Tim Anderson's ITWriting » facebook

ITWriting.com awards 2011: ten key happenings, from Nokia’s burning platform to HP’s nightmare year

tim — Thu, 29 Dec 2011 10:39:58 +0000

2011 felt like a pivotal year in technology. What was pivoting? Well, users are pivoting away from networks and PCs and towards cloud and devices. The obvious loser is Microsoft, which owns PCs and networks but is a distant follower in devices and has mixed prospects in the cloud. Winners include Apple, Google, Amazon, and Android vendors. These trends have been obvious for some time, but in 2011 we saw dramatic evidence of their outcome. As 2011 draws to a close, here is my take on ten happenings, presented as the first ever ITWriting.com annual awards.

1. Most dramatic moment award: Nokia’s burning platform and alliance with Microsoft

In February Nokia’s Stephen Elop announced an alliance with Microsoft and commitment to Windows Phone 7. In October we saw the first results in terms of product: the launch of the Lumia smartphone. It is a lovely phone though with some launch imperfections like too short battery life. We also saw greatly improved marketing, following the dismal original Windows Phone 7 launch a year earlier. Enough? Early indications are not too good. Simply put, most users want iOS or Android, and the app ecosystem, which Elop stated as a primary reason for adoption Windows Phone, is not there yet. Both companies will need to make some smart moves in 2012 to fix these issues, if it is possible. But how much time does Nokia have?

2. Riskiest technology bet: Microsoft unveils Windows 8

In September 2011 Microsoft showed a preview of Windows 8 to developers at its BUILD conference in California. It represents a change of direction for the company, driven by competition from Apple and Android. On the plus side, the new runtime in Windows 8 is superb and this may prove to be the best mobile platform from a developer and technical perspective, though whether it can succeed in the market as a late entrant alongside iOS and Android is an open question. On the minus side, Windows 8 will not drive upgrades in the same way as Windows 7, since the company has chosen to invest mainly in creating a new platform. I expect much debate about the wisdom of this in 2012.

Incidentally, amidst all the debate about Windows 8 and Microsoft generally, it is worth noting that the other Windows 8, the server product, looks like being Microsoft’s best release for years.

3. Best cloud launch: Office 365

June 2011 saw the launch of Office 365, Microsoft’s hosted collaboration platform based on Exchange and SharePoint. It was not altogether new, since it is essentially an upgrade of the older BPOS suite. Microsoft is more obviously committed to this approach now though, and has built a product that has both the features and the price to appeal to a wide range of businesses, who want to move to the cloud but prefer the familiarity of Office and Exchange to the browser-based world of Google Apps. Bad news though for Microsoft partners who make lots of money nursing Small Business Server and the like.

4. Most interesting new cross-platform tool: Embarcadero Delphi for Windows, Mac and iOS

Developers, at least those who have still heard of Embarcadero’s rapid application development tool, were amazed by the new Delphi XE2 which lets you develop for Mac and Apple iOS as well as for Windows. This good news was tempered by the discovery that the tool was seemingly patched together in a bit of a hurry, and that most existing application would need extensive rewriting. Nevertheless, an interesting new entrant in the world of cross-platform mobile tools.

5. Biggest tech surprise: Adobe shifts away from its Flash Platform

This one caught me by surprise. In November Adobe announced a shift in its business model away from Flash and away from enterprise development, in favour of HTML5, digital media and digital marketing. It also stated that Flash for mobile would no longer be developed once existing commitments were completed. The shift is not driven by poor financial results, but rather reflects the company’s belief that this will prove a better direction in the new world of cloud and device. Too soon and too sudden? Maybe 2012 will show the impact.

6. Intriguing new battle award: NVIDIA versus Intel as GPU computing catches on

In 2011 NVIDIA announced a number of wins in the supercomputing world as many of these huge machines adopted GPU Computing, and I picked up something of a war of words with Intel over the merits of what NVIDIA calls heterogeneous computing. Intel is right to be worried, in that NVIDIA is seeing a future based on its GPUs combined with ARM CPUs. NVIDIA should worry too though, not only as Intel readies its “Knight’s Corner” MIC (Many Integrated Core) chips, but also as ARM advances its own Mali GPU; there is also strong competition in mobile GPUs from Imagination, used by Apple and others. The GPU wars will be interesting to watch in 2012.

