Developing an on-demand platform that must deliver speed, scalability and stability requires a lot of thinking about performance. While working on Bungee Connect, I’ve done enough code optimizations, tweaks, hacks, anything really to squeeze more performance to know that I need to pay attention to the details up front. Not to poke the “don’t optimize until it’s done” beehive, but I’ve learned enough to know that there are some things you can learn from experience and you don’t have to wait for the performance guys to laugh at your code.

Have you ever debugged a crash where a null pointer was being dereferenced and when you tracked down the individual responsible their defense was that checking for null would slow down the system?  Have you ever found someone that wrote their own atoi function because they swore that the standard c runtime’s implementation was bad?

If you read my previous post you’ll know that I’ve been playing with the V8 JavaScript engine by Google.  I’ve enjoyed learning a new system and gleaning tricks from other programmers that you don’t get from reading a book or taking a class. But something has been gnawing on my mind for the last little while and that is how fast or slow is the bridge between the v8 engine and a c++ application that embeds it.  I wondered whether or not a developer should be worried about the performance of this bridge or if they should forget about performance for now and just start turning the crank on features. So I wrote a little performance test to see how long different areas of the V8 integration into an application take. By the way, the Google engineers that wrote this system are very solid in terms of coding standards, efficiency and readability.

These benchmarks aren’t the most scientific in nature but they do give me something to start kicking around.  Here’s the JavaScript test that I wrote and embedded into my test:

var count = 0;

function timed_dispatch() {
count += 1;
}

start = new Date();

// Test 1
for (i = 0; i < 1000000; i++) {
count += 1;
}

// get the time and print the results
end = new Date();
print(end - start);

// reset the counter and the start timer
count = 0;
start = new Date();

// Test 2
for (i = 0; i < 1000000; i++) {
timed_dispatch();
}

end = new Date();
print(end - start);

// Setup for Test 3
timed_obj = new TimedCPPDispatch();
start = new Date();

// Test 3
for (i = 0; i < 1000000; i++) {
timed_obj.empty();
}

end = new Date();
print(end - start);”);

The first for loop measures how long it takes V8 to do some simple arithmetic on a variable.  I started with 10,000 iterations but the numbers were too small so I bumped it up to 1,000,000.  The output of the first print statement was 16ms.  Pretty quick.

The second for loop looks at how long it takes to do a method dispatch that increments the same number.  Adding the overhead of the function call took the time up 4ms for a grande total of 20ms.

The last for loop uses a C++ class that I created that has a function called empty.  This function literally does nothing except for return.  What I’m looking for is how long the act of dispatching a method from the javascript to the c++ application takes.  It took a total of 1500ms or 1.5 seconds to call 1,000,000 times.

Obviously, if you can avoid crossing the boundaries between your application and the V8 engine you will be saving some overhead.  Two orders of magnitude difference is nothing to sneeze at.  However, 1.5 us (microseconds) per function call is not bad for an embedded vm.  And, I don’t expect anybody to be doing a million of those. On top of that, once you cross the boundary you’re still running in c++ code, which isn’t too shabby with performance either.  If you have some complicated c++ algorithm that you are calling then a 1.5 us boundary becomes noise and is not an issue.  So, the old adage of not optimizing too soon would appear to still hold a lot of water in this argument and I should hold off on looking to outsmart myself before that’s really necessary.  I should probably be looking to add features to my application rather than trying to figure out a priori where my code might be slowing down.

If you’re interested in checking out V8’s performance numbers for running straight JavaScript head on over to http://code.google.com/apis/v8/run.html or download the V8 engine and run them on your machine.

The illustrious BCDN member Bear454 has contributed a Basecamp API for Bungee Connect. Bear454 outlines how you can use this api in your own project and promises to maintain it until a better one is contributed. Go check it out.

Brad

The October system update for Bungee Connect went live on October 21.

For a more thorough list of this release’s new features, enhancements and bug fixes, review the Preview Announcement from September 26.

A few of the new features are worthy of a quick how-to video, so read on.

No More Pages in AppProjects
We simplified the AppProject container by eliminating the need for Pages. Any AppProjects that existed prior to the update will still have whatever pages they had before, but be sure to update your AppProjects before trying to update any existing deployed applications.

Here’s a short video to explain more.

“Publish” Tab Replaces “Staging” Tab
The new Publish tab makes it easier to manage your posts, deployments, and shares, especially when you have multiple solutions in various DesignGroups.

Here’s a short video to show you how.

Custom FavIcon Support
The much-requested support for specifying a FavIcons has finally arrived. Now when users bookmark your Bungee-powered application, they’ll see the icon of your choice.

Here’s a brief video to show how to implement a FavIcon.

Again, there is a whole lot more in this release, so check out the Preview Announcement from September 26.

