<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Deft Labs &#187; Research</title>
	<atom:link href="http://deftlabs.com/category/research/feed/" rel="self" type="application/rss+xml" />
	<link>http://deftlabs.com</link>
	<description></description>
	<lastBuildDate>Mon, 28 Nov 2011 21:04:21 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.2</generator>
<image>
  <link>http://deftlabs.com</link>
  <url>http://deftlabs.com/img/favicon.ico</url>
  <title>Deft Labs</title>
</image>
		<item>
		<title>New York Ad Startups &#8211; Location, Location, Location</title>
		<link>http://deftlabs.com/2010/02/new-york-advertising-startups-location/</link>
		<comments>http://deftlabs.com/2010/02/new-york-advertising-startups-location/#comments</comments>
		<pubDate>Tue, 09 Feb 2010 14:00:04 +0000</pubDate>
		<dc:creator>Ryan</dc:creator>
				<category><![CDATA[Research]]></category>
		<category><![CDATA[advertising]]></category>
		<category><![CDATA[New York]]></category>
		<category><![CDATA[startup]]></category>

		<guid isPermaLink="false">http://deftlabs.com/?p=229</guid>
		<description><![CDATA[photo credit: Sideshow Bruce Last week, AM New York published a list of the hottest startups in NYC. The amNY article started us thinking about all the advertising-focused startups located in New York City. In today&#8217;s Internet-based world, location is less important than it was in the past; however, proximity to the epicenter of advertising, [...]]]></description>
			<content:encoded><![CDATA[<p><a title="east broad top #14" href="http://www.flickr.com/photos/19752067@N00/4335592141/" target="_blank"><img style="border: 0pt none;" src="http://farm5.static.flickr.com/4058/4335592141_c38b94ce5e_m.jpg" border="0" alt="east broad top #14" width="119" height="134" /></a><br />
<small><a title="Attribution License" href="http://creativecommons.org/licenses/by/2.0/" target="_blank"><img src="http://deftlabs.com/wp-content/plugins/photo-dropper/images/cc.png" border="0" alt="Creative Commons License" width="16" height="16" align="absmiddle" /></a> <a href="http://www.photodropper.com/photos/" target="_blank">photo</a> credit: <a title="Sideshow Bruce" href="http://www.flickr.com/photos/19752067@N00/4335592141/" target="_blank">Sideshow Bruce</a></small></p>
<p>Last week, AM New York published a list of the <a href="http://www.chubbybrain.com/blog/2010/01/new-york-citys-10-hottest-tech-startups/" target="_blank">hottest startups in NYC</a>. The amNY article started us thinking about all the advertising-focused <a href="http://en.wikipedia.org/wiki/Startup_company" target="_blank">startups</a> located in New York City. In today&#8217;s Internet-based world, location is less important than it was in the past; however, proximity to the epicenter of advertising, <a href="http://en.wikipedia.org/wiki/Madison_Avenue" target="_blank">Madison Avenue</a>, is still important. For this post, we researched advertising startups located in NYC that have been in business for five years or less.</p>
<p><strong>Startups</strong></p>
<ul>
<li><a href="http://www.admeld.com/" target="_blank">AdMeld</a> &#8211; An ad-optimization platform focusing  on large, premium web publishers</li>
<li><a href="http://www.adsafemedia.com/" target="_blank">AdSafe Media</a> &#8211; Brand protection data provider</li>
<li><a href="http://appnexus.com/" target="_blank">AppNexus</a> &#8211; Real-time bidding platform and cloud hosting provider</li>
<li><a href="http://www.betteradvertising.com/" target="_blank">Better Advertising</a> &#8211; Provides more transparency to the advertising process</li>
<li><a href="http://www.clickable.com/" target="_blank">Clickable</a> &#8211; An online solution for search advertising automation</li>
<li><a href="http://www.collective.com/" target="_blank">Collective</a> &#8211; A premium, audience-focused advertising technology solution</li>
<li><a href="http://www.demdex.com/" target="_blank">Demdex</a> &#8211; Behavioral data management solutions</li>
<li><a href="http://www.doubleverify.com/" target="_blank">Double Verify</a> &#8211; Brand protection and campaign validation (NYC HQ, eng. in Israel)</li>
<li><a href="http://www.exelate.com" target="_blank">Exelate Media</a> &#8211; A marketplace for behavioral targeting data (NYC HQ, eng. in Israel)</li>
<li><a href="http://www.medialets.com" target="_blank">Medialets</a> &#8211; Mobile advertising platform</li>
<li><a href="http://www.mediamath.com/" target="_blank">MediaMath</a> &#8211; A demand side platform</li>
<li><a href="http://www.peer39.com/" target="_blank">Peer39</a> &#8211; Semantic advertising solutions (NYC HQ, eng. in Israel)</li>
<li><a href="http://www.pontiflex.com/" target="_blank">Pontiflex</a> &#8211; Focused on cost per lead</li>
<li><a href="http://www.yieldex.com" target="_blank">Yieldex</a> &#8211; Publisher inventory management</li>
</ul>
<p><strong>Nearby</strong></p>
<p><strong></strong>There are several notable advertising startups making waves in Boston and Philadelphia, but for the purpose of this article, close does not count.</p>
<p><strong>Note</strong></p>
<p>If we missed any notable advertising startups located in <a href="http://en.wikipedia.org/wiki/New_York_City" target="_blank">NYC</a>, please <a href="http://deftlabs.com/about">contact us</a> and we will edit the list.</p>
]]></content:encoded>
			<wfw:commentRss>http://deftlabs.com/2010/02/new-york-advertising-startups-location/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Sun Shines On Oracle Part Deux</title>
		<link>http://deftlabs.com/2009/05/sun-shines-on-oracle_2/</link>
		<comments>http://deftlabs.com/2009/05/sun-shines-on-oracle_2/#comments</comments>
		<pubDate>Thu, 14 May 2009 03:03:20 +0000</pubDate>
		<dc:creator>Ryan</dc:creator>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Research]]></category>
		<category><![CDATA[Java]]></category>
		<category><![CDATA[oracle]]></category>
		<category><![CDATA[sun]]></category>

		<guid isPermaLink="false">http://deftlabs.com/?p=192</guid>
		<description><![CDATA[In a previous post, we discussed the history of Oracle and MySQL. In this post we will focus on Oracle&#8217;s relationship with its new star, Java. History Oracle made its first big move into the Java space in 2001 when it acquired a non-exclusive license for the source code of Sweden-based IronFlare AB&#8217;s Orion Application [...]]]></description>
			<content:encoded><![CDATA[<table border="0">
<tbody>
<tr>
<td><img class="alignleft size-full wp-image-172" style="padding-right: 10px;" title="oralogo_small" src="http://deftlabs.com/wp-content/uploads/2009/05/oralogo_small.gif" alt="oralogo_small" width="133" height="18" /></td>
