TechTee

If you have ever worked in a fairly large corporate office, you would no doubt have attended numerous “re-org” meetings. They all seem to have a standard theme: “The previous structure/org chart was flawed (besides it was done by my predecessor who is a moron **cough cough**) and hence this brand new structure.”

A matrix based org structure gives way to a divlet based one which is shoved away in favor of a “line-discipline” organization etc.  ad infinitum …

“Organization” is also relevant when it comes to seating .. do you make all your engineer sit together regardless of what product they work on?, and all your QA Engineers in a different area OR do you make managers, engineers and QA sit together based on what product they are working on? … (ugh what if I’m working on multiple products?)

The one that is of interest to me currently, is organization and structure for a Project developed using Java. With the advent of “layering” and “seperation of concerns”, most projects have a controller, model and view layer.

Now, this brings its own question in terms of package structures. Do you club all your “controllers” together and your “models” etc. in its own package OR do you put them in a package based on the “vertical/feature” that they are serving — e.g. “shopping”, “reviews” etc.?

An article at http://www.javapractices.com/topic/TopicAction.do?Id=205 talks about “Package by Feature” v/s “Package by Layer” — and for various reasons prefers the “package by feature” paradigm.

Some excerpts from that article are posted below

Package-by-feature separates the application according to its various features. The package names correspond to important, high-level aspects of the problem domain. A drug prescription application, for example, might have these packages :

• com.app.doctor
• com.app.drug
• com.app.patient
• and so on…

Within each package are all (or most) items related to that particular feature : action, model, and data access object classes, for example. (There may be more than one of each class, or one might be missing, according to the needs of the problem).

Package-by-layer instead reflects the various application layers in the highest level packages, for example :

• com.app.action
• com.app.model
• com.app.dao
• com.app.util

Of course, to me, the structure you choose depends on who you are and what your role is. Maybe from a UI engineer’s point of view, its better to keep ALL UI related code in one folder. But from a “Vertical Leader” point of view, you would want all code, regardles of what part of MVC they fall under belong to one package i.e “package by feature”.

Of course, its much more difficult to arrive at a solution when one is dealing with the physical world - as is the case in the “seating” problem above. Software, however, is flexible and amenable towards a solution. Is there a way we can solve the needs of BOTH the parties here?

Lets think about the same issue in terms of your favorite Web-based Email product. Most tradional offerings such as Yahoo Mail, Hotmail, AOL Webmail etc. have gone with the old “folder” based approach to organizing emails. This brings out a question — where do I store emails that were sent by my wife but was about house bills - under “family” or under “finance”?

Gmail however has taken the approach of “tag” based organization. Essentially ALL your emails are in the same flat structure (conceptually) and individual mails can be assigned multiple “tags”.
Based on what you are trying to accomplish at the time, you can arrange and filter your emails based on the tag.

Is there a way we can introduce the concept of “tag” based “packaging” in Java. For e.g.

@Tags(controller, shopping)
public class MyShoppingController{
}


@Tags(util, shopping, general, review)
public class MyProductUtil{
}


@Tags(controller, review)
public class MyReviewController{
}


As shown above, if one were to use Annotations and store ALL java files in the same folder, but use Tag Annotations to define which “conceptual package” they belong to can we solve this issue? Of course, we need to think about the Java Language Specifications and its bearings on Package based scope and access privileges etc., not to mention other issues such as Namespaces and ClassLoaders. But its something to think about — well some day when I really have time (yea, yea, purists of Java - its just a wild concept, dont fret over the actual semantics :-))

Start Slide Show with PicLens Lite

Mashup Camp 2008 just concluded. Mashups seems like soooo last season. If one were to sort recent web technologies chronologically or in terms of buzz worthiness it would go somewhat like AJAX, Web 2.0, Mashups, Social Networking, (Bubble 2.0??), ….

