Bear454 took the material he gathered for his presentation and  posted two videos detailing browser-based development in both systems. In less than 20 minutes Bear454 shows you how to build an application on both platforms. Check out both videos and let him know what you think. We already think Bear454 is pretty darn cool.

-Brad

What got fixed:

Bug# 7889 Redux: We added the ability to specify an authentication type up front. Previously we were always using “probe” mode which would send the request without any authentication, expect the server to reject the request with a 401 and specify the types of authentication it supported.  Now you can specify your authentication type up front, avoiding the extra round-trip to discover the authentication types supported by the server you are hitting.  It also makes it possible to speed up each request by a few hundred milliseconds, since we can now avoid the probing round-trip.

The second bug we fixed is around DWA (Delegated Web Authentication). As part of our DWA package, we supply the getStandardCallbackUrl() method that returns the URL needed to merge a session back into the existing session. An application uses this URL to pass to the authentication service. The authentication service then redirects the user to that URL after the authentication request has completed. The bug with the getStandardCallbackUrl()  method was that it always returned a URL prefixed with “https://webauth.bungeeconnect.com/” which only worked during simulation. We fixed the method to return a URL prefixed with the same prefix as the current session. This solved the problem for applications that needed to use the getStandardCallbackUrl() method in production, which is only an issue for developers of new DWA drivers.

Thanks to all our community of Bungee Connect developers.  As always, if there are questions about this update or about Bungee Connect in general, don’t hesitate to ask them either as a comment on this blog post or ask them in our getsatisfaction.com channel.

David Brooksby
Director, Product Management & Development
http://www.bungeelabs.com
daveb at bungeelabs dot com

Brad

Happy Holiday season to all!  I hope the winter is treating all of our Bungee Developers well.  Except of course, if you’re sitting in the northeast and are still without power.  In which case, how on earth are you reading this post!?

It’s time to update our users on a recent system update, as well as notify you of some planned down time for an upcoming system change.

November Update:

On November 24th we rolled out a small system update to address a couple of issues.:
4563:  eBay wsdl now imports properly
7893: HTTP is no longer stripping authentication from URLs
7889: HTTP PUTs are now authenticating correctly

Like I said, it was a small update, but the changes were needed.

Planned Down-time – Need to Log Off Dec. 22nd

We’ll be making an infrastructure update that will affect DNS resolution for the Bungee Builder starting at around 10PM PST Wed. December 22nd (that’s 1 AM EST Dec 23rd).  We don’t expect the outage to be for very long, but considering that the change is primarily related to DNS it may be longer than planned—that type of change occasionally has unpredictable results around the world.  As a precaution, we’d like to ask that all Bungee Developers log out of the system before that time so that the update can take place without any risk of a loss of your work.  It’s been several months since we’ve needed to do this kind of update, so we appreciate your patience.  If you have questions about the change or timing, please contact me directly with a comment to this post.

How will the DNS changes affect your applications?

There are a small number of users who will need to make their own infrastructure changes  as a result of this change.  Please pay special attention if you have whitelisted (either on your own firewall or through an ISP) the Bungee Connect Data Center IP address so that your application can connect to your own DB or REST/SOAP/SMTP service.  The IP address you whitelisted will no longer work and you’ll need to whitelist a new address.  The new address to whitelist is 174.129.251.38.
We’ll be updating our documentation accordingly.  Additionally, we’ll be contacting several developers personally to let them know that they need to update their infrastructure in order to continue functioning beyond the 22nd.  If you have questions about updating your whitelist, please contact me directly with a comment to this post, or post a topic in our GetSatisfaction.com portal.

As always we appreciate all the effort, patience, and feedback from our beta developers.

David Brooksby
Director, Product Management/Development
Bungee Labs
daveb at bungeelabs dot com 

As a web-based development platform provider, we chose to host our documentation. Originally we chose MediaWiki; it being the de facto wiki platform. You might ask, why take the time and effort to move to a different wiki? And why Deki? We were attracted to Deki for its complete, RESTful API. In fact, the Deki PHP application only talks to the Deki API. 

As we investigated Deki further, we found that Deki has some significant improvements over MediaWiki:

I used the How To guide from MindTouch and our migration went smooth and easy.

Also check out the interview with MindTouch CTO Steve Bjorg about Deki on our web API podcast, the Bungee Line, from June 2008.