<td><img class="alignleft size-full wp-image-173" title="sun" src="http://deftlabs.com/wp-content/uploads/2009/05/sun.png" alt="sun" width="133" height="59" /></td>
</tr>
</tbody>
</table>
<p>In a <a href="http://deftlabs.com/2009/05/sun-shines-on-oracle/" target="_blank">previous post</a>, we discussed the history of Oracle and MySQL. In this post we will focus on Oracle&#8217;s relationship with its new star, <a href="http://en.wikipedia.org/wiki/Java_(programming_language)" target="_blank">Java</a>.</p>
<p><strong>History</strong></p>
<p>Oracle made its first big move into the Java space in 2001 when it acquired a non-exclusive license for the source code of Sweden-based IronFlare AB&#8217;s <a href="http://en.wikipedia.org/wiki/Orion_Application_Server" target="_blank">Orion Application Server</a> to serve as the foundation for the <a href="http://en.wikipedia.org/wiki/Oracle_Application_Server" target="_blank">Oracle Application Server</a>. Oracle continued to make progress in the J2EE space for the next few years, but it was always stuck behind JBoss, WebLogic, WepShere and others.  Rumors circulated around <a href="http://en.wikipedia.org/wiki/BEA_Systems" target="_blank">BEA Systems</a> for years that Oracle was interested in purchasing the company until 2008 when <a href="http://www.oracle.com/bea/index.html?CNT=management.htm&amp;FP=/content/about/corporate/" target="_blank">Oracle finally acquired the company</a>. With the BEA acquisition, Oracle came into control of a superior Java Application Server (WebLogic) and one of the few <em>really good</em> <a href="http://en.wikipedia.org/wiki/List_of_Java_virtual_machines" target="_blank">Java virtual machines</a>, <a href="http://en.wikipedia.org/wiki/JRockit" target="_blank">JRockit</a>. The acquisition of Sun and, subsequently, Java puts Oracle firmly in control of the Java industry.</p>
<p><strong>Future</strong></p>
<p>The majority of the Java virtual machine was open sourced under the <a href="http://www.gnu.org/licenses/gpl-2.0.html" target="_blank">GPL V2</a> license in 2007 via the <a href="http://en.wikipedia.org/wiki/OpenJDK" target="_blank">OpenJDK</a> project. Several libraries related to the <a href="http://www.itworld.com/070508opsjava" target="_blank">Java 2D APIs were withheld</a> because of previous license agreements Sun had made. If Oracle decides to stop supporting free and open source Java, there will be a void in the industry that would require Google, IBM, HP and others to invest heavily in the language to keep dominance away from Oracle.</p>
<p>We expect IBM to make a play for <a href="http://en.wikipedia.org/wiki/Red_Hat" target="_blank">Red Hat</a> before they lose too much of its competitive edge in the software infrastructure industry.</p>
<p><strong>Relevance</strong></p>
<p>According to the May 2009 <a href="http://www.tiobe.com/index.php/content/paperinfo/tpci/index.html" target="_blank">TIOBE Programming Community Index</a>, Java comprises the dominant 19.537% of the programming language mindset.  The ownership of the Java space gives Oracle a problematic amount of control and influence over the Java platform. As server operating systems become less relevant in favor of logic embedded in platform independent Java, Oracle is well positioned to place extreme pressure on all of Microsoft&#8217;s server solutions. Additionally, most of the modern <a href="http://en.wikipedia.org/wiki/Scripting_language" target="_blank">scripting languages</a> have been <a href="https://scripting.dev.java.net/" target="_blank">embedded into the Java virtual machine</a> so the platform truly transcends Linux, Windows, Mac OSX, Solaris etc. Google&#8217;s new operating system, <a href="http://en.wikipedia.org/wiki/Google_Android" target="_blank">Android,</a> is based on Linux but the APIs exposed to developers are primarily Java-based. Additionally, Google also recently released Java support for its platform solution, <a href="http://en.wikipedia.org/wiki/Google_App_Engine" target="_blank">App Engine</a>, and its <a href="http://en.wikipedia.org/wiki/Google_Web_Toolkit" target="_blank">Web Toolkit</a> is also based on Java.</p>
<p>With an uneven power shift over the Java platform, it is completely possible that innovation of Java will not continue at its current pace.</p>
<p><strong>Growth</strong></p>
<p>We would like to see Google participate more in funding, development and maintenance of the OpenJDK project to help ensure innovation is pushed forward and Oracle is kept at a safe distance from discontinuing open source releases.</p>
]]></content:encoded>
			<wfw:commentRss>http://deftlabs.com/2009/05/sun-shines-on-oracle_2/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Affero General Public License &#8211; AGPL</title>
		<link>http://deftlabs.com/2008/07/affero-general-public-license-agpl/</link>
		<comments>http://deftlabs.com/2008/07/affero-general-public-license-agpl/#comments</comments>
		<pubDate>Sun, 27 Jul 2008 15:58:18 +0000</pubDate>
		<dc:creator>Ryan</dc:creator>
				<category><![CDATA[Research]]></category>
		<category><![CDATA[AGPL]]></category>
		<category><![CDATA[gnu]]></category>
		<category><![CDATA[license]]></category>
		<category><![CDATA[open]]></category>
		<category><![CDATA[source]]></category>

		<guid isPermaLink="false">http://deftlabs.com/?p=83</guid>
		<description><![CDATA[There are a lot of open source licenses available. Based on what you want to accomplish, choosing the correct license is important. What people don&#8217;t commonly understand is the difference between open source and the freedom to do whatever you want with the source. There has been a bit of controversy surrounding the Affero General [...]]]></description>
			<content:encoded><![CDATA[<p><img class="alignleft size-medium wp-image-84" style="boder:0px; padding-right: 10px; padding-bottom: 10px;" title="160px-heckert_gnu_whitesvg" src="http://deftlabs.com/wp-content/uploads/2008/07/160px-heckert_gnu_whitesvg.png" alt="" width="160" height="156" />There are a lot of open source licenses available. Based on what you want to accomplish, choosing the correct license is important. What people don&#8217;t commonly understand is the difference between open source and the freedom to do whatever you want with the source. There has been a bit of controversy surrounding the Affero General Public License so we decided to do a bit of research on the license.</p>
