. The application draws on documents, files and associated information from several databases. The interface supports analytic tools that allow the support engineer to drag a device and drop it into a chart to render an instant analysis of part failures over time giving him an immediate view into likely problems. This level of performance and data visualization saves considerable time and contributes to greatly improved productivity.

Main functionality includes search for repair parts or technical documents, as well as bulletin boards to share the information and analysis views of repair processes. These discussion boards enable users to ask questions and get answers from colleagues and associates around the world. All correspondences on the bulletin board are searchable so it can be listed by the search. As engineers use the application, know-how or information are accumulated organically to speed the maintenance of information.

Low Support Costs - Web Delivery

Despite delivering native client performance and visualization the VOE application is delivered over the web. Curl supports client side data store, which allows the application high performance search without costly round trips to the server. Furthermore, through web delivery application support, costs are considerably lower. With Curl's flexible file-handling properties and standard APIs for external applications, documents can be viewed right within the system interface - there's no need to open new applications such as Excel or Acrobat. In addition, Curl's elastic technology allows users to adjust the size of documents as appropriate. Operations for changing chart type, targeting parts on and off, displaying above or below a certain point, were all designed and implemented to make the interface intuitive and convenient. Further, the application provides a "Repair Trend" view, primarily used by management, which enables them to track service activity by product, product category and date (monthly, quarterly, yearly, etc.) to better understand service issues and uncover potential problems.

The last year has seen considerable excitement in a new breed of web applications based on Rich Internet Application (RIA) technologies. Most of that excitement has been focused on consumer facing applications like Google Maps and Mail and much of that innovation has been driven by the hundreds of Ajax frameworks. However, as enterprises begin to examine how RIA technology can factor into their efforts to modernize legacy applications they are realizing that the Ajax approach has serious performance and security shortcomings. A category of RIA technologies that offer enterprise performance, scalability and security is emerging. We call this category Enterprise RIA and it includes products like Adobe AIR, Microsoft Silverlight, Sun JavaFXand Curl.

RIA as a category

RIA has emerged as a category and analyst groups such as Forrester have been conducting various surveys and studies to quantify their benefits. What they are finding is that there is a spectrum of RIA technologies that satisfy a range of needs from simple B2C to complex B2B applications. RIA for the enterprise differs significantly from RIA for consumer-centric applications. While sites such as Google or Yahoo handle very large numbers of users, the interactivity with business-critical databases and existing legacy applications is not a requirement. Enterprise RIA focuses on Fortune 1000 companies who spent a lot of resources during the 1980s and 1990s building client-server applications but now need to modernize those legacy applications taking advantage of web delivery.

Requirements of Enterprise RIA

The key requirements for enterprise RIA are as follows:

• Complex graphics and reports The platform should have many built-in User Interface and graphic report objects that support building visually appealing, effective applications without a lot of complex programming.

• Large Data Sets  Enterprise applications deal with large volumes of data that must be processed efficiently at the client. In the financial sector, the size of data sets can be hundreds of thousand of records.

• Offline-Online Enterprises need their applications to continue to operate even if connectivity is lost. When connectivity is restored the data gathered and modified at the client can be synchronized with the server.

• Very high scalability The number of concurrent users can grow fast, especially in a B2B environment, as partners, suppliers, and buyers get added to the system.

• SOA & Standards RIA must follow the basic fundamentals of Service Oriented Architecture. Although SOA discussions mostly refer to server-side application construction, the front-end must have the same attributes. Use of standards such as SOAP, WSDL, and REST must be followed for easy server-side interoperability.

• Migration tools from legacy applications To make the migration of old client-server applications, some tools should be provided to lower the cost of conversion.

• +Platform independence RIA must be able to run on any client operating system and any browser environment.

• Rich development tools  A rich IDE must be provided with appropriate plug-in to standard IDE's such as Eclipse, deployed at many large enterprises.

• Very high performance Latencies must be minimal (sub-second) for most business-critical applications. High throughput and fast performance are the two critical metrics for transactional systems. The division of work between the client and the server must be carefully evaluated to minimize the round-trips. The client-side must perform much of the user interaction and caching of data.

• Security Enterprises have strict security requirements for business-critical data. An enterprise RIA platform has to address data and application protection via various technologies such as encryption and careful use of client privilege.

• Manageability Applications must provide functions for performance monitoring and tuning. Dynamic configurability is also a requirement for changing needs.

Solutions for Enterprise RIA

The industry offers only a few solutions to the above requirements as Ajax fails in key areas such as offline operation and high scalability. While evaluating an Enterprise-scale RIA it is important to consider several metrics. These should include development time, lines of code, functionality, transaction speed, round-trip cycles, usability, and number of clicks to complete a transaction. Additionally the breadth and sophistication of the supporting libraries should be evaluated. An ideal RIA must follow the principles of SOA (Service Oriented Architecture) which advocates invocable services and assembly of such services forming an application. Most of the SOA discussion centers on server-side component assembly. An enterprise RIA should act as the front-end to the server side SOA.