Ted Haeger
Director, Bungee Connect Developer Network

This month’s newsletter was sent to all BCDN developers on Wednesday, October 8, 2008.

Since sending the email, there has been one modification to the original newsletter’s information. The new release of Bungee Connect will happen on Monday, October 13, not today. (I forgot about a cardinal rule of new releases, as set by BCDN members: never do a system update on a Friday. My bad!)

Hey, everyone:

It’s been a while since the last Bungee Connect Developer Network update, and we have been cooking up some great stuff for you. Let’s get to it.

Master Bungee Connect: The Learn Tab

The Learn tab provides you with the essential Programmer’s Guide material to Bungee Connect. Through hands-on activities, code examples, and short videos that quickly cover key concepts, this is your fast track to master the fundamentals of Bungee Connect. Reaction to it has been very positive.

“I’ve been through Units 1 & 2 of the new [Learn tab]. I found them very helpful. In fact, I think it’s the best example of on-line self-training that I’ve come across.” — Jan Varga, Amethon Solutions (Australia)

Now that it’s up and online, I challenge you to conquer it. As of today, any developer who passes all three Unit quizzes in the Learn tab will receive the BCDN Welcome Aboard Kit, which includes a Bungee Connect shirt. (You’ll be prompted for shipping information after passing the third quiz.)

Get going by logging onto Bungee Connect. The new Learn tab will be there waiting for you:

• Bookmark: https://builder.bungeeconnect.com?bl_username={your user name}
  

Bungee Connect Supports Google Chrome

Since our last update, Google announced their new browser, Google Chrome. Bungee Connect has aggressively supported the big three standard browsers (Firefox, Safari and Internet Explorer), and we typically keep other browsers at arm’s length. However, when Google talks, a lot of web geeks listen, and we knew that Chrome would soon be in high demand. That’s why Chrome has joined our list of officially supported browsers.

Try Bungee SQL Admin

Got a PostgreS or MySQL database? Need to set up tables or modify stored data? Bungee SQL Admin is a rich Internet application that lets anybody to rapidly manage MySQL & PostgreSQL database systems. The app was build on Bungee Connect, but you do not need a Bungee Connect account to use it.

Beside being a handy utility on its own, Bungee SQL Admin has been added to the list of Example Code available to BCDN developers, providing you with source code from which you can learn or freely create derivative works. (Look for it in the “Applications” section.)

Try out Bungee SQL Admin.

The Next Platform Update? (Coming on October 10 13)

We opened the latest BCDN Preview on September 26, allowing BCDN Developers early access to the latest features and updates. It comes a huge list of fixes, as our intrepid product manager Dave Brooksby explained in the BCDN Preview announcement.

On Friday Monday, October 10 13, we plan to update Bungee Connect (the current production platform) to the version currently used on the BCDN Preview. Until then, you can try out the new version at http://preview.bungeeconnect.com.

Changes for the BCDN Forums

The BCDN Forums are moving to Get Satisfaction. While at the O’Reilly Open Source Conference (OSCON) last summer, I did a lot of research (okay, mostly talking with geek friends) about web-based forums options. After a lot of testing, I was quite smitten with Get Satisfaction for how easy it is to use, how quickly it produces answers to commonly asked questions, and how it’s not a forums platform.

Over the next couple weeks, the community team will be integrating Bungee Connect and Get Satisfaction. Our first step is to get automatic account provisioning and single sign-on worked out. After that, we’ll bring the old forums content into the new system.

Feed Your Brain with Web-head Audio Interviews

Have you listened to our web development podcast, The Bungee Line?

• In the most recent edition, we chat with Scott Kveton of The Open Web Foundation.
• Another you may find very interesting is with Steve Bjorg discussing Deki, MindTouch’s programmable wiki. (In fact, we like Deki so much that Bungee Connect documentation will be migrating onto Deki during the month of October.)

That’s All For Now

As usual, there’s a lot more news than we can put into a short newsletter. Keep watching the BCDN Blog for ongoing updates. Lastly, you can always reply directly to this email if you have any questions.

—Ted

Ted Haeger
Director, Bungee Connect Developer Network
Bungee Labs

I’ve been playing around with Google’s V8 JavaScript engine. One of the really cool things about V8 is that it was built to be embedded into a C++ application. Here at Bungee Labs I’ve been writing the infrastructure for our bungee connect platform for some time now. One thing that I’m always interested in is speed and V8 is very fast. I ran the benchmarks that Google posted in my browser (Firefox 3.03), and then I ran them using the new V8 engine. The new engine is faster by an order of magnitude.

Getting your head wrapped around the V8 API takes some time. There is a very brief overview page that you can read to get started writing V8 applications, but you will have to spend quite a bit of time scouring the source code to figure out how to do anything of note. Most of the documentation focuses on how your js files can call into C++. For our purposes, I also needed to call into JavaScript from C++ and get information back from the V8 engine. Here is some code that does that.

