MSDev

Beef Up Your Hardware If You're Upgrading To Windows Server 2008 R2

Wed, 16 Jun 2010 16:38:29 -0500

Originally published on eWeek.com. See the original article in its entirety here.

The two most important new features for Windows Server 2008 R2, Dynamic Memory and RemoteFX, focus on enhancing both the back-end performance and end-user experience of virtualization workloads. Those running Remote Desktop Services servers or Microsoft's VDI services could immediately benefit from those features (particularly the former), while those running 2008 R2 for other roles will only get rolled-up hotfixes and some incremental improvements.

Dynamic Memory is a Hyper-V enhancement allowing the administrator to set a memory range on a virtual machine to improve VM density, allowing customers to squeeze the maximum performance out of host memory without paging to disk. Administrators define the low and high thresholds of memory for a VM, and the host and VM work together to assign memory to clients dynamically as needed for the client workload. So a VM with a base of 1GB of memory may only need that amount for basic operation, but will request more from the host when it starts a memory-intensive operation (opening a big Excel spreadsheet, perhaps.) Although the host pool of memory is shared between VMs, Microsoft claims it is done in a secure manner that does not provide the chance to perform memory reads across VMs.

Beef Up Your Hardware If You're Upgrading To Windows Server 2008 R2

Wed, 16 Jun 2010 16:31:31 -0500

Originally published on eWeek.com. See the original article in its entirety here.

Image via CrunchBase

Image via Wikipedia

Administrators can also configure a memory buffer on a per-VM basis, configuring Hyper-V to hold back a percentage of memory and not let it be used in other instances. Administrators can also set memory priority per VM, giving an order of precedence for those occasions when the virtual clients' needs exceed available system resources.

Although Dynamic Memory could have benefits for virtual instances of either Windows client or server, Microsoft representatives expressed the belief that virtual client instances--which have a greater variance in memory needs over time and workload--will likely be the biggest beneficiary of the feature. Servers, in their estimation, typically have more predictable memory needs.

Guest machines must be enlightened to support Dynamic Memory, however. At the start, the feature will only be available for Windows Server 2003 and 2008 (Standard, Enterprise and DataCenter editions in either 32-bit or 64-bit), and Windows Server 2008 R2 (64-bit, all editions). Also supported are the Enterprise and Ultimate SKUs of Windows Vista and Windows 7 clients (32-bit and 64-bit), but not the Business/Professional editions.

The World Cup of Technology

Wed, 16 Jun 2010 16:26:49 -0500

Originally posted on ZDNet. Read the full article here. Given the irresistible opportunity to use the 2010 World Cup as a platform to make some puerile jokes about technology vendors, I for one am unable to resist the temptation. Call it an Obligatory List Article (OLA) if you will, but with last night's inaugural concert and the first game just hours away (and with England's forthcoming "customary drubbing" of team USA on its way tomorrow), what could possibly be more fun? BRAZIL - Apple Computer - Always looks good, plenty of fancy tricks up its sleeve, street credible style, but has been known to put on weight and slip up. NIGERIA - Palm Inc - Peaked in the 90s/early 2000s but has experienced decline ever since. NETHERLANDS - Open Source - Ya, so like everyone should just be equal and have a good time and, like, it's not your football and it's not my football it's just about loving each other OK? SLOVENIA - O2 - Used to be called something else. ITALY - IBM - Likes to wear a lot of blue and tell you about how things were in the old days.