"Tech Titans' Web Battle" - The headline of an article by Brandon Bailey in today's Mercury proclaims as news the story we've been telling for 2 years now - The war for dominance of the next desktop is on. The big boys have realized it for a while now and the battle lines have been drawn within the new RIA platform category. The fact that this story has caught the attention of the Merc is further proof the fight is going mainstream. Gartner's recent Market focus report on RIA and Forrester's planned wave are further evidence the market is heating up and that RIA is a legitimate category. We are now seeing a class of applications that are going beyond the simple dynamic interactivity possible through Ajax and into complex standalone desktop applications. With the more sophisticated RIA platforms it is now possible to replace client-server applications with much lower cost web applications. Of course the Mercury article only mentions the titan products: Adobe's Flash/AIR, Microsoft's Silverlight and Sun's JavaFX but notes:

"analysts say it's unlikely that one company will dominate this field — at least not in the near future. But the market is huge"

Indeed many of our over 400 customers found us only after trying and failing with Ajax or Flash. While sites such as Google or Yahoo handle very large numbers of users, the interactivity with business-critical databases and existing legacy applications is not a requirement.  Enterprise RIA focuses on Fortune 1000 companies who spent a lot of resources during the 1980’s and 1990’s building client-server applications using the rich user interface of desktop clients such as Windows.

2009 should be a defining year for RIA platforms as more and more enterprises look to replace and modernize their old client server applications with web applications.

Recently I was invited by Info-Q (Scott Delap) to participate in a virtual roundtable discussion on RIA. Other invitees are - Ryan Stewart (Adobe), Tim Sneath (Microsoft), Scott Stanfield (Vertigo), John Resig, Peter Pilgrim, and Didier Girard. The final roundtable discussion will happen and I am not sure if all the names will participate. But I was sent six questions to answer and I am posting my answers below.

1.  The web has been large dominated by "pages" and not "applications" despite the advent of RIA technologies.  In the last year we have seen the shift accelerate however with websites featuring "mini-applications" for video, interactive exploration, etc.  Given this change has RIA finally "made it".

JRD – I think there is much more RIA in the consumer space, as the need for moving from static refreshable pages (hence latency) to dynamic interactive applications is strong. For the enterprise RIA, there is no choice but to provide interactive and stateful transactional applications, as that’s what they are used to in the client-server model. However, enterprise RIA is yet to take off in the US. We see a lot more use in Japan for the Curl RIA platform.

2.  As RIA technologies have been introduced, portability has been stressed.  However, user demands are driving native integration with file systems, docks/taskbars, calendaring, and other os level items.  Do you think RIA platform will focus more on such integration in the next few years or continue to work towards interoperability instead?

JRD – Again, let us distinguish between consumer RIA vs. enterprise RIA. We see more interoperability needs than integration needs. Wherever we get benefit of the client OS (such as exploiting drivers for video rendering), Curl uses them for fast performance. The approach seems to be client-side integration and server side interoperability (incidentally Curl does not have any server-side code).

3.  Video is the largest application type driving RIA adoption at the moment.  What other types of applications to you see driving RIA technology adoption in the next 12-18 months.

JRD – We at Curl focus on web-based enterprise applications that demand high scalability, reliability, security, performance and predictability. The motivation is to switch over from client-server applications of last 15 years to a web based architecture that reduces TCO (Total Cost of Ownership) drastically. Frankly, video does not appear as a high priority for these applications at all. That is the reason why Curl has 400 large enterprises as customers running mission critical business applications. Not a single customer has deployed video.

4.  Given your target framework/language what is its greatest strength versus the rest of the field at the moment (Ajax, GWT, Curl, Flex, Silverlight, JavaFx, etc)?

JRD – Curl’s greatest strength is developer productivity (one language covers the entire spectrum of text, graphics, grids, as well as object oriented types and classes), and run-time advantages of scalability, very high volume of data handling, fast performance due to client-side compilation to machine code, and high security features. These are the basic requirements of all large enterprises for mission-critical applications for their business.

5.  Given your target framework/language what is its greatest weakness  versus the rest of the field at the moment?

JRD –Curl's greatest weakness is its relative obscurity.  Most of our customers have tried and failed with Ajax and Flex before discovering that Curl can solve their high performance and security needs. Also, video rendering is not one of our strengths as that was never a target.

6.  Most RIA languages are not used for both client and server development.  Typically backend work is done in PHP, Java, .NET, etc.  How do you see this polygot programming (http://memeagora.blogspot.com/2006/12/polyglot-programming.html) model effecting RIA?

JRD – I like the phrase Polyglot. Frankly it’s a mess. We observe that the world is polarizing to two-language schemes (e.g. C# & XAML; ActionScript & MXML; JavaFX & Java). One could argue that 2 is better than 4 and 4 is better than 6. But we at Curl believe in 1 language covering both the presentation stuff and the logic stuff. Hence the researchers at MIT designed one uniform language addressing the entire spectrum. This results in tremendous “programmer economy”, something we don’t seem to focus in the RIA world. Our customer experience substantiates this advantage greatly.

Curl is a great multi-paradigm language for building rich client applications. We hope you add it to your language repertoire.

I just listened to Michael Cote of RedMonk and Adobe evangelist Ryan Stewart’s most recent podcast on RIAWeekly.com (Podcast #38) which addresses the Curl CDK-DS announcement at the 16:00 mark.

In the podcast, Michael and Ryan directly quote the CDK-DS press release and talk about Ryan's ZDNet blog post which mentions Curl on The Universal Desktop(thanks Michael and Ryan). The Curl announcement later spurns a much longer discussion about the practical uses of AMF and the debate between binary and plain text coding.

It is great to see Curl and AMF getting this level of attention which I think will continue to grow as more podcasts and articles are being developed.  I'll continue to provide alerts when new coverage comes out!