Let’s say you have some JavaScript file that defines a function foo (you can’t have a coding exercise without a foo) that looks like the following:

function foo() {
return 42;
}


If you’ve embedded V8 into your C++ application you could call foo by doing the following:

void myClass::myFunction()
{
HandleScope scope;
LocalContext context;

Script::Compile(String::New("function foo() { return 42; }"))->Run();

Local fun = Local::Cast(context->Global()->Get(String::New("foo")));

int argc = 0;
Handle argv[] = NULL;

Handle result = fun->Call(fun, argc, argv); // argc and argv are your standard arguments to a function
…
}


What this does is it sends the JavaScript that I wrote to the V8 engine via the Compile and Run functions. Now, I need access to the foo function and I do that by getting the Function from the Global namespace. If my function took any parameters I could fill out the argv array and then the function would have access to those values just like any normal JavaScript function would. When I make the Call function I give it an object to be the receiver, itself in this case, and I pass the argument length and array. The value that is returned from the function is stored in the result variable.

So, that wasn’t too bad. It all makes sense once you see it. The hard part always is trying to figure that stuff out when you don’t know where to look.

Another thing I had to figure out was how to make a function call on an object instance. This is a bit more difficult but it’s really just a variation on a theme. Let’s say our JavaScript looks like this:

function bar() {
this.x = 42;

this.foo = function() {
return x;
}
}

I need to get a handle to the function constructor first so I do that here:

Handle fun = Handle::Cast(env->Global()->Get(String::New("bar")));

Now I can create an instance of this function with:

Handle<Object> object = fun->NewInstance(argc, argv);

Again argc and argv are your arguments to your function which in this case is bar. If bar took more parameters you would pass those in so that bar would be setup correctly.

Once I have an object I can ask it for it’s function that I want to call:

Handle fun_to_call = Handle::Cast(object->Get(String::New("foo")));

And finally I can call that function:

fun_to_call->Call(object, argc, argv);

Since I am using the same API function Call, I can expect a return value just like in the first example.

I’ve found V8 to be an excellent JavaScript engine, and it has a fantastic API. I’ll be using it for some of my internal projects and I’ll keep posting cool ideas as I run across them.

Corey Olsen
Senior Platform Engineer
Bungee Labs

The Core Curriculum in the Bungee Connect Learn tab is finally complete, online and available.

Said one BCDN Developer (who goes by the handle “olympyx”):

I think the combination of text overview, video, and use of the platform is a great way to learn the platform.

I first announced the Learn tab this past summer, thinking that the final piece, Unit 3, would be online by the end of July. We managed to get the first three modules online in short order, but the final two bedeviled me for some time. Nevertheless, I hereby declare the wait to be over.

You can now log on to Bungee Connect and complete the Core Curriculum and get your status ticker to look like this:

When you do, there’s a special surprise for you at the end–a little somethin’-somethin’ to recognize your achievement. But, you’ll have to finish the final Quiz to find out what it is.

–Ted

Ted Haeger
Director, Bungee Connect Developer Network
Bungee Labs

The next version of Bungee Connect is now available in preview to BCDN developers. As usual, the BCDN Preview will be online for two weeks before it rolls to production. Access it at https://preview.bungeeconnect.com.

The Preview once again has a recent snapshot of your solutions, but remember: the Preview release is for testing purposes. Any changes you make to your code will not be carried to production when the roll-up happens.

Of course, if you run into any issues, please leave a comment right here to let us know about them.

New Features:

• Publish tab: The Publish tab (formerly named “Deploy (beta)”) has now officially replaced the Staging tab. Use it to post, share or deploy your code and applications. You can still use the old Staging tab by enabling it in Builder Tab Preferences.
• Revision Status: If you collaborate with other developers, or maybe don’t always remember what classes you made changes to, you can now view the complete status of an entire solution by right-clicking it in the Solution Explorer and choosing ‘Revision Status.’
  
  

• Number Reformatting for Strings: The new FormatUtil class in Runtime (in TypeLib: Utility) enables you to do several format transformations on strings.
  
• AppProject Template and Deployment Requirements Changed: For those of you who have been using Bungee Connect for a while and have already deployed several applications, there’s a significant change to AppProjects that affects how you deploy applications. There will be more information in the docs when the release rolls to production. If you’re curious about the details of the changes, leave us a comment here, or find us in IRC.