7. Things that got worse award: Spotify. Runners up: Twitter, Google search

Sometimes internet services come along that are so good within their niche that they can only get worse. Spotify is an example, a music player that for a while let you play almost anything almost instantly with its simple, intuitive player. It is still pretty good, but Spotify got worse in 2011, with limited plays on free account, more intrusive ads, and sign-up now requires a Facebook login. Twitter is another example, with URLS now transformed to t.co shortcuts whether you like it not and annoying promoted posts and recommended follows. Both services are desperately trying to build a viable business model on their popularity, so I have some sympathy. I have less sympathy for Google. I am not sure when it started making all its search results into Google links that record your click before redirecting you, but it is both annoying and slow, and I am having another go with Bing as a result.

8. Biggest threat to innovation: Crazy litigation from Lodsys, Microsoft, Apple

There has always been plenty of litigation in the IT world. Apple vs Microsoft regarding graphical user interfaces 1994; Sun vs Microsoft regarding Java in 1997; SCO vs IBM regarding UNIX in 2003; and countless others. However many of us thought that the biggest companies exercised restraint on the grounds that all have significant patent banks and trench warfare over patent breaches helps nobody but lawyers. But what if patent litigation is your business model? The name Lodsys sends a chill though any developer’s spine, since if you have an app that supports in-app purchases you may receive a letter from them, and your best option may be to settle though others disagree. Along with Lodsys and the like, 2011 also brought Microsoft vs several OEMs over Android, Apple vs Samsung over Android, and much more.

9. Most horrible year award: HP

If any company had an Annus Horribilis it was HP. It invested big in WebOS, acquired with Palm; launched the TouchPad in July 2011; announced in August that it was ceasing WebOS development and considering selling off its Personal Systems Group; and fired its CEO Leo Apotheker in September 2011.

10. Product that deserves better award: Microsoft LightSwitch

On reflection maybe this award should go to Silverlight; but it is all part of the same story. Visual Studio LightSwitch, released in July 2011, is a model-driven development tool that generates Silverlight applications. It is nearly brilliant, and does a great job of making it relatively easy to construct business database applications, locally or on Windows Azure, complete with cross-platform Mac and Windows clients, and without having to write much code. Several things are unfortunate though. First, usual version 1.0 problems like poor documentation and odd limitations. Second, it is Silverlight, when Microsoft has made it clear that its future focus is HTML 5. Third, it is Windows and (with limitations) Mac, at a time when something which addresses the growing interest in mobile devices would be a great deal more interesting. Typical Microsoft own-goal: Windows Phone 7 runs Silverlight, LightSwitch generates Silverlight, but no, your app will not run on Windows Phone 7. Last year I observed that Microsoft’s track-record on modelling in Visual Studio is to embrace in one release and extinguish in the next. History repeats?

Nokia’s Windows Phone gamble

tim — Fri, 28 Oct 2011 00:21:16 +0000

At Nokia World in London on Wednesday, CEO Stephen Elop presented the new Lumia range of Windows Phones. You can watch the keynote here – I was impressed by Elop’s clarity and conviction, and also by VP Blanca Juti who talked about the Asha range of nearly-smartphone feature phones.

The demonstration of the Windows Phone OS and apps seemed to me weaker and you could sense a struggle in energising the audience. I suspect this is because Windows Phone has already been out for a year and has failed to meet expectations; clearly it takes more than live tiles to make a success of a new Smartphone.

Elop is aware of this which is why he made the following widely quoted remark:

[Lumia is] the first ever instantiation of the windows phone platform that properly embodies, complements and amplifies the design sensibilities of windows phone … more simply stated, Lumia is the first real Windows Phone.

I have yet to handle a Lumia but I believe Elop, in that the other Windows Phone 7 devices are no more than ordinary in their design, whereas Nokia has done something distinctive.