Sure, there were a decent number of participants and the usual suspects (AOL, M$, Y!) had their usual booths and swags in addition to their evangelization efforts of their respecitve Open APIs, but the buzz is clearly over for mashups … unless of course you are mashing up various social networking data (FriendsFeedsFeedAggregator???)

Tradionally “mashups” were in terms of aggregating data from various “sources” and overlaying them to produce a useable application. Also tradionally data were mostly Feeds of Pictures, News etc. and most were overlayed on a Map. Location based mashups are clearly useful and here to stay.

iPhoneLocator (http://www.facebook.com/apps/application.php?id=10355565129) of course tries to mashup using all possible buzz worthy trends today namely iPhone, Mashups, Maps, and Facebook!. Yahoo annouced FireEagle (http://fireeagle.yahoo.net/) (“Fire Eagle is the secure and stylish way to share your location with sites and services online while giving you unprecedented control over your data and privacy.“)

More recently it has forayed into different data types. For e.g. Voice based Mashups, various types of data embedded in Video etc. are making some headway. Ribbit (http://www.ribbit.com/) is at the forefront of Voice API revolution. Tim Burks demoed a different kind of mashup - one that is primarily done in programming layer - basically, Tim champions “Nu”, a Object Oriented Programming Language that can “mashup” different programming languages such as Lisp, Ruby and Object C. More on this at http://programming.nu/.

Of course, now with the fad towards various Social Networking sites, there has been a lot of focus on OpenSocial (http://code.google.com/apis/opensocial/) and Shindig

The trend clearly is towards “Open”ing of data. And of course AOL has now made AIM “Open” as well. Kapow kind of takes this openness to its literal extreme - by providing means to scrape data that is out in the “open” - clearly something that was not so kosher thus far (and still might not be all that legal).

All in all, there is plenty of data and means to mashup out there to keep one interested in the area with enough to play around with and tinker with for quite a while.

Links

• http://www.mashupcamp.com/
• http://wiki.mashupcamp.com/index.php/SpeedGeeking6
• Movie Mash http://www.imoviemash.com

Start Slide Show with PicLens Lite

With the advent of web 2.0 and the buzz index of “social networking” going through the roof, a lot of people are paying attention to the various methods of “understanding” the user and means of “tailoring” content to such users.

Since the subject is so vast, here are some of the links that has served me well over the past few months since I got involved with these subjects at work (http://my.aol.com/page/mgnet).

• Free Online course on Information Retrieval by Prof. Mooney (Univ. of Texas) -> http://www.cs.utexas.edu/users/mooney/ir-course/
• Chris Manning, Prabhakar Raghavan et all have a book at http://www-csli.stanford.edu/~hinrich/information-retrieval-book.html
• Lucene’s approach and various links at http://wiki.apache.org/lucene-java/InformationRetrieval
• Wikipedia Entries on Social Networking at http://en.wikipedia.org/wiki/Social_network

Start Slide Show with PicLens Lite

After the “Web 2.0″ revolution, geeks and marketing nerds needed a new frontier to be buzzed about and march towards. Enter Web 3.0 [http://en.wikipedia.org/wiki/Web_3].

One of the trends thats been gathering traction is the usage of Cell Phones (Mobiles for the rest of the english speaking world) in place of the PC to conduct day-to-day activities. With the launch of iPhone and the annoucement of Google Android, a lot of buzz has been generated in this area.

Just like the Web 2.0 revolution started a trend towards social networking sites and sharing, the Mobile revolution will make it much easier to participate in such activities with your Cell Phone. However, unlike the fairly mature and “open standards” based Web, the Mobile world is a mish-mash of pseudo standards, proprietary networks and “pay per use” nightmares. This, combined with the difficulty involved in implementing an application that can be used by a critical mass of cell phone users has been the limiting factor in the march towards a mobile world with first class apps.

Yahoo Mobile (http://m.yahoo.com) is a clear leader in the mobile portal space.

When it comes to social networking and “sharing” there are a series of startups vying to be the next talked about application.

One of them - CellFish, accounced a “free” web service for sharing MultiMedia files with their “Add To Phone” offering.

