HTTP

REST API Developers Between a Rock and a Hard Place A recent blog on EBPML.ORG entitled “REST 2010 - Where are We?” very aggressively stated: “REST is just a "NO WS-*" movement.” The arguments presented are definitely interesting but the most compelling point made is in the way that REST APIs are constructed, namely that unlike the “ideal” REST API described where HTTP methods are used to define action (verb) and the path the resource (noun), practical implementations of REST are using a strange combination of both actions (verbs) and resources (nouns) in URIs. What this does is simulate very closely SOA services, in which the endpoint... posted @ Tuesday, March 02, 2010 4:04 AM | Feedback (5)

WILS: Layer 7 (Protocol) versus Layer 7 (Application) The problem with HTTP (okay, one of the problems with HTTP, happy now?) is that it resides at the top of the “stack” regardless of whether we identify the “stack” as based  upon the TCP/IP stack or the OSI model stack. In either case, HTTP sits at the top like a a king upon his throne. There’s nothing “higher” than the application in today’s networking models. But like every good king, HTTP has a crown: the actual application data exchanged in the body of an HTTP transaction. In the good old days, when intermediaries (proxies) were only able... posted @ Tuesday, February 16, 2010 3:17 AM | Feedback (3)

Extend Cross-Domain Request Security using Access-Control-Allow-Origin with Network-Side Scripting The W3C specification now offers the means by which cross-origin AJAX requests can be achieved. Leveraging network and application network services in conjunction with application-specific logic improves security of allowing cross-domain requests and has some hidden efficiency benefits, too. The latest version of the W3C working draft on “Cross-Origin Resource Sharing” lays out the means by which a developer can use XMLHTTPRequest (in Firefox) or XDomainRequest (in IE8) to make cross-site requests. As is often the case, the solution is implemented by extending HTTP headers, which makes the specification completely backwards and cross-platform compatible even if the... posted @ Tuesday, February 09, 2010 4:18 AM | Feedback (1)

WILS: SSL TPS versus HTTP TPS over SSL The difference between these two performance metrics is significant so be sure you know which one you’re measuring, and which one you wanted to be measuring.  It may be the case that you’ve decided that SSL is, in fact, a good idea for securing data in transit. Excellent. Now you’re trying to figure out how to implement support and you’re testing solutions or perhaps trying to peruse reports someone else generated from testing. Excellent. I’m a huge testing fan and it really is one of the best ways to size a solution specifically for your... posted @ Wednesday, February 03, 2010 4:10 AM | Feedback (3)

How to Make mailto Safe Again Using HTTP headers and default browser protocol handlers provides an opportunity to rediscover the usability and simplicity of the mailto protocol. Over the last decade it's become unsafe to use the mailto protocol on a website due to e-mail harvesters and web scraping. No one wants to put their e-mail address out on teh Internets because two minutes after doing so you end up on a trillion SPAM lists and the next thing you know you're changing your e-mail address. But people still wanted to share contact information, so it became common practice to spell out your e-mail address, such... posted @ Thursday, January 28, 2010 3:07 AM | Feedback (1)

WILS: Virtual Server versus Virtual IP Address load balancing intermediaries have long used the terms “virtual server” and “virtual IP address”. With the widespread adoption of virtualization these terms have become even more confusing to the uninitiated. Here’s how load balancing and application delivery use the terminology. I often find it easiest to explain the difference between a “virtual server” and a “virtual IP address (VIP)” by walking through the flow of traffic as it is received from the client. When a client queries for “www.yourcompany.com” they get an IP address, of course. In many cases if the site is served by a load balancer or... posted @ Monday, December 28, 2009 6:00 AM | Feedback (1)

XAJAX Perfect Choice to Build Scalable Web Applications for Cloud Computing Environments An interesting thing happens when you combine toolkits like XAJAX and SAJAX and the ability to perform content-based routing: you can actually achieve function-level load balancing in both cloud-based and traditional architectures. As you might have discovered from previous posts mentioning it, I still do web application development to support hobby interests in my (very little) spare time. I’m currently in love with the XAJAX library, which has made development of what is supposed to be a very interactive application nearly effortless. I’m also very much enamored of load balancing/application delivery and cloud computing, specifically... posted @ Wednesday, December 09, 2009 3:59 AM | Feedback (6)

No Shirt, No Shoes, No HTTP Service Using Anonymous Human Authentication to prevent illegitimate access to sites, services, and applications. In the “real world” there are generally accepted standards set for access to a business and its services. One of the most common standards is “No shirt, no shoes, no service.” Folks not meeting this criteria are typically not allowed past the doors of a business. But on the web, access to services is implicit in the fact that the business is offering the service. If the HTTP service is accessible, it’s implicitly allowing connections and providing service without any standard criteria... posted @ Monday, November 30, 2009 4:47 AM | Feedback (1)

Google SPDY Protocol Would Require Mass Change in Infrastructure Google’s desire to speed up the web via a new protocol is laudable, but the SPDY protocol would require massive changes across networks to support ArsTechnica had an interesting article on one of Google’s latest projects, a new web protocol designed to replace HTTP called SPDY. SPDY uses a single SSL-encrypted session between a browser and a client, and then compresses all the request/response overhead. The requests, responses, and data are all put into frames that are multiplexed over the one connection. This makes it possible to send a higher-priority small file without... posted @ Tuesday, November 17, 2009 4:20 AM | Feedback (2)

