On May 20, 2009 at the 360|Flex conference in Indianapolis I gave a presentation titled “Adobe AIR data privacy and security.” As I always do (and after a bit of a delay), here are the slides from my presentation. I’ve added fairly lengthy notes to the slides (I had to make the font smaller so they’d fit on the pages) so it’s more than just bullet points.

Adobe AIR data privacy and security slides, notes, and links (1 MB .zip)

As a side note for those who actually attended the presentation, in retrospect I think I over-emphasized the security concerns and didn’t emphasize enough that there are plenty of use cases for which AIR is definitely secure – especially in the case where you need to keep the user’s private data secure. Hopefully the notes that accompany the slides help to clarify this somewhat.

I also used and referred to a number of resources in my presentation, which are listed below. The download .zip with the slides also includes an html page with all these links.

Introduction

• "Maintaining security with Adobe AIR" by Ethan Malasky and Peleus Uhley (Adobe MAX 2008)

Background

• "AIR security" (Adobe AIR documentation)
• "Why Adobe AIR Doesn’t (Yet) Include the Feature You Most Want" by Oliver Goldman
• "Understanding the Flash Player Security Model" by Deneb Meketa (Adobe MAX 2008)
• "Considerations for using encryption with a database" (Adobe AIR documentation)
• "Using digital rights management" (Adobe AIR documentation)
• Operating system security (user and "admin" rights)
  • "What are Adminstrative Rights, Anyway?" by Oliver Goldman
  • "Does Installing an AIR Application Require Admin Rights?" by Oliver Goldman
• Source code visibility
  • Action Script Viewer (ASV)
  • "Ethical SWF Decompiling" by Lee Brimelow
  • Nitro-LM
• Encryption: ActionScript crypto libraries:
  • as3crypto
  • OpenSSL (partially) cross-compiled to ActionScript using Alchemy

AIR application installation

• Sign your app with a trusted cert
  • "Code Signing in Adobe AIR" by Oliver Goldman
  • "Digitally signing Adobe AIR applications" by Todd Prekaski
  • Promotion: get a free signing certificate (while supplies last) by submitting your app to the Adobe AIR marketplace
• Plan for updates
  • "Building AIR applications that can be easily updated" by David Deraedt
  • "Using the Adobe AIR update framework" Quick Start article by Jeff Swartz (Adobe AIR documentation)

Modular applications

• Sandbox bridge
  • "Scripting between content in different domains" (Adobe AIR documentation)
• XML signature validation
  • "Creating and validating XML signatures" by Joe Ward
  • "Using the XML signature validation classes" (Adobe AIR documentation)
  • "flash.security package" reference (Adobe AIR documentation)

Local shared objects

[No links]

Encrypted Local Store

• "Storing encrypted data" (Adobe AIR documentation)
• "EncryptedLocalStore class" reference (Adobe AIR documentation)

Local files

[No links]

Local SQL database (SQLite)

• SQL injection attack
  • "Using parameters in statements" (Adobe AIR documentation)
  • "SQLStatement.parameters property" reference (Adobe AIR documentation)
• Encrypted database
  • "Using encryption with SQL databases" (Adobe AIR documentation)
  • "Using the EncryptionKeyGenerator class to obtain a secure encryption key" (Adobe AIR documentation)
  • as3corelib project (includes the EncryptionKeyGenerator class and hashing algorithms

Here are a few things that stood out to me the most in this great day at the greatest Flex conference on the planet:

• FlexUnit 4. Wow. Big update. Very nice new features. Time to get (back) into it. (presentation by Michael Labriola)
• Renaun Erickson’s Structured Log Testing framework. Another great, unexpected surprise. I didn’t really have plans to go to this session except that Renaun’s such a smart, friendly guy. And frankly, I’ve never really had enough interest to take a look at his work on this project so far. Boy am I glad I changed my mind. This is definitely a testing approach I can get into – much less overhead than other approaches I’ve seen. Getting going with it is only barely more work than adding trace() calls. And the result is certainly infinitely more valuable.

Considering I didn’t come to Indianapolis with any real interest in hearing more about testing…I’m surprised to find myself so excited by what I saw today. Today is a great day for Flex testing, that’s for sure.

I also got to hear some interesting ideas and future plans from Jacob Wright and Tyler Wright. (They made me a bit jealous – I wish I had a Flex programmer brother that I could see at conferences.) If you’re in Indianapolis, I recommend checking out their “write-in” session on the Flight Framework at 10am Tuesday in the Illinois East room.