Users get a SMS message on their phone with a link to a “locker” site which hosts the multimedia asset that was “shared”.

For e.g. you can send the Defrag picture above using this button ->

Some other companies that have similar offerings are

• http://mobile17.com/
• http://hooqs.com/ (share Video Channels with your Mobile)
• http://www.darkoutcast.com/ (Video Transcoders to create video consumable by most mobile devices)

Mobile apps are still in its infancy (atleast in the States) as far as mass acceptance and usage is concerned, but there is no denying that it is the future.

Start Slide Show with PicLens Lite

Defrag Conference (http://defragcon.com) was held at Denver with the goal of getting thinkers, users and innovators in the space of Knowledge Management and Social Networking to discuss and brainstorm ideas/issues and trends in this space.

Every conference has its own charactersitics - this one

• Seems to have had an audience from both the Enterprise/Academic world (British Telecom, UC Berkeley, Siderean etc.) and the Consumer World (Medium, Yahoo, Google, AOL, FeedHub etc.)
• There were about 150 to 200 attendees
• The format was a mixture of single speaker sessions, moderated panel talks and free/open discussions on a topic of attendee’s choice.

Structured Data and Attention

Alex Iskold talked about “Structured Data and Attention” Key points were

• User’s activities (reviewing, tagging, rating etc.) were currently stored in a Silo. There is no easy way of sharing, migrating these attention data across sites.
• e.g. User does a review on Amazon on a book he purchased. Amazon benefits from this review. Amazon uses this to attract more users/offer recommendations. This recommendation however only works within Amazon.
• Since attention data is only stored/accessed per site, it poses two problems.
  • It becomes difficult to apply it across other domains - e.g. a site like Netflix could have potentially used the Author’s review on the book to recommend movies based on his feelings
  • It makes it difficult to create an aggregated social/collaborative intelligence as the data is spread out and there is no easy way of obtaining/using them.

Hence he calls for a standard to be developed around this issue in the following area.

1. Attention Data Interchange Interfaces/APIs
2. Attention Data Storage on a Trusted “Third” Party site in a well defined structured format.

Questions asked: What about APML (http://www.apml.org): Alex is appreciative of the eforts put into it - its a good start, however he thinks its too generically structured (tags). He favors more rigidly defined structures e.g. Books, Shopping Items, Movies etc.

Attention Data and User Control

A couple of sessions (featuring Doc Searls, Esther Dyson etc.) talked about the emerging Social Network based applications and the real concerns/issues it brings forth.

Esther pointed out that a lot of sites are collecting Attention Data - but most are NOT sharing what they collect/disseminate with the user. Esther prefers that a strong “Privacy/Rights” structure be worked around “Attention Data”. Users need to feel comfortable using a service and they trust a service when they can control their “Profile”.

Doc Searls spoke on “Customer Reach v/s Vendor Grasp”. He lamented the lack/reduction of customer rights (e.g. Verizon’s 10,000 words Service Agreement). What if Consumers stood up for their rights and came up with their own “agreement” and terms/conditions with each of these “Vendors”? Doc is heading a project called Project VRM (http://cyber.law.harvard.edu/projectvrm/Main_Page) which is working towards providing a framework for “Vendor Relationship Management”

Next Level Discovery/Search Panel

Moderated by Bradely Horowitz from Yahoo with participants from Factiva.com, Krugle.com (Steve), Jabber etc.

The topics of discussions were around Search queries and results. Bradely started off the discussions with the question “Does Search today suck?” and each of the panelists provided their take on it. The consensus seems to be that Search has come a long way - but it still has a long way to go especially in the Enterprise world and also in the non english speaking world.

Today’s main search engines are “Keyword Search” based. These dont always work. Sometimes people would rather use Natural Language based queries. This method has seen very limited success. Some research show that finding answers by asking questions (natural language) is well - “natural”, but using keywords and drilling down/honing on the right result is “learned”.