Using Network-Side Scripting to Implement Mock API Endpoints Steve (apparently yes, we are on a first name basis) offers up his thoughts on developing APIs for the Cloud in “A Cloud Tools Manifesto.” While the inclusion of the word “manifesto” in the title raised quite the stir (“Manifestogate” is still fresh on the minds of many cloud-oriented people), what really caught my eye is his inclusion of a “mock endpoint” primarily for testing of API based integration and development. This is something that’s increasingly important not just to cloud but to Web 2.0 and social networking sites that provide APIs via which other sites and client applications can... posted @ Monday, October 05, 2009 4:00 AM | Feedback (5)

WILS: A Good Hall Monitor Actually Checks the Hall Pass Are you monitoring the network, servers, stack, or the application? The answer may mean the difference between your application being available or not. One of the biggest problems with moving away from simple load balancing to application delivery is that network teams don’t often get the memo and the application teams don’t have a good understanding of what load balancers can do so they can’t even offer suggestions regarding how to architect a better   solution to availability. That means neither team really understands the role of health monitoring in maintaining availability for applications. What should happen... posted @ Wednesday, September 30, 2009 3:25 AM | Feedback (0)

Impact of Load Balancing on SOAPy and RESTful Applications A load balancing algorithm can make or break your application’s performance and availability It is a (wrong) belief that “users” of cloud computing and before that “users” of corporate data center infrastructure didn’t need to understand any of that infrastructure. Caution: proceed with infrastructure ignorance at the (very real) risk of your application’s performance and availability. Think I’m kidding? Stefan’s SOA & Enterprise Architecture Blog has a detailed and very explanatory post on Load Balancing Strategies for SOA Infrastructures that may change your  mind.  This post grew, apparently, out of some (perceived) bad behavior on... posted @ Tuesday, September 08, 2009 4:11 AM | Feedback (1)

If Your Users See an HTTP Error Code You’re Doing It Wrong There is no reason in a modern web application for users to see a white error page Sightings of the Twitter “fail whale” are, these days, fewer and far between. That’s a good thing. What’s interesting is that when it does show up, users are almost amused – as if they’re glad to see an old friend. I mean, come on; Twitter’s users named the whale, for crying out loud. How many of your users have a fan club for your error pages? Exactly. That’s the kind of reaction you want from HTTP errors but what you... posted @ Thursday, September 03, 2009 2:52 AM | Feedback (10)

WILS: Application Acceleration versus Optimization Why do application delivery vendors talk about both? Aren’t they the same thing? In general, acceleration implies that something will be done to the application: caching, compression, etc… The actual behavior of the application is changed such that the client may need to participate in the acceleration. Acceleration is technically speaking disruptive in the sense that it requires participation of client, intermediary, and often the server. This generally takes a form that leverages existing standards, a la caching, such that no changes need be made to clients or servers, but the behavior of the application and its... posted @ Thursday, August 20, 2009 6:00 AM | Feedback (2)

Two Different Sock(et)s The importance of a full-proxy architecture to application delivery, security, cloud computing, and virtualization People often describe the act of changing focus from one related but distinct task to another as “wearing two different hats.” Like moving from “developer” to “administrator” when you’re trying to deploy an application in a testing environment. You’re the developer, but then you have to “switch gears” and become a server administrator in order to ensure that the application server and its environment is configured properly before you can actually test the application you just wrote. But the metaphor... posted @ Thursday, July 30, 2009 4:07 AM | Feedback (0)

Rip and Replace Won’t Solve Twitter’s (Or Your) Security Problems The “replace” in “rip and replace” essentially means getting rid of old security problems and replacing them with new ones. Twittergate is (thankfully) behind us but it’s almost assuredly going to be the case that we’ll be rehashing this one for a while. This certainly isn’t the first time Twitter and security issues have clashed, and as in the past Twitter (and really any very public application in a similar situation) is the clear loser. And of course there comes the unsolicited advice offered regarding what Twitter needs to do to address its security issues. I am, of... posted @ Monday, July 20, 2009 3:43 AM | Feedback (2)

An Unhackable Server is Still Vulnerable Apparently if you’re attending the USENIX Security conference (August 12-14, 2009, in Montreal, Canada) you can participate in the Security Grand Challenge. What is that, you ask? Here’s how the organizers describe it: The concept is very simple. The participant teams will have to use their science and technical skill to create an environment where a server can function with integrity and minimum required service levels even when under attack. On the day of the competition, each participant team will receive a virtualized server, with a number of services. The services might... posted @ Tuesday, July 14, 2009 2:59 AM | Feedback (4)

Automatically Removing Cookies Using network-side scripting to remove client-side cookies @quine overhead an interesting question that he offered via Twitter regarding cookies and BIG-IP. Specifically someone was wondering whether BIG-IP automatically removes cookies from the browser. Our team had a quick discussion because the question isn’t as straight-forward as it first appears. On the surface the answer is an unequivocal “no”, because for an intermediary to just arbitrarily remove cookies would be a Very Bad Thing. But the ability to manipulate cookies is certainly something you can do using iRules, and if you implemented such functionality then the... posted @ Wednesday, July 08, 2009 3:43 AM | Feedback (0)