Fixes and Code Changes:

As always, this release fixes many issues that the BCDN community have reported:

• 0007374: [Other] Dependencies are now copied with dependent projects when posting/deploying
• 0006019: [Controls / Interactions] Popups now more properly position relative to the current position of the parent window
• 0003372: [Controls / Interactions] You can now change Icon for the Google Map in its adapter
• 0007155: [Share] Shares and Posts can now be edited by the person who created them or the Design Group owner
• 0004790: [Controls / Interactions] Constructor interface for adding elements to a Collection now uses the proper element type for the collection
• 0007075: [Form Layout] re-sizing a grid no longer collapses other grid cells in specific cases
• 0007099: [Form Layout] box (horizontal) in vertical flow does now allows you view the bottom
• 0007074: [Form Layout] Grid no longer unintentionally re-sizing cells in a vertical flow
• 0007690: [Form Layout] IE7: letting go of the grid resize tick no longer removes a pixel from the height or width
• 0007680: [Controls / Interactions] Date/Time combo box drop-down arrow now works when setting as data in specific cases
• 0007572: [Form Layout] using the text “<select one>” in an enumeration is now cleaned and no longer breaks in the UI
• 0007243: [Controls / Interactions] Google Map now has a selection manager for pin elements
• 0007250: [Controls / Interactions] Google Map now has support for GLatLngBounds
• 0007268: [Controls / Interactions] Google Map more gracefully handles it when google fails to geocode an address
• 0007361: [Controls / Interactions] Wizard now instantiates GoogleMapDirectionsAdapter in correct location
• 0004614: [Other] You can now set a double to a value containing a decimal point using a site Data
• 0006076: [Controls / Interactions] HTML now has general mimetype out capability (Bear454, this one’s for you!)
• 0006723: [Other] SMPTClient now requires an SMPT server source in order to function
• 0005800: [Other] Key word “now” is ‘now’ working in an expression
• 0007381: [Solution Explorer] Deleting a project that contains multiple tiers of nested projects no longer only deletes immediate children
• 0007379: [Solution Explorer] After Importing a ResourceProject, nested project containers now check-in correctly
• 0007190: [SOAP/WSDL] WSDL import now handling “choice” correctly
• 0005715: [Other] You can now customize the <head> tags
• 0007091: [Code Editor] convertStrToNumber parameters for “fl” and “do” now work more predictably
• 0007420: [Code Editor] Separator bar no longer switches from Vertical to Horizontal if you merge any cell in a grid
• 0007412: [Code Editor] The Separator bar does now properly goes away when deleting the column that contains it.
• 0006969: [Code Editor] Outline of a StyleButton no longer appears separate from the button when a Horizontal Box in design mode
• 0007229: [Code Editor] Vertical box is no longer sized to a height of 0px when inside another vertical box
• 0007424: [Code Editor] More than one line is no longer improperly highlighted in the Code Editor
• 0007404: [Controls / Interactions] Radio button now honors the Multiline property
• 0007143: [Properties] “DateTime” property editor tab for MonthCalendar control is no longer missing
• 0005210: [Form Layout] Clicking on a Label that contains a link on a form no longer causes an exception
• 0007706: [Controls / Interactions] CollectionStatementComplete no longer chooses second item in filter list when list contains multiple items
• 0007708: [Controls / Interactions] CollectionStatementComplete no longer throws a JavaScript error if you resize the browser
• 0005949: [Properties] Stylesheet clear button now enabled when using a control style
• 0007528: [Controls / Interactions] DateTime Format in an MCL now works if the Edit Type is set to WriteOnly
• 0007408: [Controls / Interactions] Under certain circumstances, items added to CollectionStatementComplete never show up on the server
• 0007429: [Controls / Interactions] MonthCalendarList no longer crashes when setting number of columns
• 0007538: [Meta Runtime] You can now set a function trigger to a bag
• 0007593: [SOAP/WSDL] SOAP no longer replacing hostname with IP Address
• 0007647: [Properties] Setting Multiple Select to true after removing the Multiple Select Function Interfaces no longer causes a crash
• 0007697: [Other] PostRenderInit is now getting called during Debug
• 0005634: [Other] SQLConnection now returns the standard numRowsAffected() function to know how the query affected the database
• 0007316: [Controls / Interactions] Cross window drag and drop is fixed on Safari
• 0007183: [Controls / Interactions] “Default” behavior now works inside Horizontal Flow
• 0007080: [Code Editor] triggered function args no longer discarded before saving
• 0007640: [Controls / Interactions] Flying over a google pin no longer causes map to pan and balloon to popup it’s been told not to
• 0007466: [Controls / Interactions] Calling select() on a collection that is bound to a Google Map fixed
• 0007631: [Controls / Interactions] The system no longer crashes when using a google map without setting the pin icon
• 0007172: [Controls / Interactions] Leaving the icon in an MCL column to the default of “not_set” no longer breaks simulation
• 0007330: [Controls / Interactions] [Regression] Changing the position of points on a GoogleMap behaves more predictably
• 0007409: [Controls / Interactions] Radio buttons now work when Control Placement is set to Below Label
• 0007073: [Form Layout] Hyperlinked controls in form layout when clicked, no longer take over the design pane
• 0007341: [C++] datetime computations now working as documented taking seconds more accurately into account
• 0007421: [Code Editor] Debugger will now break if you have a breakpoint set to the last statement in a function

Brad Hintze and I will be in New York City this week for Web 2.0 Expo. Along with us are our CTO Dave Mitchell, and CEO Martin Plaehn. If you’d like to get together with any of us, please drop us a note, and we hope to see you in New York.