Microsoft Bill Gates' Dad: Money Relieves Anxiety

Wed, 09 Jun 2010 13:16:15 -0500

Bill Gates' dad showed where the brilliance in the family comes from...the mother's side. Gates' dad dropped the nugget, "Any sense of angst about having a tough old age is no longer there." Bill, Sr., the news flash is you can probably be as comfortable as you need without a billionare son. Aside from that, there are some pretty unique views from the dad of one of the top 3 richest men in the world. The father of Bill Gates Jr. at age 84 helps steer the multi-billion-dollar Bill & Melinda Gates Foundation and readily admits he is lucky to have a successful family and meaningful work. Someone unhappy with work, he joked in an interview during a promotional tour this week for his book "Showing Up for Life," should "find a job in a very large foundation" that's owned by his son. "That will take care of all those apprehensions," he said. Gates Sr.'s folksy book, published last year but newly out in paperback, offers reflections and bits of wisdom on such topics as work, family, friendship and generosity. An attorney by profession, Gates is co-chair of the foundation established by his son and daughter-in-law. His son's Microsoft fortunes allow him a unique job doing charitable work, as well as peace of mind, he said. "The business of not having to worry, being able to do things, being able to eat well and travel and buy a new pair of pants once in a while, that's fundamental," he said. "Any sense of angst about having a tough old age is no longer there." Original article published by Reuters on June 4, 2010. See the original eWeek article.

Microsoft Windows Phone 7 for Businesses

Wed, 09 Jun 2010 13:01:06 -0500

Original article published by Nick Kolakowski on June 8, 2010. TechEd was a busy venue for Micorsoft to tout its new Windows 7 line of phones for Business as an alternative for the Blackberry tethers. Provided you're on a Windows 7 machine, the interoperability with your PC and other devices make it akin to Apple's seamless integration with devices. Windows Phone 7 is intended as a total revamp of Microsoft's mobile franchise. Instead of the "pages of apps" model that defines the user interface for both Apple's iPhone and Google Android devices, Windows Phone 7 devices consolidate mobile applications and Web content into a series of "Hubs" organized by subject, whether "Office" or "Games." If Microsoft's current plans hold, the first devices loaded with the operating system should make their appearance near the end of 2010; at TechEd, the company is hosting a number of deep-dive sessions and product demonstrations for the platform. "More than 90 [percent] of our target customers for Windows Phone use their Smartphone for business purposes," Paul Bryan, a senior director of Windows Phone at Microsoft, wrote in a June 7 posting on the Windows Phone Blog, timed to the first day of TechEd, "and 61 percent use their phones equally or more for business than personal use. This is why we designed Windows Phone 7 to combine a smart new user interface with familiar tools such as PowerPoint, OneNote, Word, Excel and SharePoint into a single integrated experience via the Office hub." See the original eWeek article: Microsoft Pushes Windows Phone 7 for Businesses at TechEd.

JetBrains Delivers YouTrack 2.0

Thu, 27 May 2010 08:20:21 -0500

Darryl K. Taft JetBrains, a maker of development tools intended to enhance productivity such as IntelliJ IDEA, on May 26 announced the release of YouTrack 2.0, a more customizable version of its bug and issue tracking system. YouTrack offers time savings for both bug submitters and development teams, according to JetBrains, which said rapid issue reporting is complemented by native-language-like search queries and batch operations on multiple issues from the command window. In its second major release, YouTrack 2.0 adds custom issue attributes that JetBrains said help development teams easily adapt the bug tracker to their specific needs and migrate existing projects from other issue trackers. YouTrack 2.0 also "introduces flexible access control by letting you strengthen permissions for individual issues that might contain nonpublic data," without limiting access to the whole project, the company said. Yet, YouTrack remains focused on being "an intelligent, keyboard-centric and easy-to-use issue tracker, packing the majority of its functionality in just two controls: a search box and command window," Jura Gorohovksy of JetBrains wrote on the YouTrack Issue Tracker blog May 26. "Someone once said that a product is well designed when you use it without thinking about what makes it so good," YouTrack Team Lead Vadim Gurov said in a statement. "That's our goal in making YouTrack, too. If you want to spend less time on reporting and processing bugs, YouTrack is probably for you. And with the latest security and customization enhancements, it not only improves your performance but also fully adapts to your team's needs." JetBrains said YouTrack 2.0 users can: "Create and manage custom attributes, and adjust their visibility; perform batch operations programmatically with [the] YouTrack REST API; tune visibility for individual issues that might contain nonpublic data; submit issues from any Web page--without even opening YouTrack, via the Create Issue bookmarklet; utilize extended JetBrains TeamCity integration; [and] import existing projects from JIRA 4.1." Gorohovksy added to this list that users can also "find and filter issues faster, thanks to enhanced query-based search syntax, auto-completion and highlighting; ... [and] handle issues more intuitively, in a redesigned user interface." YouTrack 2.0 is available in three editions. The first is the Starter Edition, which the company said is is "the best fit for small teams." This edition is limited to 10 projects and 10 user accounts. It doesn't support LDAP authentication and is priced at $149. The Professional Edition is targeted at midsize teams. It is limited to 20 projects and 20 user accounts. It does not support LDAP authentication and is priced at $300. The final edition is the Enterprise Edition, which the company said provides everything a large team needs, including full functionality for any number of projects and users. The Enterprise Edition is priced at $1,200. All editions come with one year of free technical support and upgrades. JetBrains also has announced a summer offer of 25 percent off on all of the above product editions. To learn more about the latest additions and enhancements, go to: www.jetbrains.com/youtrack/whatsnew?yt2pr. YouTrack is available for a free 60-day evaluation.