Being first to do something doesn’t automatically make it proprietary even if the first is Microsoft Somebody has to be first Recently Microsoft came up with a solution, supported natively in IE8, to protect against clickjacking attempts. Apparently some folks have decided that because Microsoft has a history of implementing proprietary solutions that this one, too, must be proprietary. These same folks must also have very little understanding of today’s web application architectures, as they declared the solution pretty much useless based on some pretty poor assumptions regarding the implementation of said solution.  As noted in the Register, “some critics have contended the protection [X-FRAME-OPTIONS custom HTTP header] will be ineffective because... posted @ Monday, June 29, 2009 3:15 AM | Feedback (2)

Clickjacking Protection Using X-FRAME-OPTIONS Available for Firefox But browser support is only half the solution, don’t forget to implement the server-side, too. Clickjacking, unlike more well-known (and understood) web application vulnerabilities, has been given scant amount of attention despite its risks and its usage. Earlier this year, for example, it was used as an attack on Twitter, but never really discussed as being a clickjacking attack. Maybe because aside from rewriting applications to prevent CSRF (adding nonces and validation of the same to every page) or adding framekillers there just haven’t been many other options to prevent the attack technique from being utilized against... posted @ Tuesday, June 23, 2009 3:27 AM | Feedback (4)

Facepalm: Google Wave Choice of XMPP Not the Death of HTTP Google didn’t kill HTTP. Neither did Colonel Mustard or Professor Plum. In fact, HTTP is still very much alive. Okay, folks, it’s time to stop declaring the death of protocols/technologies prematurely. Please? Especially when such proclamations are clearly not representative of reality. From ElasticVapor :: Life in the Cloud In Google's announcement what I found most fascinating was the protocol they choose for the basis of their new realtime vision. It wasn't HTTP but instead XMPP was selected as the foundation for this decentralized and interoperable vision. What this means in... posted @ Tuesday, June 02, 2009 3:47 AM | Feedback (20)

Why not network-side pre-fetching? The acceleration technique known as pre-fetching went the way of the do-do bird sometime around 2002. But perhaps it should be resurrected, just in a different place and with a slightly different focus. A SHORT HISTORY OF ACCELERATION TECHNIQUES Most modern acceleration techniques revolve around two things: decreasing the amount of data to be transferred (compression, optimization of the client-side cache) or twiddling with protocols (TCP, HTTP) and their associated behaviors to improve the overall speed at which a client and server communicate. Back in the early days of application acceleration most technologies were... posted @ Tuesday, April 14, 2009 3:01 AM | Feedback (0)

Ruby developers ignore security risks, claim X-JSON header ‘nothing serious’ Those who cannot remember the past are condemned to repeat it. George Santayana, The Life of Reason, Volume 1, 1905 US (Spanish-born) philosopher (1863 - 1952) This oft repeated quote needs to be tweaked just a bit to be more applicable to web application security: Those who choose to ignore the past in favor of convenience are condemned to repeat it. Just how many times do developers have to “hack” a protocol that eventually becomes a wide-open hole through which even a blind miscreant... posted @ Tuesday, April 07, 2009 9:25 AM | Feedback (8)

4 Reasons We Must Redefine Web Application Security Mike Fratto loves to tweak my nose about web application security. He’s been doing it for years, so it’s (d)evolved to a pretty standard set of arguments. But after he tweaked the debate again in a tweet, I got to thinking that part of the problem is the definition of web application security itself. Web application security is almost always about the application (I know, duh! but bear with me) and therefore about the developer and secure coding. Most of the programmatic errors that lead to vulnerabilities and subsequently exploitation can be traced to a lack of secure... posted @ Wednesday, March 11, 2009 3:21 AM | Feedback (1)

Web Application Security: Where do we go from here? You're standing in line at the bank when someone walks in. You instinctively look around and notice the newcomer is wearing sunglasses,  and a hooded sweatshirt. His hands are both inside the pockets of his sweatshirt, even though it's warm inside. He chooses a line, and dances nervously from foot to foot, craning his neck to see to the front of the line. After a few minutes he leaves the line and chooses a new one, growing increasingly agitated at the wait. He keeps looking from the clock to the line to the tellers, and appears to be wringing his... posted @ Tuesday, February 03, 2009 4:01 AM | Feedback (2)

I am in your HTTP headers, attacking your application Zero-day IE exploits and general mass SQL injection attacks often overshadow potentially more dangerous exploits targeting lesser known applications and attack vectors. These exploits are potentially more dangerous because once proven through a successful attack on these lesser known applications they can rapidly be adapted to exploit more common web applications, and no one is specifically concentrating on preventing them because they're, well, not so obvious. Recently, SANS Internet Storm Center featured a write up on attempts to exploit Roundcube Webmail via the HTTP Accept header. Such an attack is generally focused on exploitation of operating system, language, or environmental... posted @ Thursday, January 15, 2009 9:12 AM | Feedback (4)

SOA isn't dead, but its standards are The spirit of SOA and its core principles are still very much alive, but we can't call it SOA any more because, well, SOA is (pretty much) officially dead, at least according to folks on the tubes and we all know that if you hear it on the tubes it must be true. Anne Thomas Manes of the Burton Group declared SOA officially dead on January 1, 2009, but maintains that "although the word “SOA” is dead, the requirement for service-oriented architecture is stronger than ever." Ms. Manes blames the death of SOA on the failure to... posted @ Wednesday, January 07, 2009 9:07 AM | Feedback (1)