<p>In a nutshell, the core concept behind AGPL is that if your applications links to an AGPL licensed library and you make your product/service available via a network service, then your application must also be open source.</p>
<p>We reviewed the following pages in our research:</p>
<ul>
<li><a href="http://www.fsf.org/blogs/licensing/2007-03-29-gplv3-saas" target="_blank">GPLv3 and Software as a Service</a></li>
<li><a href="http://www.gnu.org/licenses/agpl-3.0.html" target="_blank">GNU Affero Genenal Public License</a></li>
<li><a href="http://en.wikipedia.org/wiki/Affero_General_Public_License" target="_blank">Affero General Public License (Wikipedia)</a></li>
<li><a href="http://en.wikipedia.org/wiki/Network_service" target="_blank">Network Service (Wikipedia)</a></li>
<li><a href="http://en.wikipedia.org/wiki/Application_service_provider" target="_blank">Application Service Provider (Wikipedia)</a></li>
<li><a href="http://en.wikipedia.org/wiki/GNU_General_Public_License" target="_blank">GNU General Public License (Wikipedia)</a></li>
<li><a href="# http://news.cnet.com/8301-13505_3-9917947-16.html" target="_blank">Google&#8217;s festering problem with the AGPL</a></li>
<li><a href="http://blog.sixsigns.com/2008/04/01/the-agpl-in-simple-words/" target="_blank">The AGPL in Simple Words</a></li>
</ul>
<p>Image courtesy of the <a href="http://www.fsf.org/" target="_blank">Free Software Foundation</a>.</p>
]]></content:encoded>
			<wfw:commentRss>http://deftlabs.com/2008/07/affero-general-public-license-agpl/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Cloud Infrastructure Blueprint</title>
		<link>http://deftlabs.com/2008/05/cloud-infrastructure-blueprint/</link>
		<comments>http://deftlabs.com/2008/05/cloud-infrastructure-blueprint/#comments</comments>
		<pubDate>Thu, 29 May 2008 03:38:10 +0000</pubDate>
		<dc:creator>Ryan</dc:creator>
				<category><![CDATA[Research]]></category>
		<category><![CDATA[cloud]]></category>
		<category><![CDATA[infrastructure]]></category>
		<category><![CDATA[platform]]></category>

		<guid isPermaLink="false">http://deftlabs.com/?p=77</guid>
		<description><![CDATA[As cloud platforms and services start to make their way to the market, we think it&#8217;s becoming obvious how the industry will play out. To understand the future, it’s important to look at the past. Best of Breed Stand alone providers who offer services provided by clouds are going to find it difficult to survive [...]]]></description>
			<content:encoded><![CDATA[<p><img class="alignleft size-medium wp-image-78" style="padding: 0px 10px 10px 0px;" title="cloud_wing" src="http://deftlabs.com/wp-content/uploads/2008/05/cloud_wing-300x225.jpg" alt="" width="300" height="225" />As cloud platforms and services start to make their way to the market, we think it&#8217;s becoming obvious how the industry will play out. To understand the future, it’s important to look at the past.</p>
<p><strong>Best of Breed</strong></p>
<p>Stand alone providers who offer services provided by clouds are going to find it difficult to survive on their own. Currently, enterprises have way too many Internet service vendors. The situation is reminiscent of the software industry in 2000. For a long time enterprises found themselves taking a best-of-breed approach with regard to software vendor selection. This worked for a while, but eventually products mature, prices align and competitive differences dwindle.</p>
<p>A good example of this is the competition between J2EE container providers. For a few years, BEA provided a stronger J2EE container than IBM, JRun, JBoss, ATG, SilverStream and others. The competing products eventually matured and the industry was commoditized. This placed customers in an awkward position when justifying the expenses related to maintaining numerous software vendors. SilverStream went to Novell, BEA went to Oracle, JBoss went to Red Hat and JRun went to Adobe (by way of a sale to Macromedia).</p>
<p><strong>The Stack</strong></p>
<p>Eventually, the software “stack” was born.  Software publishers started consolidating and now you can get  just about everything you need from a single vendor. Of course some companies still take the best-of-breed approach in their vendor selection process, but when you make a lot of separate purchases you miss the economies of scale that a single large transaction can bring. Most software publishers offer sizable discounts on non-core products when you buy the complete stack.</p>
<p>In a nutshell, the same consolidation we witnessed in the software industry is about to hit the cloud/platform space.</p>
<p><strong>Blueprint</strong></p>
<p>The name of the game is efficiency and this can only be achieved through service consolidation. The following is a list of services/functionality we think are essential for cloud platforms providers:</p>
<ul>
<li><strong>Storage</strong> – The ability to transparently increase your storage capabilities. This is going to be a tough nut to crack. If company A has a disk IO read requirement of 400 MBps, they may have issues with the current services available. Currently, cloud storage models are based on bytes transferred in and out of the cloud and the amount of storage available. Eventually, you’ll be able to pay extra for high throughput.</li>
</ul>
<ul>
<li> <strong>Message Bus</strong> – The ability to reliably communicate between applications and distributed nodes using a common interface.</li>
</ul>
<ul>
<li><strong>Network Isolation</strong> – Most companies don’t believe in encrypting everything that hits the wire. This results in potential security issues for applications sitting on the same network. This may be a difficult problem for cloud vendors to solve (consider each of the nodes your app runs on may be on a separate subnet).</li>
</ul>
<ul>
<li><strong>Database</strong> – This is obvious, but what is not is the death of RDBS technology. It doesn’t make sense for companies to continue using this technology much longer. The costs associated with writing applications that require multiple programming languages are high. OO databases are starting to mature and the reduction in bookkeeping and development costs will drive people to this technology. Google, Amazon and others have already released OO database services. Google added a SQL interface to their OO database for legacy users/apps.</li>
</ul>
<ul>
<li><strong>Job Scheduling</strong> – Some applications need to run at scheduled times.</li>
</ul>
<ul>
<li><strong>Load Balancing</strong> – HTTP load balancing should be transparent.</li>
</ul>
<ul>
