After putting this down for a few days to work on a new session on Adobe’s Security Architecture for the upcoming Max 2006 show, I came back to the Semaphore Website and observed some patterns. This time, I have the benefit of actually being able to both see the semaphore as well as hearing the codes. For each 7.2 second change, I noted the position of each of the four glyphs and the string-integer code. There is a repeated pattern of both the visual and audio clues synchronized. The following characters are used to denote the glyph’s position: | - vertical; \ top left to bottom right; / bottom left to top right and – for horizontal.
-| \ - K02
\ --- M 14
-/// L09
\|// O10
|\\/ B01
-||| K8
-/-/ C10
\\|/ E2
/|-- N11
\//\ G8
|/|/ K2 (note that even though K2 repeats, glyphs are different)
/\\/ M14
|--| L (5 or 9 – was not sure)
//-/ O10
- ||| B1
|//\ K8
|-\| C10
/|/| N11
/--- G8
--/| K2
\||| M14
-\\\ L9
\-\| O10
|//\ B01
---- K08
-\|\ C10
\/-\ E2
/-|| N11
\\\/ G8
|\-\ K2
///\ M14
|||- L9
/\|\ O10
---- B1 (note the glyphs repeat but not the alpha-numeric)
|\\/ K8
||/- C10
/-\- E02
/||| G8
-|\- K02 (First in sequence of compelte repeat. Duplicate with first entry.)
From here is repeated the entire cycle over. Given it started repeating a third time in a row, I got an idea. Perhaps it repeats a certain section of the code specific to each client. Some aspect of the interaction between the client and the server for Semaphore “seeds” the semaphore to produce a specific set of codes. Being in the mood to test, I hit “reload” and low and behold, the alpha numerics were the same but the glyphs were different. CAVEAT: I did not go through the entire cycle to verify it.
Hypothesis:
If Semaphore reacts to it’s environment, it might use some unique aspect of web based interactions to seed the pattern to avoid pattern detection between multiple clients. Maybe this hypothesis is too nerdy and over-analytical but I would be very interested in the abilities of others to see this. I also would be interested to see if the real world live Semaphore is synchronized with the simulcast. If someone could go in front of the Adobe building with a laptop connected ot the internet and visually verify whether or not the Semaphore’s glyphs are the same as on their laptop screen, it would be useful information.
Anyone else get the same patterns online?
Tuesday, August 22, 2006
Wednesday, August 16, 2006
Semaphore's mystery: Background on Cypher Creation
So as Adobe's Technical Evangelist for Security , I should probably share some background to you Semaphore solvers. One of the things that seems more than likely is that the cryptograph is encrypted using sequential "rounds". The concept of rounds is used in most modern cryptographic techniques such as AES. In my earlier post explaining how to build AES cyphertext using Rinjdael's key algorithms, the process is explained. For those of you who don't want to understand the gobblety gook on that blog entry, here are the basics.
The first round takes your normal text and renders it as cypher text using a "key". An example of this might be to take the phrase
"I have solved the San Jose Semaphore"
and encrypt it by moving all the letters forward (+) 8 values on the ASC II text table using the digital reference as a guide. The resulting text would be now encrypted as:
"Q(pi~m(|wt~ml(}pm([i%20(Rw|m([muixpwzm"
You could now employ a second "round" whereby each cypher text character is substituted for another using some lookup table or algorithm. In fact, in many second rounds, the key for the first round is actually encrypted as part of the cypher. An example could be to take the string above and transpose the case from lower case to upper case or substitute characters on a querty keyboard two spaces to the left of the keys needed to re-create the text.
The advantage of using two rounds is an exponential gain in complexity for those trying to solve the equation. Adobe uses AES in most of its' Livecycle products which uses 4 separate rounds of encryption resulting in so many combinations that it is physically impossible to crack the code using a brute force method. In fact, assuming you could build a machine that could crack one DES key every second by brute force, it would take a billion trillion years to crack AES at the 128 bit strength. That is why I scoffed in my earlier blog entry on some people who were under a mistaken impression they could circumvent Adobe's PDF encryption techniques using Gmail. The idea is preposterous!!!
The linear substituion demonstrated above is of course is a very poor encryption algorithm. For starters, it is linear so any patterns that are used in the original text are present in the cyphertext. For example, all spaces in the original text are displayed as "(" characters. This leads to easy recognition of patterns for things like double characters in words (example:" two "t"'s in "pattern").
A much better approach is called "non-linear substitution" whereby each character is substituted with its’ cipher text character using a dynamic map rather than a static linear map (such as Shift+8 characters on the ASCII chart). There are many ways to build this that avoid patterns being recognized from the original text and even introduce confusing patterns to those who want to crack the cipher. In the Semaphore broadcast, the tone of the woman's voice could be a key that acts as a "shift" and the tone could act as an offset on a chromatic scale. A great example of this might be to create a 16 by 16 grid and have multiple allowances of the assessors for each cipher substitute. The chart could look like this:
Now imagine you wanted to substitute the same phrase "I have solved the San Jose Semaphore". You could take it into the first cypher round and transmit it as a tied hash (ignoring space characters for now):
Alpha 9
Delta 13
Lima 7
Lima 2
Delta 9
Oscar 15
Kilo 15
Foxtrot 10
Juliet 8
Kilo 5
...etc...
Notice that patterns that may have existed before can be dissolved. For example, the "e" in have and the "e" in solved can be keyed to two completed different coordinates (both Kilo 5 and Oscar 15 correspond with "e"). I have additionally introduced what appears to be a pattern by using two Lima coordinates side by side.
The text above is very similar to what comes out of Semaphore if you listen to the live broadcast. I mapped the above grid to the broadcast from Semaphore earlier today and found there are now some astounding patterns present. By "astounding", I really mean statistically abnormal. Here is what I decrypted:
Lhsvezh vbdktppbtk vbdktppbtk lbpelsxhsllbpelsxhilhbl tnfddnnhbl tnfddln
Note that the repetition of the characters "vbdktppbtk" is statistically abnormal and probably deserves more attention. I am not 100% sure this map is correct as I was on a conference call during the time and may have misheard a character or two but this is substantially accurate.
So what should the table contain? If Semaphore is in fact a 16 by 16 grid for one round of encryption, it probably doesn't just contain A-Z repeated. Extended ASCII itself has 255 characters which is one shy of 16 times 16 (256). Could that be the answer? If someone cares to take the ASCII table and overlay it on the grid and map out some of the broadcast, I would love to see the results although I suspect the results are going to be in cyhper still. One thing that *could* be gained by such an exercise is to find out the finite length of the broadcast. If you think I should do it, please leave a comment on this blog.
So what are the second rounds? I picked up my guitar last night and played the notes as they are broadcast and found a lot of them are middle "C". Perhaps the offset on the chromatic scale from C is a second round key? What part does the airplane detection play? Why are the patterns broadcast at exactly 7.2 seconds apart? Why am I writing on this?
More to ponder.... Back to the drawing board.
I think I'm getting hooked on this project.
The first round takes your normal text and renders it as cypher text using a "key". An example of this might be to take the phrase
"I have solved the San Jose Semaphore"
and encrypt it by moving all the letters forward (+) 8 values on the ASC II text table using the digital reference as a guide. The resulting text would be now encrypted as:
"Q(pi~m(|wt~ml(}pm([i%20(Rw|m([muixpwzm"
You could now employ a second "round" whereby each cypher text character is substituted for another using some lookup table or algorithm. In fact, in many second rounds, the key for the first round is actually encrypted as part of the cypher. An example could be to take the string above and transpose the case from lower case to upper case or substitute characters on a querty keyboard two spaces to the left of the keys needed to re-create the text.