Bungee SQL Admin is a rich Internet application that enables Web 2.0 companies to rapidly manage MySQL & PostgreSQL database systems.

• No install
• No registration
• No cost

Click here to launch.

The Story Behind this Application

In August, Bungee Labs held our first ever “SkunkDay” event. SkunkDay provides Bungee Labs employees an opportunity to show off applications and utilities on which they have been secretly tinkering unbeknownst to their colleagues.

One of the winners was Herrick Muhlstein with his application, now known as “Bungee SQL Admin.” Rather than write all the details, Herrick tells us about his app in this video:

Herrick has made the complete source code for this application available through the Share in Bungee Connect. Register for a free account to get access.

If you have any questions about Bungee SQL Admin, please submit a comment for this post.

Stay tuned for more about the cool applications shown at Bungee Labs SkunkDay…

The Amazon Web Services crew are back on the road with their AWS Startup Tour, and Brad Hintze and I will be joining them tomorrow in Salt Lake City.

I’ll make a brief presentation around 3:30-ish, speaking about Bungee Connect and how Bungee Labs use Amazon Web Services. So if you’re in the area, please swing by to give Brad and me a hello.

Today, Bungee Labs announced our official move to support Google’s new browser, Google Chrome. See “Bungee Connect: First Platform-as-a-Service to Offer ‘Write Once, Run Anywhere’ Support for All Major Browsers, Including Google Chrome” for details.

Shortly after Google released the Chrome beta, our test team went to work to identify exactly what worked and what didn’t. They found that Google Chrome loaded and ran Bungee-powered applications with only a few issues, which we detail below.

Security, Bungee Connect and Google Chrome

Beyond the benefits Google Chrome brings to JavaScript performance, the team here also sees a big benefit in the area of security.

Google Chrome’s security approach fits well with Bungee Connect’s security architecture. Bungee Connect keeps all application data and logic out of browser, other than that which is currently being displayed to the user. This greatly reduces the surface area for potential attacks. Chrome complements this approach by “sandboxing” each browser tab as its own stand-alone process, preventing cross-tab attacks. The two approaches combine to dramatically reduce the risk of using JavaScript for web applications compared to other interactive web models.

More on the Bungee Connect security can be found in the FAQ.

Google Chrome’s JavaScript Issues for Bungee Connect

The issues that we have identified for Bungee-powered applications running in Google Chrome are as follows:

• Focus Issues (Some Controls Require Extra Click)
  There will be on-screen elements that you must click once in order to set focus to that item. Although you may see button ‘flyover’ effects happen. Typically, this happens when you move between different regions of the application window. We have yet to find a case in which this blocks an application’s intended functionality, but we definitely confirm that the issue is a nuisance that needs to be fixed.
• Drag & Drop Issues
  Drag/drop is not 100% predictable right now. Sometimes it works perfectly, but occasionally a ‘move’ action happens where the program is set to ‘copy.’ Sometimes, you can’t even initiate a drag operation (although this is sometimes just a focus issue, as described above). So far, this particular issue is perhaps the most serious we have seen.
• Modal Dialogs Sometimes Non-Modal
  Occasionally, a dialog pop-up may allow an end user to interact with the main application when it is not supposed to. Certainly this is better than having non-modal dialogs get forced to be modal, but it still can result in multiple problem scenarios, such as a key dialog getting lost behind a main application window, or critical workflow data not getting entered when it is needed.
• Default Action Broken on StyleButtons
  Lastly, we found a minor annoyance with how Google Chrome handles our StyleButton control. If a StyleButton has been flagged as “Default” (meaning it’s the default action for the Enter key), it doesn’t matter…you either have to click it with the mouse or tab over to it.

The Bungee Connect IDE is a Bungee-powered application, so it experiences the above issues. However, there is one issue that particularly affects developers using Bungee Connect with Google Chrome:

• Cannot Drag Controls onto Forms
  The previously-mentioned issues with drag & drop affect form construction consistently: you can’t add controls to a form in Google Chrome. (Although you can add Bungee Logic statements to a function. But you can’t re-arrange them. Go figure.) This is pretty much a showstopper for using the IDE with Chrome.