Bradely described how Yahoo! came up with Yahoo! Answers to solve this problem space (reasons: people like asking questions and obtaining answers and Korean users (which is where Answers conceptually originated) were somewhat at a disadvantage due to the lack of significant index of Korean data)

If querying data was one aspect, consuming the search results was the other end of the problem. Yahoo!, Google et all have so far stuck to displaying ranked results as list of links (An Ask.com commercial mocks this lack of “feature”). Then there are models such as the one eBay Express is experimenting with at http://www.express.ebay.com/ that attempt to provide a “Category/Filter” based approach. Search for “Womens Reebok Shoes” and see how the results are displayed.

Panelists also were of the opinion that comsuming and viewing search results across TimeLines, Geography etc. were also very valuable but very few consumer search sites provide this feature. (Some Enterprise Verticle ones do)

There were some discussions on how “Vertical Search Tools” solved the problem of “Context”.

Steve from Krugle.com offered the example of searching for “python”. Krugle understands this to be the programming language and need not disambiguate it for a snake.

Another challenge facing Search today is in the enormous amount of un-indexed non-web data out there. Jeremie from Jabber expressed hopes that some day there will be a “Collaborative Search Protocol” which facilitates aggregating and consuming search from multiple vertical/generic search engines.

OpenSocial v/s Closed Private

Google’s Kevin Marks made an unscheduled presentation on OpenSocial. It was mainly in response to some concerns/confusions in the industry on its security, usage model etc. Kevin mostly talked about what OpenSocial is and how to go about using it. The slides can be found at http://docs.google.com/TeamPresent?docid=dfng2zqx_35gq33q7. A day earlier some folks at the DeFrag announced “Closed Private” - sort of an anti-thesis to OpenSocial. The discussion was around the concerns/issues surrounding “promiscous”, “open”, social networking sites.

The key points were:

• OpenSocial is still in a very early “Alpha” stage
• Google likes to deploy products in early stages and collect feedbacks - this was a collaborative approach (with partners such as Linked In) and it was thought that its beneficial to announce this and work out the kinks in the “Open”
• The main challenges are in the area of “Identity”. A particular person may have multiple “personas” - s/he may/may not want them to be intermingled.
• Google currently is relying on Container Namespaced Identity (e.g. username@linked.com) and delegated authentication. Identity is not controlled by Google. (Google Account/gmail accounts are not necessarily tied with OpenSocial Identity - though its a possibility in the future)
• The security is left to the individual containers for now (remains to be seen how it works out - we have already seen multiple hacks (http://www.techcrunch.com/2007/11/02/first-opensocial-application-hacked-within-45-minutes/))

I asked Kevin if there were any plans to work on a “Data Format” for Social data interchange -> almost like a OPML type. For e.g. most “social networking” sites have common types of data e.g. “Friend/Buddy List”, “Activities”, “Personal Profile Information”. etc. Is it beneficial to define a data format (Social Netowrk Markup Language :-))? Kevin responded that the current aproach is to use the Atom publishing model and loosely defined “streams” for Activities. There are formats such as “hcards” for contact info, and then there are google namespaced shemas for some data types. There were some conversations around Widget specification standardization (Netvibes UWA?).

It appears that Netvibes announced their own plans around OpenSocial (http://www.techcrunch.com/2007/11/06/netvibes-wants-to-tap-into-other-social-networks/)

Information Overload Panel

Is there an information overload? Or is it just a feeling peculiar to the alpha-geeks? What is the industry doing to solve it? Paul Kedrosky moderated this panel with participation from Will Morris (VP at AOL), Bradley Allen (Siderean), James Altucher (Stockpickr) and Chris Shipley (Guidewire Group)

Will thinks Information Overload is definitely a problem, but so is information “underload”.

Will also believes that serendipitous discovery is quite beneficial too. He then offers myAOL/Mgnet as one of the initiatives that AOL has undertaken in this area (the challenge is in finding the right balance). Will suggests that the fact that the system was able to understand his habits and suggest items such as “British runners in New York Marathon” and “Running Cat” etc. was of good use to him.

