DOCSLIB.ORG

Remastering Legacy Java

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Remastering Legacy Java Remastering Legacy Java 2019.5.15 Kenji Kazumura 0 Copyright 2019 FUJITSU LIMITED Fujitsu and Java One of the oldest Java related products vendor Including Java for mainframe Interstage Application Server since 1998 Java EE certified GlassFish base application server Interstage Studio Eclipse base classic GUI library for client desktop 1 Copyright 2019 FUJITSU LIMITED History of Client Java Client & Server Web Server Server Server Server JSP/JSF Applet/Flash HTML5・SPA Clinet Browser Browser Browser Reduce Reduce Reduce Client Rich GUI Server Load Security Risk Maintenance Increase Client Increase Improve Poor GUI Maintenance Security Risk pc performance Cost W3C HTML5 recomendation 2 Copyright 2019 FUJITSU LIMITED Applet Technology Bundle with Netscape Navigator WebStart 2001 1998 1996 2013 1995 J2SE 1.2/Java Plugin 2015 Java BundleApplet runs on withHotJava browserNetscape Navigator 2017 2001 Applet 1998 WebStart 1996 Java Virtual Machine 1995 J2SE 1.2/Java Plugin Plugin Java Applet runs on HotJava browser NPAPI Web browser ※NPAPI:Netscape Plugin Application Programming Interface 3 Copyright 2019 FUJITSU LIMITED Applet Technology US DHS recomendation Bundle with Netscape Navigator WebStart (disable Plugin) 2001 1998 1996 2013 Google Chrome 1995 J2SE 1.2/Java Plugin 2015 disable NPAPI Java Applet runs on HotJava browser Edge quit NPAPI 2017 Applet support Java Virtual Machine FireFox quit NPAPI except Flash Plugin Oracle Java 9 deprecate Applet NPAPI Oracle Java 6/7 Web browser remove Plugin ※NPAPI:Netscape Plugin Application Programming Interface 4 Copyright 2019 FUJITSU LIMITED Applet Resources How much are there Applet ? Fujitsu Customers # of client pc A Company 90,000 B Company 70,000 C Company 54,000 D Company 21,000 E Company 5,000 F Company 3,500 G Company 3,000 H Company 3,000 Total 249,500 5 Copyright 2019 FUJITSU LIMITED Migration Plans 1 Use Applet until end of IE11 2 Use JSP/JSF JavaServer Faces Not so much used ? 3 use HTML5/JavaScript favorite!? 6 Copyright 2019 FUJITSU LIMITED Jakarta EE survey (used API) Java Persistence API (JPA) 76.23% Java API for Restful Web Services (JAX-RS) 75.73% Servlet 59.39% Enterprise JavaBeans (EJB) 51.14% Java Transition API 47.31% (JTA) JavaServer Pages 39.39% (JSP) JavaServer Faces 33.63% (JSF) ※https://jakarta.ee/news/2018/04/24/jakarta-ee-community-survey/ JSP/JSF are not used so much 7 Copyright 2019 FUJITSU LIMITED Migration Technologies Java app runs on browser without Plugin DukeScript https://dukescript.com/ JavaFX app runs on browser jpro https://www.jpro.io Transpiler from Java to JavaScript JSweet http://www.jsweet.org/ 8 Copyright 2019 FUJITSU LIMITED Transpiler Change source code in a language to same code in a different language Difference between transpiler and compiler COBOL source C source transpiler Machine code 9 Copyright 2019 FUJITSU LIMITED Examples of transpiler Legacy language • Fortran → C (f2c) • C++ → C (cfront) JavaScript (altJS) • TypeScript → JavaScript • CoffeeScript → JavaScript Legacy to JavaScript • Java → JavaScript (GWT, JSweet) • Haskell → JavaScript (GHCJS) 10 Copyright 2019 FUJITSU LIMITED Java→JavaScript transpiler pros • Need not know JavaScript • Easy to migration of legacy Java app • IDE support cons • Rapid frontend technology • API mismatch 11 Copyright 2019 FUJITSU LIMITED JSweet Java → TypeScript(JavaScript) transpiler • http://jsweet.org Syntax Mapper • Only Syntax conversion • Use JavaScript API in Java code Resolve existing problems of transpiler Application Java source JavaScript API(Candy) separation JavaScript impl 12 Copyright 2019 FUJITSU LIMITED Existing transpiler (API conversion) Input Java source Button button = new Button(); button.setLabel(“click me”); transpile Need not modify Java source Output JavaScript var button = document.createElement(”button”); button.innerText = “click me”; 13 Copyright 2019 FUJITSU LIMITED JSweet transpiler (Syntax Mapper) Input Java source Button button = new Button(); button.setLabel(“click me”); Modify Java source API conversion Modified Java source HTMLButtonElement button = document.createElement(StringTypes.button); button.innerText = “click me”; transpile Syntax Mapper Output TypeScript let button : HTMLButtonElement= document.createElement(”button”) button.innerText = “click me”; 14 Copyright 2019 