<li><strong>Resource Scheduling</strong> – Clouds need to provide consistent performance for all types of applications. For non-web based applications this means that they need to dedicate specific disk, memory and CPU resources. Additionally, the cloud must detect when an application needs additional resources and dynamically allocate those resources. This is easy for most standard HTTP applications but is a more difficult problem when looking at data processing/computational applications.</li>
</ul>
<ul>
<li><strong>Parallel/Grid Processing</strong> – Let&#8217;s say we need to analyze the HTTP logs we collected over the last year. This can be dispatched to a single machine but it would take forever to run. The ability to transparently process data in parallel is essential for the enterprise adoption of cloud platforms.</li>
</ul>
<ul>
<li><strong>Network Capacity</strong> – Some applications are optimized and can easily max out a 1 Gb network connection. Most cloud platforms use shared or virtualized resources. This can make it difficult to isolate network capacity. The release of 10 Gb networking technology (with 100Gb technology on the way) will drastically change the way applications are designed. Engineers will have significantly fewer restrictions when developing distributed systems. The primary focus with network capacity is on the LAN level. It’s assumed that the cloud platform has enough network capacity to handle their customer’s WAN requirements.</li>
</ul>
<ul>
<li><strong>Caching</strong> – This should be transparent for data store access. Users need the ability to create complex transient data structures that support distributed access.</li>
</ul>
<ul>
<li><strong>Advertising</strong> – Complete campaign management and fulfillment from a single vendor is essential. This includes email, text, banner, video, outdoor, IPTV, etc. The recent consolidation in the industry indicates that this is already underway.</li>
</ul>
<ul>
<li><strong>Web Analytics</strong> &#8211; Currently, there are a variety of stand alone companies who provide this service. We think these companies will be forced to sell/merge into the cloud platforms.</li>
</ul>
<ul>
<li><strong>CDN</strong> – Content delivery should be as simple and transparent as possible. Cloud platforms can transparently provide this service to their customers. Expect to see a lot of consolidation in this space over the next two years. The jewel in the industry is <a href="http://www.pantherexpress.net/" target="_blank">Panther Express</a> ☺</li>
</ul>
<ul>
<li><strong>Email/Communication</strong> – Providing a single corporate UI to your employees is essential. Switching UIs results in a context switch and requires a brief period for the user to adjust to the alternate environment. Integrating web-based email access with the rest of software/services customers use to run their business will further increase the efficiency of their employees.</li>
</ul>
<ul>
<li><strong>Core Service APIs</strong> – Embedding new applications in a cloud needs to be fast and easy. Providing a common API/framework is critical. Imagine customer A uses service B provided by company X. Customer A already has an application management console provided by the cloud. They need to be able to configure service B using their existing admin tools. Pluggable admin tools should resemble Facebook’s development environment.</li>
</ul>
<ul>
<li><strong>Content Management</strong> &#8211; Companies need to be able to organize, publish and track their content. This needs to support all common media formats.</li>
</ul>
<ul>
<li><strong>DNS/Registrar</strong> – Nobody wants to think about the plumbing nor do they want to maintain multiple accounts to manage this functionality. Using DNS provided by a single ISP doesn’t make sense from a reliability standpoint. ISP networks and services are much too xenophobic. Cloud platforms need to be 100% fault tolerant. An outage no longer impacts one company, it impacts thousands.</li>
</ul>
<ul>
<li><strong>ERP Tools</strong> – All companies need a few basic tools no matter what industry they’re in (e.g., time tracking, contact lists/corporate directories, issue tracking, project management, documents, spreadsheets, billing, etc.).</li>
</ul>
<ul>
<li><strong>Monitoring/Alerts</strong> &#8211; Users need to be notified when conditions change. These attributes must be configurable.</li>
</ul>
<ul>
<li><strong>Service Billing</strong> – Clouds will provide great environments for mashup development. A clean billing and tracking solution is necessary so that services can be used without adding additional vendors to your list of partners.</li>
</ul>
<p><img class="alignleft size-medium wp-image-79" style="padding:0px 10px 10px 0px;" title="western_us" src="http://deftlabs.com/wp-content/uploads/2008/05/western_us-300x225.jpg" alt="" width="300" height="225" /><strong>Serious Clouds</strong></p>
<p>Looking at the functionality list above, it’s obvious what Google, Amazon and others have been thinking about for a while.</p>
<p>A serious cloud platform will require a lot of custom development, but it’s still really early in the game. However, developing ALL of the systems/applications listed is a bit unrealistic. The best approach to creating a company that can compete with Google, IBM and Microsoft is to make a slew of acquisitions and integrate the applications. Most of the applications can continue to operate in relative backend silos with a completely integrated UI. The problem is that the return on investment will not be realized for some time. Enterprises are only beginning to look at moving to cloud platforms.</p>
<p>The golden age for platforms is not too far away and everyone and their brother will be looking for a pick and an axe.</p>
]]></content:encoded>
			<wfw:commentRss>http://deftlabs.com/2008/05/cloud-infrastructure-blueprint/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>Google&#8217;s App Engine</title>
		<link>http://deftlabs.com/2008/04/googles-app-engine/</link>
		<comments>http://deftlabs.com/2008/04/googles-app-engine/#comments</comments>
		<pubDate>Thu, 24 Apr 2008 01:46:11 +0000</pubDate>
		<dc:creator>Ryan</dc:creator>
				<category><![CDATA[Research]]></category>
		<category><![CDATA[Reviews]]></category>
		<category><![CDATA[10gen]]></category>
		<category><![CDATA[App Engine]]></category>
		<category><![CDATA[cloud]]></category>
		<category><![CDATA[google]]></category>

		<guid isPermaLink="false">http://deftlabs.com/?p=72</guid>
		<description><![CDATA[Recently, we&#8217;ve been researching cloud computing so we decided to take a look at Google&#8217;s App Engine. We had hoped to write this earlier, but it was some time before we received access from Google to use App Engine :-) We&#8217;re excited to see cloud computing move forward but, as usual, we&#8217;re digging through the [...]]]></description>