Stop brute force listing of HTTP OPTIONS with network-side scripting Over the holidays Marcin @ tssci security offered up a python script for brute forcing the HTTP OPTIONS on directories. One of the reasons someone would want this information is because if you're (accidentally, of course) allowing PUT methods on any directories, someone can upload something nasty and potentially execute an attack. The availability of PUT makes XSS attacks simple even for script kiddies, for example. There may be legitimate reasons for enabling PUT on your servers, but you don't necessarily want the whole world to know that - just the applications that need the functionality.... posted @ Monday, January 05, 2009 5:58 AM | Feedback (5)

Cloud Computing: Is your cloud sticky? It should be. Load balancing an application should, by now, be a fairly routine scaling exercise. But too often when an application is moved into a load balanced architecture it breaks. The reason? Application sessions are often specific to an application server instance. The solution? Persistence, also known as sticky connections. The use of sessions on application servers to add state to web (HTTP) applications is a common practice. In fact, it's one of the greatest "hacks" in the history of the web. It's an excellent solution to the problem of using a stateless application protocol to build applications for which... posted @ Wednesday, November 19, 2008 3:40 AM | Feedback (2)

Amazing Application Acceleration: Simultaneously improve productivity, efficiency, and performance As a general rule, we spend far more time worrying about external appearances than we do internal. We are more concerned with our external web applications and how they look - and perform - than we are likely to regarding our intranet or internal only applications. This blog post was interesting in that rather than encouraging folks to optimize web sites and improve end-user response time for web applications for the sake of the user experience, it focused on the relationship between page load time and impact on Google AdWords quality scores. Which is a bit different than... posted @ Thursday, November 13, 2008 3:36 AM | Feedback (0)

2.5 bad ways to implement a server load balancing architecture I'm in a bit of mood after reading a Javaworld article on server load balancing that presents some fairly poor ideas on architectural implementations. It's not the concepts that are necessarily wrong; they will work. It's the architectures offered as a method of load balancing made me do a double-take and say "What?"  I started reading this article because it was part 2 of a series on load balancing and this installment focused on application layer load balancing. You know, layer 7 load balancing. Something we at F5 just might know a thing or two about. But you... posted @ Friday, October 24, 2008 7:55 AM | Feedback (2)

Old and busted: RSS feeds. New hotness: Followers. According to Steve Rubel at Micro Persuasion, I must be way more geeky than your average consumer. (Thanks, Steve!) That's because I'm using RSS (Really Simple Syndication) and Google to peruse myriad feeds in my daily quest to "read the Internet."   Steve comments on a recently released Forrester report citing the adoption of RSS as low with no real indication it will get any better in the future. According to the research, of the 89% of those who don't use feeds only 17% say they're interested in using them. In fact Forrester... posted @ Tuesday, October 21, 2008 4:36 AM | Feedback (3)

How to prevent content theft using Apache mod_rewrite or F5 iRules Over the years imaginative developers have come up with a number of ways through which they hope to stop the pilfering of their images. Whether due to copyright issues or the increased bandwidth and associated costs resulting from "hot linking", site owners have tried a variety of solutions from JavaScript that prevents the ability to right-click and "save as" to watermarking high-resolution versions to make their images less appealing to image thieves. Regardless of the reason you may want to prevent image theft, there's an easier and more effective method than introducing easily countered JavaScript and costly alternative... posted @ Tuesday, October 21, 2008 3:31 AM | Feedback (5)

Is Twitter the newest data security threat? One of the most dangerous threats to data security is also one of the least talked about: employees. Are Twitter and other microblogging sites yet another avenue through which sensitive data can leak out of the corporate database and into the hands of ... anyone? Perhaps more worrisome, what information are you giving away simply by being a part of the community? Of course Twitter is a potential threat. Like personal e-mail accounts and instant messaging, Twitter and sites of its ilk are primarily messaging mechanisms, which translates into personal channels for exporting sensitive data outside the... posted @ Thursday, October 16, 2008 4:00 AM | Feedback (6)

3 Really good reasons you should use TCP multiplexing AJAX. SOA. Social network API integration. What is TCP Multiplexing? All of aforementioned technologies have one thing in common. Okay, they have more than that in common,  but for the purposes of this discussion there's one very TCP multiplexing is a technique used primarily by load balancers and application delivery controllers (but also by some stand-alone web application acceleration solutions) that... posted @ Tuesday, October 14, 2008 5:10 AM | Feedback (7)

The ironic truth about the ugly truth about web application acceleration Lately I've been seeing quite a few links to a white paper popping up in my alerts and feed-reader. Regardless of who's linking to it, it generally reads as promising to reveal some grand secret about how web application acceleration is an epic failure. I finally gave in and clicked on a link and ended up directed to download a white-paper, the description for which essentially distilled "web application acceleration" down to "caching". And then promised to tell me why caching wasn't a good way to accelerate web applications. I didn't download the white paper primarily because equating... posted @ Friday, October 10, 2008 3:17 AM | Feedback (0)

Firebug: The Firefox add-on everybody else says I can't live without After proclaiming very publicly that I loved HttpFox and everyone Related Posts should have it there were many comments regarding Firebug, including some that came via e-mail. I've used Firebug in the past, but hadn't really looked at it in comparison to HttpFox and thought that with so many people saying it was "all that and more" with regards to HttpFox, I should... posted @ Friday, October 03, 2008 3:57 AM | Feedback (5)