Amy Ballard
Community Program Manager
Bungee Labs

Have you ever debugged a crash where a null pointer was being dereferenced and when you tracked down the individual responsible their defense was that checking for null would slow down the system?  Have you ever found someone that wrote their own atoi function because they swore that the standard c runtime’s implementation was bad?

If you read my previous post you’ll know that I’ve been playing with the V8 JavaScript engine by Google.  I’ve enjoyed learning a new system and gleaning tricks from other programmers that you don’t get from reading a book or taking a class. But something has been gnawing on my mind for the last little while and that is how fast or slow is the bridge between the v8 engine and a c++ application that embeds it.  I wondered whether or not a developer should be worried about the performance of this bridge or if they should forget about performance for now and just start turning the crank on features. So I wrote a little performance test to see how long different areas of the V8 integration into an application take. By the way, the Google engineers that wrote this system are very solid in terms of coding standards, efficiency and readability.

These benchmarks aren’t the most scientific in nature but they do give me something to start kicking around.  Here’s the JavaScript test that I wrote and embedded into my test:

var count = 0;

function timed_dispatch() {
count += 1;
}

start = new Date();

// Test 1
for (i = 0; i < 1000000; i++) {
count += 1;
}

// get the time and print the results
end = new Date();
print(end - start);

// reset the counter and the start timer
count = 0;
start = new Date();

// Test 2
for (i = 0; i < 1000000; i++) {
timed_dispatch();
}

end = new Date();
print(end - start);

// Setup for Test 3
timed_obj = new TimedCPPDispatch();
start = new Date();

// Test 3
for (i = 0; i < 1000000; i++) {
timed_obj.empty();
}

end = new Date();
print(end - start);");

The first for loop measures how long it takes V8 to do some simple arithmetic on a variable.  I started with 10,000 iterations but the numbers were too small so I bumped it up to 1,000,000.  The output of the first print statement was 16ms.  Pretty quick.

The second for loop looks at how long it takes to do a method dispatch that increments the same number.  Adding the overhead of the function call took the time up 4ms for a grande total of 20ms.

The last for loop uses a C++ class that I created that has a function called empty.  This function literally does nothing except for return.  What I’m looking for is how long the act of dispatching a method from the javascript to the c++ application takes.  It took a total of 1500ms or 1.5 seconds to call 1,000,000 times.

Obviously, if you can avoid crossing the boundaries between your application and the V8 engine you will be saving some overhead.  Two orders of magnitude difference is nothing to sneeze at.  However, 1.5 us (microseconds) per function call is not bad for an embedded vm.  And, I don’t expect anybody to be doing a million of those. On top of that, once you cross the boundary you’re still running in c++ code, which isn’t too shabby with performance either.  If you have some complicated c++ algorithm that you are calling then a 1.5 us boundary becomes noise and is not an issue.  So, the old adage of not optimizing too soon would appear to still hold a lot of water in this argument and I should hold off on looking to outsmart myself before that’s really necessary.  I should probably be looking to add features to my application rather than trying to figure out a priori where my code might be slowing down.

If you’re interested in checking out V8’s performance numbers for running straight JavaScript head on over to http://code.google.com/apis/v8/run.html or download the V8 engine and run them on your machine.

Brad

The October system update for Bungee Connect went live on October 21.

For a more thorough list of this release’s new features, enhancements and bug fixes, review the Preview Announcement from September 26.

A few of the new features are worthy of a quick how-to video, so read on.

No More Pages in AppProjects
We simplified the AppProject container by eliminating the need for Pages. Any AppProjects that existed prior to the update will still have whatever pages they had before, but be sure to update your AppProjects before trying to update any existing deployed applications.

Here’s a short video to explain more.

“Publish” Tab Replaces “Staging” Tab
The new Publish tab makes it easier to manage your posts, deployments, and shares, especially when you have multiple solutions in various DesignGroups.

Here’s a short video to show you how.

Custom FavIcon Support
The much-requested support for specifying a FavIcons has finally arrived. Now when users bookmark your Bungee-powered application, they’ll see the icon of your choice.

Here’s a brief video to show how to implement a FavIcon.

Again, there is a whole lot more in this release, so check out the Preview Announcement from September 26.