We intend to fully support the use of Bungee Connect’s IDE from Chrome before year-end.

In light of the recent announcement about Google Chrome, I found a couple articles particularly interesting:

• First, in “Chrome’s JavaScript poses challenge to Silverlight,” Microsoft apparently cites that JavaScript–not Flash–will be the biggest competitive threat to Silverlight.
• Second, in “New Firefox JavaScript engine is faster than Chrome’s V8,” Mozilla has responded to Google Chrome’s JavaScript speed claims by raising the bar still further.

If indeed Microsoft sees JavaScript as Silverlight’s biggest competitive threat, and Mozilla and Google are apparently squaring off for an arms race around JavaScript performance, this bodes extremely well for the future of web applications built on standards-based JavaScript.

Our product manager Dave Brooksby continues to test Google Chrome. Today he sent me a screenshot of our demo application for calendar management, WideLens.

Is it just me, or does Google Chrome look like it was designed for Bungee-powered applications?

(click image to embiggen)

Just to be clear, there are definitely some issues with some of the controls and interactions. One of our community developers reported that drag and drop is not working correctly, and we have found that some of the Bungee controls have to be clicked once to activate before you can interact with them. Still, we’re excited about how close to the mark Google has hit with Javascript support.

Dave sent me screenshots for a couple other Bungee-powered apps. So, stay tuned…

The first question we at Bungee Labs thought when we read the news about Google’s nifty new browser, Google Chrome, was: I wonder how it will do running Bungee Connect?

Google chose to use WebKit, the same rendering engine as Safari, which we support for Bungee Connect. So far, so good:

(click either image to embiggen)

But they also state that they chose to create a wholly new Javascript engine. Hrmmm…

In our early tests, we have found that there are at least a few controls that exhibit issues. Mostly, issues seem to be little interaction annoyances, such as having to click on a Tree control a second time before you can interact with it.

So, we make no formal announcement of support for Chrome yet (Come on! Chrome was just introduced and is still in beta!), but the Bungee Boys are smiling.

Recently I wrote about why rich interactivity matters but what are the concerns around it? Ajax has made new kinds of web applications possible by bringing interactivity usually seen only on the desktop to a web browser. Google Maps and countless other web applications have begun adding interactivity throughout the application.

It isn’t easy though. Many times interactivity is cobbled into existing applications with a mish-mash of code–creating a Frankenstein of multiple technologies and line-after-line of code. This approach is difficult to maintain and can open several security threats to the user, server and data.

When using javascript, two big security vulnerabilities include:

• Cross-site scripting (XSS) is a problem where code from another, potentially malicious, site is executed as if it were from a trusted site. This type of attack can result in identity theft and unauthorized access to data and subsystems.
• Injection vulnerabilities exist when an attacker can inject their own inputs into the web application and spoof certain commands to gain access to a file system or data set.

These are very important concerns for a business to consider as they begin adding interactivity to their site. Managing these risks requires a significant investment in time and resources throughout the life of an application.

Are these risks, and the cost of managing them, just the price of adding interactivity? At Bungee we don’t believe it is.

Bungee Connect takes a strong stance on security through a unique approach to these issues:

• Cross-site scripting is eliminated by moving the access to other domains and sites to the server, and never the client. In this way all requests and responses are parsed by the server then sent down to the client. If an issue is encountered the malicious code is not executed or passed through to the client.
• Injection vulnerabilities are reduced by removing all code from the client and leaving it on the server. In this way users (potential hackers) cannot see how the business logic is executed or what sub-systems or databases are accessed. By keeping this information away from the client it is impossible for the hacker to see which inputs are required for a specific function and replicate its request by sending malicious data. Instead of using specific client-side code, a genericized javascript engine is used to communicate between the client and server. This generic javascript engine uses unique identifiers to identify objects and functions. For additional security, these unique identifiers change with each session. In this way the Bungee Connect javascript engine acts like a security sandbox for any Bungee-powered application.
• The javascript payload is a single payload, it never changes as an application incrementally changes. The benefit here is that a security team can validate this package once and feel confident that any changes in the future will not open any vulnerabilities. Thus significantly reducing the amount of work required in delivering an application.

Users are requiring more interactivity, but that doesn’t mean you need to sacrifice security or increase your cost of delivering an application. By employing a generalized javascript engine through Bungee Connect you can securely and quickly add the interactivity you need with less development time and strong security.

Another Bungee-powered application has recently been added to Facebook. (This joins iRecommend, the Digg Comment Viewer, and FriendMapper.)