I was impressed by the demo of turn by turn navigation; this does look like an attractive and useful app.

I was also impressed when Elop talked about the marketing effort which Nokia and its retail partners are putting behind Lumia. He said that there are 31 operators and retailers in size countries which:

…have each committed to significant levels of marketing investment which includes unprecedented retail exposure and three times the level of total marketing investment compared to any other single Nokia launch.

He added that Nokia will be distributing seed devices widely among retailers so that they really know (and, Elop claims, love) the Lumia Windows Phones.

My immediate reflection is that Microsoft needed Nokia a year ago; Windows Phone has never before received this kind of backing. I am not sure that I have ever seen a Windows Phone for sale in my local small town centre, which has several mobile phone shops.

The tough question: is the OS good enough to compete with Apple and Android? I think it is a reasonable alternative, though I personally find the 20 beautifully designed icons I see on the first screen of the iPhone 4 more appealing than the seven chunky, flickering tiles I see on a Windows Phone. That said, I can see that the Windows Phone makes a good Facebook phone. I also like the Office apps and their read-write support for SharePoint, which is useful to me as a SharePoint user.

Where Windows Phone falls short is in the quality and availability of apps. There may be 30,000 in the Marketplace, but most of them are rubbish, and if you have a niche interest it is less likely to be represented than on an iPhone. I play Bridge, and on the iPhone I can enjoy FunBridge among others; on Windows Phone, nothing yet.

I have also found the data in Local Scout, a location-based index of places to see, shop or eat, too poor to be of much use where I am, though it may be better in London or other big cities.

If Nokia can win significant market share through its new range, problems like these will solve themselves as more people will care about them, and more apps will be developed.

It does need early success though, and this will not be easy bearing in mind that the general public are not really discontented with what is already on offer from others.

Nokia seems to have the right marketing ideas though, and the prices look reasonable. Watch this space.

The frustration of developing for Facebook with C#

tim — Thu, 07 Jul 2011 09:42:04 +0000

I am researching a piece on developing for Facebook with Microsoft Azure, and of course the first thing I did was to try it out.

It is not easy. The first problem is that Facebook does not care about C#. There are four SDKs on offer: JavaScript, Apple iOS, Google Android, and PHP. This has led to a proliferation of experimental and third-party SDKs which are mostly not very good.

The next problem is that the Facebook API is constantly changing. If you try to wrap it neatly in an SDK, it is likely that some things will break when the next big change comes along.

This leads to the third problem, which is that Google may not be your friend. That helpful article or discussion on developing for Facebook might be out of date now.

Now, there are a couple of reasons why it should be getting better. Jim Zimmerman and Nathan Totten at Thuzi (Totten is now a technical evangelist at Microsoft) created a new C# Facebook SDK, needing it for their own apps and frustrated with what was on offer elsewhere. The Facebook C# SDK looks like it has some momentum.

C# 4.0 actually works well with Facebook, thanks to the dynamic keyword, which makes it easier to cope with Facebook’s changes and also lets it map closely to the official PHP SDK, as Totten explains.

Nevertheless, there are still a few problems. One is that documentation for the SDK is sketchy to say the least. There is currently no reference for it on the Codeplex site, and most of the comments are the kind that produces impressive-looking automatic documentation but actually tells you nothing of substance. Plucking one at random:

FacebookClient.GetAsync(System.Collections.Generic.IDictionary)

Summary:
Makes an asynchronous GET request to the Facebook server.

Parameters:
parameters: The parameters.

Another problem, inherent to dynamic typing, is that IntelliSense (auto-completion in Visual Studio) has limited value. You constantly need to reference the Facebook documentation.

Finally, the SDK has changed quite a bit in different versions and some of the samples reference old versions.

In particular, I found it a struggle getting OAuth authentication and access token retrieval working and ended up borrowing Totten’s sample code here which mostly works – though note that the code in the sample does not cope with the same users logging out and logging in again; I fixed this by changing his InMemoryUserStore to use a ConcurrentDictionary instead of a ConcurrentBag, though there are plenty of other ways you can store users.