The advantage of using two rounds is an exponential gain in complexity for those trying to solve the equation. Adobe uses AES in most of its' Livecycle products which uses 4 separate rounds of encryption resulting in so many combinations that it is physically impossible to crack the code using a brute force method. In fact, assuming you could build a machine that could crack one DES key every second by brute force, it would take a billion trillion years to crack AES at the 128 bit strength. That is why I scoffed in my earlier blog entry on some people who were under a mistaken impression they could circumvent Adobe's PDF encryption techniques using Gmail.
The linear substituion demonstrated above is of course is a very poor encryption algorithm. For starters, it is linear so any patterns that are used in the original text are present in the cyphertext. For example, all spaces in the original text are displayed as "(" characters. This leads to easy recognition of patterns for things like double characters in words (example:" two "t"'s in "pattern").
A much better approach is called "non-linear substitution" whereby each character is substituted with its’ cipher text character using a dynamic map rather than a static linear map (such as Shift+8 characters on the ASCII chart). There are many ways to build this that avoid patterns being recognized from the original text and even introduce confusing patterns to those who want to crack the cipher. In the Semaphore broadcast, the tone of the woman's voice could be a key that acts as a "shift" and the tone could act as an offset on a chromatic scale. A great example of this might be to create a 16 by 16 grid and have multiple allowances of the assessors for each cipher substitute. The chart could look like this:
Now imagine you wanted to substitute the same phrase "I have solved the San Jose Semaphore". You could take it into the first cypher round and transmit it as a tied hash (ignoring space characters for now):
Alpha 9
Delta 13
Lima 7
Lima 2
Delta 9
Oscar 15
Kilo 15
Foxtrot 10
Juliet 8
Kilo 5
...etc...
Notice that patterns that may have existed before can be dissolved. For example, the "e" in have and the "e" in solved can be keyed to two completed different coordinates (both Kilo 5 and Oscar 15 correspond with "e"). I have additionally introduced what appears to be a pattern by using two Lima coordinates side by side.
The text above is very similar to what comes out of Semaphore if you listen to the live broadcast. I mapped the above grid to the broadcast from Semaphore earlier today and found there are now some astounding patterns present. By "astounding", I really mean statistically abnormal. Here is what I decrypted:
Lhsvezh vbdktppbtk vbdktppbtk lbpelsxhsllbpelsxhilhbl tnfddnnhbl tnfddln
Note that the repetition of the characters "vbdktppbtk" is statistically abnormal and probably deserves more attention. I am not 100% sure this map is correct as I was on a conference call during the time and may have misheard a character or two but this is substantially accurate.
So what should the table contain? If Semaphore is in fact a 16 by 16 grid for one round of encryption, it probably doesn't just contain A-Z repeated. Extended ASCII itself has 255 characters which is one shy of 16 times 16 (256). Could that be the answer? If someone cares to take the ASCII table and overlay it on the grid and map out some of the broadcast, I would love to see the results although I suspect the results are going to be in cyhper still. One thing that *could* be gained by such an exercise is to find out the finite length of the broadcast. If you think I should do it, please leave a comment on this blog.
So what are the second rounds? I picked up my guitar last night and played the notes as they are broadcast and found a lot of them are middle "C". Perhaps the offset on the chromatic scale from C is a second round key? What part does the airplane detection play? Why are the patterns broadcast at exactly 7.2 seconds apart? Why am I writing on this?
More to ponder.... Back to the drawing board.
I think I'm getting hooked on this project.
More Semaphore clues - cracking the Adobe Semaphore Cryptograph
In response to a questions I received from a woman on my earlier blog entry, I have made an incorrect statement (although I did say it was a guess). Joann asked if "semaphore's discs spun faster when an airplane flew overhead". I replied it was probably coincidental however have since been corrected.
Siri (no last name) who worked on the project internally at Adobe emailed me and stated " I saw in the last blog you were discussing the reactions of the semaphore when planes flew by - there actually is an antenna on the roof that registers when a plane goes by and causes the semaphores to spin wildly". I stand corrected. The only thing that comes to mind is what does it have to do with the cryptogram? Theories anyone?
Stay tuned for another blog post with some new theories on the subject.
Ciao!
Siri (no last name) who worked on the project internally at Adobe emailed me and stated " I saw in the last blog you were discussing the reactions of the semaphore when planes flew by - there actually is an antenna on the roof that registers when a plane goes by and causes the semaphores to spin wildly". I stand corrected. The only thing that comes to mind is what does it have to do with the cryptogram? Theories anyone?
Stay tuned for another blog post with some new theories on the subject.
Ciao!
Tuesday, August 15, 2006
Semaphore Solution? A 16 by 16 grid?
After thinking about cracking the Semaphore cryptograph a bit more, I noticed that the string-integer codes both use values that seem to range from 1-16. No numeric value I have encountered is over 16 and neither are the letters using a=1, b=2 etc.
This may imply a 16 by 16 grid. The changes in tones of the voice could be markers for new words or other punctuation, case etc. The lighted glyphs could eassily be used to demark a 16 * 16 grid too, given each of the four glyphs can indicate 4 positions (vertical, horizontal, slanted right, slanted left). This is consistent with the Semaphore flaggin system. I would presume that this gives each of the four glyphs the ability to communicate either A-P or 1-16. How does this sync up with the broadcast message?
I have made a 16 * 16 grid and used letters of the alphabet laid out in a number of ways on the grid to reference the targets but the message is still cypher text. Perhaps there is a dual stage to the encryption. This leaves the tones of the music and the ladies voice to use as clues. The tones that begin each segment seem to be rather limited to only a few notes as does the ladies voice.
More later. Anyone have any theories?
This may imply a 16 by 16 grid. The changes in tones of the voice could be markers for new words or other punctuation, case etc. The lighted glyphs could eassily be used to demark a 16 * 16 grid too, given each of the four glyphs can indicate 4 positions (vertical, horizontal, slanted right, slanted left). This is consistent with the Semaphore flaggin system. I would presume that this gives each of the four glyphs the ability to communicate either A-P or 1-16. How does this sync up with the broadcast message?
I have made a 16 * 16 grid and used letters of the alphabet laid out in a number of ways on the grid to reference the targets but the message is still cypher text. Perhaps there is a dual stage to the encryption. This leaves the tones of the music and the ladies voice to use as clues. The tones that begin each segment seem to be rather limited to only a few notes as does the ladies voice.
More later. Anyone have any theories?
Adobe LiveCycle 8 gets SOA right
A lot of vendors are claiming to be “SOA compliant”; whatever that means. Unless you have made such a claim within the context of an established metric, such as the OASIS Reference M odel for SOA or IBM’s Big Red Book of SOA Patterns, such claims are largely hollow. At a recent Syscon event in New York, my colleagues and I howled in laughter as we overheard someone talking about how with their company’s offerings, within 3 years many people might be able to do SOA, AJAX and ESB together. So before I make ay claims, I want to quantify a few things about SOA.
The OASIS Reference Model for SOA, a well scrutinized committee specification, provides the context for the rest of this blog entry. The RM alone is not sufficient to make the claim I have in the title, so I will augment it a bit. For SOA to be done right, a ubiquitous set of protocols must exist to facilitate the widest possible range of service bindings as possible with the minimal set of complexity. Once a large group of services exist using a common set of protocols and/or standards, a virtual bus exists where services may be consumed by consumers supporting the set of protocols and standards. This is what is often called a “service bus”. Additionally, a common processing model and a common set of invocation patterns aid the virtual bus in providing consumers an easy onramp to use the services on the bus.