Other less code-centric, but interesting, tidbits:

• Joe Berkovitz is an avid mountain biker.
• Ben Stucki has a sweet five-year-old daughter who likes deep-fried calamari and pasta, although she wasn’t able to finish her macaroni and cheese at Buca di Beppo, where apparently even the child meals are sized to feed 3-4 people.

In case you’ve missed the announcements, the month of May feels like it’s overflowing with community events. Here’s what’s on my schedule so far for May 2009 (And I strongly endorse these. With the possible exception of the third one =):

• SilvaFUG North (SF) May meeting (May 12): This is basically a pre-event for FlashCamp, with presentations on Flex-related designer concepts and designer/developer workflow. I’ve been away from the design world for a while, so I’m excited for the “refresher” course.
• 360|Flex Indianapolis (May 18-20): I’ll be there, speaking on “AIR data privacy and security”, and you’ll also find a host of the best and friendliest Flex developers I’ve ever met, including a healthy contingent from the Flex engineering and evangelism teams. If I had to choose one conference to go to (and I probably do, this year) 360|Flex is it for me.
• Bloomington, Indiana Adobe users’ groups (May 21): While I’m in Indiana, I’ll be heading down to Bloomington to speak to the users’ group(s). My presentation topic is still being finalized, but it looks like it’s going to be something around Flash/Flex Designer/Developer collaboration (notice a trend?). I’m also hoping to have a bit of time to catch up with friends, colleagues, professors, etc. – I went to grad school at Indiana University and worked for IU after graduation, living in Bloomington for just under six years total.
• FlashCamp San Francisco (May 29): Back in SF, at the Adobe office, this is the preview event that’s not to be missed, covering all things Flex 4/Flex Builder “Gumbo”/Flash Catalyst. I won’t be speaking at this one, but I’ll be hanging around learning more Flex 4 goodness, talking to developers (as part of the AIR team), etc.

This is pretty much old news by internet time standards, but I haven’t had time to write about it until now. (We’re working hard to make future Flex/AIR/ActionScript/Flash documentation more focused on how you actually use documentation, better than ever before.)

A couple of years ago, before AIR beta 1 (“Apollo”), I wrote a tool for testing SQL statements in AIR. Later (I can’t remember exactly when) I released it under the name ”Doppler.” I had plans to make it a full-fledged database management tool, but those plans never really panned out. I’ve told this story lots of times now, about how I now use (and even help develop) David Deraedt’s “Lita” SQLite admin tool.

However, “Doppler” in its current form served a different need than Lita – Lita is great for creating and managing database structure (you’ll never have to write a CREATE TABLE statement again), but it isn’t as strong for testing individual SQL statements. Over the past several months I’ve been doing some “serious” app development, working on an AIR app that makes heavy use of SQLite. I found my little tool to be quite handy, and also found and implemented a number of small improvements that make it much more useful.

Since my original intentions were never going to come to fruition, and I had new future plans for the app, I decided a new name was in order. Since it is for running SQL statements, “run” was an easy and obvious choice. So now, (several weeks after posting it), allow me to officially introduce you to the Run! AIR SQL query authoring and testing tool – the next generation of Doppler.

If you look at the full feature list for the latest release, you’ll see that I’ve added several types of changes. A few of the ones that I’ve found most useful in my day-to-day work are:

• Auto-update and badge install – no more downloading the .air file (admittedly not a big deal) and no more uninstall and reinstall each time there’s a new version (a big deal)
• “Recent SQL files” and “Recent databases” menu items
• Opening and saving SQL files (plus keyboard shortcuts)
• “Row count” and “execution time” displayed for SELECT statements
• Line numbers and auto-indent in the SQL panel

And yes, I did say “day-to-day” work. On some days, Run! has been my primary IDE, as I’m writing and testing and rewriting large SQL statements. It’s been kind of strange and kind of fun building a developer tool and using it as much as I use Run!.

I’ve already gotten a bug report and I’m working on features for the next big release, so if you have thoughts or comments please comment on the project page!

David Deraedt is at it again with another amazing application for Flex developers.

(No, he’s not paying me for all these things I say about him. He’s just nice enough to let me hang around in his source code sometimes =)

I just watched the demo video of his Lupo Flex Localization Studio. If you think you might ever want to build a Flex app in more than one language, you should watch it too. If you don’t think you’ll ever need to…think again. One thing I’ve definitely had drilled into my head as I’ve been working on documentation at Adobe is the importance and impact that localization can have on a project. As a French- and English-speaking Flex developer and participant in many localization projects, David has a lot of expertise in this area, which shows in the tools he’s made.