FUJITSU LIMITED New problem Need source modification before transpilation Resolve by Candy No modification Application Common Library(Candy) Java Modified code source JavaScript API(Candy) separation JavaScript impl Good for systems using common library/framework 15 Copyright 2019 FUJITSU LIMITED JSweet (practical way) Input Java source public class Button extends JButton { Button button = new Button(); public void setLabel(String label) { button.setLabel(“click me”); this.label = label; } No Modify only library modification ( ) for app API conversion public class Button { public Button { button = document.createElement(StringTypes.button); } Button button = new Button(); public void setLable(String label); button.innerText = label; button.setLabel(“click me”); } transpile Syntax Mapper 16 Copyright 2019 FUJITSU LIMITED Candy (JSweet library) Bridge between Java and JavaScript • There are 1744 Candy registered (as of 2018/5) http://www.jsweet.org/candies-releases/ • Can create your own Candy types • Java Candy: Application common Java library can be used Common Library(Candy) by JSweet • JavaScript Candy: JavaScript API(Candy) bridge to existing JavaScript impl JavaScript 17 Copyright 2019 FUJITSU LIMITED System of Company A Summary of system Requirements 22K LoC Applet Migrate to JavaScript Created more than with less cost and time 10years ago Must be same as Use Fujitsu GUI before for Looks and product operation 18 Copyright 2019 FUJITSU LIMITED Fujitsu product for Client provide button,label,frame and dialog for Java GUI application Application(Java) JBKGUI SpreadBean Spread functions similar to Excel JRE(AWT/coreAPI) for Java application Java Virtual Machine JBK Plugin Web browser Run applet on Web browser *JBK: J Business Kit 19 Copyright 2019 FUJITSU LIMITED Applet transformation before after Applet(Java) Application(JavaScript) JBKGUI Spread JBKGUI SpreadBean (JavaScript)(JavaScript) Java base core JavaScript spread API JRE(AWT/coreAPI) AWT framework library JBK Plugin JavaScript engine Java Virtual Machine jQuery AngularJS SlickGrid … Wijmo Web browser Web browser … 20 Copyright 2019 FUJITSU LIMITED Demo POC 21 Copyright 2019 FUJITSU LIMITED Result LoC of two windows LoC %auto total manual auto A window 6,102 63 6,039 99.0% B window 4,764 44 4,720 99.1% common 11,789 849 10,940 92.8% total 22,655 956 21,699 95.8% manual: need to modify for transpiler High auto transformation by Candy of Fujitsu product 22 Copyright 2019 FUJITSU LIMITED Copyright 2019 FUJITSU LIMITED.
Load more

Recommended publications
  • On the Uniqueness of Browser Extensions and Web Logins
    To Extend or not to Extend: on the Uniqueness of Browser Extensions and Web Logins Gábor György Gulyás Dolière Francis Somé INRIA INRIA [email protected] [email protected] Nataliia Bielova Claude Castelluccia INRIA INRIA [email protected] [email protected] ABSTRACT shown that a user’s browser has a number of “physical” charac- Recent works showed that websites can detect browser extensions teristics that can be used to uniquely identify her browser and that users install and websites they are logged into. This poses sig- hence to track it across the Web. Fingerprinting of users’ devices is nificant privacy risks, since extensions and Web logins that reflect similar to physical biometric traits of people, where only physical user’s behavior, can be used to uniquely identify users on the Web. characteristics are studied. This paper reports on the first large-scale behavioral uniqueness Similar to previous demonstrations of user uniqueness based on study based on 16,393 users who visited our website. We test and their behavior [23, 50], behavioral characteristics, such as browser detect the presence of 16,743 Chrome extensions, covering 28% settings and the way people use their browsers can also help to of all free Chrome extensions. We also detect whether the user is uniquely identify Web users. For example, a user installs web connected to 60 different websites. browser extensions she prefers, such as AdBlock [1], LastPass [14] We analyze how unique users are based on their behavior, and find or Ghostery [8] to enrich her Web experience. Also, while brows- out that 54.86% of users that have installed at least one detectable ing the Web, she logs into her favorite social networks, such as extension are unique; 19.53% of users are unique among those who Gmail [13], Facebook [7] or LinkedIn [15].
