At O’Reilly’s conference on emerging web technologies in San Francisco last week, several of the hit topics from last year’s conference have become full-blown tracks this time around, reflecting how quickly a niche topic like the Facebook Query Language or the mobile web become mainstream.

Another key trend is the move away from traditional web-based interfaces to alternate ways of interacting with applications, from SMS or instant messenger to e-mail. Brady Forrest, co-chair of the event for O’Reilly Media, also listed personal analytics as a growing theme at the conference, citing applications like Socialistics that provide “lots of info porn on your network.”

While much of the event’s content revolves around the practice of running sites, there are a growing number of sessions on how to manage user communities, design interfaces, develop SEO-friendly applications, and include gameplay in sites. “We’ve done a really good job of making this a place where people can learn from those who are defining the future of the web,” said Forrest.

It’s a reflection that the job of web operations, which used to involve hardware, is now as much about managing analytics, communities, content, and legality.

I’m not a huge fan of security and everything that is associated with it. That’s not because I don’t think it’s important; I actually think it’s critical in both networking and application development. But, rather, it’s just not my thing and I’ve usually been in technology areas where security is important, but somewhat peripheral.

That being said, I attended a couple of sessions at Web2Expo today where security issues were a takeaway in both.

First, Jacob West (who’s written a book on security) gave an interesting talk on the “Dark Side of Ajax.” It’s not news that Ajax has some significant security holes that have been exposed already and are somewhat well known. Some examples:

• Cross-site scripting lets malicious users insert bad javascript code into the content of a website and harm future visitors (the famous Myspace worm exploited this).
• Cross-Site Request Forgery (CSRF or XSRF) is nasty and exploits websites that need user authentication (among other things)
• And a new one called javascript hijacking that Jacob has actually written a paper on.

I’ve seen similar presentations at other Ajax/web2.0 events and it’s interesting to me how it’s a lot of talk about how there are problems and very little about what’s being done about them. Mr. West did talk about how some popular Ajax frameworks are addressing the javascript hijacking issue, which is great. But, what happens with the next vulnerability, and the one after that?

Read More→