Security for the Services World
Chris Riley presents security issues threatening service based systems, examining security threats, presenting measures to reduce the risks, and mentioning available security frameworks.
Tracking change and innovation in the enterprise software development community
Posted by Gavin Terrill on Jan 28, 2008
The debate around Push versus Pull architecture has been resurrected, sparked by a posting from Jive Software's CTO Matt Tucker declaring that the push based approach of XMPP is the future for cloud services:
There's a new firestorm brewing in web services architectures. Cloud services are being talked up as a fundamental shift in web architecture that promises to move us from interconnected silos to a collaborative network of services whose sum is greater than its parts. The problem is that the protocols powering current cloud services; SOAP and a few other assorted HTTP-based protocols are all one way information exchanges. Therefore cloud services aren't real-time, won't scale, and often can't clear the firewall. So, it's time we blow up those barriers and come to Jesus about the protocol that will fuel the SaaS models of tomorrow--that solution is XMPP (also called Jabber) . Never heard of it? In just a couple of years Google, Apple, AOL, IBM, Livejournal and Jive have all jumped on board.
Matt states that the common approach of clients polling servers for updates over HTTP is inefficient, citing examples such as Tivo, Twitter and SalesForce, where polling has not been able to sufficiently scale:
Since the beginning of the Internet, if you wanted to sync services between two servers the most common solution was to have the client ping the host at regular intervals, which his known as polling. Polling is how most of us check our email. We ping our email server every few minutes to see if we got new mail. It's also how nearly all web services APIs work.
XMPP's profile has been steadily gaining since its inception as the protocol behind the open source IM server jabberd in 1998. XMPP's advantages include:
While initially targeted at IM, XMPP is now being used for a wide variety of applications. For example, this Internet-Draft proposal for sending notifications about syndicated resources using the Atom feed format opens up interesting possibilities for application integration. Matt says that the biggest hold up preventing further adoption is that it does not run over HTTP:
XMPP's largest hurdle is that its not HTTP, and common wisdom states everything new that's built must be web-based. That means we won't see a widespread application of XMPP in cloud services until a few more brave pioneers clear the path for the rest of us.
So what makes XMPP a good fit for cloud computing? Matt listed several items:
- It allows for easy two-way communication, so bye bye polling. It even has rich pub-sub functionality built-in.
- It's XML-based and easily extensible, perfect for both new instant messaging features and custom cloud services.
- It's efficient and proven to scale to millions of concurrent users on a single service (such as Google's GTalk). It also has a built-in worldwide federation model.
XMPP is not the only publish subscribe enabler getting a lot of interest from web application developers - Comet is seeing an uptake in interest, with Webtide CTO Greg Wilkins recently reporting supporting 20,000 users on an amazon EC2 backed server running Jetty and Cometd from Dojo. Unlike XMPP, Comet is based on HTTP, and in conjunction with The Bayeux Protocol, uses JSON to exchange data.
One question that is tempting to ask is how much scalability is needed, as Sean McGrath did when he pondered how far can you get with Pull versus Push in building Mashups:
The web - with all its concomitant bits'n'bobs from XML to RSS/Atom to AJAX - is an extremely good platform for pull-centric design. On the Web, if you try to pull some piece of information and something goes wrong, well you just pull again and again until you get it or give up. Nothing fancy. Just brutish repetition. Something machines are extremely good at. If you want to look at information from yesterday, you just go to the URL that contains yesterday's information. Nothing fancy. Just a simple naming convention that includes dates in URLs.
It will remain to be seen if XMPP is the future of cloud services, but one thing is for certain now: if you are a web application architect, you need to know about XMPP.
Innovation in Your Data Centre
Virtual Software Development Appliances Primer
Consolidation and Virtualization Are NOT Enough: The Case for Non-x86
The XACML Enabled Gateway -- The entrance to a New SOA Ecosystem
Chris Riley presents security issues threatening service based systems, examining security threats, presenting measures to reduce the risks, and mentioning available security frameworks.
This talk investigates technical issues encountered when moving to an Agile process.
Don Box and Amanda Laucher present “M”, a declarative language for building data models, domain models or external DSLs. Don Box's demos show some of M’s features and latest changes of the language.
It is four months since the SOA manifesto was announced; InfoQ interviewed the original author’s to get insight into the motivations and the process behind the initiative.
This article explains the impact memory barriers, or fences, have on the determinism of multi-threaded programs.
Schneider on 7 service testing fundamentals: thoroughly testing, large amounts of realistic data, security testing, high productivity, tracking test results, realistic loads, and proper governing.
This talk outlines innovations in tools, process, planning and culture emerging at the front lines of continuous delivery.
Amanda Laucher and Josh Graham introduce the audience to F# basics showing some of its main features, emphasizing what makes it better than imperative languages, and also showing F# code samples.
1 comment
Watch Thread Reply