    [Show full text]
  • Cisco Telepresence Management Suite 15.13.1
    Cisco TelePresence Management Suite 15.13.1 Software Release Notes First Published: June 2021 Cisco Systems, Inc. www.cisco.com 1 Contents Preface 3 Change History 3 Product Documentation 3 New Features in 15.13.1 3 Support for Cisco Meeting Server SIP recorder in Cisco TMS 3 Support for Cisco Webex Desk Limited Edition 3 Webex Room Panorama series to support 20000 kbps Bandwidth 3 Features in Previous Releases 3 Resolved and Open Issues 4 Limitations 4 Interoperability 8 Upgrading to 15.13.1 8 Before You Upgrade 8 Redundant Deployments 8 Upgrading from 14.4 or 14.4.1 8 Upgrading From a Version Earlier than 14.2 8 Prerequisites and Software Dependencies 8 Upgrade Instructions 8 Using the Bug Search Tool 9 Obtaining Documentation and Submitting a Service Request 9 Cisco Legal Information 10 Cisco Trademark 10 Cisco Systems, Inc. www.cisco.com 2 Cisco TelePresence Management Suite Software Release Notes Preface Change History Table 1 Software Release Notes Change History Date Change Reason June 2021 Release of Software Cisco TMS 15.13.1 Product Documentation The following documents provide guidance on installation, initial configuration, and operation of the product: ■ Cisco TelePresence Management Suite Installation and Upgrade Guide ■ Cisco TelePresence Management Suite Administrator Guide ■ Cisco TMS Extensions Deployment Guides New Features in 15.13.1 Support for Cisco Meeting Server SIP recorder in Cisco TMS Cisco TMS currently supports Cisco Meeting Server recording with XMPP by default. As XMPP is deprecated from Meeting Server 3.0 onwards, it will only support SIP recorder. For such Cisco Meeting Server with SIP recorder, the valid SIP Recorder URI details must be provided in Cisco TMS.
    [Show full text]
  • Download Issue
    Issue October 2019 | presented by www.jaxenter.com #70 The digital magazine for enterprise developers JavaThe JDK’s hidden 13 treasures i Jakarta EE 8 Let the games begin JDK 13 Why text blocks are worth the wait OpenJFX 13 JavaFX gets its own identity © Teguh Mujiono/Shutterstock.com, Pushkin/Shutterstock.com Illustrationen: Sun Microsystems Inc., S&S Media Editorial Let’s celebrate Java – three times! It’s that time again: A new Java version is here! Java 13 Last but not least: Jakarta EE, the follow-up project of was launched as planned, six months after the release Java EE, has announced its first release under the umbrella of of Java 12, and again it has some interesting features on the Eclipse Foundation. We got hold of the executive director board. In this issue of Jax Magazine, we’ve covered them of the Eclipse Foundation, Mike Milinkovich, and asked him for you in detail. about the current status of Jakarta EE. The good news doesn’t end there, as JavaFX 13 has also been released. The UI toolkit is no longer included in the JDK Happy reading, but has adjusted its new version releases to the new Java re- lease cadence. Find out what’s new here! Hartmut Schlosser Java 13 – a deep dive into the JDK’s 3 Kubernetes as a multi-cloud 17 new features operating system Falk Sippach Patrick Arnold Index Java 13 – why text blocks are worth the wait 6 Multi-tier deployment with Ansible 21 Tim Zöller Daniel Stender Jakarta EE 8 is sprinting towards an 9 Do we need a service mesh? 28 exciting future for enterprise Java Anton Weiss Thilo Frotscher
    [Show full text]
  • Plugin to Run Oracle Forms in Chrome
    Plugin To Run Oracle Forms In Chrome Emmott deuterate prenatal. Ataxic Clarance ambuscades: he tinkles his lairdships phonetically and occupationally. Slovenian and electrifying Ishmael often shuns some peregrination transversally or clapping competently. Desupport of Java Applet Plugin is my Forms Application at. Good Riddance to Oracle's Java Plugin Krebs on Security. Support the the java plug-in used to friend these applications ends with this version of Firefox. Oracle Forms Browser Alternatives DOAG. Note Chrome is not supported for Oracle Formsbased EBS applications Supported Java plug-ins also differ according to the operating system great well as. Configure browser to favor the Adobe PDF plug-in and open. Many recent browser versions include their particular native PDF plug-ins that automatically. Similar to Chrome Firefox will drop support must all NPAPI plugins such as. Oracle Forms 12c version can apology be used without a browser while still keeping the native appearance of the application Either JDK or Java Plugin JRE has not be installed on the client PC An inn of inventory to trigger this answer of configuration can blood found love the Forms web configuration file formsweb. Ui objects in the new row is not only one of the following parmaments in to determine whether you never supported. Why need use Google Chrome for Oracle APEX Grassroots Oracle. How something I run Oracle Forms 11g locally? After you download the crx file for ThinForms 152 open Chrome's. So her whole application is a web based login and stealth launch Java J-initiator. The location for npapi will not clear history page in apex competitors and chrome release and to run oracle forms in chrome, more of the application express file that they would prompt.