(Disclosure: I work on the myAOL/Magnet team at AOL)

Other panelists such as Chris were of the view that there is no such thing as information overload - it depends on the individual and the context.

My take on information overload is that we need to differentiate information into “consumable/interesting data” and “actionable data items” We then have to prioritize and act on actionable items. Interesting data (including the serendipitously discovered articles) can wait for consumption during leisure.

For e.g. the numerous “friend invites” from various social networking sites are “actionable data” - but of a slightly lower priority compared to “finish my design task on creating a OpenSocial based widget”

Booths

Siderean

I visited the booth of Siderean (http://www.siderean.com/) and had a chat with Gary Wright, Director of Western Region Sales who showed me a demo of how they have helped Oracle use the siderean custom integration to obtain “structural” information from their internal blogs, calendars, events etc. The results can be navigated by “People, Timeline, Place etc.” e.g. http://pressroom.oracle.com/prNavigator.jsp

Medium

Medium (https://addons.mozilla.org/en-US/firefox/addon/4365) is a very impressive Firefox plugin that reveals the hidden world of people and activity behind your Firefox browser (impresssive in terms of features/concepts - Not the UI).

Its about “collaborative browsing” - of meeting (online) with people who happen to be browsing the same site as you are - and then discovering what other/related sites these users are on - all in real time. It then provides a way to share/chat with these users.

This concept is definitely not new - Stumble Upon, Delicious etc. have already found a way to provide items based on how other users similar to you have already discovered based on tags/ratings etc. But Medium’s twist on this is the real-time aspect and the “View” - which is an AJAX based sidebar that lets you watch this curious browsing behavior in real time.

Start Slide Show with PicLens Lite

It appears that its all about Links: Who you are linked to? - and who links to you. Ever since Sergey and Larry came up with the PageRank paper with backlinks being a major contributor to the rank, the SEO industry is practically teetering over the edge with plenty of theories and ideas on how to “cheat” the system - or as in most cases, come out ahead it for legitimate reasons.

One such company, www.kango.com, had such a hard time with it, that they came up with a satirical take on what Google might have to do in order to make it into the SEO rankings.

Although “link madness” is a big menance, and Google’s recent Google Dance with Blog Links Farm notwithstadning, its been widely quoted that PageRank and backlinks are just one of the many (reportedly over 500) cascading factors that are taken into account to generate the SERPs.

Start Slide Show with PicLens Lite

Its been a while since the “AJAX” way of development caught the web world in a delirious rebuilding cycle. This year’s AJAX conference of course, did not have to explain what AJAX is - buzzwords have a shelf life - and unless one has his head stuck in the sand, most web developers have “been there and done that: with AJAX”.

The industry seems to have moved into the phase where “enabling AJAX developers” seems to be the primary objective. Although the conference itself had interesting sessions, the location and the facilities were simply not upto the mark (Ever heard of a big tech conference with none-to-minimal wireless connection?).

The summary of what was on on the offering can be categorized as:

• AJAX security and deployment challenges.
• JavaScript/UI/Widget Libraries and Frameworks
• IDEs and AJAX Development Frameworks
• AJAX Development Patterns (offline apps, “AJAX Push” etc.)

Edwin Aoki (AOL Technology Fellow) provided AOL’s experience in deploying AJAXy web applications and the challenges that went with it - with some glimpses of how AOL has solved them. Of course the focus was on enterprise concerns such as Page Views (and AJAX’s affect on them), advertisements, Cross Domain Scripting and related security issues etc. But the one that generated most buzz and enquiries was the “Content on Demand” demo - in which Edwin showed an application that would download data based on the “page scroll” position of the browser. Edwin’s presentation can be found here at http://dev.aol.com/presentations/EA_Ajax_Experience_2007.ppt

There has been a proliferation of javascript libraries and frameworks. DOJO, prototype, script.aculo.us, YUI, GWT, jQuery, DWR, etc. were in the fore front vying for a piece of the web developer’s mindshare. It appeared that DOJO was the most used one as far as advanced Javascript/performance based applications go, but others had its own followers (I base this on conversations I had with developers and not on any official survey . If however you are a HTML/CSS expert (like most “UI Designers”), then jQuery seems to be tailor made for you.