If you don't know the difference between HTTP and DNS, don't blog about it Pet peeve time: screaming technical inaccuracies in blog posts do a huge disservice to the root problem being discussed. If you're going to discuss hijacking DNS errors for the purposes of advertising, then please do so - don't call them DNS "error pages" (there are no such things) or refer to them as "404 errors". 404 is an HTTP status code indicating that the requested resource cannot be found. It is in no way related to DNS and, in fact, such an error code cannot be returned without a successful DNS lookup, which means there's no hijacking... posted @ Tuesday, September 30, 2008 8:19 AM | Feedback (2)

HttpFox: The Firefox add-on you can't live without Whether you're a network architect, a web developer, or a web administrator there's one tool that's a must have in your troubleshooting toolbox: a protocol analyzer. Like many network focused folks, I traditionally rely upon ethereal (now Wireshark) for protocol analysis. It decodes just about every protocol up and down the stack, and it can import/export to a variety of formats. But being connected to the corporate LAN via an SSL VPN, wireshark is often constrained by it's own architecture. Because it inserts itself into the network stack to gather data, it can't decrypt the SSL encrypted packets, which makes... posted @ Friday, September 26, 2008 7:24 AM | Feedback (18)

My application is not the next Twitter so why should I care about high availability? It often seems that load balancing and high availability are associated with only high traffic sites, like Twitter and Google. But load balancing and high availability isn't just for Web 2.0 phenomenons or web monsters; it can be an invaluable tool in your strategy to maintain service level agreements and customer satisfaction no matter how large or small your customer base - and data center - might be. ... posted @ Tuesday, September 23, 2008 4:34 AM | Feedback (3)

4 things you can do in your code now to make it more scalable later No one likes to hear that they need to rewrite or re-architect an application because it doesn't scale. I'm sure no one at Twitter thought that they'd need to be overhauling their architecture because it gained popularity as quickly as it did. Many developers, especially in the enterprise space, don't worry about the kind of scalability that sites like Twitter or LinkedIn need to concern themselves with, but... posted @ Friday, September 19, 2008 5:09 AM | Feedback (2)

Why you still need layer 7 persistence Tony Bourke of the Load Balancing Digest points out that mega proxies are largely dead. Very true. He then wonders whether layer 7 persistence is really all that important today, as it was largely implemented to solve the problems associated with mega-proxies - that is, large numbers of users coming from the same IP address. Layer 7... posted @ Tuesday, September 16, 2008 6:03 AM | Feedback (0)

BusinessWeek takes viral advertising a little too seriously Yesterday it was reported that BusinessWeek had been infected with malware via an SQL injection attack. [begin Mom lecture] Remember when we talked about PCI DSS being a good idea for everyone, even though it's just a requirement for the payment card industry? If I've told you once, I've told you a million times: safer is better, more protection never hurts. ... posted @ Tuesday, September 16, 2008 5:40 AM | Feedback (1)

A Billion More Laughs: The JavaScript hack that acts like an XML attack Don is off in Lowell working on a project with our ARX folks so I was working late last night (finishing my daily read of the Internet) and ended up reading Scott Hanselman's discussion of threads versus processes in Chrome and IE8. It was a great read, if you like that kind of thing (I do), and it does a great job of digging into some of the RAMifications (pun intended) of the new programmatic models for both browsers. But this isn't about processes or threads, it's about an interesting comment that caught my eye: ... posted @ Thursday, September 11, 2008 4:01 AM | Feedback (8)

Automatically detecting client speed We used to spend a lot of cycles worrying about detecting user agents (i.e. browser) and redirecting clients to the pages written specifically for that browser. You know, back when browser incompatibility was a way of life. Yesterday. Compatibility is still an issue, but most web developers are either using third-party JavaScript libraries to handle detection and incompatibility issues or don't use those particular features that cause problems. One thing still seen at times, however, is the "choose high bandwidth or low bandwidth" entry pages, particularly on sites laden with streaming video and audio, whose... posted @ Tuesday, September 09, 2008 3:31 AM | Feedback (1)

The third greatest (useful) hack in the history of the Web Developers have an almost supernatural ability to workaround restrictions, even though some of the restrictions on building applications delivered via the web have been akin to a kryptonite. Like Superman fighting through the debilitating effects of the imaginary mineral, they've gotten around those restrictions by coming up with ways to implement functionality and improve the behavior of browsers and thus web applications anyway. The first greatest hack was giving HTTP state. The second? Cookie-based persistence. The third? The CNAME trick. THE PROBLEM The reason the "CNAME trick" came about was a limitation on browser connections... posted @ Monday, September 08, 2008 4:13 AM | Feedback (1)

Is the URL headed for the endangered technology list? Jeremiah Owyang, Senior Analyst, Social Computing, Forrester Research, tweeted recently on the subject of Chrome, Google's new open source browser. Jeremiah postulates: Chrome is a nod to the future, the address bar is really a search bar.  URLs will be an anachronism. That's an interesting prediction, predicated on the ability of a browser translate search terms into destinations on the Internet. Farfetched? Not at all. After all, there already exists a layer of obfuscation between a URL and an Internet destination; one that translates host names into IP addresses,... posted @ Thursday, September 04, 2008 4:52 AM | Feedback (2)

How AJAX can make a more agile enterprise In general, we talk a lot about the benefits of SOA in terms of agility, aligning IT with the business, and risk mitigation. Then we talk about WOA (web oriented architecture) separately from SOA (service oriented architecture) but go on to discuss how the two architectures can be blended to create a giant application architecture milkshake that not only tastes good, but looks good. AJAX (Asynchronous JavaScript and XML) gets lumped under the umbrella of "Web 2.0" technologies. It's neither WOA nor SOA, being capable of participating in both architectural models easily. Some might argue that AJAX, being... posted @ Tuesday, September 02, 2008 3:50 AM | Feedback (0)