    [Show full text]
  • Creating Dynamic Web-Based Reporting Dana Rafiee, Destiny Corporation, Wethersfield, CT
    Creating Dynamic Web-based Reporting Dana Rafiee, Destiny Corporation, Wethersfield, CT ABSTRACT OVERVIEW OF SAS/INTRNET SOFTWARE In this hands on workshop, we'll demonstrate and discuss how to take a standard or adhoc report and turn it into a web based First, it is important to understand SAS/INTRNET software and its report that is available on demand in your organization. In the use. workshop, attendees will modify an existing report and display the results in various web based formats, including HTML, PDF Three components are required for the SAS/INTRNET software and RTF. to work. INTRODUCTION 1) Web Server Software – such as Microsoft’s Personal To do this, we’ll use Dreamweaver software as a GUI tool to Web Server/Internet Information Services, or the create HTML web pages. We’ll use SAS/Intrnet software as a Apache Web Server. back end tool to execute SAS programs with parameters selected on the HTML screen presented to the user. 2) Web Browser – Such as Microsoft’s Internet Explorer or Netscape’s Navigator. Our goal is to create the following screen for user input. 3) SAS/INTRNET Software – Called the Application Dispatcher. It is composed of 2 pieces. o SAS Application Server – A SAS program on a Server licensed with the SAS/INTRNET Module. o Application Broker – A Common Gateway Interface (CGI) program that resides on the web server and communicates between the Browser and the Application Server. These components can all reside on the same system, or on different systems. Types of Services 1) Socket Service: is constantly running, waiting for incoming Transactions.
    [Show full text]
  • Formal Aspects of Mobile Code Security
    FORMAL ASPECTS OF MOBILE CODE SECURITY RICHARD DREWS DEAN ADISSERTATION PRESENTED TO THE FACULTY OF PRINCETON UNIVERSITY IN CANDIDACY FOR THE DEGREE OF DOCTOR OF PHILOSOPHY RECOMMENDED FOR ACCEPTANCE BY THE DEPARTMENT OF COMPUTER SCIENCE JANUARY 1999 c Copyright by Richard Drews Dean, 1998. All Rights Reserved Abstract We believe that formal methods of all kinds are critical to mobile code security, as one route to gaining the assurance level necessary for running potentially hos- tile code on a routine basis. We begin by examining Java, and understanding the weaknesses in its architecture, on both design and implementation levels. Iden- tifying dynamic linking as a key problem, we produce a formal model of linking, and prove desirable properties about our model. This investigation leads to a deep understanding of the underlying problem. Finally, we turn our attention to crypto- graphic hash functions, and their analysis with binary decision diagrams (BDDs). We show that three commonly used hash functions (MD4, MD5, and SHA-1) do not offer ideal strength against second preimages. The ability of a cryptographic hash function to resist the finding of second preimages is critical for its use in digi- tal signature schemes: a second preimage enables the forgery of digital signatures, which would undermine confidence in digitally signed mobile code. Our results show that modern theorem provers and BDD-based reasoning tools are effective for reasoning about some of the key problems facing mobile code security today. iii Acknowledgments My advisor, Andrew Appel, offered sure guidance through what turned out to be an exceptionally smooth journey through graduate school.
