Why CORS? In order to keep your content safe, your web browser implements something called the same origin policy. The default policy ensures that scripts and other active content loaded from one site or domain cannot interfere or interact with...

John Davies discusses passwords, the need for multiple passwords and password managers, and how OAuth is providing SSO for multiple sites, including an OAuth demo app for the iPhone. By John Davies

I interviewed Todd Fasullo of Smartsheet learn more about Smartsheet and how it uses AWS to support online collaboration. Todd told me that they started using Amazon S3 way back in 2006 to store uploads and attachments. They added CloudFront...

Security researchers from Poland-based security firm Security Explorations claim to have discovered a vulnerability in the Java 7 security update released Thursday that can be exploited to escape the Java sandbox and execute arbitrary code on the underlying system.

Several companies including Oracle, Rackspace, Red Hat and CloudBees have proposed an API for PaaS application management. The API allows developers to manage applications within and across various PaaS that will implement the specification without having any knowledge of the underlying cloud infrastructure. By Abel Avram

Earlier in the week another zero-day exploit of the JVM was announced. Yesterday a security alert went out from Oracle. But at what point do we become proactive in protecting our systems against exploits?

It’s fair to say that the platform-as-a-service market is heating up. From huge open-source juggernauts like Red Hat to younger startups on the up, it seems that all the hype might just be amounting to something. You also can’t fail to notice just how crowded the market has become so quickly. To truly stand out, companies have had fine-tune their pitches to developers and offer something unique. Not a day goes by without someone announcing new to their conveyor belt of products. But one company truly striking out on their own (which we at JAXenter have eagerly been following over the past few months) is Portland’s infrastructure agnostic and polyglot-preaching AppFog, currently riding the crest of the PaaS wave. Originally starting life off as PHP Fog, founder Lucas Carlson led the burgeoning PaaS down other avenues after initial success with a pure PHP PaaS. Seeing an opportunity to expand into other languages as part of the package, Carlson realised the potential and the pitfalls of the polyglot approach. “We ran some funding ($9.8m in two rounds),” he says, “and with that funding we were able to expand our vision, to move from just PHP to deal with multiple languages. The problem with that up front was we didn’t want to give a bad experience on so many languages. “We don’t want polyglot PaaS to be the bare minimum PaaS for every language. We want it to be the best Java, the best Node, the best PHP Paas there is.” When asked why they were heading down this route, when some vendors opt for one language, Carlson said that whilst PaaS has been around for while, the biggest problem is that it hasn’t yet tackled a polyglot approach head on. “The problem polyglot solves uniquely is one that enterprises have a crisis today with. These enterprises are scaling and managing sometimes 1,000 developers and you need something that supplies a standard interface across the development platforms and technologies,” he said. The relationship with VMware’s in-beta platform Cloud Foundry provides the key here, since it follows an interesting trend in the PaaS market of co-opetition between competitors. The decision to hook up to Cloud Foundry a year ago, enabled them to utilise a universal API, with the hope of spanning across a plethora of infrastructure environments such as Rackspace and Microsoft Azure. AppFog effectively becomes the middle-man for enterprises, simplifying what can often be an arduous task. It’s a very savvy move, allowing AppFog’s distinctive platform to permeate the community already invested with Cloud Foundry but also reiterates their desire to offer the user as much choice as possible, whilst reducing complexity at the same time. AppFog are also keen committers to Cloud Foundry, being an active contributor to the codebase. Carlson told us that Cloud Foundry’s vision struck a chord with their company “The thing with Cloud Foundry that was very, very unique was that it approached it from the open source perspective so that there would be support for multiple languages. But instead of having to build up the support yourself every time and having expertise and the operational knowledge to run that, the people in the community would build it. “For example, a day after they released Cloud Foundry, there was a pull request for Erlang, and now they had Erlang supported. Nobody had done Erlang-as-a-Service until Cloud Foundry and it helped me decide that this was the right tool worth moving forward with.” Community building is certainly a big deal with AppFog as they try and create as many bridges as possible. Just this week, the company announced they had purchased Nodester, the most recognised PaaS for the Node.js community. Carlson said that AppFog and Nodester had developed “an instant bond”: “Nodester also spent two years forming a deep relationship with the Node community and has been adding depth and breadth to our support at AppFog,” he said. “On the depth side, it adds more technology, getting some of the missing components like Websocket support and on the breadth side, it adds a large community into the AppFog ecosystem and helps us push forward.” Node.js seems to be the darling of the wider industry at the moment. The hugely popular and highly scalable server side language hasn’t taken long to become one of the premier choices when writing a next-gen web application. Carlson believes the reason for this is simple: “Everyone knows JavaScript. Even the people who know CSS and Flash know it. Even the ones that know Java know JavaScript and so on. It’s lingua franca. We go back to the problem of enterprises. Perhaps half of them know Java and half know PHP. All know Node.” For AppFog, it ticks another box in their continuing quest for polyglot supremacy and strikes us as a no-brainer to purchase a company on the rise. For Nodester users, it opens the door to Ruby and Java within one platform. The acquisition also brings Websocket and Node 0.8 support to AppFog - an absolute must for any developer looking to create mobile and modern web apps. It’s just another string to AppFog’s bow, but one of the biggest additions yet. But Carlson understands the challenges that lie ahead for AppFog and PaaS in general, namely vendor lock-in: “Developers loves PaaS - that’s been the drive, the adoption factor and the only way it’s been maturing. CTOs and CIOs within enterprises don’t care or want to know about it and there’s a good reason for that. It’s not that they don’t want what AppFog has built, it’s because PaaS has come to mean more vendor lock-in. The problem for a CIO or CTO is that they’ve got 5 to 10 datacenters where code runs. To them, what PaaS has meant so far, oh great here’s another locked in datacenter. “I think that’s the big open question - is PaaS is going to evolve or is there going to be a next-generation technology?” Carlson isn’t the only one asking that, and we’re liable to agree with the latter. PaaS’s biggest problem is the definition often cast onto it by some who don’t believe it’s worthy. Perhaps a makeover is needed? Either way, AppFog seem to be leading the way towards the next-generation of PaaS.

