This update brings in some great stuff like routing controllers to use the ASP.NET MVC architecture, csharp inteactive shell and other great performance enhancements to an already speedy C#.

The Top 25 is organized into three high-level categories that contain multiple CWE entries.

Insecure Interaction Between Components

These weaknesses are related to insecure ways in which data is sent and received between separate components, modules, programs, processes, threads, or systems.

• CWE-20: Improper Input Validation
• CWE-116: Improper Encoding or Escaping of Output
• CWE-89: Failure to Preserve SQL Query Structure (aka ‘SQL Injection’)
• CWE-79: Failure to Preserve Web Page Structure (aka ‘Cross-site Scripting’)
• CWE-78: Failure to Preserve OS Command Structure (aka ‘OS Command Injection’)
• CWE-319: Cleartext Transmission of Sensitive Information
• CWE-352: Cross-Site Request Forgery (CSRF)
• CWE-362: Race Condition
• CWE-209: Error Message Information Leak

Risky Resource Management

The weaknesses in this category are related to ways in which software does not properly manage the creation, usage, transfer, or destruction of important system resources.

• CWE-119: Failure to Constrain Operations within the Bounds of a Memory Buffer
• CWE-642: External Control of Critical State Data
• CWE-73: External Control of File Name or Path
• CWE-426: Untrusted Search Path
• CWE-94: Failure to Control Generation of Code (aka ‘Code Injection’)
• CWE-494: Download of Code Without Integrity Check
• CWE-404: Improper Resource Shutdown or Release
• CWE-665: Improper Initialization
• CWE-682: Incorrect Calculation

Porous Defenses

The weaknesses in this category are related to defensive techniques that are often misused, abused, or just plain ignored.

• CWE-285: Improper Access Control (Authorization)
• CWE-327: Use of a Broken or Risky Cryptographic Algorithm
• CWE-259: Hard-Coded Password
• CWE-732: Insecure Permission Assignment for Critical Resource
• CWE-330: Use of Insufficiently Random Values
• CWE-250: Execution with Unnecessary Privileges
• CWE-602: Client-Side Enforcement of Server-Side Security

Python 3000

Python 2.6 was released not too long ago as an update adding great stuff like simplejson within python.  But Python 3000 might be the release that draws lots of usage and programmers new and veteran.

Having 2.0 solid and complete is a great step to making production apps run off of it.

Microsoft Compatible APIs

• ADO.NET 2.0 API for accessing databases.

• ASP.NET 2.0 API for developing Web-based applications.

• Windows.Forms 2.0 API to create desktop applications.

• System.XML 2.0: An API to manipulate XML documents.

• System.Core: Provides support for the Language Integrated Query (LINQ).

• System.Xml.Linq: Provides a LINQ provider for XML.

• System.Drawing 2.0 API: A portable graphics rendering API.

Mono APIs

• Gtk# 2.12: A binding to the Gtk+ 2.12 and GNOME libraries for creating desktop applications on Linux, Windows and MacOS X.
• Mono.Cecil: A library to manipulate ECMA CLI files (the native format used for executables and libraries).
• Mono.Cairo: A binding to the Cairo Graphics library to produce 2D graphics and render them into a variety of forms (images, windows, postscript and PDF).
• Mono’s SQLite support: a library to create and consume databases created with SQLite.
• Mono.Posix: a library to access Linux and Unix specific functionality from your managed application. With both a low-level interface as well as higher level interfaces.

Third Party APIs bundled with Mono

• Extensive support for databases: PostgresSQL, DB2, Oracle, Sybase, SQL server, SQLite and Firebird.
• C5 Generics Library: we are bundling the C5 generics collection class library as part of Mono.

Compilers

These compilers are part of the Mono 2.0 release:

• C# 3.0 compiler implementation, with full support for LINQ.
• Visual Basic 8 compiler.
• IL assembler and disassembler and the development toolchain required to create libraries and applications.