Created by Michael Walker (non-Bungee) and Brad Hintze (from the Bungee team), the beta release of “What is Your Best” is a social application for sharing your greatest moments, accomplishments, scores, and stories within your social network. For example, say you bowled a 271 last night. Want to brag about it and challenge your Facebook friends to do better? Well, cue the diabolical laughter, because now you can. (Void in states where mixing bowling and diabolical laughter is prohibited. I’m talking about you, Wisconsin.)

Next week, Bungee Labs will release a short video interview with Brad and Mike about the application, including why and how they created it and a short demo. However, if you want to get a sneak-peak at it, go to beta.whatisyourbest.com and check it out.

Yesterday, Bungee Labs released 15 regular employees and contractors. It was a difficult day for us. The people we hire are without exception highly talented, motivated, creative, and professional. We regret their departure deeply.

This change had less to do with the rate of technology development and more to do with actual versus anticipated rates of adoption. Our Platform-as-a-Service, Bungee Connect, has achieved the level of robustness and capability we envisioned and we are committed to its continued regular advancement and support. As with most new breakthrough offerings, Bungee Connect will require longer incubation time to become broadly accepted. As a start-up, our action yesterday extends our operating plan well into 2010 to more deeply establish Bungee Connect in the marketplace.

Today, our leaner team is concentrating its efforts on the following:

Demonstrating Enterprise-class Applications
The major assertions we made about Bungee Labs’ vision for a Platform-as-a-Service are that developing in and for the cloud must: i) produce much better and more productive applications for end-users with less total effort end-to-end, ii) enable applications to be automatically hosted for a fraction of the cost and complexity of self-hosting, and iii) enable applications to be iteratively and rapidly enhanced. Over the next several months, Bungee Labs will lay out the course for a business object solution framework for user configurable enterprise-class applications that demonstrate these principles.

Enhancing Bungee Connect Platform-as-a-Service
We continue to pursue our vision for Platform-as-a-Service described well over a year ago. Bungee Connect is now very capable, comprehensive, and a stable platform for building and hosting highly-interactive web-service and database driven applications. However, 100% cloud-based development and hosting is still a radically novel idea. Feedback from potential adopters have raised understandable concerns about it being too early, a new and different programming paradigm, a perceived proprietary stack, and a potential risk for vendor lock-in–as observed with most SaaS and cloud-base systems. We intend to address the core aspects of these concerns over the coming quarters through changes in our software and business policies/licenses.

Opening Bungee Connect
No matter how powerful a development platform may be, developers are both sophisticated and skeptical when selecting the frameworks and platforms they use. Bungee Connect leverages the work of many open source communities and is built on Linux, around Apache, and uses numerous open utility libraries. We have begun the process of opening our own source code via the publication and “solicitation for comments” on the Bungee Labs Community Source License (BCSL) which will provide no-fee source code access to Bungee’s full stack when we emerge from Beta. There are still several significant platform level modifications and enhancements needed before making the full source-code generally available. Additionally, we are evaluating other licenses to find the appropriate Open Source license or compatible set of Open Source licenses for a cloud-based world.

Community Interaction
Transformations for any business and team—especially ones with large ambitions—are exciting, and challenging. From the moment we opened access to Bungee Connect, first by private invitations in June 2007, then as an open beta in February 2008, Bungee Labs has been on a voyage of discovery. All along the journey, our community of developers and other technologists provided us ongoing advice, critique and support. As we evolve and take actions on the plans implied above, we’ll continue to use our blog as a central place for communication so that we can receive valuable feedback.

As always, we encourage you to engage with us to influence our plans and guide our actions.

Martin Plaehn
Chief Executive Officer
Bungee Labs

As we bid adieu to the Preview Build for our August release it is with equally unabashed pride that we annouce that the August Release has rolled out and is now live at:  http://builder.bungeeconnect.com.

See the previous post for a list of visible resolved issues and features. 

Thanks to our beta developers for the time they spent in the preview build.

My latest contribution to the Share, our BCDN shared code repository, is a library that wraps the Yahoo Geocoding API.

Yahoo provides an excellent API for getting the latitudes and longitudes of US-based addresses, which is an extremely helpful service for anyone working with the GoogleMap control in Bungee Connect. With the library now available, you can include the code in your own Bungee Connect solutions and use a single, simple function to get lats and longs for an address.

If you import the library into a new solution, you can simulate the example application in it to test the library. Since importing provides you with my complete source code, this also makes a good resource for understanding how to call a RESTful web service and convert its response into objects using our restUtility helper class.

In order to use the library, follow these steps in Bungee Connect:

1. Either create a new solution, or open an existing solution.
2. Select the solution in the Solution Explorer. (It’s the top-level container.)
3. Click the Modify Dependencies button.
4. In the Modify Dependencies dialog, click the Share tab.
5. Locate YahooGeocodingAPI and add it to you list of imports.
6. Select Import so that you can to look through the source code and run the sample app.

Once you have done that, the project notes will come up and explain how to use the library further.