Ted Haeger
Director, Bungee Connect Developer Network

Since sending the email, there has been one modification to the original newsletter’s information. The new release of Bungee Connect will happen on Monday, October 13, not today. (I forgot about a cardinal rule of new releases, as set by BCDN members: never do a system update on a Friday. My bad!)

Hey, everyone:

It’s been a while since the last Bungee Connect Developer Network update, and we have been cooking up some great stuff for you. Let’s get to it.

Master Bungee Connect: The Learn Tab

The Learn tab provides you with the essential Programmer’s Guide material to Bungee Connect. Through hands-on activities, code examples, and short videos that quickly cover key concepts, this is your fast track to master the fundamentals of Bungee Connect. Reaction to it has been very positive.

“I’ve been through Units 1 & 2 of the new [Learn tab]. I found them very helpful. In fact, I think it’s the best example of on-line self-training that I’ve come across.” — Jan Varga, Amethon Solutions (Australia)

Now that it’s up and online, I challenge you to conquer it. As of today, any developer who passes all three Unit quizzes in the Learn tab will receive the BCDN Welcome Aboard Kit, which includes a Bungee Connect shirt. (You’ll be prompted for shipping information after passing the third quiz.)

Get going by logging onto Bungee Connect. The new Learn tab will be there waiting for you:

• Bookmark: https://builder.bungeeconnect.com?bl_username={your user name}
  

Bungee Connect Supports Google Chrome

Since our last update, Google announced their new browser, Google Chrome. Bungee Connect has aggressively supported the big three standard browsers (Firefox, Safari and Internet Explorer), and we typically keep other browsers at arm’s length. However, when Google talks, a lot of web geeks listen, and we knew that Chrome would soon be in high demand. That’s why Chrome has joined our list of officially supported browsers.

Try Bungee SQL Admin

Got a PostgreS or MySQL database? Need to set up tables or modify stored data? Bungee SQL Admin is a rich Internet application that lets anybody to rapidly manage MySQL & PostgreSQL database systems. The app was build on Bungee Connect, but you do not need a Bungee Connect account to use it.

Beside being a handy utility on its own, Bungee SQL Admin has been added to the list of Example Code available to BCDN developers, providing you with source code from which you can learn or freely create derivative works. (Look for it in the “Applications” section.)

Try out Bungee SQL Admin.

The Next Platform Update? (Coming on October 10 13)

We opened the latest BCDN Preview on September 26, allowing BCDN Developers early access to the latest features and updates. It comes a huge list of fixes, as our intrepid product manager Dave Brooksby explained in the BCDN Preview announcement.

On Friday Monday, October 10 13, we plan to update Bungee Connect (the current production platform) to the version currently used on the BCDN Preview. Until then, you can try out the new version at http://preview.bungeeconnect.com.

Changes for the BCDN Forums

The BCDN Forums are moving to Get Satisfaction. While at the O’Reilly Open Source Conference (OSCON) last summer, I did a lot of research (okay, mostly talking with geek friends) about web-based forums options. After a lot of testing, I was quite smitten with Get Satisfaction for how easy it is to use, how quickly it produces answers to commonly asked questions, and how it’s not a forums platform.

Over the next couple weeks, the community team will be integrating Bungee Connect and Get Satisfaction. Our first step is to get automatic account provisioning and single sign-on worked out. After that, we’ll bring the old forums content into the new system.

Feed Your Brain with Web-head Audio Interviews

Have you listened to our web development podcast, The Bungee Line?

• In the most recent edition, we chat with Scott Kveton of The Open Web Foundation.
• Another you may find very interesting is with Steve Bjorg discussing Deki, MindTouch’s programmable wiki. (In fact, we like Deki so much that Bungee Connect documentation will be migrating onto Deki during the month of October.)

That’s All For Now

As usual, there’s a lot more news than we can put into a short newsletter. Keep watching the BCDN Blog for ongoing updates. Lastly, you can always reply directly to this email if you have any questions.

—Ted

Ted Haeger
Director, Bungee Connect Developer Network
Bungee Labs

Getting your head wrapped around the V8 API takes some time. There is a very brief overview page that you can read to get started writing V8 applications, but you will have to spend quite a bit of time scouring the source code to figure out how to do anything of note. Most of the documentation focuses on how your js files can call into C++. For our purposes, I also needed to call into JavaScript from C++ and get information back from the V8 engine. Here is some code that does that.

