Category Archives: Software Development

A Guide to Building Secure Web Applications

from Slashdot: “A Guide to Building Secure Web Applications“, other valuable things on the site include a list of web application security white papers, a web application vulnerability scanner written in Java, and Filters, a project whose goal is “.. to offer a set of tools that will allow developers building web applications to adopt secure practices in a complimentary way to the tools and technologies that they are developing today.”

Tim Berners-Lee on the Semantic Web

Today I T’ed it to MIT Building NE43, took the elevator to the 5th floor and sat in a cozy room with 50 or so other geeks & academics taking in a presentation by Tim Berners-Lee on the Semantic Web. Wait… Tim Berners-Lee! The creator of the World Wide Web for goodness sakes! Wow. After getting past the fact that I was sitting not more than 10 feet away from the guy who created the WWW AND the first web browser, I realized two things: a) Tim Berners-Lee is *really* excited about the stuff he does (isn’t it interesting to listen to someone who LOVES what they do?!) and b) the Semantic Web will be a big thing, although it’ll take awhile.

I won’t try to explain the Semantic Web, the W3C site does an excellent job of describing it technically, and there are other sites that cover it as well. Some interesting tidbits I wrote down (for myself):

· N3 or Notation 3 “… a quick notation for jotting down or reading RDF semantic web information, and experimenting with more advanced sematic web features.” [source]

· HTML is to the WWW as RDF is to the Semantic Web

· The Semantic web is a technical problem, but also a philosophical one. In order for massive adoption to occur, we (how quickly I claim participation!) must have some sort of specification that explicity describes what this is and what that is (see: ontology), which is why there is a working group devoted solely to the problem of describing objects for the web.

· Humourously, at one point Tim mentioned that he had wanted a ‘why’ button in his browser.

· The word ‘trust’ came up multiple times during the conversation, something that we’re more and more likely to see as the Semantic Web makes ‘meaningful’ information 24×7 365. (interesting paper @ Caltech on this subject)

· Various software tools mentioned during the presentation:

Blindfold (“… a semantic web software toolkit. It can be used by programmers as a library of handy functions or at the command line to perform various data transformations.”, written by Sandro Hawke, who was at the presentation),

Algae (“Algae is a constraint-based query interface based on algernon. Aside from syntax, the pricipal difference between algae and algernon is that algae is not tied to an accessor (algernon assumes triples are accessed by subject only)”),

Cwm (“… a general-purpose data processor for the semantic web. It is a forward chaining reasoner which can be used for querying, checking, transforming and filtering information. Its core language is RDF, extended to include rules, and it uses RDF/XML or N3 serializations as required.”),

Annotea (“.. a LEAD (Live Early Adoption and Demonstration) project enhancing the W3C collaboration environment with shared annotations.”, which I immediately began thinking of using along w/ a wireframe implementation. The idea behind Annotea is that you could/can leave “..comments, notes, explanations, or other types of external remarks…” on any document available on the web, thereby increasing collaboration among teams. It’s built into the Amaya browser, you can download Annotea here or use the demo w3c.org annotea server),

Haystack (“The Haystack project makes use of Semantic Web RDF technology to permit maximum flexibility in describing information. On top of this we have created a user interface paradigm capable of displaying various kinds of information in many forms. We provide a powerful infrastructure for incorporating machine learning algorithms that implement personalization and per user adaptation. Our framework also facilitates and fosters collaboration between Haystack users.”), check out this screenshot of Haystack, reminds me of some of the Flash portals I’ve seen demo’ed by Macromedia.

Zakim, “An irc bot created by Ralph Swick that interfaces with W3C’s Zakim teleconference bridge and provides meeting support services such as notification of participant arrival and departure, requests to speak, and requests for agenda items.” Tim talked about this bot briefly, reminded me of Jabber’s Chatbot.

Tim mentioned some of the challenges that the Semantic Web faces in his presentation (which was supposed to be on the web, but I don’t see it here, anyone know where it is?). Anyway, after you get by the technical and philosophical issues, there remains the small tiny matter of UI, how do you display all this information to the user so that he/she uses it? Haystack tries to address this… but there’s definitely a business opportunity there for the person(s) that can effectively present vast amounts of information to a human being in a finite space.

After the presentation was over, someone asked a question about patents relative to the Semantic Web. Tim replied something to the effect that if everyone would keep their hands off the patent machine, we’d probably get alot farther faster (he referenced the VoiceXML area which is supposedly mired in patent hell and thus developers aren’t flocking to the standard(s) as they should)…

That’s all! Thanks MIT, W3C and Tim for a great seminar and for opening it up to the general public. The Web continues to be fascinating, largely thanks to your non-selfish efforts.

Translucent Databases

Interesting article on oreillynet.com in response to the recent hacking of Yale student admission information by Princeton. The gist is that sensitive data that you don’t need to physically see, but only compare/search/parse should be put into your DB hashed. Excerpt:

“For example, what if a police department needs to build a database of sexual-assault victims that lets them identify trends but hides personal information? You could use a translucent database where the first column is the hash of the victim’s name, and the second column is a hash of their full address, and the third column is a hash of their block and street. You can now group incidents together by grouping entries with identical block hashes; you can see if the incidents refer to the same person by checking to see if those hashes are different.”

More information on translucent databases can be found here.

crazy browser tricks

Found this via http://cms-list.org/, my small brain can’t figure out how this would be useful, but nonetheless, try changing your <body> tag to look like this:

<body contenteditable=true>

and then view your page… type away, move images, *resize* images, delete text… wow. Kinda cool. As usual, it’s IE 5.5 (and higher) specific, although some people have written workarounds to get it to work in Mozilla.

MSDN documentation: http://msdn.microsoft.com/library/default.asp?url=/workshop/author/dhtml/reference/properties/contenteditable.asp