2006/07/28

Web Interactivity, AJAX and Security

Two items read online today raised interesting and potentially high impact points about the web. A News.com article talked about the security risks being introduced by highly interactive websites of the 2.0 variety, especially with respect to AJAX (Asynchronous Javascript And XML). The other item, a Tara Hunt post on HorsePigCow discussed the coming demise of web browsers.

"The Security Risk in Web 2.0" makes the point that for highly interactive websites built using AJAX, an important component of Web 2.0, "in the rush to add features, security has become an afterthought." Although AJAX isn't the only aspect of Web 2.0 sites which results in decreased security, it is one of the big contributors. In describing AJAX, the article says, "A traditional Web site is like a house with no windows and just a front door. An AJAX Web site is like a house with a ton of windows and a sliding door."

Two general causes of security problems on the new, more interactive sites are website programmers lack of security focus and the inherent insecurity that comes with web interactivity. The twenty-something web programmers building the Web 2.0 sites are more focused on the features and interactivity of the site than they are on the security. They haven't had much experience programming sites where security was the most important attribute of the code. Many of them haven't had any formal training in secure coding (possibly no formal programming training at all) and many of the code examples they have learned from have not been optimized for security. Additionally, in many ways web interactivity is synonymous with insecurity. When a website is programmed to easily interact with legitimate users, it automatically becomes that much easier for a malicious visitor to misuse the site, especially if security wasn't the top concern when the site was designed.

Tara's post, "R.I.P. Browsers" discusses an interesting theory that should bring a smile to Steve Ballmer's face. Her premise is that browsers should soon become a thing of the past because of their design. For one thing, doing everything on the web with browsers (such as Gmail, Writely, Gspreadsheets, etc) means that when you're offline, by choice or by necessity, you likely have limited access to your info that is stored online. Also, using a web application like Gmail within a browser is recursive, running an application within an application (within another application if you want to consider a modern OS an 'application'). Instead of this situation, Tara suggests we should have "No more browsers. Just connected desktop apps." Read the list of points supporting her theory and see if you agree.

The 'net continues to evolve. Its nearly continuous innovation presents both opportunity and problems, bringing to mind the E. F. Russell phrase, "May you live in interesting times."

For a brief background of AJAX, read "AJAX breathes new life into Web apps" from InfoWorld.com.

Here's the initial weekly issues list for NEW NET's 01 Aug 2006 gathering:


*****

posted by myDigitechnician at 28.7.06

0 Comments:

Post a Comment

<< Home