Let’s say you have some JavaScript file that defines a function foo (you can’t have a coding exercise without a foo) that looks like the following:

function foo() {
return 42;
}


If you’ve embedded V8 into your C++ application you could call foo by doing the following:

void myClass::myFunction()
{
HandleScope scope;
LocalContext context;

Script::Compile(String::New("function foo() { return 42; }"))->Run();

Local fun = Local::Cast(context->Global()->Get(String::New("foo")));

int argc = 0;
Handle argv[] = NULL;

Handle result = fun->Call(fun, argc, argv); // argc and argv are your standard arguments to a function
...
}


What this does is it sends the JavaScript that I wrote to the V8 engine via the Compile and Run functions. Now, I need access to the foo function and I do that by getting the Function from the Global namespace. If my function took any parameters I could fill out the argv array and then the function would have access to those values just like any normal JavaScript function would. When I make the Call function I give it an object to be the receiver, itself in this case, and I pass the argument length and array. The value that is returned from the function is stored in the result variable.

So, that wasn’t too bad. It all makes sense once you see it. The hard part always is trying to figure that stuff out when you don’t know where to look.

Another thing I had to figure out was how to make a function call on an object instance. This is a bit more difficult but it’s really just a variation on a theme. Let’s say our JavaScript looks like this:

function bar() {
this.x = 42;

this.foo = function() {
return x;
}
}

I need to get a handle to the function constructor first so I do that here:

Handle fun = Handle::Cast(env->Global()->Get(String::New("bar")));

Now I can create an instance of this function with:

Handle<Object> object = fun->NewInstance(argc, argv);

Again argc and argv are your arguments to your function which in this case is bar. If bar took more parameters you would pass those in so that bar would be setup correctly.

Once I have an object I can ask it for it’s function that I want to call:

Handle fun_to_call = Handle::Cast(object->Get(String::New("foo")));

And finally I can call that function:

fun_to_call->Call(object, argc, argv);

Since I am using the same API function Call, I can expect a return value just like in the first example.

I’ve found V8 to be an excellent JavaScript engine, and it has a fantastic API. I’ll be using it for some of my internal projects and I’ll keep posting cool ideas as I run across them.

Corey Olsen
Senior Platform Engineer
Bungee Labs

Said one BCDN Developer (who goes by the handle “olympyx”):

I think the combination of text overview, video, and use of the platform is a great way to learn the platform.

I first announced the Learn tab this past summer, thinking that the final piece, Unit 3, would be online by the end of July. We managed to get the first three modules online in short order, but the final two bedeviled me for some time. Nevertheless, I hereby declare the wait to be over.

You can now log on to Bungee Connect and complete the Core Curriculum and get your status ticker to look like this:

When you do, there’s a special surprise for you at the end–a little somethin’-somethin’ to recognize your achievement. But, you’ll have to finish the final Quiz to find out what it is.

–Ted

Ted Haeger
Director, Bungee Connect Developer Network
Bungee Labs

The next version of Bungee Connect is now available in preview to BCDN developers. As usual, the BCDN Preview will be online for two weeks before it rolls to production. Access it at https://preview.bungeeconnect.com.

The Preview once again has a recent snapshot of your solutions, but remember: the Preview release is for testing purposes. Any changes you make to your code will not be carried to production when the roll-up happens.

Of course, if you run into any issues, please leave a comment right here to let us know about them.

New Features:

• Publish tab: The Publish tab (formerly named “Deploy (beta)”) has now officially replaced the Staging tab. Use it to post, share or deploy your code and applications. You can still use the old Staging tab by enabling it in Builder Tab Preferences.
• Revision Status: If you collaborate with other developers, or maybe don’t always remember what classes you made changes to, you can now view the complete status of an entire solution by right-clicking it in the Solution Explorer and choosing ‘Revision Status.’
  
  

• Number Reformatting for Strings: The new FormatUtil class in Runtime (in TypeLib: Utility) enables you to do several format transformations on strings.
  
• AppProject Template and Deployment Requirements Changed: For those of you who have been using Bungee Connect for a while and have already deployed several applications, there’s a significant change to AppProjects that affects how you deploy applications. There will be more information in the docs when the release rolls to production. If you’re curious about the details of the changes, leave us a comment here, or find us in IRC.