Cray Shows Off New AMD-Powered XE6 Supercomputer

Thu, 27 May 2010 08:18:21 -0500

Guest blog by Jeffrey Burt Supercomputer vendor Cray is unveiling its latest high-end system powered by Advanced Micro Devices' latest Opteron processors and featuring Cray's newest interconnect technology, dubbed "Gemini." The result is the XE6 supercomputer, which Cray officials said can scale to more than 1 million cores and can expand the reach of petascale computing to a wider range of HPC (high-performance computing) applications. Cray officials introduced the XE6--formerly codenamed "Baker"--May 25 at the 2010 Cray User Group meeting in Edinburgh, Scotland. The new supercomputer will start shipping early in the third quarter, but already Cray has more than $200 million in contracts for the system from such facilities as the Korea Meteorological Administration and the U.S. Department of Energy's National Energy Research Scientific Computing Center. Cray also will provide three XE6 systems to the U.S. Air Force Research Laboratory, the Arctic Region Supercomputing Center and the U.S Army Engineer Research and Development Center as part of the Department of Defense's HPC modernization program. Other customers include the National Nuclear Security Administration, the Engineering and Physical Sciences Research Council and NOAA (National Oceanic and Atmospheric Administration) through a partnership with the Oak Ridge National Laboratory. The system is powered by AMD's Opteron 6100 chips, which offer from eight to 12 cores each. AMD released the chip family--formerly named "Magny-Cours"--in March. Cray's current XT6 supercomputer also runs on the Opteron 6100 processors. According to Barry Bolding, Cray's vice president of scalable systems, the combination of the AMD chips with the new Gemini interconnect technology bring vast improvements to the XE6 over previous models. The Gemini interconnect--which replaces the current SeaStar technology--offers greater performance in multicore environments, including a 100-fold improvement in messaging rates and a three-fold reduction in latency over current systems. It also offers hardware support for a global user address space. "With the new Gemini interconnect, we are putting the final piece of the puzzle in place," Bolding said in a statement. "With the Gemini interconnect we will provide the scalable network to meet the demands of a petascale environment. The Cray XE6 system is the production supercomputer designed for the multicore era." Also included in the XE6 is the third generation of the Cray Linux Environment operating system, which was announced in April. Cray showed off the XE6 a week before the 2010 International Supercomputing show in Hamburg, Germany.