I’m puzzled why Microsoft does not invest more in making this easier. Microsoft invested in Facebook and it is easy to get the impression that Microsoft and Facebook are in some sort of informal alliance versus Google. Windows Phone 7, for example, ties in closely with Facebook and is probably the best Facebook phone out there.

As it is, although I prefer coding in C# to PHP, I would say that choosing PHP as the platform for your Facebook app will present less friction.

Windows Phone “Mango” shown, looks good but still no Adobe Flash

tim — Tue, 24 May 2011 19:06:36 +0000

I attended the London press briefing for Windows Phone “Mango”, also known as Windows Phone 7.1. This will be on new phones in the Autumn, and will be a free update for all existing Windows Phone 7 devices.

Microsoft showed a bunch of new features, including Internet Explorer 9 – which, we were told, is built from the same code as the PC version – improved social media integration now including Twitter and LinkedIn as well as Facebook, Hotmail, Exchange, Messenger and Gmail; and multi-tasking support.

Hold down the back key for a moment, and all running apps appear in a tiled view. Just tap the one you want.

We also saw text-to-voice and voice-to-text demos. The presented spoke the reply to a text message, though admittedly he chose to do a one-word reply, and sent it successfully.

Microsoft also announced three new OEM partners, Acer Inc., Fujitsu Ltd. and ZTE Corp.

It looks good; but I did have a sense that Microsoft is ducking the hard questions. One of those concerns Adobe Flash support. At a separate developer briefing, I asked developer relations guy Brandon Watson about Adobe Flash support, observing that when Windows Phone was shown in detail pre-launch at the Mix 2009 conference in Las Vegas, it was clearly stated that Flash would be on the phone, and that Adobe was being allowed to build the Flash runtime in native code, but that it would not be included at launch.

“It does not run on the phone”, said Watson. Then he added, “It does not run on the phone.” Finally, he said, “It does not run on the phone.”

Silverlight does not run in the mobile browser either, so perhaps the problem is with mobile IE – clearly not all the code is included. Or maybe Adobe is hanging back; I asked Adobe about this at Mobile World Congress earlier this year and got an answer that was warmer but no more informative. Or maybe Microsoft is thinking, Apple does not need it, so we do not need it either.

It is a shame though, because there is a perception that Flash is one of the advantages of not going the Apple route.

On the developer side, the beta tools for Mango were released today. You can target either Windows Phone 7.0 or 7.1 with the tools, so if the beta tag does not put you off you can get going straight away. There is a ton of good stuff for developers, including the SQL Server CE local database, and the ability to mix XNA and Silverlight in a single app. We saw an app from British Airways that makes use of this to show a 3D view of an aircraft cabin when choosing a seat; I am not sure how much real value this adds but it demos nicely.

The new emulator includes accelerometer support, so you can simulate movement to test your app’s response.

There is also a profiler which shows your app’s performance in various views. Code that you wrote is highlighted in blue in the graphical view, so you can tell what you can optimise, as opposed to slow system calls that are outside your control.

The developer tools are great though, and having played with a number of mobile developer toolkits I would say that Microsoft’s is among the best and above average, though I would like to see an option for native code development. “We hear that a lot,” Watson told me.

The problem though: developers want a big market, and so far Windows Phone has not delivered it. It is almost invisible on the high street, and all the current operators and manufacturers have other phones that they are more concerned about. That will change when Nokia devices appear, but in an intensively competitive market (not forgetting HP WebOS and RIM Blackberry/QNX/PlayBook) it will not be easy for Microsoft to gain ground.

After the event I discussed this with some of the Microsoft folk. Maybe the company can better exploit the Xbox link, and sell the phone to that community. Maybe Nokia will save the day. Maybe when Microsoft comes out with a fully professional iteration of Windows Phone, tightly linked to Active Directory and group policy, and with additional developer features aimed at line of business apps, maybe then it will take off.

One positive thing I heard today was an anecdotal report that returns on Windows Phone 7 are among the lowest because users like the device so much.