I am pleased to announce that Mono C# compiler (gmcs) has now full C# 3.0 support. Most of the features has been available since Mono 1.2.6 release. However, with the upcoming Mono 2.0 release we will also support complex LINQ expressions and mainly expression trees which is fairly overlooked new feature with a lot of potential.

For anyone interested in compiling and running this LukeH’s slightly extreme LINQ example I have good news. It compiles on Mono and it runs as fast as on .NET.

UNIVERSITY OF CALIFORNIA, IRVINE

Architectural Styles and
the Design of Network-based Software Architectures

DISSERTATION

submitted in partial satisfaction of the requirements for the degree of

DOCTOR OF PHILOSOPHY

in Information and Computer Science

by

Roy Thomas Fielding

2000

Dissertation Committee:
Professor Richard N. Taylor, Chair
Professor Mark S. Ackerman
Professor David S. Rosenblum

PDF Editions

1-column for viewing online

2-column for printing

Table of Contents

Dedication

Acknowledgments

Curriculum Vitae

Abstract of the Dissertation

Introduction

CHAPTER 1: Software Architecture

1.1 Run-time Abstraction

1.2 Elements

1.3 Configurations

1.4 Properties

1.5 Styles

1.6 Patterns and Pattern Languages

1.7 Views

1.8 Related Work

1.9 Summary

CHAPTER 2: Network-based Application Architectures

2.1 Scope

2.2 Evaluating the Design of Application Architectures

2.3 Architectural Properties of Key Interest

2.4 Summary

CHAPTER 3: Network-based Architectural Styles

3.1 Classification Methodology

3.2 Data-flow Styles

3.3 Replication Styles

3.4 Hierarchical Styles

3.5 Mobile Code Styles

3.6 Peer-to-Peer Styles

3.7 Limitations

3.8 Related Work

3.9 Summary

CHAPTER 4: Designing the Web Architecture: Problems and Insights

4.1 WWW Application Domain Requirements

4.2 Problem

4.3 Approach

4.4 Summary

CHAPTER 5: Representational State Transfer (REST)

5.1 Deriving REST

5.2 REST Architectural Elements

5.3 REST Architectural Views

5.4 Related Work

5.5 Summary

CHAPTER 6: Experience and Evaluation

6.1 Standardizing the Web

6.2 REST Applied to URI

6.3 REST Applied to HTTP

6.4 Technology Transfer

6.5 Architectural Lessons

6.6 Summary

Conclusions

References

List of Figures

Figure 5-1. Null Style

Figure 5-2. Client-Server

Figure 5-3. Client-Stateless-Server

Figure 5-4. Client-Cache-Stateless-Server

Figure 5-5. Early WWW Architecture Diagram

Figure 5-6. Uniform-Client-Cache-Stateless-Server

Figure 5-7. Uniform-Layered-Client-Cache-Stateless-Server

Figure 5-8. REST

Figure 5-9. REST Derivation by Style Constraints

Figure 5-10. Process View of a REST-based Architecture

List of Tables

Table 3-1. Evaluation of Data-flow Styles for Network-based Hypermedia

Table 3-2. Evaluation of Replication Styles for Network-based Hypermedia

Table 3-3. Evaluation of Hierarchical Styles for Network-based Hypermedia

Table 3-4. Evaluation of Mobile Code Styles for Network-based Hypermedia

Table 3-5. Evaluation of Peer-to-Peer Styles for Network-based Hypermedia

Table 3-6. Evaluation Summary

Table 5-1. REST Data Elements

Table 5-2. REST Connectors

Table 5-3. REST Components

Kepler is an open source platform that brings the power of Lua to web development. There are a number of great Web development platforms out there but none balances portability, size, power and extensibility quite like Kepler does:

• Being extremely portable and light means that it can be installed in very constrained devices as much as in providers that limit the amount of RAM and processing time for your scripts.
• If you ever heard of the customization features of games such as World of Warcraft, think about all that power applied to web scripting.
• Being extensible means both that we can extend the platform by adding new modules and that the users of the applications that you build can extend those applications using Lua.

Kepler was created by Fábrica Digital and PUC-Rio and is continuously being improved by a core team of commiters (see Dev Team) and lots of contributors (see Credits).