Adobe LiveCycle has matured a lot in version 7.0+ and lots of SOA-ish behavior is present in the current version, but some real breakthroughs are coming in LiveCycle 8 as it gets a specification for service developers to use to create such a bus. This is partly due to SOA in general maturing and Adobe’s vigilance in keeping atop the standards around SOA and Web Services.
For starters, simple tasks like standard naming conventions for services across the entire platform are part of the core design specifications. This makes is far easier for developers to intuitively find services via the service registry. The service registry itself is a major step forward from LiveCycle 7. Event though LC7 employed a service registry, it was likely under-optimized for use within the platform and largely tasked with form management functions in LC 7. In LC 8, the core service registry is a central resource that can be used by the entire platform for registering and referencing services.
In LC8, Services are layered more consistently. Rather than each component simply determining its’ own level of abstraction for an API, the unified service designs classify services into different layers. The lowest layer is the native API’s for a component (such as a Java Interface) and connectors bridge the gaps to map the endpoints from various wire protocols to the underlying interfaces. Managed transparency is present and the interfaces are also agnostic to the wire protocols used by consumers to deliver their requests to the service container.
LiveCycle 8 will be previewed at the MAX Conference this year in Las Vegas by Matt Butler. I look forward to attending the talk and finding out more. It should be a pivotal moment in the life cycle of Adobe LiveCycle as the SOA story continues to mature.
The OASIS Reference Model for SOA, a well scrutinized committee specification, provides the context for the rest of this blog entry. The RM alone is not sufficient to make the claim I have in the title, so I will augment it a bit. For SOA to be done right, a ubiquitous set of protocols must exist to facilitate the widest possible range of service bindings as possible with the minimal set of complexity. Once a large group of services exist using a common set of protocols and/or standards, a virtual bus exists where services may be consumed by consumers supporting the set of protocols and standards. This is what is often called a “service bus”. Additionally, a common processing model and a common set of invocation patterns aid the virtual bus in providing consumers an easy onramp to use the services on the bus.
Adobe LiveCycle has matured a lot in version 7.0+ and lots of SOA-ish behavior is present in the current version, but some real breakthroughs are coming in LiveCycle 8 as it gets a specification for service developers to use to create such a bus. This is partly due to SOA in general maturing and Adobe’s vigilance in keeping atop the standards around SOA and Web Services.
For starters, simple tasks like standard naming conventions for services across the entire platform are part of the core design specifications. This makes is far easier for developers to intuitively find services via the service registry. The service registry itself is a major step forward from LiveCycle 7. Event though LC7 employed a service registry, it was likely under-optimized for use within the platform and largely tasked with form management functions in LC 7. In LC 8, the core service registry is a central resource that can be used by the entire platform for registering and referencing services.
In LC8, Services are layered more consistently. Rather than each component simply determining its’ own level of abstraction for an API, the unified service designs classify services into different layers. The lowest layer is the native API’s for a component (such as a Java Interface) and connectors bridge the gaps to map the endpoints from various wire protocols to the underlying interfaces. Managed transparency is present and the interfaces are also agnostic to the wire protocols used by consumers to deliver their requests to the service container.
LiveCycle 8 will be previewed at the MAX Conference this year in Las Vegas by Matt Butler. I look forward to attending the talk and finding out more. It should be a pivotal moment in the life cycle of Adobe LiveCycle as the SOA story continues to mature.
Semaphore - Clues to cracking the Cypher: is Slashdot smart enough?
For those of you who love a challenge, Adobe has sponsored a whopper. The Semaphore art project in San Jose is where art meets technology. Four large round glyphs rotate their position every 7.2 seconds while a simultaneous low power radio broadcast emits a coded message. Artist Ben Rubin’s mind shred’s message seems to follow a pattern. Each broadcast segment contains an audible analog tone, an audible analog pattern, followed by a string-integer hash. Several items vary during the broadcast including the tone of the woman’s voice as she speaks the integers. The tones also change.
Here is a pattern:
Tone, dot pattern, click(ping), string, integer, ping
Here are some general observations that might help those trying to decode it. I also want to state that while I do work for Adobe, I have in no way had any internal knowledge of this project nor do I have any keys to the answer.
Background:
Semaphore is an ancient flag based signaling system. A person holds two flags and uses one rotational angle to act as a key while using a second flag to indicate a specific value. The comparison to the rotating glyphs cannot be ignored.
1. What is the significance of the glyphs changing position every 7.2 seconds? This could be a key or it could be incidental to the entire exercise. I would suspect that due to its’ precise timing, it is a key.
2. Ben Rubin’s education should probably be factored in. There are no details of him ever studying cryptographic techniques. Accordingly, I would presume the cypher’s key to be less complex than Rinjdael’s (AES) et al. I did find his master’s thesis entitled “Constraint based cinematic editing” which may be a clue into his mind.
3.What possible significance does the tone of the woman’s voice have? It seems to speak in two tones – one about one octave higher than the other. It this significant of some kind of logic gate?
4. What are the string-integer pairs. Here is an example:
India 02
Kilo 08
Echo 06
Delta 01
Charlie 05
Mike 03
Mike 14
Echo 06
Delta 04
Delta 04 (note repeat)
India 02
Kilo 08
Echo 06
Delta 01
Charlie 05
Mike 03
India 02
Delta 15
Delta 04
Mike 14
Alpha 10
Delta 04
Delta 04
Alpha 10
Charlie 16
Delta 15
India 02
Delta 15
Delta 04
Mike 14
Alpha 10
Delta 04
Delta 04
Alpha 10
Charlie 16
Delta 15
Delta 01
Pumpkin 02 ??
Kilo 03
November 04
Charlie 11
Charlie 16
Lima 03
Echo 06
…..
Note the pattern repeats certain characters (Delta 04’s seem popular). There are alsio patterns of repetition that seem to repeat above a statistically normal basis. Based on this I would aver that the answer is a value of text. The same values suggest double letter combinations in the resulting text (example = Challenge has two “ll”’s)
While the Semaphore Flag code uses only 9 positions, note that the numeric values scale much higher. Could this be a revision of the code based on some key (7.2) to reflect the glyphs ability to provide a more precise rotational index? I did not encounter any numeric value over 16 while listening.
The Semaphore art uses the NATO phonetic alphabet.
A: Alpha
B: Bravo
C: Charlie
D: Delta
E: Echo
F: Foxtrot
G: Golf
H: Hotel
I: India
J: Juliet
K: Kilo
L: Lima
M: Mike
N: November
O: Oscar
P: Papa
Q: Quebec
R: Romeo
S: Sierra
T: Tango
U: Uniform
V: Victor
W: Whiskey
X: X-ray
Y: Yankee
Z: Zulu
Note that “Pumpkin” is not actually part of the phonetic alphabet. Perhaps I heard it wrong.
Good luck - anyone with Theories, please post them back to this blog. Maybe we can get lucky....
Here is a pattern:
Tone, dot pattern, click(ping), string, integer, ping
Here are some general observations that might help those trying to decode it. I also want to state that while I do work for Adobe, I have in no way had any internal knowledge of this project nor do I have any keys to the answer.
Background:
Semaphore is an ancient flag based signaling system. A person holds two flags and uses one rotational angle to act as a key while using a second flag to indicate a specific value. The comparison to the rotating glyphs cannot be ignored.
1. What is the significance of the glyphs changing position every 7.2 seconds? This could be a key or it could be incidental to the entire exercise. I would suspect that due to its’ precise timing, it is a key.
2. Ben Rubin’s education should probably be factored in. There are no details of him ever studying cryptographic techniques. Accordingly, I would presume the cypher’s key to be less complex than Rinjdael’s (AES) et al. I did find his master’s thesis entitled “Constraint based cinematic editing” which may be a clue into his mind.