Caveat Emptor: Be sure to align your goals for cloud computing with provider models before you sign up Elasticity (adj) the ability of a cloud computing environment to expand or contract automatically on-demand according to real-time computing needs One of the promises of an on-demand cloud computing environment (that's redundant, I think) is the ability to burst resources. Much in the same way that ISPs have long offered contracts that include the ability of the organization to exceed its allotted bandwidth for a fee, it is expected that cloud computing providers offer a mechanism for "bursting resources" that allows an organization to exceed its agreed upon resources for a fee, based on any number of factors such... posted @ Thursday, August 28, 2008 7:04 AM | Feedback (1)

The Best Post on Latency You Will Ever Read No, it's not this one. It's not even mine. It's this one on High Scalability written by Todd Hoff. Not only does he explain latency and its sources, but its costs. Then he goes on to offer a plethora of ways to reduce latency. A couple of suggestions he offers are: Use a TCP Offload Engine (TOE). TOE tech offloads the TCP/IP stack from the main CPU and puts it on the network controller. This means network adapters can respond faster which means faster end-to-end communication. Network adapters respond faster because bus... posted @ Monday, August 25, 2008 8:49 AM | Feedback (0)

Some services are more equal than others   During the debate of WAF versus, well, just about everything, I heard an interesting thing. See, I was taking the view that the duplication of security code across all services/applications lays the groundwork for the introduction of errors, accidental omission, and the degradation of performance. I argued that a WAF addressed all these problems and was therefore a better option. The person with whom I was discussing the subject declared that security code did not necessarily need to be included in the application, it could be a service that, in the spirit of SOA, could be reused and that this... posted @ Thursday, August 21, 2008 5:02 AM | Feedback (1)

SOA Security: Chain reactions are bad, mmmkay? As a child of the 80s's I lived under an umbrella of fear surrounding nuclear everything. Living fairly close to a nuclear power plant, we all heard the words "chain reaction" a lot, and though we didn't understand the science we did know that it was a Very Bad ThingTM and like children in the 60's we were taught to hide under a desk in the event of a catastrophe. Now, one of the benefits of SOA is reuse. Business services provide consistency across multiple applications when they are reused both for data and for processes. This is... posted @ Thursday, August 14, 2008 3:32 AM | Feedback (1)

What's the difference between a web application and a blog? Nothing. At least not from an attacker's perspective. A blog is an individual content management system, requiring storage (either database or flat file) and the ability to write to that storage. Comments allow discussion but also require access to files and or databases. It's an app, and that means it comes with all the baggage today's web applications necessarily come with: vulnerabilities. Those vulnerabilities are likely to become more visible as more organizations adopt blogging and other Web 2.0 applications in the next two years. Analyst firm Gartner recently highlighted 27 technologies in its 2008 Hype Cycle for... posted @ Wednesday, August 13, 2008 3:35 AM | Feedback (3)

The Unpossible Task of Eliminating Risk An ant named Archimedes is in a hole 6' deep. He climbs half the distance to the top every hour. How long does it take for him to escape the hole? Trick question. He can never, mathematically, escape. Realistically, we know that when Archimedes gets close to the top he will escape because he is actually longer than the amount of hole he has left to go. But what if every hour that Archimedes climbed the hole expanded 6" and thus changed the equation? He'd be one frustrated ant, that's what he'd be. That's how... posted @ Monday, August 11, 2008 3:54 AM | Feedback (4)

Server Virtualization versus Server Virtualization No, that's not a typo. That's the reality of virtualization terminology today: a single term means multiple technology implementations. Server virtualization is used to describe at least two (and probably more) types of virtualization. 1. Server virtualization a la load balancing and application delivery 2. Server virtualization a la VMWare and Microsoft Server virtualization as implemented by load balancers/application delivery controllers is a M:1 virtualization scheme. An application delivery controller like BIG-IP can make many servers look like one server, a virtual server. This type of server virtualization is used... posted @ Thursday, August 07, 2008 4:14 AM | Feedback (9)

Working around client-side limitations on custom HTTP headers One of the most well-kept secrets in technology is the extensibility of HTTP. It's one of the reasons it became the de facto application transport protocol and it was instrumental in getting SOAP off the ground before SOAP 1.2 and WS-I Basic Profile made the requirement for the SOAP Action header obsolete. Web browsers aren't capable of adding custom HTTP headers on their own; that functionality comes from the use of client-side scripting languages such as JavaScript or VBScript. Other RIA (Rich Internet Applications) client platforms such as Adobe AIR and Flash are also capable of adding HTTP... posted @ Wednesday, August 06, 2008 4:07 AM | Feedback (1)

Is the Mozilla FireFox 3 SSL policy bad for the web? Slashdot is discussing a recent rant regarding Mozilla FireFox 3's SSL policy regarding self-signed certificates. The rant claims that the policy is "bad for the web."   Nat Tuck Thu on Mozilla SSL policy bad for the Web   Mozilla Firefox 3 limits usable encrypted (SSL) web sites to those who are willing to pay money to one of their approved digital certificate vendors. This policy is bad for the web. Not only does it make users less secure overall by reducing the number of encrypted connections, it damages the basic principle of equality among web participants. The problem... posted @ Tuesday, August 05, 2008 10:59 AM | Feedback (3)

