Best of this Week Summary 29 December - 11 January 2009

• Interesting comparison whether and when to use SOAP or REST.
  


• OpenSocial now has Java, PHP, Ruby and Python client libraries available.
  


• A few weeks ago, PKI which uses MD5 as cryptographic hash function, has now officially been broken at the hackers convention Chaos Communication Congress 2008. Six Certificate Authorities still give out MD5-signed certificates as mentioned in the article. Since 2004 it is already known that MD5-collisions can be created for different data. Therefore, certificates should be issued with at least SHA-1 encryption. Here's a summary of what an MD5 collision is and what Mozilla and Microsoft issued as advisories. Additionally some (other) SSL issues are described.
  


• Nice summary of lessons learned during a project using GWT, Axis and JPA. Some more comments here.
  


• Paper by Kate McKinley (a researcher at iSec Partners, a San Francisco security firm) on the privacy protection mechanisms of FireFox, Chrome, IE and Safari. Conclusion: "We find current browsers are unable to extend tracking protection to third party plug-ins such as Google Gears and Adobe Flash. Some of these require no user prompting under common configurations and even expose tracking data saved with one browser sites visited by a different browser. [...] Safari on Windows fared the worst of all in these tests with respect to private browsing, and did not clear any data at all, either before entering or after exiting the private mode. On OS X, Safari’s behavior was quirky; in no case was the HTML 5 database storage cleared before or after private browsing.".
  

The iPhone Push Notification Service: what to watch out for

This week Apple introduced its Push Notification Service API to a restricted set of developers.
What's so special about this? The new iphone 3G does not allow developers create applications that can run in the background. An example would be a chat application for Facebook that sounds a 'ping' when one of your contacts goes online; this chat application would need to be running all the time on your iphone and now and then ask the server "anybody new?". Or it just has to sit listening for a message from the server telling that one of your contacts logged on.
This push notification service sits between the 3rd party server (e.g the facebook application server) and the iphone device. See here for a clear basic architecture picture. It allows any 3rd party server to contact this Apple(!) service, which in turn then contacts the related iphone device. This means Apple will have all the knowledge of all the 3rd party applications and their communication with the connected iphones!! Scary. This sounds sooo Microsoft.
Here's another post dedicated to this too.

Best of this Week Summary 14 July - 20 July 2008

• Real world cases used to describe vertical scaling for Java EE applications. Definitely check also the comments.
  


• An interesting theory and technology: host-proof hosting. This is a technique where the browser encrypts the data to be stored on the server, such that the host (application) only sees encrypted data, thus completely preventing the host from seeing the actual contents of the user data. Thus enables for "zero knowledge web applications". Two examples of implementations are Clipperz (sourcecode partially AGPL v3) and Passpack (sourcecode MIT license).
  
  
• Visualize your code in CVS with this Visual Code Navigator. Too bad that's CVS, which is quite old. Hopefully there'll be an SVN version soon!
  


• Sun this week released their
  Sun Java Mobile Enterprise Platform 1.0: "MEP is a framework for developing mobile enterprise applications. Based on robust synchronization technologies, it enables enterprise users to synchronize enterprise data (from back-end systems like Siebel or SAP) with their mobile devices. In a nutshell, MEP enables enterprise users to carry the enterprise in their pockets". You can get a free evaluation here.