    [Show full text]
  • Jersey 3.0.0-M1 User Guide Jersey 3.0.0-M1 User Guide Table of Contents
    Jersey 3.0.0-M1 User Guide Jersey 3.0.0-M1 User Guide Table of Contents Preface ........................................................................................................................... xvii 1. Getting Started ................................................................................................................ 1 1.1. Creating a New Project from Maven Archetype .......................................................... 1 1.2. Exploring the Newly Created Project ........................................................................ 1 1.3. Running the Project ............................................................................................... 3 1.4. Creating a JavaEE Web Application ......................................................................... 5 1.5. Creating a Web Application that can be deployed on Heroku ........................................ 6 1.5.1. Deploy it on Heroku ................................................................................... 8 1.6. Exploring Other Jersey Examples ........................................................................... 11 2. Modules and dependencies .............................................................................................. 12 2.1. Java SE Compatibility .......................................................................................... 12 2.2. Introduction to Jersey dependencies ........................................................................ 12 2.3. Common Jersey Use Cases ..................................................................................
    [Show full text]
  • Workforce Management Web
    Workforce Management Web 8.5.214.14 9/23/2021 8.5.214.14 8.5.214.14 Workforce Management Web Release Notes Release Date Release Type Restrictions AIX Linux Solaris Windows 05/08/19 General X X Contents • 1 8.5.214.14 • 1.1 Helpful Links • 1.2 What's New • 1.3 Resolved Issues • 1.4 Upgrade Notes • 1.5 Supported Languages Workforce Management Web 2 8.5.214.14 What's New Helpful Links This release includes the following new features and enhancements: Releases Info • WFM Web for Supervisors includes a redesigned Forecast module, • List of 8.5.x Releases enabling access to existing forecasting functionality and features, but with many user-friendly enhancements, wizards, and tools. Web for • 8.5.x Known Issues Supervisors (Classic) Forecast module is still supported and available. Note: The Forecast module is currently available only in English. (WFM-28004) Product Documentation • AI-powered Forecasting is introduced in the redesigned Forecast module, providing a sophisticated, automated build method that uses the best of best forecasting algorithms provided through Genesys Workforce Management hosted cloud infrastructure. For information about how to use this build method, see Building Volumes in the Workforce Management Genesys Products Supervisor Help.(WFM-28004) List of Release Notes • The Workforce Management Supervisor Help is a context-sensitive Help that describes the new Forecast interface, including topics that describe the Forecast Scenario and Master Forecast views, and procedures that describe forecasting tasks. The Workforce Management Supervisors (Classic) Help is still available. (WFM-29230) • The Overlays view in the new WFM Web Forecast interface is enhanced, enabling supervisors to adjust Spread over distribution to 15 or 30 minutes (in addition to 60).
    [Show full text]
  • Modern Web Application Frameworks
    MASARYKOVA UNIVERZITA FAKULTA INFORMATIKY Û¡¢£¤¥¦§¨ª«¬­Æ°±²³´µ·¸¹º»¼½¾¿Ý Modern Web Application Frameworks MASTER’S THESIS Bc. Jan Pater Brno, autumn 2015 Declaration Hereby I declare, that this paper is my original authorial work, which I have worked out by my own. All sources, references and literature used or ex- cerpted during elaboration of this work are properly cited and listed in complete reference to the due source. Bc. Jan Pater Advisor: doc. RNDr. Petr Sojka, Ph.D. i Abstract The aim of this paper was the analysis of major web application frameworks and the design and implementation of applications for website content ma- nagement of Laboratory of Multimedia Electronic Applications and Film festival organized by Faculty of Informatics. The paper introduces readers into web application development problematic and focuses on characte- ristics and specifics of ten selected modern web application frameworks, which were described and compared on the basis of relevant criteria. Practi- cal part of the paper includes the selection of a suitable framework for im- plementation of both applications and describes their design, development process and deployment within the laboratory. ii Keywords Web application, Framework, PHP,Java, Ruby, Python, Laravel, Nette, Phal- con, Rails, Padrino, Django, Flask, Grails, Vaadin, Play, LEMMA, Film fes- tival iii Acknowledgement I would like to show my gratitude to my supervisor doc. RNDr. Petr So- jka, Ph.D. for his advice and comments on this thesis as well as to RNDr. Lukáš Hejtmánek, Ph.D. for his assistance with application deployment and server setup. Many thanks also go to OndˇrejTom for his valuable help and advice during application development.