Kepler is free software and uses the MIT license model: it can be used for both academic and commercial purposes at absolutely no cost. See the Kepler License for more details.

Kepler is a platform that uses LuaRocks to offer Modules such as:

• Page based and MVC XHTML generation (WSAPI, CGILua and Orbit)
• SQL and XML processing (LuaSQL and LuaExpat)
• Hash (MD5) and a pair crypt/decrypt
• Zip files reading (LuaZip)

The Lua community is constantly contributing with more modules that can be used with the Kepler Architecture. Most of those modules are catalogued on LuaForge and new ones keep coming.

Unix installation

Please check UNIX Installation for a detailed view of how to install Kepler on Unix machines (including OSX).

Windows installation

Installing Kepler on Windows does not require any C compiler and should work on any Windows machine with internet access.

1. Download LuaRocks and install it using install /SCRIPTS c:\luarocks\0.5.2
2. Add the LuaRocks scripts dir to your system path (the same directory used in the /SCRIPTS parameter above)
3. Install Kepler and Xavante using luarocks install kepler-xavante
4. Configure everything using setup-kepler and following the instructions
5. Use xavante to run Xavante as a tray bar application, or use ‘xavante_start’ to run Xavante from the command prompt. Another option is to run Kepler using CGI

Once Kepler is running, you might want to look at those pages:

• Hello World will tell you how to write a simple application
• Using a Database will tell you how to use some of the popular databases with Kepler.
• Configuring Web Servers will tell you how to use Kepler with some specific web servers.

The Kepler 1.1 Unix installer can be downloaded from its downloads page. Check the Installation page for more details and for the Windows installation instructions (using LuaRocks).

If you need the binaries for specifics Modules you can also get them from LuaForge, on the module respective project page.

Lightweight REST framework for Java

Do you want to embrace the architecture of the Web and benefit from its simplicity and scalability? Leverage our innovative REST engine and start blending your Web Sites and Web Services into uniform Web Applications!

Java is making things more lightweight now with lots of emerging kits that compete with other web ready platforms like Python, Ruby, .NET, PHP etc. After this many years things get bloated and need to be simplified.  I think this will start winning people over in this direction.

Each platform has their own way to do this, but there is a common baseplane way to do caching, yes even in .NET. That is with memcached. Memcached is a very common and useful tool that makes caching data and cache layers in an application something that can be the same on every platform. The benefit of using memcached is it is open, common and it has APIs for nearly every popular web development platform (and can be wired in easily to platforms that don’t have their own cache mechanism). Why write your caching layer specific to a certain platform when you can memcache?

If you write high performance web apps and don’t memcache, I feel bad for your server budget and your late nights when that ad buy hits or something popular on your site becomes all the rave.

Perl API

An object-oriented Perl module can be found on CPAN as Cache::Memcached or in Subversion (ChangeLog). (GPL/Artistic)

The Perl API takes advantage of the server’s opaque flag support and sets its “complex” flag whenever the object being stored or retrieved isn’t a plain scalar. In that case, the Storable module is used to freeze and thaw the value automatically going in and out of the memcached.

There is also Cache::Memcached::Fast—another Perl client written in C, largely compatible with the original Cache::Memcached. Available on CPAN at http://search.cpan.org/dist/Cache-Memcached-Fast/.

PHP API

There are tons of PHP libraries available, in different conditions. But it now seems there’s an official one:

• PHP PECL memcached client — official PHP client

Python API

The Python client we’d previously released was just a prototype, and we don’t have regular Python programmers on hand. The folks at Tummy.com have took over maintenance. See ftp://ftp.tummy.com/pub/python-memcached/ for the latest versions.

Ruby API

• http://www.deveiate.org/code/Ruby-MemCache.html
• gem install memcache-client
• http://blog.evanweaver.com/files/doc/fauna/memcached/. C backed client wrapping libmemcached.