Sybase IQ Update Strengthens Database Query, Search Features

Thu, 27 May 2010 08:11:45 -0500

Guest blog by Brian Prince Sybase is touting new full text search and query federation capabilities in the latest release of its Sybase IQ database. Building on last year's update, in Sybase IQ 15.2 the company has built in the ability to extract information currently locked in e-mail, file systems and other unstructured formats in a bid to improve analytics. Users can retrieve information by searching for multiple or alternative words and phrases and scoring the frequency with which a term occurs within a document. According to a recent Forrester Research report, as much as 70 percent of the information in today's organizations is unstructured data. "What we've been finding over the past couple of years is that customers have really been wanting to extend the reach of their analytic systems in a couple of ways, one of which is that they have been wanting to integrate text better with their analytics processes - particularly text with e-mail...(and) other types of data that often travels with structured information," said Tom Traubitz, Director of Sybase IQ Product Marketing. "The second is they have been wanting to be able to increasingly integrate analytics systems into more real-time...operations," he added. To that second point, Sybase has added support for federated analytics queries and real-time loading. Query federation allows users to access information previously unavailable due to data movement or restrictions without it having to be moved or copied to a data warehouse, according to Sybase. "What it allows the analytics system to do is look at information that is in other computers via ODBC (open database connectivity) or other interfaces," Traubitz said. Accompanying this, he added, are tighter role-based access controls that allow administrators to define access privileges by the role of the user and apply that several users. Other enhancements include extended support for Web 2.0 development languages such as PERL and Python. "Sybase IQ is best known for its extreme performance, allowing decision-makers to analyze business trends, predict outcomes, and revise strategies, often in a matter of seconds," Joydeep Das, Director of Product Management, Data Warehousing and Analytics at Sybase, said in a statement. "With Sybase IQ 15.2, enterprises are now able to analyze previously untapped sources of information, such as web content and email, to deliver smarter answers across structured and unstructured data."

Google Introduces New Cloud Storage for Developers

Thu, 27 May 2010 08:07:50 -0500

Guest blog by Chris Preimesberger Google on May 20 launched a new cloud storage service specifically for software developers that will provide another option alongside several similar online services, including Amazon's well-established Simple Storage Service, or S3. The announcement was made at the Google I/O 2010 developers' conference at Moscone West in San Francisco. Amazon might have anticipated this new competition, announcing May 19 that it is trimming its storage rates for S3 by 33 percent. Google Storage for Developers utilizes the RESTful application programming interface (API) and Google's vast existing storage and networking infrastructure to store data and code from cloud-computing projects while they are being built. In the Web services world, REpresentational State Transfer (REST) is a key design idiom that embraces a stateless client/server architecture in which the Web services are viewed as resources and can be identified by their URLs. Using this API, it becomes much easier for developers to connect their applications to Google's storage, which is replicated across several of its U.S. data centers. The new Google service offers multiple authentication methods, SSL (Secure Sockets Layer) support, and access controls for sharing with individuals and groups, Jessie Jiang of the Google Storage for Developers Team wrote in a blog. "It is highly scalable--supporting read-after-write data consistency, objects of hundreds of gigabytes in size per request, and a domain-scoped namespace. In addition, developers can manage their storage from a Web-based interface and use GSUtil, an open-source command-line tool and library," Jiang wrote. Jiang said that Google Storage for Developers is being opened "to a limited number of developers at this time. During the preview, each developer will receive up to 100GB of data storage and 300Gbit monthly bandwidth at no charge." To learn more and sign up for the waiting list, visit the Google Storage for Developers site. Jiang said that the team will be demonstrating the service at Google I/O 2010 in a session and in the Developer Sandbox.