3.What possible significance does the tone of the woman’s voice have? It seems to speak in two tones – one about one octave higher than the other. It this significant of some kind of logic gate?
4. What are the string-integer pairs. Here is an example:
India 02
Kilo 08
Echo 06
Delta 01
Charlie 05
Mike 03
Mike 14
Echo 06
Delta 04
Delta 04 (note repeat)
India 02
Kilo 08
Echo 06
Delta 01
Charlie 05
Mike 03
India 02
Delta 15
Delta 04
Mike 14
Alpha 10
Delta 04
Delta 04
Alpha 10
Charlie 16
Delta 15
India 02
Delta 15
Delta 04
Mike 14
Alpha 10
Delta 04
Delta 04
Alpha 10
Charlie 16
Delta 15
Delta 01
Pumpkin 02 ??
Kilo 03
November 04
Charlie 11
Charlie 16
Lima 03
Echo 06
…..
Note the pattern repeats certain characters (Delta 04’s seem popular). There are alsio patterns of repetition that seem to repeat above a statistically normal basis. Based on this I would aver that the answer is a value of text. The same values suggest double letter combinations in the resulting text (example = Challenge has two “ll”’s)
While the Semaphore Flag code uses only 9 positions, note that the numeric values scale much higher. Could this be a revision of the code based on some key (7.2) to reflect the glyphs ability to provide a more precise rotational index? I did not encounter any numeric value over 16 while listening.
The Semaphore art uses the NATO phonetic alphabet.
A: Alpha
B: Bravo
C: Charlie
D: Delta
E: Echo
F: Foxtrot
G: Golf
H: Hotel
I: India
J: Juliet
K: Kilo
L: Lima
M: Mike
N: November
O: Oscar
P: Papa
Q: Quebec
R: Romeo
S: Sierra
T: Tango
U: Uniform
V: Victor
W: Whiskey
X: X-ray
Y: Yankee
Z: Zulu
Note that “Pumpkin” is not actually part of the phonetic alphabet. Perhaps I heard it wrong.
Good luck - anyone with Theories, please post them back to this blog. Maybe we can get lucky....
Tuesday, July 25, 2006
Finally - a standard for Service Oriented Architecture (SOA)
After almost 14 months of intense work, over 6000 messages posted to hundreds of threads, 6 face to face meetings and 34 conference calls by over 225 members and observers from approximately 89 different companies, the first true public standard to describe SOA now exists. The OASIS SOA RM TC closed a final ballot with a successful majority vote to unanimously approve the current draft as an official OASIS Reference Model for SOA Committee Specification.
The Reference Model is not itself Architecture, it is more like a template to guide archtiects. Unlike most definitions of SOA which rely on specific examples, the SOA RM is also entirely abstract and not tied to any one technology family or specifications. Those architecting SOA or BPM as the governance layer over top of SOA will probably find it the most useful as it points out the entities and patterns required to allows SOA to work and support the governance layer.
Some general notes on the RM:
Web Services: Although it is not tied directly to any standards, it is highly optimized for use with WS-*, the web services set of standards, protocols and technologies.
Business Process Management: In order to facilitate BPM as a layer over SOA, there are certain minimal things yoour SOA should have. The RM describes these in an abstract manner - architects can decide on the best way to implement the patterns.
Architectural Patterns: The RM for SOA is essentailly a large set of reusable patterns. By itself, the RM illustrates what makes SOA different from other architectural paradigms and provides the patterns to help illustrate the concepts.
Architecture: Although the RM is itself not architecture, there is a sub TC now working on building a Reference Architecture.
This standard should help clear up some of the perceived FUD in the Tech sector regarding SOA.
The Reference Model is not itself Architecture, it is more like a template to guide archtiects. Unlike most definitions of SOA which rely on specific examples, the SOA RM is also entirely abstract and not tied to any one technology family or specifications. Those architecting SOA or BPM as the governance layer over top of SOA will probably find it the most useful as it points out the entities and patterns required to allows SOA to work and support the governance layer.
Some general notes on the RM:
Web Services: Although it is not tied directly to any standards, it is highly optimized for use with WS-*, the web services set of standards, protocols and technologies.
Business Process Management: In order to facilitate BPM as a layer over SOA, there are certain minimal things yoour SOA should have. The RM describes these in an abstract manner - architects can decide on the best way to implement the patterns.
Architectural Patterns: The RM for SOA is essentailly a large set of reusable patterns. By itself, the RM illustrates what makes SOA different from other architectural paradigms and provides the patterns to help illustrate the concepts.
Architecture: Although the RM is itself not architecture, there is a sub TC now working on building a Reference Architecture.
This standard should help clear up some of the perceived FUD in the Tech sector regarding SOA.
Friday, July 14, 2006
Try Adobe LiveCycle Policy Server online.
I guess this is a great follow up to my last post pondering whether or not the theft of Coca Cola recipes was preventable. Adobe has now offered the Adobe LiveCycle Policy Server as a service. Aside from trendsetting by offering software as a service (SAAS), this provides an excellent opportunity for anyone to test drive the functionality without having to download, install and configure the Policy Server.
The service is easy to use and can be used with Acrobat 6 or 7 although 7 offers higher security by utilizing the AES encryption standard in 128 bit cyher strength.
The Protected PDF service is now available as a public beta (users need to create a free trial account). You can access it either via the Create Adobe PDF Online service https://createpdf.adobe.com or directly via https://policy.adobe.com/spdf/login.do
Policy Server protects PDF documents and will not allow them to be rendered unless the policies declared by the document owners have been satisfied. Even then, APS might not allow certain types of interactions with the documents such a printing or copying parts of the document.
What I like doing is also using it as a tool to see how many people actually read the stuff they ask you for. Any PDF document can be audited to see who actually read it, for how long and what other actions they took.
Wouldn't it be fun to ask someone to summarize a document you sent them when you know for a fact they haven't read it? Oops - now my prankster side is emerging.
The service is easy to use and can be used with Acrobat 6 or 7 although 7 offers higher security by utilizing the AES encryption standard in 128 bit cyher strength.
The Protected PDF service is now available as a public beta (users need to create a free trial account). You can access it either via the Create Adobe PDF Online service https://createpdf.adobe.com or directly via https://policy.adobe.com/spdf/login.do
Policy Server protects PDF documents and will not allow them to be rendered unless the policies declared by the document owners have been satisfied. Even then, APS might not allow certain types of interactions with the documents such a printing or copying parts of the document.
What I like doing is also using it as a tool to see how many people actually read the stuff they ask you for. Any PDF document can be audited to see who actually read it, for how long and what other actions they took.
Wouldn't it be fun to ask someone to summarize a document you sent them when you know for a fact they haven't read it? Oops - now my prankster side is emerging.
Wednesday, July 12, 2006
Another preventable theft of IPR? Maybe.
In my position as a technical evangelist, I often get opinions flying at me left, right and centre (note "correct" spelling of "centre") of issues. One recent issue that blew me away was in response to a news bit about how the FBI allegedly stopped an espionage ring from stealing a secret Coca-Cola recipe and selling it to rival Pepsi.
Given I usually talk about how using Adobe LiveCycle Policy Server could have prevented such things, many people were eager to come up to me and express that I should write about this. I am hesitant to make any such claims for a number of reasons. First - if you are dealing with people who have access to information and they are really intent on betraying your organization and leaking the information outside, there is little you can do to stop them. Employing some advanced information assurance technology like Adobe Policy Server or Microsoft’s Rights Management Server will do little to thwart someone with a pen, paper and access to the recipe or a digital camera. Secondly, if you can render something once, you can capture it and re-serialize it to distribute electronically later. The side channel art of deception is also commonly referred to as "Social Engineering".