The social features in Windows Phone are already good and will be better in Mango – though bear in mind that by the time Mango phones appear in the Autumn, Microsoft will likely have iPhone 5 and many tempting new Android devices to contend with.

Years ago it used to be said that Microsoft had average products (or worse) but excellent marketing. With Windows Phone, the product is good but either the marketing is lacking or the task is too great. Of course there is still time, and this industry is full of surprises, but it will take more than Mango to make Windows Phone fly.

Single sign-on from Active Directory to Windows Azure: big feature, still challenging

tim — Wed, 22 Dec 2010 09:11:10 +0000

Microsoft has posted a white paper setting out what you need to do in order to have users who are signed on to a local Windows domain seamlessly use an Azure-hosted application, without having to sign in again.

I think this is a huge feature. Maintaining a single user directory is more secure and more robust than efforts to synchronise a local directory with a cloud-hosted directory, and this is a point of friction when it comes to adopting services such as Google Apps or Salesforce.com. Single sign-on with federated directory services takes that away. As an application developer, you can write code that looks the same as it would for a locally deployed application, but host it on Azure.

There is also a usability issue. Users hate having to sign in multiple times, and hate it even more if they have to maintain separate username/password combinations for different applications (though we all do).

The white paper explains how to use Active Directory Federation Services (ADFS) and Windows Identity Foundation (WIF, part of the .NET Framework) to achieve both single sign-on and access to user data across local network and cloud.

The snag? It is a complex process. The white paper has a walk-through, though to complete it you also need this guide on setting up ADFS and WIF. There are numerous steps, some of which are not obvious. Did you know that “.NET 4.0 has new behavior that, by default, will cause an error condition on a page request that contains a WS-Federation authentication token”?

Of course dealing with complexity is part of the job of a developer or system administrator. Then again, complexity also means more to remember and more to troubleshoot, and less incentive to try it out.

One of the reasons I am enthusiastic about Windows Small Business Server Essentials (codename Aurora) is that it promises to do single sign-on to the cloud in a truly user-friendly manner. According to a briefing I had from SBS technical product manager Michael Leworthy, cloud application vendors will supply “cloud integration modules,” connectors that you install into your SBS to get instant single sign-on integration.

SBS Essentials does run ADFS under the covers, but you will not need a 35-page guide to get it working, or so we are promised. I admit, I have not been able to test this feature yet, and aside from Microsoft’s BPOS/Office 365 I do not know how many online applications will support it.

Still, this is the kind of thing that will get single sign-on with Active Directory widely adopted.

Consider FaceBook Connect. Register your app with Facebook; write a few lines of JavaScript and PHP; and you can achieve the same results: single sign-on and access to user account information. Facebook knows that to get wide adoption for its identity platform it has to be easy to implement.

On Microsoft’s platform, another option is to join your Azure instance to the local domain. This is a feature of Azure Connect, currently in beta.

Are you using ADFS, with Azure or another platform? I would be interested to hear how it is going.

Which mobile platforms will fail?

tim — Fri, 15 Oct 2010 08:54:01 +0000

Gartner’s Nick Jones addressed this question in a blog post yesterday. He refers to the “rule of three” which conjectures that no more than three large vendors can succeed in a mature market. If this applies in mobile, then we will see no more than three survivors, after failures and consolidation, from the following group plus any I’ve missed. I have shown platforms that have common ownership and are already slated to be replaced in strikeout format.

Apple iOS
Google Android
Samsung Bada
~~Maemo~~ MeeGo
~~RIM BlackBerry OS~~ BlackBerry Tablet OS (QNX)
HP/Palm WebOS
Symbian
~~Windows Mobile~~ Windows Phone 7 and successors

Jones says that success requires differentiation, critical mass, and a large handset manufacturer. I am not sure that the last two are really distinct. It is easy to fall into the tautology trap: to be successful a platform needs to be successful. Quite so; but what we are after is the magic ingredient(s) that make it so.