How to Talk Like a Programmer

Thu, 27 May 2010 08:03:46 -0500

Guest blog by Darryl Taft As the profession of computer programming continues to evolve, so does the jargon that typifies the daily life of a coder. Programming is alternately referred to as coding, hacking, developing and software engineering, among other things. And the age old debate over whether software development should be considered a creative endeavor or simply a rote, technical one. Whatever the case, it's clear that among the legions of folks who are professional programmers are some of the most intelligent and creative people in our society. That creativity is not lost on nifty mobile apps or money-making enterprise apps or complex technical computing apps, or even on catchy code names whose significance to the program might be three layers deep. Often the creativity of the modern programmer lies in the jargon of the day. Programming has lent several terms to the lexicon of popular speak, including spaghetti code, Easter eggs, bugs, wizards, widgets and a lot more. However, today in 2010, a whole new crop of programmer slang has emerged. Thanks to the folks at Stack Overflow, who prompted developers to share their programming terminology, and Joey Devilla at the Global Nerdly blog (who was good enough to package it and help popularize it), we have a slew of new terms, such as "Unicorny," which is used as an adjective to describe a feature that is so early in the planning stages that it might as well be imaginary. Or Bugfoot, which refers to a bug that is not reproducible and has been sighted by only one person. This is similar to the Loch Ness Monster Bug. Meanwhile, the concept of a bug report has spawned several new terms. There is the Drug Report, used to describe a bug report so utterly incomprehensible that whoever submitted it must have been smoking crack. The lesser version is a Chug Report, where the submitter is thought have had one too many. And then there is the Smug Report, which describes a bug submitted by a user who thinks he knows a lot more about the system's design than he really does. Filled with irrelevant technical details and one or more suggestions (always wrong) about what he thinks is causing the problem and how we should fix it. Finally, there's the Shrug Report, which is a bug report with no error message or repro steps and only a vague description of the problem. Usually contains the phrase "doesn't work." Other interesting programming terms originate in relationships. For instance, there is the Common Law Feature: A bug in the application that has existed so long that it is now part of the expected functionality, and user support is required to actually fix it. And there also is the Mad Girlfriend Bug, which occurs when a developer sees something strange happening, but when he inquires about it it will just say that everything is fine. Another term that is indicative of the way many programmers work is Code Slush, as opposed to Code Freeze, Code Slush is a term for the date after which no changes will be accepted, except, of course, all the changes that management will ask for at the last minute. It is like Code Freeze, but accepting of the fact that some changes will still get in. Meanwhile, I'm sure my friend Rod Johnson and the folks over at the SpringSource division of VMware would like this one: Lethal Dependency Injection, when a programmer uses too much Spring XML wiring to configure a handful of classes. Mostly, you don't want to be considered an Impediphile - Someone who codes in such a manner as to constantly cause impediments to others work. Are you a nerd? What are some of the unique programming terms in your shop?

Google Chrome Web Store Will Let Developers Sell Web Apps

Thu, 20 May 2010 07:36:30 -0500

Guest blog by Clint Boulton Google May 19 introduced the Chrome Web Store to make it easier for users to browse and download the thousands of free and paid Web apps on the market. The store will enable the roughly 70 million users of the Google Chrome Web browser to not only find Web apps, but create shortcuts in Chrome to access them easier. Developers will be able sell their apps through the store, said Sundar Pichai, vice president of product management for Google. Pichai previewed the Web Store at Google I/O in San Francisco. "It is very hard for users to find Web applications," Pichai noted, adding that people used to go to retail stores to buy software off the shelves. Thanks to the rise of AJAX in 2004, the times have changed. The Web is littered with, to use Pichai's example, apps for the game of chess. However, finding centralized reviews and ratings about these chess apps to decide which one is the best has proven difficult to impossible. To that end, the Chrome Web Store is essentially an app gallery featuring apps for magazines, productivity tools, and yes, games such as chess. Like the iPhone App Store, Android Market and other mobile forebears, the Web Store will sport ratings, reviews and a payment system by which developers can sell apps for consumers to purchase. "It should be easy to create and sell a premium application on the Web," Pichai said. During a demonstration, Pichai showed how Web apps were added to the Web Store and appeared as big icons in the Chrome Web Store palette that users can drag and drop. Pichai played the games Plants & Zombies, Lego Star Wars and Dark Room, which costs $4.99. See screenshots on Gizmodo here. Terry McDonell, managing editor of Sports Illustrated, then triggered the SI's Web application in the Web Store with a single click. Engadget has pics of this app running in Chrome here. Apps in the store support Adobe's Flash software and other standard Web technologies. The move is part of Google's efforts to make Web apps the rule and not the exception to classic on-premise applications users download to their desktops. That is the thrust behind not only Chrome but Chrome Operating System, the broader platform on which Chrome will run Web apps. Chrome OS is expected to run on netbooks from Acer, Asus, HP and other computer makers in the latter half of 2010. With more and more apps built on the emergent HTML5 markup language coming to the fore, Google wants to make sure it has the mechanisms in place to get more users consuming games, social apps and productivity tools. The Web Store is one such outlet. Web Store is not yet available, but will be later this year for Chrome on Windows, Mac and Linus and Chrome OS, Pichai said. Those who want more information, including preliminary documentation, may go here. Meanwhile, Chrome is growing fast. Pichai noted that Chrome had 30 million users in June 2009, but has more than double that number to 70 million and a 6.7 percent browser market share with minimal advertising. However, the company has begun advertising Chrome in earnest on popular Websites such as the New York Times and ESPN.com.