People looking at Policy Server need to be very clear on their expectations. Policy server can do a number of very important things to protect digital property. Looking at the scenario at Coca-Cola, I would have recommended the following:
- Any recipe document should have been policy protected and available only to a very small list of people who were supposed to have access to it. I would also place a large watermark on the document so each of them know that if they release the document it can be traced back to them.
- I would audit the list of people who have access rights and immediately suspend rights to anyone who no longer needs to have the information.
- When the document is stored, it would always be encrypted using the AES 128 bit cipher.
- I would regularly audit the trail of document interactions to see if there are any patterns that would indicate a problem such as an employee repeatedly rendering it and trying things like Printing, Control-Printscreen, Cutting and Pasting etc. If these patterns persevere, it could be indicative of a problem.
- In the event that the recipe did leak out, I would immediately make that document non-render able.
- Each document involved in the process would have it's entire process model documented and would be immediately deprecated and non-render able once it is no longer required.
In short, no matter what security system you put in effect, someone can and will find a way around. What Applications like Policy Server do is make it more difficult for people to do front channel attacks, often drawing more attention to themselves as they have to develop side channel tactics.
On a side note, no one has yet claimed the $500.00 I offered if this Adobe Policy Server protected document could be rendered. It is still up for grabs if anyone thinks they can defeat Policy Server. The cash is sitting here – waiting for you.
Monday, July 10, 2006
Johnny Rotten, Artificial Intelligence and LiveCycle
My new photo, taken by Matt Mackenzie, has caused a stir in the tech community, but in my own true fashion, I really don’t care. So What!! The concern seems to be that I have a striking similarity to Johnny Lydon a.k.a. Johnny Rotten of Sex Pistols and P.I.L. fame. Of course - as a punk musician, the Pistols were one of my all time favorite bands and a major influence. In fact, my new band, F.L.U., is heavily influenced by a sound created by the Pistols. I also find that P.I.L was imenseley more musically interesting than the Pistols. Therefore, I find any comparison to Johnny a major compliment and there are some similarities:
1. Neither of us is complacent. If something is broken - do something about it.
2. Both of us are musicians who write and perform politically driven music.
3. We both push the boundaries. No society advances without someone constantly provoking it. People hate it but it needs to be done.
4. I guess there may be a slight resemblance between my picture and some from his site but you judge. I personally thought I was more like Billy Idol from Gen-X. Met the guy once - we do look alike.
Do we look alike?!!! Or do I look more like this:
So what the hell does this have to do with artificial intelligence and Adobe LiveCycle. Artificial Intelligence is a huge waste of time and will never work. What is promising is the concept of Computational Intelligence or getting computers to aspects of mimic intelligence based on our expectations. There are two very important and almost always neglected aspects of CI. One is the lack of context. Context is everything, especially for inference. Look at the Sex Pistols putting out Never Mind the Bullocks made a lot of people at the time very upset for a number of reasons. It was insulting to the queen of England and talked about real things we all think. Keep in mind this perspective, the Queen of England once hated Rock and Roll, but has since knighted several rock musicians. In the context of rock’s invention, it was not accepted however over time, it became an acceptable art form (WFT that really means). Looking back now, the Pistols got an entire generation to sit up and say "something’s not working here and were pissed". In the right context, I would nominate Johnny and the boys for giving an entire generation the message that they better think for themselves and things can be changed. It changed my life. When I had the chance to work for the United Nations and be disruptive and tell people who were full of crap that they were full of crap. I did it and I am proud of that.
The point is that Context is everything and most approaches to artificial intelligence seem to be rather static than dynamic. Most of the AI research to date in the field of Ontologies and semantics seems to take a hard coded approach. This is not how humans think.
To add to the problem, there is one other important thing that humans do well that computers cannot do as well. This is excellently summed up in David Luckham who I consider a genius in every sense of the word. Definitely on par with Johnny. Simply stated, it is the ability to detect two events, recognize the context in which they occur and understand the causality relationship between them For example, if you came home and saw that your spouses car was gone, that is one event. If you then saw a guy carrying a TV around the corner, that in itself is another event. Now put the two events together and the causality may point to a situation where they are stealing your TV because the house is empty and they helped themselves. Easy for a human, not so easy for a programmer to capture this model in a generalized sense so it can be reused over multiple examples.
To make Computational Intelligence work, one would require a model for Complex Event Programing, an inference engine using something like the Blackboard patterns with a hypothesis limiter on it to negate the exponential hypothesis problem, a context ontology to layer over top of whatever semantic reasoning one might employ, and a large enough source of events that be used to feed it all. The latter is very important since event isolation would lead to an incomplete set of events to mine for the inference component and probably miss key things.
This is where Adobe LiveCycle enters. LiveCycle, as a platform, has several key places where events are captured and stored in a manner that they can be audited later. The next generation of the LiveCycle platform and the blades that plug into it carry a much more complex series of audit trails than the last version.
Here is a hypothetical situation where a phishing attack is starting. A mass email goes out and tells customers of a bank to use their forms to change their password because of a security breach. If you use LiveCycle Forms, served from a LiveCycle Form Manager, you will generate an auditable event each time one of your customers grabs the form. If your customers account is then accesses and a transfer form is filled out, that will also generate a second event. You now have two events that have a relationship to one thing - the unique account. This should be a relatively easy pattern to catch if you are using LiveCycle as a platform over your IT infrastructure. If you were to use multiple disparate technologies, it could also be caught however this may take more hard work to account for different Document models and mine the events at the same level of granularity.
LiveCycle Policy Server will be able to make events accessible in the LC 8 release and via the SDK, some events are available now. This should be useful to companies who are serious about thwarting criminal behaviour linked to people using their IT infrastructure.
Back to Johnny Rotten now. Things have to change in the world. The pistols and PIL changed me and now I am feeding back change into the world. People need to start thinking about this stuff and start finding ways to fix it. Come to think of it, I guess I am not too changed from my previous punk days. The picture on the left was taken in July of 2006 ;-)
1. Neither of us is complacent. If something is broken - do something about it.
2. Both of us are musicians who write and perform politically driven music.
3. We both push the boundaries. No society advances without someone constantly provoking it. People hate it but it needs to be done.
4. I guess there may be a slight resemblance between my picture and some from his site but you judge. I personally thought I was more like Billy Idol from Gen-X. Met the guy once - we do look alike.
Do we look alike?
So what the hell does this have to do with artificial intelligence and Adobe LiveCycle. Artificial Intelligence is a huge waste of time and will never work. What is promising is the concept of Computational Intelligence or getting computers to aspects of mimic intelligence based on our expectations. There are two very important and almost always neglected aspects of CI. One is the lack of context. Context is everything, especially for inference. Look at the Sex Pistols putting out Never Mind the Bullocks made a lot of people at the time very upset for a number of reasons. It was insulting to the queen of England and talked about real things we all think. Keep in mind this perspective, the Queen of England once hated Rock and Roll, but has since knighted several rock musicians. In the context of rock’s invention, it was not accepted however over time, it became an acceptable art form (WFT that really means). Looking back now, the Pistols got an entire generation to sit up and say "something’s not working here and were pissed". In the right context, I would nominate Johnny and the boys for giving an entire generation the message that they better think for themselves and things can be changed. It changed my life. When I had the chance to work for the United Nations and be disruptive and tell people who were full of crap that they were full of crap. I did it and I am proud of that.