Lupo includes two tools:

• “Lupo Manager” is a tool for developers. It scans your source code, identifying strings that might need to be localized. You use a simple form to create key values (often the default is sufficient) and it rewrites the source code for you. You can then edit the resource bundle values and preview the properties file which you can hand off to localizers. Once your strings are localized, Lupo Manager also generates the compiler arguments and sample source code to help you get started with actually integrating the language switching into your app.
• “Lupo Translator” Just in case a developer tool isn’t enough, Lupo also includes a computer-aided translation tool that localizers can use to easily translate the strings in the resource bundle.

Something else that I think is definitely worth noting is that Lupo is intended as a commercial AIR application. Adobe AIR isn’t meant to just be about free apps, and it’s exciting to see another entry into the commercial AIR app space.

Once again, amazing work by David. I can’t wait to see the released version – I’ve got some projects that I think are going to need a little Lupo love =)

If you use David Deraedt’s great AIR SQLite administration tool Lita, you probably already saw that he just pushed an update (v. 1.2) a few days ago. Aside from my general happiness from seeing that this release fixes some bugs and adds new features that were important to me, this release has personal significance for me as well. As David noted last week, I have joined him as a contributor to the project. So in fact, some of those bug fixes and new features were done by me! I’ve discovered that there are few feelings greater than wanting a feature in a tool you use every day, and then actually implementing it. =) Upgrading is more fun when you see your own bugs in the release notes, too =)

As David pointed out, the fact that I’m an Adobe employee and am participating in the project doesn’t mean it’s now an official Adobe product (for good or bad). I’m doing this 100% on my own time. And my role is still pretty small – David is certainly the lead, main, primary, controlling, etc. author. I just file bugs as I find them, add some comments about feature requests, and fix issues when I know how to.

In case you’re curious, the back story is really pretty straightforward. I started writing my own version of an AIR SQLite admin tool back before AIR beta 1, but never had time to take it beyond a “query runner” tool. Late in 2008 I discovered Lita, and once I started using it I realized that 1) it is implemented in a similar way to many of the ideas I had, and 2) It’s already got a big head start in features, so there’s not much point in me trying to “compete” or anything like that, especially for something that I wasn’t planning to make money from.

After using it for a while I discovered a few bugs, and decided to email David about them. (He and I had communicated a bit previously, about the encrypted database functionality added in Adobe AIR 1.5 and how to integrate it into Lita.) I think I probably mentioned in that message that I would be willing/interested to fix issues myself as I have time. Fortunately David was very kind and accepted my offer. So, as I said, now when I find issues I get to fix them myself, which is nice because I can fix them quickly, but also adds some responsibility since now the burden is on me to make those changes myself =)

As a side note, I really want to point out that David is a really great developer – something I appreciate greatly as we work in the same codebase. It is a big testament to his architectural and coding skills that I was able to dive right in and fix four bugs/feature requests in a very short time (literally a matter of minutes after first looking at the code). I’ve learned a lot just from seeing his code, and now I’m anxious to read his “Flex Architecture Fundamentals” series to learn more about the thinking behind the great code.

Disclaimer: this is just a silly little note, perhaps the first such on this site although my personal site primarily consists of such little tidbits, mostly about my kids.

A few years ago I was working as a developer for a computer training department at a large midwestern university*. I also wrote and taught training courses for them. As jobs tend to do, the work was often in cycles – sometimes I’d spend a few months doing mostly coding, then perhaps I’d be working on a new workshop so I’d spend most of my time writing for a few months.

At one point I was in the transition phase, moving off of a “coding” cycle and into a “writing” cycle. One day while I was writing (in Adobe Framemaker – the word processor we used) I realized that each time I reached the end of a sentence my first instinct was to type a semicolon rather than a period. Too many lines of code written, I guess!

Anyway, I was reminded of that today when something kind of similar took place. Nowadays of course most of my writing, whether code or documentation, is done on a computer. In fact it’s fairly common that when I reach a stopping place while writing in a web browser (such as editing a wiki page) I instinctively type Ctrl+S to “save” (even though that just opens up a dialog to save the HTML of the page, rather than actually saving my work in the wiki or whatever. Today, however, this instinctual behavior was taken to a new level.