And of course, when there are so many libraries and frameworks abound, there definetely is a place and need for a IDE/Tool/Framework that abstracts these and provides its own layer of icing to the cake. The following occupy this category:

• jMaki - at https://ajax.dev.java.net/ seems to provide a pretty decent Eclipse/Netbeans enabled AJAX development framework. The demo was quite impressive with Greg Murray from Sun explaining how easy it was to use one widget from Dojo and another from Adobe to create a simple Mashup
• QooxDoo -(http://qooxdoo.org/) - an Open source AJAX development framework - with Demos available at http://qooxdoo.org/demo
• Google Mashup Toolkit at http://editor.googlemashups.com/editor of course is the new entrant in this space - availability is currently through invitation/registration only - I am yet to explore this fully.
  

Google Gears (http://gears.google.com/) which was announced recently had a session that went through some of the design choices they had while creating this “access your data offline using a Javascript based open source plugin” framework. Some interesting points/debates were around their choice of SQLLite as the database engine behind their offline access storage. The debate of course revolved around using SQL as the query protocol - and its pitfalls - such as SQL Injection and security implications. In fact Gears was singled out as a “bad architecture/choice” by the Yahoo Architects in their session on AJAX security and their own implementation of an as yet unvieled yahoo “application server”.
All in all, most sessions were quite engrossing and I have plenty of things to try out - makes for a rather busy few weeks.

Start Slide Show with PicLens Lite

The MashupCamp is unlinke most conferences - according to the organizers its “The Unconference for the Uncomputer” - which roughly means - nothing is organized, there are no schedules, and its a Geekfest of mashup developers building/dissecting and boasting about their Mashups.

The ubiquitous nature of Feeds and the changed world order in which most companies (Yahoo, Google, MS, AOL etc.) are toppling each other to provide “Free” APIs to all sorts of data/applications - has created a revolution of sorts with a large contingent of developers building gadgets/widgets with some even dreaming of creating a “startup” with these offerings.

This was my second mashupcamp. However, this time, I had a demo/presentation and a tech session for our newly launched myAOL (and Magnet). It was sobering and a little daunting to note that unlike other conferences you had to “fight” for a room - put up your proposed talk/demo and let the other developers decide whether they would like to attend. The presentation can be found here (http://dev.aol.com/presentations/mashupcamp_feeds/index.html). The discussion went well - topics covered included “standardization of widget formats”, “authentication and ACLs for widgets/data”, etc. Here is an attendee’s view of the proceedings (http://www.column2.com/2007/07/mashup-camp-iv-day-1-aol-and-feed-mashups/)

Some of the interesing sessions/mashups were

• Google’s Mashup Editor (http://code.google.com/gme/) [you need to sigup in order to use this beta product]
• An integration of LignUp’s VOIP service with TWiki to allow for the integration of voice information into the wiki
• Talk on OpenID by Kevin Lawver(http://presentations.lawver.net/philosophy/mashup_university_tapping_the/)

As mentioned above, there were “startup entrepreneurs” too such as one couple (Raghu and Veena) who built a mashup using Movie data. The site (http://www.seegest.com) was fully implemented by this couple using data from Amazon, Netflix etc. Its got promise, but the business model around it is as yet unformed (and yes, the developer was aware that the oft-quoted “I will integrate with Adsense” will only pay for the hosting bills at the most).

Here is a screenshot of the application. It pretty much says it all.