			<content:encoded><![CDATA[<p><img class="alignnone size-full wp-image-73" style="border: none; float: left; padding: 0px 10px 10px 0px;" title="appengine_lowres" src="http://deftlabs.com/wp-content/uploads/2008/04/appengine_lowres.jpg" alt="" width="100" height="79" /></p>
<p>Recently, we&#8217;ve been <a href="http://deftlabs.com/2008/04/gazing-into-the-clouds/" target="_blank">researching cloud computing</a> so we decided to take a look at <a href="http://code.google.com/appengine/" target="_blank">Google&#8217;s App Engine</a>. We had hoped to write this earlier, but it was some time before we received access from Google to use App Engine :-) We&#8217;re excited to see cloud computing move forward but, as usual, we&#8217;re digging through the hype.</p>
<p><strong>Data Access</strong></p>
<p>Data access appears to be well implemented. Users have the option to create Google Query Language (GQL) or object-based queries. GQL is essentially a scaled down version of <a href="http://en.wikipedia.org/wiki/SQL" target="_blank">SQL</a> (currently, GQL does not support join statements). The GQL extension is handy, but we expect most people to use the object query interfaces. We were pleasantly surprised when we saw that App Engine supports transactions.</p>
<p><strong>Configuration</strong></p>
<p>The configuration files for App Engine use <a href="http://en.wikipedia.org/wiki/YAML" target="_blank">YAML</a>. While this is cool from a geeky staindpoint, XML would&#8217;ve been a better choice for the masses. Hopefully, Google will add a nice web UI down the road that removes the need to edit these ugly configuration files.</p>
<p><strong>Local Development</strong></p>
<p>We like the local development SDK, although  it needs a lot of work.  When we added an error to our &#8220;<a href="http://en.wikipedia.org/wiki/Hello_world_program" target="_blank">hello world</a>&#8221; application, we were a bit frightened. The stack trace was scary and the first 90% of the message related to App Engine SDK (dev_appserver.py). After scrolling to the very bottom of the page, we found our problem:</p>
<p><img class="alignnone size-full wp-image-74" title="app_engine_error" src="http://deftlabs.com/wp-content/uploads/2008/04/app_engine_error.gif" alt="" width="412" height="197" /></p>
<p><strong>Runtime Language</strong></p>
<p>Google&#8217;s App Engine only supports <a href="http://en.wikipedia.org/wiki/Python_(programming_language)" target="_blank">Python</a> right now. However, there is a placeholder in the primary configuration file (app.yaml) that keeps the window open for additional language support down the road. We&#8217;re not huge Python fans, but they should be able to easily integrate just about any language into the cloud in the future.</p>
<p><strong>Pricing</strong></p>
<p>Details about how much Google will charge for the service haven&#8217;t been released yet. The free account only allows 500 MB of storage so it seems as if their model is to make money on storage and CPU. Their bandwidth prices are pretty good&#8230; they offer 10GB in <em>and</em> out per day for free. We shall see how they do in their quiet entry into the CDN industry. Perhaps this will be the product that pushes <a href="http://deftlabs.com/2008/02/akamai-vs-limelight-networks/" target="_blank">Akamai to sue Google over patent 6,108,703</a>.</p>
<p><strong>Missing</strong></p>
<p>The main component that is missing is an advanced UI. Google lets you perform some basic operations in their administration interface but it&#8217;s not even close to a robust environment. We expected a really slick <a href="http://deftlabs.com/2008/04/browser-based-web-development/" target="_blank">browser-based editor</a> from Google.</p>
<p>Also noticeably absent is the ability to run scheduled/<a href="http://en.wikipedia.org/wiki/Cron" target="_blank">cron</a> jobs.</p>
<p><strong>Vendor Lock-In</strong></p>
<p>There is huge potential for vendor lock-in with App Engine. Google has open sourced all of the App Engine APIs, but if large tech companies don&#8217;t support/implement the platform then it&#8217;s little more than a defense to ward off lock-in criticism. <a href="http://appdrop.com/" target="_blank">AppDrop</a> has already released an alpha implementation but without support from an IBM, Red Hat or Novell, it probably won&#8217;t gain much traction.</p>
<p><strong>Competition</strong></p>
<p>Google&#8217;s App Engine release formally <a href="http://deftlabs.com/2007/10/chapter-30-platform-wars/" target="_blank">kicks off the third chapter</a> of the Internet&#8217;s evolution. There are already several startups working feverishly on cloud platforms and we expect lots of exciting news this summer about new companies trying to compete in the space. Of course there will be a lot of companies who washout, but the more people involved, the more innovation we&#8217;ll see.</p>
<p><strong>Overall</strong></p>
<p>If App Engine had been released by a startup, we would&#8217;ve given the product five stars. However, Google employs nearly 17,000 people and is worth roughly $174 billion. We&#8217;re happy that there are cloud platforms coming to market but expected more from Google.</p>
<p>We had the opportunity to play with the <a href="http://www.10gen.com/" target="_blank">10gen</a> alpha, and so far, App Engine has some ground to cover to compete in the cloud space. Of course, having the most recognized brand in the world goes a long way ;-)</p>
]]></content:encoded>
			<wfw:commentRss>http://deftlabs.com/2008/04/googles-app-engine/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Gazing Into The Clouds</title>
		<link>http://deftlabs.com/2008/04/gazing-into-the-clouds/</link>
		<comments>http://deftlabs.com/2008/04/gazing-into-the-clouds/#comments</comments>
		<pubDate>Mon, 07 Apr 2008 15:58:46 +0000</pubDate>
		<dc:creator>Ryan</dc:creator>
				<category><![CDATA[Research]]></category>
		<category><![CDATA[10gen]]></category>
		<category><![CDATA[cloud]]></category>
		<category><![CDATA[google]]></category>
		<category><![CDATA[grid]]></category>
		<category><![CDATA[heroku]]></category>
		<category><![CDATA[ibm]]></category>
		<category><![CDATA[microsoft]]></category>
		<category><![CDATA[platform]]></category>

		<guid isPermaLink="false">http://deftlabs.com/2008/04/gazing-into-the-clouds/</guid>