The point is that Context is everything and most approaches to artificial intelligence seem to be rather static than dynamic. Most of the AI research to date in the field of Ontologies and semantics seems to take a hard coded approach. This is not how humans think.
To add to the problem, there is one other important thing that humans do well that computers cannot do as well. This is excellently summed up in David Luckham who I consider a genius in every sense of the word. Definitely on par with Johnny. Simply stated, it is the ability to detect two events, recognize the context in which they occur and understand the causality relationship between them For example, if you came home and saw that your spouses car was gone, that is one event. If you then saw a guy carrying a TV around the corner, that in itself is another event. Now put the two events together and the causality may point to a situation where they are stealing your TV because the house is empty and they helped themselves. Easy for a human, not so easy for a programmer to capture this model in a generalized sense so it can be reused over multiple examples.
To make Computational Intelligence work, one would require a model for Complex Event Programing, an inference engine using something like the Blackboard patterns with a hypothesis limiter on it to negate the exponential hypothesis problem, a context ontology to layer over top of whatever semantic reasoning one might employ, and a large enough source of events that be used to feed it all. The latter is very important since event isolation would lead to an incomplete set of events to mine for the inference component and probably miss key things.
This is where Adobe LiveCycle enters. LiveCycle, as a platform, has several key places where events are captured and stored in a manner that they can be audited later. The next generation of the LiveCycle platform and the blades that plug into it carry a much more complex series of audit trails than the last version.
Here is a hypothetical situation where a phishing attack is starting. A mass email goes out and tells customers of a bank to use their forms to change their password because of a security breach. If you use LiveCycle Forms, served from a LiveCycle Form Manager, you will generate an auditable event each time one of your customers grabs the form. If your customers account is then accesses and a transfer form is filled out, that will also generate a second event. You now have two events that have a relationship to one thing - the unique account. This should be a relatively easy pattern to catch if you are using LiveCycle as a platform over your IT infrastructure. If you were to use multiple disparate technologies, it could also be caught however this may take more hard work to account for different Document models and mine the events at the same level of granularity.
LiveCycle Policy Server will be able to make events accessible in the LC 8 release and via the SDK, some events are available now. This should be useful to companies who are serious about thwarting criminal behaviour linked to people using their IT infrastructure.
Back to Johnny Rotten now. Things have to change in the world. The pistols and PIL changed me and now I am feeding back change into the world. People need to start thinking about this stuff and start finding ways to fix it. Come to think of it, I guess I am not too changed from my previous punk days. The picture on the left was taken in July of 2006 ;-)
Adobe LiveCycle: why is it so boring?
So you might think that is a funny title for a blog entry made by a guy who is supposed to be the evangelist for Adobe LiveCycle. I mulled it over for quite a while before deciding that it really is accurate and portrays what I want to say.
In following weeks, I will post some more advanced subjects converning LiveCycle. Stay tuned.
The Adobe® LiveCycle® family of J2EE-based enterprise software enables organizations to create, deploy, and optimize solutions to more efficiently capture, process, and archive information. It combines robust process management with electronic forms, document security, and document generation in an integrated and cohesive set of products that work inside and outside the firewall, for users in online and offline environments.
LiveCycle solutions leverage the universal client Adobe Reader® software and Intelligent Documents based on PDF and XML to capture information from users and automatically process it to the back-end or transaction systems that need it.”
For more about what it is, just visit http://www.adobe.com/products/livecycle/
The top four reasons why I think some find it boring?
- Most successful technologies are very simple and do something so well that they are often forgotten. Think about HTTP – you don’t see analysts and press talking about how radical and exciting it is. HTTP simply is a workhorse that does something extremely useful to the benefit of everyone. Once it is up and running, you tend to forget about it unless you have a problem. Adobe LiveCycle is a workhorse – most people are more interested in what it has done rather than how it has done it. Once it is deployed it sits there quietly in the background just performing its tasks. Not really that exciting…
- Another trait that well designed and well thought out technologies have is that they solve a problem and do it well. Once the problem is solved, the IT group moves on to the next problem and unless something breaks, tend to somewhat forget about the problem they just solved over time. Once you deploy LiveCycle to do something, you should hopefully be able to move on to other problems and more or less forget about it.
- LiveCycle does the middle tier connecting. Simply, with all the buzz about Application Servers and Rich Internet Applications (RIA’s), the workhorse (the middle tier) is often neglected. Although absolutely essential, most people will never see it directly, only interact with it other that the results. Look at components like LiveCycle Assembler. It gathers data from various other sources and serves it up as a PDF document then hands it off. The end user only sees the PDF document and should not really care how it got created. In fact, if you started telling them about Assembler, most would probably go to sleep since they do not need to care how.
- LiveCycle is complex. In fact, there are so many libraries providing the functionality behind the scenes, that most people would (and should) get bored if they tried to read through and understand all of it. If someone is really excited about LiveCycle and talks about it with a passion, they need another hobby.
In following weeks, I will post some more advanced subjects converning LiveCycle. Stay tuned.
Microsoft and ODF: Yeah, what he said.
I cannot over emphasize the importance of accurate journalism in my blog. Rather than repeat this, please just read the ZDnet blog on the subject:
http://blogs.zdnet.com/BTL/?p=3300&tag=nl.e622
http://blogs.zdnet.com/BTL/?p=3300&tag=nl.e622
Thursday, July 06, 2006
Adobe LiveCycle Assembler - what is it?
Adobe LiveCycle Assembler is a cool new technology for those of you working with aggregating data from multiple sources to bind into a PDF document as output. It embraces a simple pattern of Whole-part using a template model to declare the construction of a final PDF document. This is done using an XML template called a "Document Description XML (DDX)" that defines the single output file and the content and data used to create it.
LiveCycle Assembler is a server based solutions that uses the DDX templates and the specified source documents, manipulates the data in the source documents according to the specifications of the DDX, and places the resulting documents in the specified output location.
Why I like this?
Simple - it is starting the road to declarative PDF expressed in XML and DDX document sare relatively easy to author. The namespace of the DDX language is http://ns.adobe.com/DDX/DocText/1.0/, and the root element is
DocText. A simple example of how the root might look?
The DDX format allows for rich declarative expressions for all elements of a PDF document, ranging from Metadata to control over text of artwork. The data model for the XML is well thought out. Describing simple items like bookmarks is easy and you can also express actions:
LiveCycle Assembler is a server based solutions that uses the DDX templates and the specified source documents, manipulates the data in the source documents according to the specifications of the DDX, and places the resulting documents in the specified output location.
Why I like this?
Simple - it is starting the road to declarative PDF expressed in XML and DDX document sare relatively easy to author. The namespace of the DDX language is http://ns.adobe.com/DDX/DocText/1.0/, and the root element is
DocText. A simple example of how the root might look?
The DDX format allows for rich declarative expressions for all
Most documents formats appear to be moving towards a full XML expression with some form of packaging. Open Document Format (ODF), the OASIS open standard for XML declared documents, spreadsheets and presentations, uses XML as the standard for syntax. Norm Walsh was a pioneer in using DocBook which used stylesheets to display XML and even the next version of Microsoft Office is purported to be in XML format. In general, it seems to be a relatively popular activity nowadays.
Wednesday, June 28, 2006
Flash Player on Linux by year end
Having run a Linux Laptop and desktop for a while, I sympathize with those of you waiting to get Flash 9 for Linux. I have made good on my promise from JavaOne to follow up internally. The latest public news I have found is that we will have updated the Flash player for Linux by the end of this year. Read near the bottom. If you have comments on this subject, please feel free to leave them here. Although I do not speak for Adobe on this blog, I do perceive that there is a sense of urgency on this issue that seems to increase in the last two months.