Microsoft Ships Silverlight 4 Tools for Visual Studio 2010

Thu, 20 May 2010 07:29:37 -0500

Guest blog by Darryl Taft Microsoft has released the final version of the Silverlight 4 Tools for Visual Studio 2010. In a May 17 blog post, the Microsoft Windows Presentation Foundation (WPF) and Silverlight Designer team announced the availability of the tools, which provide developers with new features to help them take advantage all the capabilities in Silverlight 4. Silverlight 4 Tools for Visual Studio 2010 is now available for download at: http://www.silverlight.net/getstarted/. Microsoft released both Visual Studio 2010 and Silverlight 4 in April. While Visual Studio is Microsoft's flagship toolset for application development of all types, Silverlight 4 enables developers to create a wide range of rich Internet and media applications for the Web, desktop and devices. To make development of these applications easier, the Silverlight 4 tools for Visual Studio 2010 delivers: Support for targeting Silverlight 4 in the Silverlight designer and project system; RIA Services application templates and libraries, and; support for Silverlight 4 elevated trust and out-of-browser applications, among several other new and enhanced features. A 20-minute video on the designer features can be found here. In addition to the Silverlight 4 tools for Visual Studio, Microsoft also on May 17 announced the 1.0 release of WCF RIA Services -- the Windows Communication Foundation rich Internet application services. In a blog post, John Papa, a senior technical evangelist for Microsoft, said the Silverlight 4 tools for Visual Studio include "several impressive, new features in the Visual Studio 2010 designer that work for both Silverlight and WPF development." According to a Microsoft Website for WCF RIA Services: "Microsoft WCF RIA Services simplifies the traditional n-tier application pattern by bringing together the ASP.NET and Silverlight platforms. RIA Services provides a pattern to write application logic that runs on the mid-tier and controls access to data for queries, changes and custom operations. It also provides end-to-end support for common tasks such as data validation, authentication and roles by integrating with Silverlight components on the client and ASP.NET on the mid-tier." A common problem when developing an n-tier RIA solution is coordinating application logic between the middle tier and the presentation tier, Microsoft said. WCF RIA Services solves this problem by providing framework components, tools, and services that make the application logic on the server available to the RIA client without requiring the developer to manually duplicate that programming logic.

Caspio Provides Cloud Solution for Microsoft Access Developers

Thu, 20 May 2010 07:24:25 -0500

Guest blog by Nathan Eddy Caspio, an online database platform for creating Web applications without programming, announced the launch of its Access Migration Kit, which provides a package of tools and services for developers to bring their Microsoft Access databases online. With last week's launch of Microsoft Office 2010, there has been a lot of attention surrounding the new Office Web Apps, which allows users to stay connected to their Office applications on the go. Caspio said Office 2010 does not provide the ability to easily create Web-based apps using Microsoft Access because it requires a multistep integration with a SharePoint server. Caspio is designed to be intuitive for Access users, with built-in, step-by-step wizards that help eliminate the complexities of creating database-bound Web forms, reports and apps, and guide the user through the app creation process from start to finish. The hosted service enables migration with features such as built-in import and export functions that can read and write Microsoft Access MDB format files and the ability to publish imported data to any Website, SharePoint and content management systems, hosted anywhere through reports or interactive searchable apps. Additional features include point-and-click tools that allow for the application interface design to be completed without programming, a SOAP-compatible API that allows developers to extend the capabilities of their online apps with any programming or scripting language, including ASP, ASP.Net, and VB.Net, a scalable online platform that supports up to two million records in each table and serves thousands of users simultaneously and security and reliability standards including SSL, SAS 70, PCI compliance, Section 508 accessibility and TRUSTe certification. Additionally, Caspio offers a plug-in for Microsoft Access and Excel whereby customers can synchronize an offline copy of their data with their online database. The plug-in automatically downloads users' Caspio-hosted data to their local desktop and keeps it refreshed, allowing them to use the Microsoft Office productivity suite to run local analysis on the data, mail merge or integrate with other applications. To encourage Access developers to try Caspio for online database migration, the company is offering an Access Migration Kit that includes a free trial of Caspio Bridge, unlimited data import, video tutorials, a whitepaper on Access migration, an upcoming instructional Webinar, and a consultation with a database migration expert. "Microsoft Office 2010 is an exciting release; however, Access developers are still challenged to find a viable solution for Web-centric data management," said Caspio founder and CEO Frank Zamani. "Caspio's cloud platform provides what's missing in Microsoft Access, allowing for easy online databases and Web app creation."