Compliance in the Cloud Who is responsible for security in the cloud? Let's say you just developed a web app through which customers can order widgets. You're pretty sure your widgets are going to be the hit of the year and you want to make sure that you don't suffer outages and performance issues like many retailers have in the past, especially around Black Friday. So you've decided to take advantage of the fact that a cloud computing provider can and will shoulder the responsibility for scaling your application even in the face of hundreds of thousands of customers knocking on your... posted @ Tuesday, August 05, 2008 4:56 AM | Feedback (0)

Is Your Cloud Opaque or Transparent? Cloud computing promises customers the ability to deliver scalable applications on-demand without the overhead of a massive data center. The visibility - and flexibility as well as control - you have into and over the cloud computing environment depends on whether the provider you select offers an opaque or a transparent cloud computing environment. OPAQUE CLOUD COMPUTING MODEL In an opaque cloud computing model all details are hidden from the organization. The hardware and software infrastructure details are not necessarily known or controlled by the organization but are completely managed by the cloud computing provider. This allows for a completely... posted @ Monday, August 04, 2008 5:04 AM | Feedback (4)

8 things you can do with an ADC to make your apps secure, fast, and available An application delivery controller (ADC) essentially acts a reverse proxy. That means that client requests interact with the ADC, and the ADC interacts with web and application servers on the client's behalf. This mediation offers the chance to implement acceleration, availability, and security features without requiring changes to existing applications. There are many, many more features in an ADC that provide significant value. These eight capabilities are the most commonly employed features in reverse-proxy application delivery solutions that provide immediate benefits to web applications, and all can be used without modifying applications or the servers on... posted @ Friday, August 01, 2008 4:56 AM | Feedback (2)

Wanna know a secret? You can consolidate servers by using acceleration technologies Forrester Research recently conducted a survey on virtualization, citing server consolidation as one of the primary drivers behind the 73% of enterprises already or planning on implementing virtualization technology. But virtualization, particularly operating system virtualization, assumes you have additional cycles on servers to spare. In some cases, that's just not true. Your application servers are working as hard as they can to serve up your applications and virtualizing them isn't going to change that fact. But application acceleration technologies can change that, and offer you the chance to consolidate servers. I know that sounds crazy. How can... posted @ Thursday, July 31, 2008 5:49 AM | Feedback (0)

Port Knocking: What are you hiding in there? I read with interest an article on port knocking as a mechanism for securing SOA services on CIO.com. If you aren't familiar with port knocking (I wasn't) then you'll find it somewhat interesting: From Nicholas Petreley's "There is More to SOA Security Than Authorization and Authentication" For the sake of argument, let's say you have an SOA server component for your custom client software that uses port 4000. Port knocking can close off port 4000 (and every other port) to anyone who doesn't know the "secret method" for opening it. Any cracker who scans your... posted @ Tuesday, July 29, 2008 9:21 AM | Feedback (3)

Architecting for Speed               I'm going to give you an engine low to the ground.               An extra-big oil pan that'll cut the wind underneath you.               That'll give you more horsepower.               I'll give you a fuel line that'll hold an extra gallon of gas.               I'll shave half an inch off you and shape you like a bullet.               When I get you primed, painted and weighed... ... posted @ Friday, July 25, 2008 11:30 AM | Feedback (0)

4 reasons not to use mod_security Apache is a great web server if for no other reason than it offers more flexibility through modules than just about any other web server. You can plug-in all sorts of modules to enhance the functionality of Apache. But as I often say, just because you can doesn't mean you should. One of the modules you can install is mod_security. If you aren't familiar with mod_security, essentially it's a "roll your own" web application firewall plug-in for the Apache web server. Some of the security functions you can implement via mod_security are: Simple filtering ... posted @ Wednesday, July 23, 2008 5:53 AM | Feedback (18)

Interactive F5 SOA Reference Architecture I do an awful lot of talking about SOA: problems, challenges, concepts, solutions, security, products. But I don't often present "the big picture", and certainly rarely discuss how F5 and SOA go together like ice-cream and pretzels. I know, that isn't a traditional simile, but if you've ever tried hot pretzels and ice-cream you might agree with me in saying that while they don't sound like they go together they really do, and they do so well. It's also applicable because when you think of ice-cream you don't immediately think of pretzels, and I'm fairly certain... posted @ Tuesday, July 22, 2008 4:17 AM | Feedback (0)

Links, Sex, and Application Fluency I ran across an interesting site containing an algorithm that predicts your sex based on browser history. This algorithm uses demographics from popular sites, determines which popular sites you have visited by digging through your browser history, and then predicts what gender you are based on your browsing habits.  This algorithm sounds a lot like an adaptation of the Turing Test. But instead of predicting which of two participants in the test is human, this one predicts what gender they are. The Turing Test has long been the standard for judging the intelligence of a computer system, even... posted @ Friday, July 18, 2008 5:11 AM | Feedback (5)

Persistent and Persistence, What's the Difference? The English language is one of the most expressive, and confusing, in existence. Words can have different meaning based not only on context, but on placement within a given sentence. Add in the twists that come from technical jargon and suddenly you've got words meaning completely different things. This is evident in the use of persistent and persistence. While the conceptual basis of persistence and persistent are essentially the same, in reality they refer to two different technical concepts. Both persistent and persistence relate to the handling of connections. The former is often used as a general... posted @ Friday, July 11, 2008 5:12 AM | Feedback (0)