Flex, that "Web 2.0 thingy" and today as a significant event in history
So today, Flex 2.0 was officially released. Hurray! What? Exactly! So why is the arrival of Flex so important and if it truly is, why is this event not larger?
First - for those of you who do not know what Flex is, Flex is an offering from Adobe that allows you to create Rich Internet Applications (RIA's) that display using Flash by using a declarative markup langauge (MXML). Furthermore, unlike Flash Director, Flex Builder caters specifically to developer who like to think in terms of Objects, Event Models, Event Handlers, MVC and other commonly accepted programming methodoligies and techniques, rather than the timeline based world of Flash Director. Flex has two important components - the Flex Builder, an Exclipse based development tool that comes with a wide range of prebuilt widgets and components, and Flex Data Services, a server that can allow the heavy lifting to be done away from the client.
A major point of clarity - to use Flex, you do not need to buy anything. There is a free Compiler available and you can write your own server and bind to it however you want. Adobe sells it tools based solely on the value they present. Most people will want to do a few common tasks and these are packages in our tools to make it much easier and quicker for you to get your next generation RIA up and running. This model was triumphed by Macromedia - think of why people bought Dreamweaver instead of hand coding HTML and JavaScript. Still - please feel free to use the free stuff.
Flex arroving in its' current iteration is a major milestone on the road to the next generation of the internet or what some are calling "Web 2.0". Flash has been for a long time the preferred technology for most rich internet applications and Flex bridges the gaps between web developers and application developers. It briges the gaps between enterprise architecture and the edge. There is even a bridge between AJAX and Flex.
In short, this toolset, the common programming model and forced MVC architectural constraints are moving the internet along to whatever it will be. Want to make a rich HTML text editor for your site? It used to take several days or weeks to do. Today, using Flex Builder 2, you can make the front end in minutes (I actually timed myself and my fastest time was 42 seconds).
As with everything I post on this blog thought, don't just take my word for it or believe me. Try it out for yourself.
First - for those of you who do not know what Flex is, Flex is an offering from Adobe that allows you to create Rich Internet Applications (RIA's) that display using Flash by using a declarative markup langauge (MXML). Furthermore, unlike Flash Director, Flex Builder caters specifically to developer who like to think in terms of Objects, Event Models, Event Handlers, MVC and other commonly accepted programming methodoligies and techniques, rather than the timeline based world of Flash Director. Flex has two important components - the Flex Builder, an Exclipse based development tool that comes with a wide range of prebuilt widgets and components, and Flex Data Services, a server that can allow the heavy lifting to be done away from the client.
A major point of clarity - to use Flex, you do not need to buy anything. There is a free Compiler available and you can write your own server and bind to it however you want. Adobe sells it tools based solely on the value they present. Most people will want to do a few common tasks and these are packages in our tools to make it much easier and quicker for you to get your next generation RIA up and running. This model was triumphed by Macromedia - think of why people bought Dreamweaver instead of hand coding HTML and JavaScript. Still - please feel free to use the free stuff.
Flex arroving in its' current iteration is a major milestone on the road to the next generation of the internet or what some are calling "Web 2.0". Flash has been for a long time the preferred technology for most rich internet applications and Flex bridges the gaps between web developers and application developers. It briges the gaps between enterprise architecture and the edge. There is even a bridge between AJAX and Flex.
In short, this toolset, the common programming model and forced MVC architectural constraints are moving the internet along to whatever it will be. Want to make a rich HTML text editor for your site? It used to take several days or weeks to do. Today, using Flex Builder 2, you can make the front end in minutes (I actually timed myself and my fastest time was 42 seconds).
As with everything I post on this blog thought, don't just take my word for it or believe me. Try it out for yourself.
Thursday, June 15, 2006
Interview on Web 2.0
I am really grateful to the Syscon folks for creating this interview:
http://tv.sys-con.com/read/235922.htm
The gist is about the Web 2.0 but with some actual depth added to the concept. The ideas started during a blog exchange with Tim Oreilly. Despite the fact that the name "Web 2.0" is perhaps suboptimal, the "thing" that people have come to link to the term does exist. Problem is (of course) that the "thing" is undefined. Accordingly, everybody thinks it is something a little bit different.
The interview discusses some possibilities for creating a set of reusable architectural patterns using the Mackenzie-Nickull Architectural Patterns Metamodel to distill out the differences in Tim Oreilly's examples of Web 1.0 and Web 2.0. This would by far be the most concrete definition.
Dion Hinchliffe recently published an example of some of the Web 2.0 Patterns I have been working on. Matt Mackenzie, who is always thinking beyond the edge, also has some interesting thoughts on the subject of Web 2.0.
http://tv.sys-con.com/read/235922.htm
The gist is about the Web 2.0 but with some actual depth added to the concept. The ideas started during a blog exchange with Tim Oreilly. Despite the fact that the name "Web 2.0" is perhaps suboptimal, the "thing" that people have come to link to the term does exist. Problem is (of course) that the "thing" is undefined. Accordingly, everybody thinks it is something a little bit different.
The interview discusses some possibilities for creating a set of reusable architectural patterns using the Mackenzie-Nickull Architectural Patterns Metamodel to distill out the differences in Tim Oreilly's examples of Web 1.0 and Web 2.0. This would by far be the most concrete definition.
Dion Hinchliffe recently published an example of some of the Web 2.0 Patterns I have been working on. Matt Mackenzie, who is always thinking beyond the edge, also has some interesting thoughts on the subject of Web 2.0.
Tuesday, June 06, 2006
Sign the "SOA 2.0 - Stop the Madness" petition!
If you care about technology, please sign this:
http://www.mwdadvisors.com/resources/stop-the-madness.php?do=show
http://www.mwdadvisors.com/resources/stop-the-madness.php?do=show
Wednesday, May 24, 2006
SOA 2.0 makes people finally speak out!
I have observed a really cool phenomena in the last week. Normally, when someone comes out with a new buzzword that doesn't really have any substance, most people merely complain quietly and go about their business. With Gartner and Oracle now having gone public with their term "SOA 2.0", the collective disgust seems to have finally reached the tipping point where people can no longer keep quiet. I am a bit surprised for two reasons. One is that I have talked to Yefim Natis and actually found him highly intelligent. It doesn't seem characteristic of him to back a buzzword like SOA 2.0.
The second surprise is the wave of attacks coming at the use of the term. This is good to see that folks are finally starting to yell "where's the beef" and "the emperor has no clothes". Some recurring thoughts on SOA 2.0 are spot on. This is a compilation of my favorites so far.
The second surprise is the wave of attacks coming at the use of the term. This is good to see that folks are finally starting to yell "where's the beef" and "the emperor has no clothes". Some recurring thoughts on SOA 2.0 are spot on. This is a compilation of my favorites so far.
http://markclittle.blogspot.com/2006/05/soa-20-ignorance.html
http://www.mac-kenzie.net/blog/2006/05/24/soa-20-what-are-they-smoking/
http://www.mwdadvisors.com/blog/2006/05/soa-20-stop-madness.html
http://jroller.com/page/dancres?entry=oh_no_soa_2_0
http://sw.deri.org/~juan/weblog/?p=242
http://mult.ifario.us/articles/2006/05/24/soa-2-0-mud-in-the-mud-puddle
http://www.thedatafarm.com/blog/PermaLink.aspx?guid=cfb38e60-5c9c-4670-8c36-ae36f114e075
http://voelterblog.blogspot.com/2006/05/it-folks-out-of-control.html
http://data-entry-business.blograzor.com/52352/
You'll notice a pattern here. There are about 3 or 4 people who like the term and several of the entries in Google's blog search simply syndicate the same content. The above links are unique comments written by people who I consider pragmatic and smart, not based on this but on previous blog entries they have written.