Horia Dragomir talks about the challenges of writing HTML5 apps and games for mobile devices, the graphical APIs and problems of achieving responsive UIs, JavaScript and other languages and more. By Horia Dragomir

Vendor lock-in has frequently been highlighted as one of the biggest concerns to enterprises adopting both public and private clouds, and is cited as a major barrier for mass adoption. Thankfully some of the industry’s largest players have taken notice and last night revealed a draft version of an API specification allowing intercompatibility between clouds, both public and private. Known as Cloud Application Management for Platforms (CAMP), the draft has been written by seven big-name vendors: Oracle, Rackspace, Red Hat, CloudBees, Cloudsoft Corporation, Huawei and Software AG. CAMP has been proposed as a language-agnostic API to provide a common interface for cloud management. The draft has yet to be approved by OASIS, the not-for-profit standards body, but you can have a read of it on the 57-page specification document [PDF]. In theory, the API should allow management of multiple clouds through a single common interface, making it easier to move applications between clouds and from an on-premise server out into the wilderness. It also allows for infrastructure management to be abstracted by cloud providers wanting to provide a simpler user experience. There a plenty of notable absentees from the initial list, including Amazon, Google, Windows Azure, Salesforce and Heroku, who have everything to lose from increasing interoperability between clouds. Of course, if CAMP takes off and becomes the norm throughout the rest of the industry, there may be increasing pressure to jump on the bandwagon. For more information, check out Oracle’s blog post or the new cloudspecs.org. Photo by kewl.

The rise of NoSQL is characterized with confusion and ambiguity; very much like any fast-emerging organic movement in the absence of well-defined standards and adequate software solutions. Whether you are a developer or an architect, many questions come to mind when faced with the decision of where your data should be stored and how it should be managed. What does the rise of all these NoSQL technologies mean to my enterprise? What is NoSQL to begin with? Does it mean "No SQL"? Could this be just another fad? Is it a good idea to bet the future of my enterprise on these new exotic technologies and simply abandon proven mature Relational DataBase Management Systems (RDBMS)? How scalable is scalable? Assuming that I am sold, how do I choose the one that fit my needs best? Is there a middle ground somewhere? What is this Polyglot Persistence I hear about? The answers to these questions and many more is the subject of this JAXconf talk along with a survey of the most popular of NoSQL technologies. Filming - Marakana Tech TV

I couldn't find any good, brief, practical introduction into Puppet that gives you basic working knowledge in minimal time, so here it is. You will learn how to do the elementary things with Puppet - install packages, copy files, start services, execute commands. I won't go into Puppet installation, nodes, etc. as this introduction focuses on the users of Vagrant, which comes with...