Fixes and Code Changes:

As always, this release fixes many issues that the BCDN community have reported:

• 0007374: [Other] Dependencies are now copied with dependent projects when posting/deploying
• 0006019: [Controls / Interactions] Popups now more properly position relative to the current position of the parent window
• 0003372: [Controls / Interactions] You can now change Icon for the Google Map in its adapter
• 0007155: [Share] Shares and Posts can now be edited by the person who created them or the Design Group owner
• 0004790: [Controls / Interactions] Constructor interface for adding elements to a Collection now uses the proper element type for the collection
• 0007075: [Form Layout] re-sizing a grid no longer collapses other grid cells in specific cases
• 0007099: [Form Layout] box (horizontal) in vertical flow does now allows you view the bottom
• 0007074: [Form Layout] Grid no longer unintentionally re-sizing cells in a vertical flow
• 0007690: [Form Layout] IE7: letting go of the grid resize tick no longer removes a pixel from the height or width
• 0007680: [Controls / Interactions] Date/Time combo box drop-down arrow now works when setting as data in specific cases
• 0007572: [Form Layout] using the text “<select one>” in an enumeration is now cleaned and no longer breaks in the UI
• 0007243: [Controls / Interactions] Google Map now has a selection manager for pin elements
• 0007250: [Controls / Interactions] Google Map now has support for GLatLngBounds
• 0007268: [Controls / Interactions] Google Map more gracefully handles it when google fails to geocode an address
• 0007361: [Controls / Interactions] Wizard now instantiates GoogleMapDirectionsAdapter in correct location
• 0004614: [Other] You can now set a double to a value containing a decimal point using a site Data
• 0006076: [Controls / Interactions] HTML now has general mimetype out capability (Bear454, this one’s for you!)
• 0006723: [Other] SMPTClient now requires an SMPT server source in order to function
• 0005800: [Other] Key word “now” is ‘now’ working in an expression
• 0007381: [Solution Explorer] Deleting a project that contains multiple tiers of nested projects no longer only deletes immediate children
• 0007379: [Solution Explorer] After Importing a ResourceProject, nested project containers now check-in correctly
• 0007190: [SOAP/WSDL] WSDL import now handling “choice” correctly
• 0005715: [Other] You can now customize the <head> tags
• 0007091: [Code Editor] convertStrToNumber parameters for “fl” and “do” now work more predictably
• 0007420: [Code Editor] Separator bar no longer switches from Vertical to Horizontal if you merge any cell in a grid
• 0007412: [Code Editor] The Separator bar does now properly goes away when deleting the column that contains it.
• 0006969: [Code Editor] Outline of a StyleButton no longer appears separate from the button when a Horizontal Box in design mode
• 0007229: [Code Editor] Vertical box is no longer sized to a height of 0px when inside another vertical box
• 0007424: [Code Editor] More than one line is no longer improperly highlighted in the Code Editor
• 0007404: [Controls / Interactions] Radio button now honors the Multiline property
• 0007143: [Properties] “DateTime” property editor tab for MonthCalendar control is no longer missing
• 0005210: [Form Layout] Clicking on a Label that contains a link on a form no longer causes an exception
• 0007706: [Controls / Interactions] CollectionStatementComplete no longer chooses second item in filter list when list contains multiple items
• 0007708: [Controls / Interactions] CollectionStatementComplete no longer throws a JavaScript error if you resize the browser
• 0005949: [Properties] Stylesheet clear button now enabled when using a control style
• 0007528: [Controls / Interactions] DateTime Format in an MCL now works if the Edit Type is set to WriteOnly
• 0007408: [Controls / Interactions] Under certain circumstances, items added to CollectionStatementComplete never show up on the server
• 0007429: [Controls / Interactions] MonthCalendarList no longer crashes when setting number of columns
• 0007538: [Meta Runtime] You can now set a function trigger to a bag
• 0007593: [SOAP/WSDL] SOAP no longer replacing hostname with IP Address
• 0007647: [Properties] Setting Multiple Select to true after removing the Multiple Select Function Interfaces no longer causes a crash
• 0007697: [Other] PostRenderInit is now getting called during Debug
• 0005634: [Other] SQLConnection now returns the standard numRowsAffected() function to know how the query affected the database
• 0007316: [Controls / Interactions] Cross window drag and drop is fixed on Safari
• 0007183: [Controls / Interactions] “Default” behavior now works inside Horizontal Flow
• 0007080: [Code Editor] triggered function args no longer discarded before saving
• 0007640: [Controls / Interactions] Flying over a google pin no longer causes map to pan and balloon to popup it’s been told not to
• 0007466: [Controls / Interactions] Calling select() on a collection that is bound to a Google Map fixed
• 0007631: [Controls / Interactions] The system no longer crashes when using a google map without setting the pin icon
• 0007172: [Controls / Interactions] Leaving the icon in an MCL column to the default of “not_set” no longer breaks simulation
• 0007330: [Controls / Interactions] [Regression] Changing the position of points on a GoogleMap behaves more predictably
• 0007409: [Controls / Interactions] Radio buttons now work when Control Placement is set to Below Label
• 0007073: [Form Layout] Hyperlinked controls in form layout when clicked, no longer take over the design pane
• 0007341: [C++] datetime computations now working as documented taking seconds more accurately into account
• 0007421: [Code Editor] Debugger will now break if you have a breakpoint set to the last statement in a function

