Recently PaloAlto Networks published a survey Social Networking Usage Explodes In Businesses Worldwide that found 27 different social networking applications in use across 95% of the participating organizations.  The survey findings are based on actual analysis of application traffic, not survey questions. The following chart from the report shows that the most prominent use is Instant Messaging at 50%.

The survey makes the point that applications are not threats ? yet they carry risks.

"The adoption of Enterprise 2.0 applications is being driven by users, not by IT. The ease with which they can be accessed, combined with the fact that newer (younger) employees are accustomed to using them, points toward a continuation of this trend. The somewhat disconcerting fact is that users do not take into account the business and security risks that these applications present. Looking at the 202 Enterprise 2.0 applications found, 70% can transfer files, 28% are known to propagate malware, and 64% have known vulnerabilities."

All this points to increased security risks as more enterprise 2.0 applications see more pervasive adoption.  As we have previously pointed out it is important that developers and IT operations both understand best practices with regard to security.  Jeffrey Hammond points out in his paper on Securing Rich Internet Applications that is is important to understand the 3 Attack Surfaces: Server-side, Communication-stream and Client-side.  In this post I'll focus on the client-side. 

RIA frameworks use a Sandbox model the protect clients from malicious code.  It is important to realize however that not all sand boxes are created equal.  While Ajax, browser based applications use the browser's sandbox, RIA frameworks like AIR, Silverlight and Curl use their own security model and permit access to the local machine.  It's natural that developers want to take advantage of the broader capabilities at RIA frameworks offer over the browser based sandbox but they need to be aware of how their decisions effect the vulnerabilities that these frameworks introduce.

To give administrators and application developers the most control over security for creating and deploying Enterprise 2.0 applications Curl supports both un-privileged and privileged modes executing in the browser and on the desktop.  This is in contrast to AIR that allows only un-privileged in the browser and only privileged on the desktop.  The follow table shows the differences between Curl and AIR privilege options.

I had briefly reported from the Web 2.0 Expo last week. Here is an overall summary of the event.

I have been going to all the Web 2.0 events since they started back in 2005. It's quite remarkable how fast the attendance has grown. There used be just one conference in November. Due to its popularity they made it into two events - We 2.0 Expo in April and Web 2.0 Summit in October. The one in the fall tends to be much more technical. The expo is broader and the attendance is much larger. The success of this event has prompted the organizers (O'Reilly & company) to have similar events in New York, Tokyo, and Europe since 2007.

For those who are confused by the term Web 2.0,  you are in good company of many.  Ambiguity is the name of the game here. The phrase Web 2.0 was coined to explain the evolution of the Web to being a serious platform for the future applications, as opposed to the first phase (Web 1.0) where static pages were delivered and user-interactivity was quite limited. Also it was architecturally poor and slow to perform with all the page refreshes. Web 2.0 deals with asynchronous access to servers, polling data to the client cache for continuous feeding (e.g. Google Maps), hence it feels like a local desktop application. The phrase Ajax was coined 2 years ago to highlight the asynchronous aspects, even though the underlying technology remains the same - HTML, Javascript, CSS, DOM, XML,..

During 2005 and 2006, almost all the attendees at the Web 2.0 events were young kids working on start-ups like Flickr, YouTube, MySpace, etc. During last year's Web 2.0 Summit, the first session was with Marc Zuckerberg, the 23 year old who founded Facebook. The same night, the dinner guest was the 73-year old Rupert Murdoch, head of News Corporation and owner of MySpace. During my first attendance back in 2005 Fall, I felt like a fish out of water. There were no large enterprises including my former employers like IBM or Oracle. I could not recognize anyone from my generation. No gray hair from the client-server era. But it was lots of fun watching the kids re-invent the same issues some of us had worked on years back.  Topics like stateful applications, transactional integrity, secure commits to the database, good scalability when numbers rise fast, were all being revisited. I call this "Back to the Future". So all the discussions centered around the "consumer space". It's like the boom-years of 1997-2000 when Jeff Bozos of Amazon said, "profit,? I spell that as Prophet." People started talking about another "bubble" around Web 2.0. No one seemed to care about "monetization" or "business value".

Zimbra got a standing ovation in the fall of 2005 when it displayed its email with pop-ups as you mouse thru the content. Yahoo bought Zimbra for $300m, but its future inside Yahoo is clouded as much as Yahoo's own future. This year, I noticed a remarkable shift. Suddenly large enterprises are everywhere. IBM had a big booth. So did Oracle. Juniper networks, HCL, Nokia, all had large booths. Even the sessions were full of speakers from large corporations. The classic "social-networking-is-the-future" crowd was also there, but they seemed less in number.

This is good for us at Curl, as we position our solution for the enterprise, serious to deploy the business-critical applications on the new web platform. We gave over 120 demos to visitors in our booth. Many of the visitors asked serious questions this time. Some have tried to implement complex visualization apps. via Adobe Flash, or via one of many Ajax frameworks, but were highly disappointed with scalability and functions. Programmer productivity is a key factor. Rapid prototyping is also crucial for creating proof points. Gone are the days of long development cycle. Getting users involved during the design process is key to success. Cul renders itself well to these approaches.  We need to continue aggressively with our "awareness campaign" for the enterprise crowd.

In summary, I was not that surprised with the evolution of Web 2.0 towards more "enterprise focus". The same phenomenon was also visible at the AjaxWorld in New York during March. There were more discussions on "building RIA outside Ajax", as people realize the deficiencies of Ajax frameworks.