Drawing up a list like this is hard, since some operating systems are more distinct than others. Android, Bada, MeeGo and WebOS are all Linux-based; iOS is also a Unix-like OS. Windows Mobile and Windows Phone 7 are both based on Windows CE.

While it seems obvious that not all the above will prosper, I am not sure that the rule of three applies. I agree that it is unlikely that mobile app vendors will want to support and build 8 or more versions of each app in order to cover the whole market; but this problem does not apply to web apps, and cross-platform frameworks and runtimes can solve the problem to some extent – things like Adobe AIR for mobile, PhoneGap and Appcelerator. Further, there will probably always be mobile devices on which few if any apps are installed, where the user will not care about the OS or application store.

Still, pick your winners. Gartner is betting on iOS and Android, predicting decline for RIM and Symbian, and projecting a small 3.9% share for Microsoft by 2014.

I am sure there will be surprises. The question of mobile OS market share should not be seen in isolation, but as part of a bigger picture in which cloud+device dominates computing. Microsoft has an opportunity here, because in theory it can offer smooth migration to existing Microsoft-platform businesses, taking advantage of their investment – or lock-in – to Active Directory, Exchange, Office and .NET. In the cloud that makes Microsoft BPOS and Azure attractive, while a mobile device with great support for Exchange and SharePoint, for example, is attractive to businesses that already use these platforms.

The cloud will be a big influence at the consumer end too. There is talk of a Facebook phone which could disrupt the market; but I wonder if we will see the existing Facebook and Microsoft partnership strengthen once people realise that Windows Phone 7 has, from what I have seen, the best Facebook integration out there.

So there are two reasons why Gartner may have under-rated Microsoft’s prospects. Equally, you can argue that Microsoft is too late into this market, with Android perfectly positioned to occupy the same position with respect to Apple that worked so well for Microsoft on the desktop.

It is all too early to call. The best advice is to build in the cloud and plan for change when it comes to devices.

BBC iPlayer goes social

tim — Wed, 26 May 2010 16:07:51 +0000

I’m just back from the BBC’s press briefing on the new iPlayer. This is a public beta. The press release is here.

The big story is that social media features are now integrated. The idea is that you can post recommendations (or otherwise) to Twitter and Facebook about programmes you are viewing, or participate in real-time chat via Microsoft Live Messenger. The Messenger feature will be delivered later than the other features; a beta is promised “later this summer.”

I was interested to see these features delivered, as I spoke to the BBC’s Anthony Rose about them at Adobe MAX in 2008 and wrote it up for The Guardian. I talked to Rose again today and asked why Twitter, Facebook and Live Messenger had been favoured above other social media services?

There are only so many hours in the day, you’ve got to start somewhere. We picked the major ones. In the case of the chat, the technical requirements are actually really high, you need presence detection, there needs to be user to user chat, and it turns out that Facebook doesn’t have that kind of presence detection. So very few platforms have the technical bits that are necessary. But absolutely we’re looking to get the others on board, we know that people are going to want it. We had a choice of ship nothing, or try and dip the toes in the water

This is in line with a theme we heard a lot about today: that the BBC will go where the users are. Devices will be supported only if they succeed in attracting a large user base. We also heard that BBC Online is narrowing its focus, and will not needlessly duplicate what third parties already do. For example, the BBC has no intention of creating its own social network, even though over a million individuals have registered a BBC ID. Rather, it will link that identity to existing social networks, initially Twitter and Facebook. At least, that’s the current strategy. The BBC is a public broadcasting service financed by a licence fee, and its strategy is partly set from above; it has changed recently and will no doubt change again.

Still, iPlayer is a superb service and one reason I am personally happy to keep paying the fee.

Future of Web Apps cheers the independent Web

tim — Fri, 02 Oct 2009 07:07:39 +0000

The Future of Web Applications conference in London is always a thought-provoking event, thanks to its diversity, independence and character. That said, it is a frustrating creature at times. The frustration on day 1 was the barely functional wi-fi, which ruined a promising interactive application called HelloApp, built with ASP.NET MVC. HelloApp would have told us who we were sitting next to, what their interests were, their twitter ID and so on. Microsoft must be disappointed since the developers, some of them more used to technologies like PHP and Ruby, said how impressed they were with the framework and Visual Studio. The poor connectivity was a shame, and a bad slip-up for a web application conference. Even the speakers had to work mostly offline – cloud devotees beware.