HTML5 Security Facts Developers Should Keep in Mind

Thu, 20 May 2010 07:21:15 -0500

Guest blog by Brian Prince The war on the words between Apple and Adobe Systems has prompted plenty of speculation about the fate of HTML5. But while HTML5 remains a work in progress, the one thing that is certain is developerswho adopt HTML5 will have a new set of features to consider as part of the application security development life cycle. So how will HTML5 impact the attack surface you have to cover? eWEEKspoke to some security experts and got feedback on a few key areas. Client-side storage Earlier versions of HTML only allow sites to store cookies as local information, and these are relatively small and only useful for storing simple profile information or identifiers for data stored elsewhere, such as a session ID, explained Dan Cornell, head of application security research at the Denim Group. HTML5 LocalStorage, however, allows much greater amounts of data to be stored locally by the browser, permitting new types of applications. "The risk associated with this is that sensitive data may be stored locally on a user's workstation and an attacker with physical access to that workstation or that compromises the workstation could get access to that data," Cornell said. "This could be especially bad for users using shared computers." "By definition it's really just the specification of being able to store information on the client system," Josh Abraham, security researcher for Rapid7, told eWEEK. "So that potentially you have the ability to do client-side-based SQL injection, or you could even have a client whose database is just malicious, and when they synchronize with the production system you have either synchronization issues or potentially malicious data from a client's database that's going to be inserted into a production system." To address this, developers need to be able to verify whether the data is good or malicious, something which can be a complex question, Abraham said. Not everyone is in agreement as to how important an issue this is. Veracode CTO Chris Wysopal noted for example that there have always been ways for Web applications to store data client-side through the use of plug-ins or browser extensions. "There are known methods [of manipulating] the HTML5 SessionStorage attribute as it's currently implemented, but chances are that this will be fixed by the time the standard is final," Wysopal said. Cross-domain communication While other versions of HTML would only allow JavaScript to make XML HTTP request calls back to the original server, HTML5 has relaxed this restriction so that XML HTTP requests can be made to any server that allows them. This of course poses a security risk if the server is untrusted. "For example, I could be building a mashup that pulls in sports scores from a third-party site via JSON [JavaScript Object Notation]," Cornell said. "This site could potentially send malicious data back to my application that could run in my users' browsers. As with many aspects of HTML5, this allows for new types of applications to be built, but if developers start using these capabilities without understanding the security implications they may build applications that open their users up to security risks." It's important that developers writing applications that rely on PostMessage() carefully check to ensure that messages originate from their own sites, because otherwise malicious code from other sites could spoof rogue messages, Wysopal added. The functionality itself, however, isn't inherently insecure, and developers have used various DOM (Document Object Model)/browser capabilities to emulate cross-domain messaging for some time now, he said. A related issue is that the World Wide Web Consortium's current draft for cross-origin resource sharing provides a way to circumvent the same-origin policy using a mechanism similar to the cross-domain, Wysopal continued. "Even more confusing, IE [Internet Explorer] implements the feature differently from Firefox, Chrome and Safari," he noted. "Developers need to be sure they understand the dangers of creating an overly permissive access control list, particularly since some of the available documentation on the topic contains reference code that is blatantly insecure." Iframe security There is good news about HTML5 from a security perspective, such as plans to support a sandbox attribute for iframes. "This attribute will allow a developer to choose how data should be interpreted," Wysopal said. "Unfortunately, this design, like much of HTML, has a pretty high chance of being misunderstood by developers and may easily be disabled for the sake of convenience. If done properly, it could help protect against malicious third-party ads or anywhere else that accepts untrusted content to be redisplayed."

