Dragos Manolescu's (work) blog : web

Web Sandbox available under the Apache License

Dragos Manolescu — Wed, 28 Jan 2009 09:36:00 GMT

Earlier today we announced releasing the runtime code of the Web Sandbox available under the Open Source Apache License 2.0. The announcement has already been picked up by the blogosphere. Should you head over to the site check out the Web Slices samples we added with this release: weather and traffic.

Web Sandbox in Azure Color

Dragos Manolescu — Wed, 10 Dec 2008 08:37:37 GMT

Earlier today we rolled out an updated version of Live Labs Web Sandbox CTP, a technology for securing Web 2.0 through virtualization. This update incorporates new features on several fronts (more on that elsewhere). In this post I'd like to call out a new option for hosting the transformation component: the cloud, or more precisely the Azure Services Platform CTP. From the online documentation:

We insert the intercepting layer through a code transformation. By default this transformation executes server side, on our servers. Two additional options are available. If Silverlight is installed the transformation could execute client-side, thus saving the round-trip to the server. The transformation could also execute in the cloud, on the Azure Services Platform Community Technology Preview. (Note that the Azure transformation is enabled only when the gadget code is specified via a URL.)
The three options use the same codebase. The platform helped us extend the implementation, initially targeted at our server, to first cover the browser, and then to cover the cloud. Consequently, regardless of where it is hosted, the transformation should have the same result. You can choose which approach to use via the appropriate checkbox on the Sandbox experimentation pages.

Incidentally earlier today I also noticed that Web Sandbox (along with two other Live Labs projects I worked on) is now on the Windows Live Wikipedia page, in the Microsoft Live Labs section.

Live Labs Web Sandbox

Dragos Manolescu — Fri, 24 Oct 2008 08:37:04 GMT

Earlier today we launched a technology preview for Web Sandbox, a project aimed at securing Web 2.0. The Sandbox applies techniques from programming languages to inject an interception layer that in effect virtualizes the execution of untrusted code in the browser. Among other interesting things the interception layer also gives us an opportunity to normalize the DOM API exposed to developers. Take it for a spin in your favorite browser--4 popular browsers shown below--and come the session Live Labs Web Sandbox: Securing Mash-ups, Site Extensibility, and Gadgets that Scott Isaacs and myself will run next week at PDC2008.

Web 2.0 Patterns Wiki

Dragos Manolescu — Wed, 09 Jul 2008 16:23:13 GMT

Last week a group comprising Felix Nyffenegger, Judith Bishop, Duane Nickull, Marco Brambilla, Marco Egli, Michael Mahemoff, Patrice Pelland, Petri Selonen, Steve Burns, Wolf Logan, and Wei Wei joined me and Joe Yoder at the Web 2.0 pattern mining workshop at ETH Zuerich.

Several clusters emerged around the workshop's presentations. For example, Patrice and Wolf's coverage of gadgets and gadget platforms pushed our exploration to the UI/glass. Some of the common traits include:

Provide an open platform
Support several technologies (JavaScript, Silverlight, Flash)
Package applications as gadgets
Extend instrumentation to include the client
Provider feeds raw content, users create personalized mashups

Also on the first day Duane and Steve's coverage of cloud-hosted services brought forth the following:

Execution context awareness
Scale services up and down

Add more capacity quickly, only when you need it
Remove capacity when you no longer need it

Leverage analytics-increase awareness of server utilization
Abstract out the hardware

Push into the cloud
Leverage virtualization

On the second day Michael's focus on gadgets and OpenSocial directed us to paleosocial patterns, while Felix and Marco's coverage of Web 2.0 site navigation put on the table vizualizations (e.g., debategraph.com, tafiti.com), presentation shifting (e.g., piclens.com, Photosynth), and others.

During the workshop we also designed a web-based video player that surfaced many of the solutions we looked into. Besides reminding us what it's like to use a real blackboard this exercise helped cluster some of the emerging themes:

Key-value store: Amazon Dynamo/S3, BigTable (Google)
Streaming: Hulu, YouTube streaming (not Flash)
Client time synchro service: NTP, MMORPG
Social network integration services: Oauth, OpenID/Passport
Mash-up engine: PopFly, Yahoo! pipes
Monetization (social cash -> $, analytics, instrumentation): AdSense, witkey.com, SiteMeter, Elance
Video: Vime, Nicovideo.jp, Jaman.com
Mood: Musicovery, Yahoo! IM, Nabaztag.com
Friend states: Twitter
IM: Facebook/MySpace, Twitter, Shoutbox
Recommendations: Tuneglue, Netflix, Facebook

We are planning on fleshing out some of the emerging patterns as a a distributed, collaborative endeavor. We have a wiki site to provide the locus of collaboration for this work. For the moment only the folks who attended the workshop could add and change the content. I expect that to change as the content shapes up so stay tuned.

Web 2.0 Pattern Mining Workshop

Dragos Manolescu — Tue, 24 Jun 2008 20:20:21 GMT

Monday June 30 we're kicking off the Web 2.0 Pattern Mining Workshop at the TOOLS Europe conference, in Zurich, Switzerland. The submitted proposals focus on gadgets/widgets, gadget platforms, site navigation, and services. So far the confirmed participants include (some of the) people behind:

The workshop spans over 2 days and includes presentations, brainstorming, and pattern mining sessions, as well as 2 related keynotes:

Day	Time	Event
Monday, June 30	11:00-11:30	1. Introductions 2. Gadget Platforms: Patrice Pelland and Wolf Logan 3. Services in Web 2.0: Steven Burns and Duane Nickull
	13:00-14:30	Lunch break
	14:30-15:30	Keynote: Michael Mahemoff
	15:30-16:00	Brainstorming
	16:00-16:30	Coffee break
	16:30-18:00	Patterning mining 1
Tuesday, July 1	11:00-13:00	1. Summary of results from Day 1 2. Gadgets: Michael Mahemoff 3. Web 2.0 Navigation: Fleix Nyffenegger and Marco Egli
	13:00-14:30	Lunch break
	14:30-15:30	Keynote: Erik Meijer
	15:30-16:00	Brainstorming
	16:00-16:30	Coffee break
	16:30-18:00	Patterning mining 2 and closing

Anybody is welcome to participate, even if they haven't submitted proposals. We expect those folks to:

Read the submissions (links in the workshop's page)
Select 3-5 Web 2.0 sites relevant to the workshop's topics
Post to the TOOLS social networking site a brief explanation about why they selected these sites

See you there!