    [Show full text]
  • Making Speech Recognition Work on the Web Christopher J. Varenhorst
    Making Speech Recognition Work on the Web by Christopher J. Varenhorst Submitted to the Department of Electrical Engineering and Computer Science in partial fulfillment of the requirements for the degree of Masters of Engineering in Computer Science and Engineering at the MASSACHUSETTS INSTITUTE OF TECHNOLOGY May 2011 c Massachusetts Institute of Technology 2011. All rights reserved. Author.................................................................... Department of Electrical Engineering and Computer Science May 20, 2011 Certified by . James R. Glass Principal Research Scientist Thesis Supervisor Certified by . Scott Cyphers Research Scientist Thesis Supervisor Accepted by . Christopher J. Terman Chairman, Department Committee on Graduate Students Making Speech Recognition Work on the Web by Christopher J. Varenhorst Submitted to the Department of Electrical Engineering and Computer Science on May 20, 2011, in partial fulfillment of the requirements for the degree of Masters of Engineering in Computer Science and Engineering Abstract We present an improved Audio Controller for Web-Accessible Multimodal Interface toolkit { a system that provides a simple way for developers to add speech recognition to web pages. Our improved system offers increased usability and performance for users and greater flexibility for developers. Tests performed showed a %36 increase in recognition response time in the best possible networking conditions. Preliminary tests shows a markedly improved users experience. The new Wowza platform also provides a means of upgrading other Audio Controllers easily. Thesis Supervisor: James R. Glass Title: Principal Research Scientist Thesis Supervisor: Scott Cyphers Title: Research Scientist 2 Contents 1 Introduction and Background 7 1.1 WAMI - Web Accessible Multimodal Toolkit . 8 1.1.1 Existing Java applet . 11 1.2 SALT .
    [Show full text]
  • How to Change Your Browser Preferences So It Uses Acrobat Or Reader PDF Viewer
    How to change your browser preferences so it uses Acrobat or Reader PDF viewer. If you are unable to open the PDF version of the Emergency Action Plan, please use the instructions below to configure your settings for Firefox, Google Chrome, Apple Safari, Internet Explorer, and Microsoft Edge. Firefox on Windows 1. Choose Tools > Add-ons. 2. In the Add-ons Manager window, click the Plugins tab, then select Adobe Acrobat or Adobe Reader. 3. Choose an appropriate option in the drop-down list next to the name of the plug-in. 4. Always Activate sets the plug-in to open PDFs in the browser. 5. Ask to Activate prompts you to turn on the plug-in while opening PDFs in the browser. 6. Never Activate turns off the plug-in so it does not open PDFs in the browser. Select the Acrobat or Reader plugin in the Add-ons Manager. Firefox on Mac OS 1. Select Firefox. 2. Choose Preferences > Applications. 3. Select a relevant content type from the Content Type column. 4. Associate the content type with the application to open the PDF. For example, to use the Acrobat plug-in within the browser, choose Use Adobe Acrobat NPAPI Plug-in. Reviewed 2018 How to change your browser preferences so it uses Acrobat or Reader PDF viewer. Chrome 1. Open Chrome and select the three dots near the address bar 2. Click on Settings 3. Expand the Advanced settings menu at the bottom of the page 4. Under the Privacy and security, click on Content Settings 5. Find PDF documents and click on the arrow to expand the menu 6.
    [Show full text]
  • Attacking AJAX Web Applications Vulns 2.0 for Web 2.0
    Attacking AJAX Web Applications Vulns 2.0 for Web 2.0 Alex Stamos Zane Lackey [email protected] [email protected] Blackhat Japan October 5, 2006 Information Security Partners, LLC iSECPartners.com Information Security Partners, LLC www.isecpartners.com Agenda • Introduction – Who are we? – Why care about AJAX? • How does AJAX change Web Attacks? • AJAX Background and Technologies • Attacks Against AJAX – Discovery and Method Manipulation – XSS – Cross-Site Request Forgery • Security of Popular Frameworks – Microsoft ATLAS – Google GWT –Java DWR • Q&A 2 Information Security Partners, LLC www.isecpartners.com Introduction • Who are we? – Consultants for iSEC Partners – Application security consultants and researchers – Based in San Francisco • Why listen to this talk? – New technologies are making web app security much more complicated • This is obvious to anybody who reads the paper – MySpace – Yahoo – Worming of XSS – Our Goals for what you should walk away with: • Basic understanding of AJAX and different AJAX technologies • Knowledge of how AJAX changes web attacks • In-depth knowledge on XSS and XSRF in AJAX • An opinion on whether you can trust your AJAX framework to “take care of security” 3 Information Security Partners, LLC www.isecpartners.com Shameless Plug Slide • Special Thanks to: – Scott Stender, Jesse Burns, and Brad Hill of iSEC Partners – Amit Klein and Jeremiah Grossman for doing great work in this area – Rich Cannings at Google • Books by iSECer Himanshu Dwivedi – Securing Storage – Hackers’ Challenge 3 • We are
    [Show full text]