Monday, May 22, 2006
The Fan just got smothered!!!!
The fan just got hit big time!
I cannot believe this is happening. I met up with Mark Little at Java One and he told me some people are actually starting to talk about “SOA 2.0”. The German language has the only words for this – “einfach unglaublich”. Roughly translated it means “utterly unbelievable”.
Now Mark is a very smart guy – I work with him on many Web Services standards bodies where he provides great value. I have never seen him get really upset about anything before I saw this blog entry. This should be a testament to how absurd the concept of SOA 2.0 is.
As Mark correctly points out, you cannot take some half baked marketing term and milk it for another few miles by sticking a version number at the end of it. This appears to be nothing more than a scam to keep people coming back for more information. People – they are making it up!!! You are being lead down the wrong path. I can see it in my head:
Please note I am not just picking on analysts - they are just the easiest target in this case ;-)
On Mark’s blog, he notes that Steve says Web 2.0 it is a mix of EDA and SOA. Bullocks! All SOA is event driven. How can you have a service that does something if there is no notion of an event (trigger) in the architecture? I suppose if you just built it and it sat there doing absolutely nothing but even then it would be event driven since doing nothing is what it should do in the absence of any events. Can anyone provide an example of SOA that is NOT event driven?
A group of people (over 200 members and observers to be precise) got together out of disgust for lack of clarity around SOA and put together a Reference Model to clarify what is meant by the term. Being largely end users, they asked all the right questions. If SOA is architecture, as the name implies, how do we express it as architecture or some architectural artifact? How is it different from other interface based designs? Does it have a right to exist as a term (*read – does it have any substance or is it pure marketing hype)?
These people wrote a Reference Model which defines an architectural paradigm for organizing and using resources under different domains. The Reference Model is not architecture per se, it merely notes the main concepts, at a completely abstract level, for the entities which consistently appear within service oriented domains.
SOA Definitions – There’s enough for one per person.
Given the current Wikipedia definition and the OASIS Reference Model for SOA, it appears that SOA is something we all have probably been doing for a long time. Even Starbucks implements the OASIS Model. Service provides for their Services (they provide caffienated beverages to customers) use visibility (signs, advertising) to let others know the services are available. There is an interaction model (money for coffee) that uses a behavior model (pay first, coffee later) to provide the service. There is a service description (like WSDL for customers) and a fabric they attach to to allow service consumers to interact with the service. WS-* is the same. This really makes me wonder when I see quotes stating things like “over 60% of all companies hope to be doing SOA by 2007”. Even some smart IBM'ers have been skeptical of peoples claims to be “doing SOA”. Given they also have at least established a metric for SOA, they are IMO entitled to talk about it. For someone who starts this sort of a conversation without using a *useful and measure-able” definition of SOA is, cannot be held in high esteem.
The OASIS Reference Model for SOA does not purport to be the one and only true definition of SOA. It is simply a model that is a stick in the mud (or FUD in this case). Even if you do not agree with it, it represents a non-proprietary definition which you can use as a point of reference to state where your definition differs. Someone can easily state “When I say SOA, I differ from the OASIS Reference Model in the following ways….. [insert your POV here]”.
Summary
Mark is a smart guy, beware of people selling anything undefined with a 2.0 extension and if your “doing SOA”, be careful and don't forget to use Starbucks products.
I cannot believe this is happening. I met up with Mark Little at Java One and he told me some people are actually starting to talk about “SOA 2.0”. The German language has the only words for this – “einfach unglaublich”. Roughly translated it means “utterly unbelievable”.
Now Mark is a very smart guy – I work with him on many Web Services standards bodies where he provides great value. I have never seen him get really upset about anything before I saw this blog entry. This should be a testament to how absurd the concept of SOA 2.0 is.
As Mark correctly points out, you cannot take some half baked marketing term and milk it for another few miles by sticking a version number at the end of it. This appears to be nothing more than a scam to keep people coming back for more information. People – they are making it up!!! You are being lead down the wrong path. I can see it in my head:
Analyst: “SOA is the answer to anything. Even if you don’t know the question. Too bad I can’t tell you what it is exactly but if you listen to me, maybe you can do it someday.”
Customer: “Actually, I think I figured it out. It is a model for software architecture.”
Analyst: (Thinks silently – “Oh no – they’re on to me. What should I do??”)
Analyst: ” Very well, I think now you are ready for SOA 2.0”.
Please note I am not just picking on analysts - they are just the easiest target in this case ;-)
On Mark’s blog, he notes that Steve says Web 2.0 it is a mix of EDA and SOA. Bullocks! All SOA is event driven. How can you have a service that does something if there is no notion of an event (trigger) in the architecture? I suppose if you just built it and it sat there doing absolutely nothing but even then it would be event driven since doing nothing is what it should do in the absence of any events. Can anyone provide an example of SOA that is NOT event driven?
A group of people (over 200 members and observers to be precise) got together out of disgust for lack of clarity around SOA and put together a Reference Model to clarify what is meant by the term. Being largely end users, they asked all the right questions. If SOA is architecture, as the name implies, how do we express it as architecture or some architectural artifact? How is it different from other interface based designs? Does it have a right to exist as a term (*read – does it have any substance or is it pure marketing hype)?
These people wrote a Reference Model which defines an architectural paradigm for organizing and using resources under different domains. The Reference Model is not architecture per se, it merely notes the main concepts, at a completely abstract level, for the entities which consistently appear within service oriented domains.
SOA Definitions – There’s enough for one per person.
Given the current Wikipedia definition and the OASIS Reference Model for SOA, it appears that SOA is something we all have probably been doing for a long time. Even Starbucks implements the OASIS Model. Service provides for their Services (they provide caffienated beverages to customers) use visibility (signs, advertising) to let others know the services are available. There is an interaction model (money for coffee) that uses a behavior model (pay first, coffee later) to provide the service. There is a service description (like WSDL for customers) and a fabric they attach to to allow service consumers to interact with the service. WS-* is the same. This really makes me wonder when I see quotes stating things like “over 60% of all companies hope to be doing SOA by 2007”. Even some smart IBM'ers have been skeptical of peoples claims to be “doing SOA”. Given they also have at least established a metric for SOA, they are IMO entitled to talk about it. For someone who starts this sort of a conversation without using a *useful and measure-able” definition of SOA is, cannot be held in high esteem.
The OASIS Reference Model for SOA does not purport to be the one and only true definition of SOA. It is simply a model that is a stick in the mud (or FUD in this case). Even if you do not agree with it, it represents a non-proprietary definition which you can use as a point of reference to state where your definition differs. Someone can easily state “When I say SOA, I differ from the OASIS Reference Model in the following ways….. [insert your POV here]”.
Summary
Mark is a smart guy, beware of people selling anything undefined with a 2.0 extension and if your “doing SOA”, be careful and don't forget to use Starbucks products
Adobe Developer Week Registration Live
Registration for Adobe Developer week is now live. The week long event is completely virtual. It is sort of an "anti-conference" of sorts.
URL: http://www.adobe.com/cfusion/event/index.cfm?event=detail&id=452429&loc=en_us
Developer Week is a week of free, online technical seminars on Adobe technologies, scheduled for June 12-16. I will be presenting on Friday.
URL: http://www.adobe.com/cfusion/event/index.cfm?event=detail&id=452429&loc=en_us
Developer Week is a week of free, online technical seminars on Adobe technologies, scheduled for June 12-16. I will be presenting on Friday.
Subscribe to:
Posts (Atom)