		<description><![CDATA[photo credit: Lodewijk van den Broek Cloud computing is garnering a lot of attention lately. There are wild rumors and announcements about Google, Microsoft, IBM and others entering the space. Additionally, startups like 10gen and Heroku also appear to be working on the same problem. Cloud computing will be a fast and drastic shift that [...]]]></description>
			<content:encoded><![CDATA[<p style="padding: 0px 10px 0px 0px; float: left"><a href="http://www.flickr.com/photos/12760128@N04/2381321824/" target="_blank"><img src="http://farm4.static.flickr.com/3243/2381321824_f6898a8d52_m.jpg" border="0" alt="" /></a><br />
<small><a title="creative commons" href="http://www.photodropper.com/creative-commons/" target="_blank"><img src="http://deftlabs.com/wp-content/plugins/photo_dropper/images/cc.png" border="0" alt="Creative Commons License" width="16" height="16" align="top" /></a> <a href="http://www.photodropper.com/photos/" target="_blank">photo</a> credit: <a title="Lodewijk van den Broek" href="http://www.flickr.com/photos/12760128@N04/2381321824/" target="_blank">Lodewijk van den Broek</a></small></p>
<p>Cloud computing is garnering a lot of attention lately. There are wild rumors and announcements about Google, Microsoft, IBM and others entering the space. Additionally, startups like <a href="http://www.10gen.com/" target="_blank">10gen</a> and <a href="http://heroku.com/" target="_blank">Heroku</a> also appear to be working on the same problem.</p>
<p>Cloud computing will be a fast and drastic shift that will initially result in a lot of innovation on the Internet. Companies will no longer have to worry about plumbing when they decide to build web applications. Additionally, the barrier to entry to build sophisticated web applications will be significantly decreased.</p>
<p>In the next couple of years we expect to see a lot of cloud infrastructure deployed. Cloud platforms should be the fuel for the next tech boom. Of course we think it will be at least two years before cloud platforms are the norm (outside of startups).</p>
<p><strong>Why?</strong></p>
<p>Cloud computing is an essential evolution for the Internet. Power and space costs for server hosting are consistently increasing  and in the not-so-distant future, it will be difficult to justify Internet infrastructure if it&#8217;s not fully utilized. For example, a server that is 10% utilized does not consume that much less energy than a server running at 100% utilization.</p>
<p><a href="http://en.wikipedia.org/wiki/Multi-core_(computing)" target="_blank">Multi-core</a> CPU technology and <a href="http://en.wikipedia.org/wiki/Virtualization" target="_blank">virtualization</a> are the primary drivers behind cloud computing. With the upcoming availability of eight- core chips, you&#8217;re now able to pack 16+ CPUs in a single 1U server. Virtualization isn&#8217;t really a new concept, but the ability to run inexpensive or free virtualization software on commodity hardware makes the technology accessible to more companies.</p>
<p><strong>Development Costs</strong></p>
<p>The costs to develop, deploy, scale and maintain applications should be drastically reduced when using cloud platforms. Communal services and libraries on a platform will reduce the amount of code that must be written to develop sophisticated applications.</p>
<p><strong>Job Security</strong></p>
<p>If you&#8217;re a system or network admin you may want to consider taking some classes. Cloud computing will drastically reduce the number of admin jobs because these positions will be outsourced to the cloud platforms. Engineers should also take note. The number of engineers needed to write applications will also be reduced. Most platforms will build <a href="http://deftlabs.com/2008/04/browser-based-web-development/" target="_blank">sophisticated development environments</a> that will allow engineers to use more visual tools to quickly assemble/extend applications.</p>
<p>It looks like <a href="http://www.10gen.com/jobs" target="_blank">10gen is hiring</a> if you&#8217;re in the market.</p>
<p><a href="http://www.flickr.com/photos/89365565@N00/2386082270/" target="_blank"><img src="http://farm4.static.flickr.com/3149/2386082270_1c822ab6a0_m.jpg" border="0" alt="" /></a><br />
<small><a title="creative commons" href="http://www.photodropper.com/creative-commons/" target="_blank"><img src="http://deftlabs.com/wp-content/plugins/photo_dropper/images/cc.png" border="0" alt="Creative Commons License" width="16" height="16" align="top" /></a> <a href="http://www.photodropper.com/photos/" target="_blank">photo</a> credit: <a title="L-plate big cheese" href="http://www.flickr.com/photos/89365565@N00/2386082270/" target="_blank">L-plate big cheese</a></small></p>
<p><strong>The Long Haul</strong></p>
<p>The problem with cloud computing comes down the road. If there aren&#8217;t constant improvements/extensions to cloud platforms, there will be a lull in innovation. We predict that in a few years there will be several primary platform providers. Hopefully, the competition between these companies will be sufficient to force the platforms to innovate.</p>
<p>Vendor lock-in is potentially a huge problem. If you&#8217;re only able to run your applications on one platform, you&#8217;re essentially stuck with your cloud vendor. We think that the <a href="http://wordpress.org/" target="_blank">WordPress</a> model will prevail. WordPress&#8217;s blogging software is free to download, modify and use. Additionally, WordPress offers a hosted platform which provides free and paid services based on usage and functionality.</p>
<p><strong>More Info</strong></p>
<p>Here are some interesting links we found while researching this post:</p>
<ul>
<li><a href="http://en.wikipedia.org/wiki/Cloud_computing" target="_blank">Cloud Computing &#8211; Wikipedia</a></li>
<li><a href="http://gigaom.com/2008/02/28/how-cloud-utility-computing-are-different/" target="_blank"> How Cloud &amp; Utility Computing Are Different</a></li>
<li><a href="http://smoothspan.wordpress.com/2008/02/12/when-do-the-saas-acquisition-games-begin-a-primer-on-cloud-computing-market-segments/" target="_blank"> When Do The SaaS Acquisition Games Begin?</a></li>
<li><a href="http://www.roughtype.com/archives/2008/03/rumor_microsoft.php" target="_blank">Rumor: Microsoft about to unveil web-apps strategy</a></li>
<li><a href="http://highscalability.com/rumors-signs-and-portents-concerning-freeish-google-cloud" target="_blank">Rumors of Signs and Portents Concerning Freeish Google Cloud</a></li>
<li><a href="http://blog.pmarca.com/2007/09/the-three-kinds.html" target="_blank">The three kinds of platforms you meet on the Internet </a></li>