We’ve rolled out a new Preview release to https://preview.bungeeconnect.com. This release focused primarily on bug fixes and enhancing the usability of existing features, so there’s not a lot of new functionality to talk about for this release. There are a couple things to call out before we get into the list of bug fixes though.

Deployment Tab
We continue to advance the new deployment tab, which is still in an alpha state. We’re working to make the tab more task based and more easily understood than the old Staging tab. The staging tab is still in this release, but in the next couple releases will be replaced with the new look/feel you see in the Deployments tab. Take a look and try it out. As always we’re looking for your feedback.

Tab list dropdown
The builder now has a drop down menu for all open tabs. This is especially useful for developers who find they are opening a lot of tabs in the design pane. This should save some time for the power developers out there.

That’s pretty much it for new functionality in the Builder.

This release introduces the breaking change that I posted a blog about previously. If you use MySQL in your applications you will need to look closely at this preview build over the next two weeks as this will likely affect your application.

There’s a new error in the event view that you should keep an eye out during simulate sessions. We’re now reporting error messages when a function is called on a variable that hasn’t been constructed. Next release, we’ll be halting in this case. Look for a blog post on this change soon.

Here’s a list of some of the more visible bugs we fixed in this release:

3415        XmlToObject function propertly handles “&” character

4255        getSubCollection backup argument working properly

4583        Solution Detail Header now displays more information on the selected item

4718        StringUtil.findOneNotOf Out parameter now corrected to be an Int

5719        Label property for several controls now more consistently applied

5813        You can now delete posts

5921        Chooser now allows for broader choice when a function argument calls for a string

5986        Performance (speed) of the first call against a Large WSDL object has been improved

6075        Labels at the right of a sight control are now selectable (makes copy/paste easier)

6182        Chooser now automatically selecting objects that are inherited

6193        Enumerations can now be set on a field override

6269        Now TimeUtil.getTZData() can be passed any standard Unix name (”US/Mountain”) and it will return the matching timezone

6373        xmlUtil.convertObjecToXML now assigns namespace prefixes to sub-objects

6381        Sorting in an MultiColumnListBox no longer changes selection

6384        We handle invalid veil colors are handled in IE7

6454        MainRunFunction adapter has been renamed to MainFunction

6515        Double clicking in a FormList no longer selects all

6552        Recent Selections section of Chooser now working for CallFunction

6577        LabelAdapter property “stringvalue” is now “labelvalue”

6592        SingleSelect function now firing properly on the TabList control

6600        Overlay dialog titles are no longer encoding special characters

6606        Copying of Classes disabled

6659        ConvertStrToNumber now handles commas

6667        Multiple overlays can now swap focus more predictably

6709        XY values for positioning of a DynamicImageAction control popups working more consistently

6838        Notes can now be added to a stylesheet

6843        Postgres driver now returns more accurate error when login authentication fails

6854        Design and Properties pane staying in sync better when tied to Vars

6856        Large number of open tabs now navigable via tab chooser

6873        Overly simple WSDL files with no defined types will now import properly

6889        Raw XML strings are now properly being encoded in SOAP requests

6905        Fixed a logic error with the label placement property for CheckBoxes

6910        We’ve enhanced the control that the developer has over PopupButton alignment

6955        You can no longer edit the Model or View Names for Adapters

7002        Set Breakpoint button moved to the code button toolbar from the property pane header

7014        Images for a ButtonImageSet state can now be un-set

7033        Errors are now reported when a function is called on a Var that hasn’t been constructed (see note in italics above)

7040        Fixed a logic error in how margins were being applied from the Edit Grid Margins dialog

7048        Tablist control can now intercept a tab close event with a functionadapter callback

7050        Importing many projects from the Home tab at the same time, now imports properly

7090        SOAP marshalling now supports RPC literal encoding

7105        You no longer have to be a SuperAdmin to deploy or update a deployment

7154        Form titles are no longer defaulting to “Bungee App”

7202        Code buttons (if, comment, moveup,down) now more consistently affect the selected line of code

7254        You can now arrow key through controls in vertical containers

7257        You can now view notes for a Page

7351        Label tied to date tiem now using Text property properly when the value is null

7402        You can update a locally sourced WSDL

7462        Drag Zone and Drop Zone properties removed from several controls where they weren’t applicable

258/3531        Sorting a collection and selection get along better now

5790/6600        Enable/Disable state now triggers correctly across a Class boundary

5902/6374        xmlUtil.convertObjecToXML will now allow you to create element attributes

6014/6015/5780        Several issues around WSDL updating have been resolved

6578/6045/6834        Overlay dialog backgrounds no longer default to transparent

6614/4866/4777        MultiColumnListBox columns were misaligned in some scenarios. They’ve been fixed