• No install
• No registration
• No cost

Click here to launch.

The Story Behind this Application

In August, Bungee Labs held our first ever “SkunkDay” event. SkunkDay provides Bungee Labs employees an opportunity to show off applications and utilities on which they have been secretly tinkering unbeknownst to their colleagues.

One of the winners was Herrick Muhlstein with his application, now known as “Bungee SQL Admin.” Rather than write all the details, Herrick tells us about his app in this video:

Herrick has made the complete source code for this application available through the Share in Bungee Connect. Register for a free account to get access.

If you have any questions about Bungee SQL Admin, please submit a comment for this post.

Stay tuned for more about the cool applications shown at Bungee Labs SkunkDay…

The Amazon Web Services crew are back on the road with their AWS Startup Tour, and Brad Hintze and I will be joining them tomorrow in Salt Lake City.

I’ll make a brief presentation around 3:30-ish, speaking about Bungee Connect and how Bungee Labs use Amazon Web Services. So if you’re in the area, please swing by to give Brad and me a hello.

Shortly after Google released the Chrome beta, our test team went to work to identify exactly what worked and what didn’t. They found that Google Chrome loaded and ran Bungee-powered applications with only a few issues, which we detail below.

Security, Bungee Connect and Google Chrome

Beyond the benefits Google Chrome brings to JavaScript performance, the team here also sees a big benefit in the area of security.

Google Chrome’s security approach fits well with Bungee Connect’s security architecture. Bungee Connect keeps all application data and logic out of browser, other than that which is currently being displayed to the user. This greatly reduces the surface area for potential attacks. Chrome complements this approach by “sandboxing” each browser tab as its own stand-alone process, preventing cross-tab attacks. The two approaches combine to dramatically reduce the risk of using JavaScript for web applications compared to other interactive web models.

More on the Bungee Connect security can be found in the FAQ.

Google Chrome’s JavaScript Issues for Bungee Connect

The issues that we have identified for Bungee-powered applications running in Google Chrome are as follows:

• Focus Issues (Some Controls Require Extra Click)
  There will be on-screen elements that you must click once in order to set focus to that item. Although you may see button ‘flyover’ effects happen. Typically, this happens when you move between different regions of the application window. We have yet to find a case in which this blocks an application’s intended functionality, but we definitely confirm that the issue is a nuisance that needs to be fixed.
• Drag & Drop Issues
  Drag/drop is not 100% predictable right now. Sometimes it works perfectly, but occasionally a ‘move’ action happens where the program is set to ‘copy.’ Sometimes, you can’t even initiate a drag operation (although this is sometimes just a focus issue, as described above). So far, this particular issue is perhaps the most serious we have seen.
• Modal Dialogs Sometimes Non-Modal
  Occasionally, a dialog pop-up may allow an end user to interact with the main application when it is not supposed to. Certainly this is better than having non-modal dialogs get forced to be modal, but it still can result in multiple problem scenarios, such as a key dialog getting lost behind a main application window, or critical workflow data not getting entered when it is needed.
• Default Action Broken on StyleButtons
  Lastly, we found a minor annoyance with how Google Chrome handles our StyleButton control. If a StyleButton has been flagged as “Default” (meaning it’s the default action for the Enter key), it doesn’t matter…you either have to click it with the mouse or tab over to it.