<li><a href="http://www.unionsquareventures.com/2007/09/i_want_a_new_pl.html" target="_blank">I Want a New Platform </a></li>
<li><a href="http://www.wired.com/wired/archive/14.10/cloudware.html" target="_blank">The Information Factories</a></li>
</ul>
]]></content:encoded>
			<wfw:commentRss>http://deftlabs.com/2008/04/gazing-into-the-clouds/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>Browser-Based Web Development</title>
		<link>http://deftlabs.com/2008/04/browser-based-web-development/</link>
		<comments>http://deftlabs.com/2008/04/browser-based-web-development/#comments</comments>
		<pubDate>Wed, 02 Apr 2008 16:50:16 +0000</pubDate>
		<dc:creator>Ryan</dc:creator>
				<category><![CDATA[Research]]></category>
		<category><![CDATA[browser]]></category>
		<category><![CDATA[development]]></category>
		<category><![CDATA[editor]]></category>

		<guid isPermaLink="false">http://deftlabs.com/2008/04/browser-based-web-development/</guid>
		<description><![CDATA[For the last few decades, there have been two primary methods for developing software. The first is the remote model where engineers write software on a networked server. Typically, an engineer will open a remote terminal session and use either Vim or Emacs to edit source files. The other, and more popular model (currently), is [...]]]></description>
			<content:encoded><![CDATA[<p><img style="padding-right: 10px" src="http://deftlabs.com/wp-content/uploads/2008/04/editor.gif" alt="editor.gif" align="left" />For the last few decades, there have been two primary methods for developing software. The first is the remote model where engineers write software on a networked server. Typically, an engineer will open a remote terminal session and use either <a href="http://en.wikipedia.org/wiki/Vim_(text_editor)" target="_blank">Vim</a> or <a href="http://en.wikipedia.org/wiki/Emacs" target="_blank">Emacs</a> to edit source files. The other, and more popular model (currently), is local development. An engineer pulls a copy of the source to a local computer and periodically push changes back to a central repository. Both models of development work and each style has its own strengths and weaknesses. Researching both models, it is clear that a new method for development is on the horizon &#8212; browser-based web development.<strong><br />
</strong></p>
<p><strong>Local Development Issues</strong></p>
<p>Local development has issues with intellectual property (IP). Companies do not want to expose <em id="un1w">all</em> their IP to engineers, nor do they want to provide a simple way of moving that information from one computer to another.</p>
<p>From a practical standpoint, centralizing a team of engineers on a web-based editor simplifies development needs and reduces the costs associated with local/native editors. Open source local editors still have costs surrounding developer setup time and synchronization of configuration amongst team members.</p>
<p>Browser-based source editing reduces the risk of environmental differences. When engineers write code on a local machine the likelihood that all computers will remain in sync with the production servers is decreased.</p>
<p><strong>Remote Development Issues</strong></p>
<p>Granting engineers shell access on a remote server can open up a host of security issues. An organization must thoroughly (and continuously) audit the security of their servers to make sure they&#8217;re not susceptible to exploitation.</p>
<p>Remote server development has been out of style for a few years because of the tools available. Vim and Emacs are incredibly powerful tools that include most of the functionality (as well as a lot of additional tools) found in modern IDEs. However, the learning curve for these editors can be overwhelming for some engineers.</p>
<p><strong>The Future</strong></p>
<p>Expect to start using browser-based editors in the next several years. If you&#8217;re a Vi user, don&#8217;t worry, there is already a <a href="http://gpl.internetconnection.net/vi/" target="_blank">JavaScript version available</a> :-)</p>
<p>Happy coding!</p>
]]></content:encoded>
			<wfw:commentRss>http://deftlabs.com/2008/04/browser-based-web-development/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Notes on Android</title>
		<link>http://deftlabs.com/2007/12/notes-on-android/</link>
		<comments>http://deftlabs.com/2007/12/notes-on-android/#comments</comments>
		<pubDate>Fri, 21 Dec 2007 16:11:00 +0000</pubDate>
		<dc:creator>Ryan</dc:creator>
				<category><![CDATA[Research]]></category>
		<category><![CDATA[Android]]></category>
		<category><![CDATA[google]]></category>
		<category><![CDATA[mobile]]></category>

		<guid isPermaLink="false">http://blog.deftlabs.com/2007/12/21/notes-on-android/</guid>
		<description><![CDATA[Over the holidays we researched Google&#8217;s Android. We assembled a lot of information but never finished documenting our analysis. Here are our notes. In case you&#8217;ve been hiding under a rock for the last month, Android is Google&#8217;s new mobile operating system. In August of 2005, Google acquired Android from a company founded by Andy [...]]]></description>
			<content:encoded><![CDATA[<p><a href="http://bp2.blogger.com/_FBrleHWhb_4/R2vrkEalbYI/AAAAAAAAEKM/qCN7B25uvNI/s1600-h/logo_android.gif" onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}"><img id="BLOGGER_PHOTO_ID_5146466004093988226" style="cursor: pointer" src="http://bp2.blogger.com/_FBrleHWhb_4/R2vrkEalbYI/AAAAAAAAEKM/qCN7B25uvNI/s320/logo_android.gif" border="0" alt="" /></a><br />
Over the holidays we researched Google&#8217;s Android. We assembled a lot of information but never finished documenting our analysis. Here are our notes.</p>
<p>In case you&#8217;ve been hiding under a rock for the last month, <a href="http://code.google.com/android">Android</a> is Google&#8217;s new <a href="http://en.wikipedia.org/wiki/Android_%28mobile_phone_platform%29">mobile operating system</a>. In August of 2005, Google <a href="http://www.news.com/8301-10784_3-5837102-7.html">acquired Android</a> from a company founded by Andy Rubin, Rich Miner, Nick Sears and Chris White. Android and the Open Handset Alliance were <a href="http://www.techcrunch.com/2007/11/05/breaking-google-announces-android-and-open-handset-alliance/">officially announced</a> in November 2007.</p>
<p><span style="font-weight: bold">Open Handset Alliance</span></p>