Web 2.0 Patterns

Dragos Manolescu — Fri, 21 Mar 2008 16:46:08 GMT

During the last decade software patterns emerged as one of the most successful forms of reuse. The Gang of Four 23 Design Patterns, the POSA Architecture Patterns, Fowler's Enterprise Application Patterns, or the xUnit Test Patterns (to name just a few) changed in a fundamental way the way we craft software.

If you are involved with applications that employ:

Folksonomies
Microformats
REST, XML, or JSON-based APIs
AJAX and RIAs
Syndication and aggregation (RSS, Atom)
Mashups
Blogs, wikis, social media, or other types of user-generated content

and are interested in patterns covering these topics then join us at the Web 2.0 Pattern Mining Workshop at the TOOLS-Europe 2008 conference, the 46th International Conference on Objects, Models, Components and Patterns. Participation in the workshop is open to anybody who could contribute to Web 2.0 patterns. See the call for participation online and drop me a line if you have questions.

Volta: The Power of Lingua Franca

Dragos Manolescu — Thu, 06 Dec 2007 10:25:50 GMT

Earlier today we released the Live Labs Volta Technology Preview. There are already a few blog posts covering Volta from several team members, including Danny van Velzen, Harish Kantamneni, Jeffrey van Gogh, and Wes Dyer; Erik Meijer also posted an entry on Lambda-the-ultimate. Here I'd like to clarify an aspect that is starting to come up in other conversations: the power of lingua franca.

Here's the flow of transformations from source code (C# in this example) to native code, without Volta:

The Volta recompiler works on MSIL, the intermediate language that .NET languages such as C#, VB or Iron Python are compiled to. Consequently, Volta alters the above flow by introducing another transformation of the MSIL. This transformation rewrites MSIL into MSIL, while adding the plumbing code for distribution and asynchronous method invocation. This is precisely where Volta pushes the corresponding accidental complexity, thus getting it out of the way. The following diagram shows this modified flow, when both the client and the tier-split service are running on the CLR.

A similar MSIL transformation provides the ability to stretch the reach of the .NET platform to cover the cloud through retargeting. Rather than rewriting MSIL into MSIL Volta rewrites it into JavaScript. The following diagram shows the retargeting flow, when the client runs in a DHTML browser and the service on the CLR.

The above sketches illustrate the power of lingua franca. By working on MSIL rather than source code Volta gives developers the freedom to use any .NET language, the ability to mix multiple languages, as well as leverages the hard work of the compiler writers (think optimizations, for example). In addition, avoiding source code is less brittle and accommodates high-level language evolution as long as the MSIL doesn't change.

Guidance on Model-View-... Variants

Dragos Manolescu — Tue, 28 Aug 2007 07:27:00 GMT

Rcently I've been part of several conversations on the differences between Model-View-Controller and Model-View-Presenter. While reviewing the original articles (i.e., Krasner + Pope and Potel) which I read years ago I ran into many different, and sometimes incomplete or even incorrect interpretations and renditions. Following this experience I bet that MVC and MVP are the most misunderstood popular patterns. Answers to questions such as Why have you used MVP? or What's are the salient traits that determine whether a triad is still an MVP? are leading me to believe that many folks would welcome guidance about these patterns (including their relationsip). What's the best side by side MVC/MVP explanation you've seen? Would something like that make your life easier?

What is a LOB application?

Dragos Manolescu — Thu, 19 Jul 2007 19:34:00 GMT

I wanted to blog about this topic for a while so I might as well make it the first post. Line of Business (LOB) applications come up quite frequently in conversations around me. However I'm not sure whether everybody has a common understanding of what that means. They're business rather than consumer applications, but what else? There's one definition here but is it sufficient? I've brainstormed LOB applications with p&p's Web Client team, weaved the results with my consulting experience with Global 1000 companies, and came up with a few traits (I'm sure there are more).

LOB applications are (in no particular order):

Interactive--self explanatory
Have multiple screens--the interaction happens on screens, and typically several of them are involved
Domain specific--examples include finance, insurance, health care, telecom, and e-commerce applications
OLTP--transaction processing rather than analytical processing
Have relatively simple user interface/presentation--text fields, checkboxes, buttons
Integrate with other systems that manage the data and execute the transactions--databases, systems of record, etc.

Do the above chracteristics represent a tall order? It depends. Here's just one data point to consider. A while back I followed the flow of a claim to understand the claim processing workflow. That particular claim processor (like pretty much all the other insurance companies I worked with) ran claims through a legacy application running on a mainframe. The folks working with the application used green screens to enter the claim information and process the claim. If you've never seen a mainframe before, this translates into very fast response times (when navigating, validating, pulling reference data, and moving from one screen to another) and keyboard-intensive navigation and input (typically with all those function keys performing some action). This may be a tall order if you're building a browser-based application.

[Update] The point about relatively simple UI warrants an explanation. Don't read it as "LOB applications ought to have boring UIs." Far from it. But if you find yourself implementing the functionality of a windowing system or that of a portal site, it's likely that you're over engineering.