The Bungee Connect IDE is a Bungee-powered application, so it experiences the above issues. However, there is one issue that particularly affects developers using Bungee Connect with Google Chrome:

• Cannot Drag Controls onto Forms
  The previously-mentioned issues with drag & drop affect form construction consistently: you can’t add controls to a form in Google Chrome. (Although you can add Bungee Logic statements to a function. But you can’t re-arrange them. Go figure.) This is pretty much a showstopper for using the IDE with Chrome.

We intend to fully support the use of Bungee Connect’s IDE from Chrome before year-end.

• First, in “Chrome’s JavaScript poses challenge to Silverlight,” Microsoft apparently cites that JavaScript–not Flash–will be the biggest competitive threat to Silverlight.
• Second, in “New Firefox JavaScript engine is faster than Chrome’s V8,” Mozilla has responded to Google Chrome’s JavaScript speed claims by raising the bar still further.

If indeed Microsoft sees JavaScript as Silverlight’s biggest competitive threat, and Mozilla and Google are apparently squaring off for an arms race around JavaScript performance, this bodes extremely well for the future of web applications built on standards-based JavaScript.

Is it just me, or does Google Chrome look like it was designed for Bungee-powered applications?

(click image to embiggen)

Just to be clear, there are definitely some issues with some of the controls and interactions. One of our community developers reported that drag and drop is not working correctly, and we have found that some of the Bungee controls have to be clicked once to activate before you can interact with them. Still, we’re excited about how close to the mark Google has hit with Javascript support.

Dave sent me screenshots for a couple other Bungee-powered apps. So, stay tuned…

Google chose to use WebKit, the same rendering engine as Safari, which we support for Bungee Connect. So far, so good:

(click either image to embiggen)

But they also state that they chose to create a wholly new Javascript engine. Hrmmm…

In our early tests, we have found that there are at least a few controls that exhibit issues. Mostly, issues seem to be little interaction annoyances, such as having to click on a Tree control a second time before you can interact with it.

So, we make no formal announcement of support for Chrome yet (Come on! Chrome was just introduced and is still in beta!), but the Bungee Boys are smiling.

Recently I wrote about why rich interactivity matters but what are the concerns around it? Ajax has made new kinds of web applications possible by bringing interactivity usually seen only on the desktop to a web browser. Google Maps and countless other web applications have begun adding interactivity throughout the application.

It isn’t easy though. Many times interactivity is cobbled into existing applications with a mish-mash of code–creating a Frankenstein of multiple technologies and line-after-line of code. This approach is difficult to maintain and can open several security threats to the user, server and data.

When using javascript, two big security vulnerabilities include:

• Cross-site scripting (XSS) is a problem where code from another, potentially malicious, site is executed as if it were from a trusted site. This type of attack can result in identity theft and unauthorized access to data and subsystems.
• Injection vulnerabilities exist when an attacker can inject their own inputs into the web application and spoof certain commands to gain access to a file system or data set.

These are very important concerns for a business to consider as they begin adding interactivity to their site. Managing these risks requires a significant investment in time and resources throughout the life of an application.

Are these risks, and the cost of managing them, just the price of adding interactivity? At Bungee we don’t believe it is.

Bungee Connect takes a strong stance on security through a unique approach to these issues:

• Cross-site scripting is eliminated by moving the access to other domains and sites to the server, and never the client. In this way all requests and responses are parsed by the server then sent down to the client. If an issue is encountered the malicious code is not executed or passed through to the client.
• Injection vulnerabilities are reduced by removing all code from the client and leaving it on the server. In this way users (potential hackers) cannot see how the business logic is executed or what sub-systems or databases are accessed. By keeping this information away from the client it is impossible for the hacker to see which inputs are required for a specific function and replicate its request by sending malicious data. Instead of using specific client-side code, a genericized javascript engine is used to communicate between the client and server. This generic javascript engine uses unique identifiers to identify objects and functions. For additional security, these unique identifiers change with each session. In this way the Bungee Connect javascript engine acts like a security sandbox for any Bungee-powered application.
• The javascript payload is a single payload, it never changes as an application incrementally changes. The benefit here is that a security team can validate this package once and feel confident that any changes in the future will not open any vulnerabilities. Thus significantly reducing the amount of work required in delivering an application.

Users are requiring more interactivity, but that doesn’t mean you need to sacrifice security or increase your cost of delivering an application. By employing a generalized javascript engine through Bungee Connect you can securely and quickly add the interactivity you need with less development time and strong security.