FOWA has been at London Excel recently, but this event was back to its earlier venue of Kensington Town Hall, more crowded but a better atmosphere and easier to get to. I suspect a little downsizing, but much prefer it. Organizer Ryan Carson has his heart set on enabling start-ups, proffering business advice and uniting developers, designers and money folk, though many attendees are not in the start-up category at all. When revealing the results of a survey showing that many web app hopefuls had less then 1000 site visitors a month he shook his head despairingly “you’re never gonna build a business on that kind of traffic”.

Carson has excellent contacts and the day kicked off with Digg’s Kevin Rose on how to get those visitor numbers up – he should know if anyone does. Rose exceeded my expectations with tips on massaging your visitor egos, avoiding analysis paralysis, hanging round event parties to meet influencers even when you can’t afford to attend the event, and even how to hack the press.

After that the day was disappointingly low-key, at least until midday. Then we got Francisco Tolmasky from 280 North and it all changed. Tolmasky’s line is that we should use pure web technology but with the richness of desktop applications, and to enable this he’s put forward cappuccino, a JavaScript framework inspired by Apple’s Objective C and Cocoa – Cappuccino uses Objective-J. This now has a visual development tool (web-based of course) called Atlas, and in Tolmasky’s demo it looked superb. See here for more details.

The surprising twist is that after developers told Tolmasky that they (or their companies) were not willing to trust code to the web, 280 North came up with a desktop version of Atlas with the added ability to create desktop applications as well. I am not clear about all the runtime details, though it no doubt involves webkit, but Tolmasky’s differentiator versus alternatives like Java or Adobe AIR is that Atlas uses only web APIs.

We heard a lot at FOWA about social media, how to use it for marketing, and how to integrate it into applications. Cat Lee from Facebook gave us a breathless presentation on how simple it is to hook into Facebook Connect. It was OK but it was a sales pitch, and that never goes down well at FOWA.

The later afternoon sessions were excellent. Bruce Lawson of Opera gave us an entertaining overview of how HTML 5 would make life easier for developers. There was nothing new here, but nevertheless a revealing moment. He showed some rich media working in HTML 5 and made the comment, jabbing at Adobe Flash and Microsoft Silverlight, that the web was too important to place control in the hands of any one vendor. A loud and spontaneous cheer went up.

This was echoed later when Aza Raskin of Mozilla gave us a browser-centric view of social media, suggesting that the browser could broker our “social graph” by integrating with multiple identity providers. Raskin’s line: social media is too important to be in the hands of any one vendor.

The Guardian’s Chris Thorpe gave a bold presentation about how the Guardian wants to embed itself in the web through its open platform. Like most print media, the Guardian has many challenges around its future business model (disclaimer: I write for the Guardian from time to time); but Thorpe’s presentation shows that his newspaper is coming up with an intelligent response, promoting interaction and building out into the wider web rather than erecting paywalls. Having said that, maybe the Guardian will try other business models too; it is a journey into the unknown.

Overall a day for social media and the open web, and a good antidote to the more vendor-centric conferences at which I often find myself. Next week, for example, it is the Flash-centric Adobe MAX; and having heard very little about Flash at FOWA that will make an interesting contrast.

Technorati Tags: fowa,microsoft,adobe,mozilla,opera,cappucino,280 North,Facebook Connect,guardian,html 5

O2 router attack shows danger of staying logged in

tim — Wed, 09 Sep 2009 07:46:55 +0000

Concerned about web security? One thing that may prove more valuable than any amount of supposed security software (anti-virus and the like) is the simple good practice of logging out of web sites at the end of each session.