4 Things You Need in a Cloud Computing Infrastructure Cloud computing is, at its core, about delivering applications or services in an on-demand environment. Cloud computing providers will need to support hundreds of thousands of users and applications/services and ensure that they are fast, secure, and available. In order to accomplish this goal, they'll need to build a dynamic, intelligent infrastructure with four core properties in mind: transparency, scalability, monitoring/management, and security.  Transparency One of the premises of Cloud Computing is that services are delivered transparently regardless of the physical implementation within the "cloud". Transparency is one of the foundational concepts of cloud computing, in that the actual implementation of... posted @ Thursday, July 10, 2008 5:45 AM | Feedback (4)

Performance Testing Web 2.0: Don't forget the APIs Keynote, well known for its application performance testing and monitoring services, just announced a new version of its KITE (Keynote Internet Testing Environment) that is now capable of testing Web 2.0 sites that make use of AJAX, Flash, and other "hidden" methods of obtaining content. Announcement of KITE 2 Performance testing dynamic and HTML websites is now a fairly straightforward process, however the rise of Web 2.0 sites that don’t rely on clicking to reveal another new page have been almost impossible to test. However Keynote has now developed a scripted system that allows you to... posted @ Wednesday, July 09, 2008 5:06 AM | Feedback (0)

Layer 4 vs Layer 7 DoS Attack Not all DoS (Denial of Service) attacks are the same. While the end result is to consume as much - hopefully all - of a server or site's resources such that legitimate users are denied service (hence the name) there is a subtle difference in how these attacks are perpetrated that makes one easier to stop than the other. SYN Flood A Layer 4 DoS attack is often referred to as a SYN flood. It works at the transport protocol (TCP) layer. A TCP connection is established in what is known as a 3-way handshake. The client... posted @ Tuesday, July 08, 2008 4:31 AM | Feedback (9)

3 Reasons not to use Apache mod_rewrite After reading this discussion on Slashdot regarding an anti-virus agent pretending to be Internet Explorer and flooding sites with requests I waited to see a response come from an Apache fan on using mod_rewrite to detect and stop the flood of useless traffic coming from these robots. It was sure to come, particularly after the first post in the discussion pointed out how to use an iRule to detect and "nuke from orbit" these nasty little requests. I was not disappointed. It's not the case that the solution won't work. It will, and it's certainly a viable solution.... posted @ Monday, July 07, 2008 6:18 AM | Feedback (12)

The Disadvantages of DSR (Direct Server Return) I read a very nice blog post yesterday discussing some of the traditional pros and cons of load-balancing configurations. The author comes to the conclusion that if you can use direct server return, you should. I agree with the author's list of pros and cons; DSR is the least intrusive method of deploying a load-balancer in terms of network configuration. But there are quite a few disadvantages missing from the author's list. Author's List of Disadvantages of DSR The disadvantages of Direct Routing are: Backend server... posted @ Thursday, July 03, 2008 4:29 AM | Feedback (10)

Fail Open or Fail Closed? Bob owns a widget shop. Now this widget shop is not your ordinary widget shop, because the widgets are made from Swarovski crystal. Very expensive stuff. Bob is aware that losing any number of his widgets would be financially devastating, and the negative press he'd receive would darken his shop's reputation. So he's invested in a very modern physical security system that utilizes electronic locks on all the doors, and includes all the newest laser motion detection technology. It's further connected to a monitoring service just in case, so he'll know if security has been breached and can... posted @ Wednesday, July 02, 2008 4:58 AM | Feedback (6)

Web 2.0: Integration, APIs, and Scalability Web 2.0 is built on primarily two technologies: AJAX and RSS. AJAX is used to develop interactive, real-time applications while RSS is primarily used as for integration and syndication. Import a feed, share a feed, drag-n-drop a gadget, widget, or component. It's all RSS (XML) today. It's further becoming a requirement of Web 2.0 sites that they provide some sort of API through which developers can write add-on applications. Twitter, Tumblr, Facebook. They all offer APIs that are quite heavily used at this time and startups are following suit. Other sites offer richer media, like video or slideware,... posted @ Tuesday, July 01, 2008 4:53 AM | Feedback (1)

HTTP: The de facto application transport protocol of the Web When the OSI defined its model it included a transport layer which was supposed to handle end-to-end connections and address communication reliability. In the early days of the web HTTP sat at the application layer (layer 7) and rode atop TCP, its transport layer. An interesting thing happened on the way to the 21st century; HTTP became an application transport layer. Many web applications today use HTTP to transport other application protocols such as JSON and SOAP and RSS. Applications now "speak" using a variety of languages to communicate, but underlying them all is HTTP. This... posted @ Wednesday, May 21, 2008 5:41 AM | Feedback (6)

Web 2.0 Expo: HTTP is not scalable? The second session I attended today was hosted by Blaine Cook (formerly of Twitter) and discussed the problems inherent in building the real-time web. His reason for dismissing HTTP as a method for building the real-time web: hard to scale for frequent updates and frequent polling. I call shenanigans. HTTP is not hard to scale in those situations if you have the right infrastructure. In fact, just about every application delivery controller in existence can easily scale HTTP - even under circumstances described by Blaine. The frequency of updating and polling is similarily a problem with any real-time web application,... posted @ Wednesday, April 23, 2008 3:28 PM | Feedback (2)