JRuby 1.5 Ships

Thu, 20 May 2010 07:16:43 -0500

Guest blog by Darryl Taft The JRuby community has announced the availability of JRuby 1.5, the latest version of the JRuby programming language. Engine Yard, a Ruby cloud computing software and services company that employs the lead developers of JRuby, lauded the May 12 release of JRuby 1.5 as it brings significant enhancements to the platform that make it easier for developers to use. JRuby is a Java implementation of the Ruby programming language. It is a popular open-source package that allows Java developers to use Ruby to expand the capabilities of Java applications, provide service-oriented architecture/Web service architecture (SOA/WOA) interfaces for existing Java applications, or create entirely new applications. Ruby continues to gain adoption in the enterprise market because it offers significant productivity gains. Indeed, on May 11, Heroku, another Ruby/Rails cloud software provider, announced a new $10 million round of funding to grow its team and overall presence in the market. Engine Yard officials said the 1.5 release of JRuby makes it easier than ever for Java developers to take Ruby for a spin because of the seamless interaction it allows with commonly used Java components. In a notice about the 1.5 release on the JRuby site, the JRuby team said: "This development cycle has been our longest cycle yet (nearly 5 months), but it also has the most fixes. It also includes many new notable features (see below). Most of our bug fixes have been more of what we consider fine-tuning, since we keep getting into smaller corner-cases of compatibility for individual Ruby methods. In that sense, we expect if you had a good experience with JRuby 1.4.0 then 1.5.0 will be a no-brainer upgrade. If you haven't tried JRuby in a while with your application, then please give us another try. Odds are whatever issue you were having before no longer exists!" Key features in JRuby 1.5 include tighter Java library integration, as JRuby 1.5 delivers more efficient memory and CPU usage, and enables faster development cycles; improved Ruby compatibility, as JRuby 1.5 is the most Ruby-compatible release yet; and improved Windows support so that Windows developers interested in Ruby can select JRuby with greater confidence. Engine Yard said JRuby 1.5 eliminates dozens of challenges to running JRuby on Windows. "With JRuby, we can accelerate development by four to 10 times while writing 80 percent less code," said Joe O'Brien, co-founder of EdgeCase, a Ruby development shop. "The true cost of software is in testing and code maintenance, and JRuby allows more thorough testing, which helps to keep maintenance costs down. In addition, we lowered our costs for engineering resources on one project by 50 percent and reduced the time required for deploying code changes from six to eight weeks to three weeks. These productivity gains give us more time to build new applications." Engine Yard employs Thomas Enebo, Charles Nutter and Nick Sieger--three of the JRuby project's core contributors. "This was our most ambitious development cycle yet. With the fantastic support of JRuby contributors and the Java and Ruby communities, we've made JRuby 1.5 a release everyone deserves to be proud of," said Nutter, who is lead JRuby developer and co-lead of the JRuby core team at Engine Yard. Moreover, Engine Yard officials said the company also congratulates the entire community of JRuby contributors, as over 30 developers contributed more than 1,000 individual commits that comprise JRuby 1.5. JRuby provides productivity benefits to Java teams, including the ability to deploy Ruby code to the same servers, use the same libraries, and integrate with existing Java code and applications that they are familiar with. For a full description of all the improvements and bug fixes in JRuby 1.5, or to download JRuby, go to www.jruby.org. Engine Yard also recently announced its JRuby commercial support offering, which includes JRuby 1.5. Commercial JRuby support from Engine Yard includes developer assistance and advice on how to tune and optimize JRuby. It covers the most recent version of JRuby and the following libraries: jruby-openssl, activerecord-jdbc-adapter, warbler and jruby-rack. It also covers bundled JRuby components such as Joni, Yecht and jrubyffi.