Here’s the reason. Let’s say you are logged into some site – could be Facebook, or Google, or the admin screen on your router, and you’ve left checked the option that says “keep me logged in”. Then you visit some other site. The vast majority of web pages today run JavaScript code in the background, and these scripts execute on your computer, not on the web server. What if one of those scripts sends a request to a site where you are logged in? The request comes from your computer, so it looks like you to the web site. If you are unlucky, the script will be able to perform any action you could perform, but without your awareness – such as changing your password, or reading confidential information.

For this hack to work, a couple of things need to have gone wrong:

1. You are running a malicious script. This implies that the site you are visiting has been hacked, or has a vulnerability such as forum software which allows users to post content that might trigger a script. Even a link to an image in a forum post might be sufficient.

2. The site where you are logged in doesn’t make any additional checks on the source of the script. Although it is running on your computer, the HTTP request generally includes referrer data, revealing the URL of the page from which the script came. By checking this value, the site can figure out that there is something wrong. Another idea is to have unpredictable URLs for sensitive data.

Still, you’ll notice that neither of these things are under your control, whereas generally the option to log out of a site is under your control. Even that might not always be true – a developer could code a site without an option to log out – but that is unusual.

The O2 attack referenced above exploits this flaw to get into your router admin, if you are running an O2-supplied broadband router. It is a huge vulnerability, since if the router is re-configured a wide range of further attacks are possible. One example is DNS poisoning, where familiar URLs might take you to malicious destinations. It could also disable firewall protection and redirect external requests to one of your home or small business PCs – very nasty.

Here’s a couple of things that will improve security:

1. Don’t use the broadband supplier’s equipment, if it is not entirely under your control. Use your own; turn off universal pnp, change the admin password, don’t stay logged into the admin.

2. Don’t stay logged into any site which matters. Even sites which don’t appear to matter can be a security risk, if they expose passwords or security questions that you use elsewhere, for example. Personally I always log out of Facebook, Google and Twitter, for example, even though sites like these should be aware of the risks and be coded appropriately – they mostly are, but mistakes happen.

Unfortunately many sites encourage you to stay logged in, because it reduces the friction of using the site. Still, there are compromises which work. I notice with Amazon for example, that it uses cookies to give you personalized information even when not logged in, but displays password prompts with boring regularity for actions that spend money – though Amazon also advises you to log out completely if using a public or shared computer.

Technorati Tags: security,google,facebook,o2,twitter,xss

Flash library for Facebook, Silverlight library for MySpace

tim — Tue, 31 Mar 2009 07:04:31 +0000

Adobe and Facebook have announced that ActionScript 3, the language of Flash 9 and higher, is now officially supported by FaceBook along with JavaScript and PHP. Information about coding for Facebook with Flash is here, and the library itself is on Google Code.

MySpace has announced the MySpace Silverlight SDK which will be hosted on Microsoft’s CodePlex open source site. The focus of the Microsoft Silverlight work seems to be on wrapping the Open Social API used by MySpace in a C# library.

Note that there is already documentation on creating Flash applications for MySpace. On the Facebook side, here’s an intriguing fact: there’s also an Fb:silverlight tag, though the documentation remarks: “For now this feature has no functionality.” Fb:swf is better supported. David Justice has been working on a Facebook library for Silverlight. It’s clear though that Flash is more widely accepted and supported on both platforms, reflecting its maturity and broader acceptance.

Smart developers can already devise code to access the public APIs of platforms like Facebook and MySpace from a variety of clients; this is about making that easier. It benefits the social networking sites if a wider group of developers has access to its platform, and with the advantages of multimedia features; equally it benefits the plug-in vendors if their runtime works smoothly with the broadest possible range of services. Therefore we should expect more of this type of announcement.

It is interesting to see technology partnerships bridging political divides. Microsoft has a stake in Facebook, for example, while Google has a partnership with MySpace.

Perhaps the most interesting outcome may be more Facebook applications based on AIR, Adobe’s Flash platform for the desktop. The existence of AIR applications like Twhirl and Tweetdeck has significantly boosted Twitter; maybe it is now Facebook’s turn.

Technorati Tags: flash,myspace,silverlight,facebook,microsoft,adobe