Java API

A Java API is maintained by Greg Whalin from Meetup.com. You can find that library here:

• http://www.whalin.com/memcached/ — Java API for memcached

An improved Java API maintained by Dustin Sallings is also available. Aggressively optimised, ability to run async, supports binary protocol, etc. See site for details:

• http://bleu.west.spy.net/~dustin/projects/memcached/ — Improved Java API for memcached

C# API

There are multiple C# APIs:

• https://sourceforge.net/projects/memcacheddotnet/
• http://www.codeplex.com/EnyimMemcached/ – Client developed in .NET 2.0 keeping performance and extensibility in mind. (Supports consistent hashing.)
• http://code.google.com/p/beitmemcached/ – Client developed by BeIT with many new features.

C API

Multiple C libraries for memcached exist:

• apr_memcache by Paul Querna; Apache Software License version 2.0
• libmemcached by Brian Aker; BSD license. This is a new library, under heavy development.
• libmemcache by Sean Chittenden; BSD license. This is the original C library. It is no longer under active development. You should try libmemcached instead.

Postgres API

The pgmemcache project allows you to access memcache servers from Postgresql Stored Procedures and Triggers. More details and downloads are available at:

• http://pgfoundry.org/projects/pgmemcache/

Chicken Scheme

• http://chicken.wiki.br/memcached — Chicken Scheme library

Lua

• http://luamemcached.luaforge.net/ — Lua library

MySQL API

The memcache_engine allows memcache to work as a storage engine to MySQL. This means that you can SELECT/UPDATE/INSERTE/DELETE from it as though it is a table in MySQL.

• memcache_engine

A set of MySQL UDFs (user defined functions) to work with memcached using libmemcached.

• MySQL UDFs for memcached

Protocol

To write a new client, check out the protocol docs. Be aware that the most important part of the client is the hashing across multiple servers, based on the key, or an optional caller-provided hashing value. Feel free to join the mailing list (or mail me directly) for help, inclusion in Subversion, and/or a link to your client from this site.

The best part, they support all good platforms and even Lua, and wisely they left out VB.NET, no worries, VB.NET’ers will never know. Only kidding…

Finally, memcached is distributed, most cache layers included with platforms listed above are in process and per machine.  If you are running your code on a webfarm memcached is the only way to go.

PHP gets alot of heat mainly because it is critical mass and when that happens mediocrity comes in but since PHP5, PHP has really grown to be a great web development toolkit with many frameworks to choose from. But which one do you choose for your development? Do you want an MVC, or do you want to piece together an MVC from a template library, model framework and custom controller?

Well if you want to pick an MVC there are some great ones.

There is a site that has a decent ranking that is similar to my own likings in PHP frameworks that lists them like this:

I have not used QPHP, Zoop, Prado or PHPDevShell but plan on doing reviews of all of them. I have a simple application that i will be building in the latest versions of each platform to help show highlights, pros, cons and the ins and outs of each.

Why? And why PHP? I have long been a developer of web sites and applications. Until around 2005 PHP was not accepted in enterprisey, but this is changing. Usually .NET, Java, Perl, Python and recently Ruby were the dictated choice of the clients or environments to code in. But with PHP5 now stable and PHP4 being retired, PHP is a insurgent platform that muscled its way into the web development world in a grassroots effort, from the bottom up. That takes work and the platform deserves a second look from people that have written it off.

PHP runs many large sites from Facebook, to Digg, to Yahoo and many other platforms even Microsoft is trying to buy. PHP might even be responsible for MySQLs meteoric rise to just recently being purchased by Sun. It is a platform that is being used to build platforms. It works on any platform, it is low-bar entry and high bar scalability and architecture if using a great framework or architecture (if custom or using an existing framework).

I am an engineer, developer, architect and interactive/game developer, I use the tools for the job no matter what is chosen. Any good developer can make a system work even with bad technology but today there isn’t alot of that going around. So many great platforms, languages and frameworks, why limit to a certain OS or platform. Open your horizons and stop specializing yourself out of special skills. Choose a tool that works on just about anything on the server side and doesn’t take over servers and take 3 times as long to develop. Try some PHP5 MVC frameworks today.