<p>In a move to help mobile carriers escape the pressure from closed and proprietary technologies, Google has created the Open Handset Alliance. This coterie includes Sprint and several strong European and Asian mobile operators. Currently, AT&amp;T and Verizon are noticeably absent on the <a href="http://www.openhandsetalliance.com/oha_members.html">official member&#8217;s page</a>, although there are rumors about their participation floating around.</p>
<p>From a hardware perspective there is a strong list of supporters and from a software/service perspective there is also an impressive list of companies. For years, software companies have had a difficult time gaining real estate on mobile devices. Often, application providers have to port their software to a half a dozen different mobile platforms if they want consistent distribution. With operating conditions like this, it&#8217;s no wonder that Google pushed this through.</p>
<p><span style="font-weight: bold">Developer Contest</span></p>
<p>In an effort to guarantee developers create Crowdware applications for Android, Google has announced a <a href="http://code.google.com/android/adc.html">$10 million competition</a> beginning on January 02, 2008. We think developer competitions are a fantastic way to stimulate market growth. We don&#8217;t think competitions like this are for all tech companies, but if you&#8217;re able to garner the attention of a large group and the bounty is adequate, you should see good results.</p>
<p>A note to developers: don&#8217;t bother writing yet another Twitter-style application for Android. Google recently acquired <a href="http://jaiku.com/">Jaiku</a>, a Twitter clone. If you want to write a good communication app, <a href="http://en.wikipedia.org/wiki/Mashup_%28web_application_hybrid%29">mashup</a> all the existing Twitter style APIs (Twitter, Jaiku, Tumblr, etc.) into an innovative interface. Make sure your app has some restraint when pulling data. You&#8217;ll kill the battery if you suck on the Internet connection too much.</p>
<p><span style="font-weight: bold">Alternatives</span></p>
<p><a href="http://www.buglabs.net/">Bug Labs</a> and <a href="http://www.openmoko.com/">OpenMoku</a> are both open source mobile device platforms that engineers might like; however, they don&#8217;t have development competitions or the backing of Google.</p>
<p><span style="font-weight: bold">Wallpaper</span><br />
<a href="http://bp2.blogger.com/_FBrleHWhb_4/R2v2-EalbZI/AAAAAAAAEKU/K0C9qKU8VIc/s1600-h/android-wallpaper5_1024x768.jpg" onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}"><img id="BLOGGER_PHOTO_ID_5146478545398492562" style="cursor: pointer" src="http://bp2.blogger.com/_FBrleHWhb_4/R2v2-EalbZI/AAAAAAAAEKU/K0C9qKU8VIc/s320/android-wallpaper5_1024x768.jpg" border="0" alt="" /></a><br />
If you&#8217;re sick of your background Google has provided some <a href="http://code.google.com/android/goodies/">desktop images</a>. We imagine these backgrounds are popular at Google :-^</p>
<p><span style="font-weight: bold">Developer Tools</span></p>
<p><a href="http://code.google.com/p/android-positron/">Positron</a> &#8211; A nice unit test framework (uses JUnit).</p>
<p><a href="http://code.google.com/p/droiddraw/">DroidDraw</a> &#8211; A slick tool for creating layout foundation.</p>
<p><span style="font-weight: bold">Android Focused Sites</span></p>
<p><a href="http://openandroids.com">Open Android(s)</a></p>
<p><a href="http://www.helloandroid.com">Hello Android</a></p>
<p><a href="http://www.android-freeware.org">Android Freeware Directory</a></p>
<p><a href="http://googleandroidblog.blogspot.com">Google Android Blog</a></p>
<p><a href="http://droidr.com">Droidr</a></p>
<p><a href="http://davanum.wordpress.com">Show me the code!</a></p>
<p><span style="font-weight: bold">Misc Links</span></p>
<p><a href="http://www.openhandsetalliance.com/">Open Handset Alliance</a></p>
<p><a href="http://code.google.com/android">Official Android Developer Site</a></p>
<p><a href="http://en.wikipedia.org/wiki/Android_%28mobile_phone_platform%29">Android on Wikipedia</a></p>
]]></content:encoded>
			<wfw:commentRss>http://deftlabs.com/2007/12/notes-on-android/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Facebook Application Security</title>
		<link>http://deftlabs.com/2007/10/facebook-application-security/</link>
		<comments>http://deftlabs.com/2007/10/facebook-application-security/#comments</comments>
		<pubDate>Mon, 15 Oct 2007 14:33:00 +0000</pubDate>
		<dc:creator>Ryan</dc:creator>
				<category><![CDATA[Research]]></category>
		<category><![CDATA[facebook]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://blog.deftlabs.com/2007/10/15/facebook-application-security/</guid>
		<description><![CDATA[While developing Smart Links we spent a lot of time thinking about the security model of Facebook applications. We did this to ensure that our users have a reliable experience. Imagine how a user would feel if they went to view a link they added in the application and it wasn&#8217;t there. A doubt is [...]]]></description>
			<content:encoded><![CDATA[<p>While developing <a href="http://apps.facebook.com/smartlinks">Smart Links</a> we spent a lot of time thinking about the security model of Facebook applications. We did this to ensure that our users have a reliable experience. Imagine how a user would feel if they went to view a link they added in the application and it wasn&#8217;t there. A doubt is placed in their mind that the application doesn&#8217;t always work as expected. Perceptions of doubt are lethal for an application.</p>
<p>How does this relate to security? Apart from the lack of an SSL option, the only real issue we found is verifying data ownership. A request from the Facebook servers delivers a message that can be authenticated using a private key. This is great but what application developers need to consider is the ownership of the data and the action requested.</p>
<p>If an application were to blindly modify data based on a request action it would open up the possibility for spam and other malicious action. In <a href="http://apps.facebook.com/smartlinks/">Smart Links</a>, if we did not verify the ownership of the data in an action the application would be susceptible to user A modifying the data for user B. A piece of custom software/script would have to be written to exploit this weakness but it&#8217;s not outside the capabilities of most software engineers.</p>
<p>In a nutshell, this isn&#8217;t a weakness in the Facebook platform but a note for application developers that they need to consider security when developing.</p>
]]></content:encoded>
			<wfw:commentRss>http://deftlabs.com/2007/10/facebook-application-security/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
	</channel>
</rss>