While on the subject of conferences, Daya Baran of WebGuild was looking around for potential conference themes - Web 2.0 already looks old and jaded, and everyone and their neighbors have done Social Networking to death - dont be surprised if this years theme is on challenges of Social Networking, mostly revolving around identity, security and portability

Start Slide Show with PicLens Lite

Well, finally, the product that I have been working on for the past few months got launched as a Beta. Developing Mgnet (http://beta.my.aol.com/page/mgnet) (pronounced “Magnet”) has been a lot of fun.

Personalization has come a long way since the Web 1.0 days. There is still a long way to go, but AOL’s take on it via this Beta launch is the first step on the road to a personalized product with elements of social networking (for the company).

Mgnet is an innovative way to discover and consume content (news, blogs, videos etc.) in an easy to use, intuitive, light-weight manner. Along the way, you will get Recommended content that the system generates. You can of course find your own content by using the “Mgnet Search”. Its not meant to be a serious news reader. For that there are other services which do a much better job. Its not meant to be a RSS feed reader, which is mostly used by “geeks”. The suite though, does provide a feature rich RSS Feed Reader embedded as a Tab for all the tech-savvy audience.

And of course, all of this is housed inside myAOL, a personalized widget hosting system.

Here are a few mentions in the blogosphere.

• TechCrunch: [http://www.techcrunch.com/2007/07/10/aol-launches-three-new-myaol-products-into-beta]
• Jeremy O.’s Web Strategist blog [http://www.web-strategist.com/blog/2007/06/25/a-tour-of-myaol/]
• Washington Post  : ‘The more interesting feature is the second tab, which the Dulles company has dubbed Mgnet. Pronounced Magnet’
• NET’s Webware : ‘the real surprise here is Mgnet. This is one of the cooler things I’ve seen lately’
• Rev2.org : ‘With so much content on the web, it becomes hard to sift through and find the kind that most interests you. Mgnet offers a great visual recommendation and discovery tool to help you find what you’re looking for.’
  ortable personalization platform.’

Give the new myAOL a try! And to those of you who do not have or like to use “Screennames”, the product can be used “anonymously”

Start Slide Show with PicLens Lite

With the popularity of AJAX and Web 2.0, a lot of web sites are dependent on users submitting rich content data and process them using AJAX calls. The family of attacks termed as Cross-Site-Scripting attacks (or XSS for short) is well known with many articles and blogs discussing them along with known solutions and checklists.

e.g. http://en.wikipedia.org/wiki/Cross-site_scripting

What is not that well known in the developer community is the family of attacks known as “Timing based attacks“. Andrew Bortz et. all from Stanford University discuss these set of attacks in their paper hosted at http://www2007.org/papers/paper555.pdf.

To summarize,

• There are two types of Timing based attacks
  • Direct Timing Attacks
  • Remote or Cross Site Attacks
• Direct Timing Attacks
  • The idea here is to determine whether or not a username or more popularly an email address based loginid is present/accepted at a web site. Ever notice that when you log on to most systems (including your local windows box), it takes longer for the system to return back with an error message when you have entered the wrong password? Similarly most web sites take a discernably different amount of time to respond to a valid loginid v/s one that is not valid. Using this method an attacker for e.g. can find out whether user@somedomain.com is a valid user at say Bank Of America Web Site. It then becomes easy to send phishing emails to the user to further propagate the attack.
• Remote or Cross Site Attacks
  • Here the idea is to use some browser based timing mechanisms to determine how long (on an average) it takes for a user to load any given web site. For e.g. The HTML tag for images, “<img src=”..”> can be used to time the amount of time it takes to load the destination site for the user. Using this information, the paper shows that they have been successful in finding private information such as the number of items in a shopping cart, the number of pictures in a user’s private gallery etc.

What can be done to prevent of protect against these attacks?

• The authors of the paper suggest using a server side time padding that creates a more uniform response time
• My own observation is that although using email addresses as a login ID is very popular for many reasons, its becomes easier for timing based attackers to use this mechanism to send your users spams and phising attacks. Its better to use other types of Identifications such as OpenID (http://openid.net/)