I was in a meeting and I had a thought about something I’ve been brainstorming since yesterday. It’s a new project I’m starting on (a documentation architecture project, not a coding one) so I’ve started by just jotting down thoughts in a notebook as they occur to me. I pulled out my notebook and wrote down my ideas. Then I felt a sort of funny twitching in my left hand – my left pinky and middle finger were instinctively trying to perform some sort of repetitive action, and couldn’t quite figure out whether it was appropriate or not. I realized that since I had just finished writing down a thought, my hand was trying to make the gesture for Ctrl+S in an attempt to “save” my “document”. Because of this my brain was momentarily confused – like it somehow knew this action didn’t quite fit in this context (pen and paper) but couldn’t figure out exactly why that was the case. Since of course, mentally I knew I needed to hurry and save my work so that it wasn’t lost.

Anyway, that’s my funny story for the day. Probably for the rest of my life, at least in terms of publishing at this url. So I hope you enjoyed it =)

* Note

My use of the term “large midwestern university” is also an attempt at humor – its an academic inside joke. I went to graduate school at Indiana University (the same “large midwestern university” where I later worked) and we students often read academic papers published by our professors or their former students. In the spirit of anonymity, when they described the participants in their research studies they never described their study participants as “students at Indiana University” or something like that. Instead they always described them as “students at a large midwestern university” although the authors’ biographies would always indicate their affiliation with Indiana University, so there really wasn’t any anonymity about it at all.

Since I first created my ActionScript GZIP library as a test of Adobe AIR’s file compression capability, the number one request I’ve received has been to add support for Flash Player-only projects. With the release of Flash Player 10 last fall, I couldn’t use the lack of player support as an excuse any more. So now I’ve just been using the “not enough time” excuse…

But not any more. A few days ago I checked in a beta (barely tested) version of that adds support for Flash Player 10 (browser) projects. It’s not linked from the main google code project page yet, but you can get to it from the GZIP encoder project downloads page.

The download that adds Flash Player 10 support is “ascompress-.2.0.zip”. It now includes two SWC files:

• GZIPEncoder_AIR.swc is the full package, with all the same features as the previous release (.1.0.2).

• GZIPEncoder_Flash.swc is the Flash-Player-only version. It only compresses/uncompresses ByteArrays, and doesn’t have any support for files.

  Of course, since Flash Player 10 also adds local file opening/saving support that uses ByteArray data for the files, you could easily write your own code to prompt the user for a gzip file, or compress a file and prompt the user to save it. For an example of opening and saving files from Flash Player 10, see my quick start article: “”

As I implied when I described this as “beta (barely tested)” I haven’t done a lot of testing of this code yet. I don’t actually anticipate that there will be issues – really all I did was refactor the code into two classes instead of one – but that doesn’t mean there won’t be any issues, of course. =) If you’re interested, and especially if you’re one of the people who’s asked for this support, I would love it if you try it out and let me know how it works for you. If you’re willing to test it out, I’ll be happy to quickly make any fixes necessary.

As I’ve mentioned I’ve been doing a lot of AIR database work, so I’ve been spending literally hours a day working in my AIR SQL query runner app. The good news is that means I’ve been finding/fixing bugs and adding features!

One thing I’ve been wishing for the last week or so is undo/redo functionality as I’m editing query text. Coincidentally, I just found out that my 360|Flex friend Jac Wright has written a library for undo and redo in Flash Player (ActionScript) text fields. The previous link is to the Google Code project; here’s his introductory blog post about the “undo textfields” library. (via Tyler Wright via Gilles Guillemin/Twitter)

Admittedly I haven’t tried this yet, and I’ve asked whether it’s been tested in AIR so I don’t know whether it will actually be feasible as-is. But I’ve got my fingers crossed! =)

I just wanted to write a quick note to say that I’ve released an update to my “Doppler” AIR SQL admin tool. You can get it from the Doppler project page. (I’ve been working on an actual real application, one with a fair amount of database work, so naturally I’ve found motivation to fix some lingering bugs and add some missing functionality.)

As with previous versions, if you’ve been using the app you’ll need to uninstall it before installing the new version. Someday I’ll add updating support, but I’m not going to promise anything real soon.

Along with this release, I’ve also made a change to how I describe the tool, and to my future intentions for it. I’ve always had it in my mind to make this a full-fledged database admin tool, similar to the tools that come with SQL Server or other enterprise databases. However, time has obviously not allowed me to do that, and in the mean time other tools have been released by other developers. I’ve found one, David Deraedt’s “Lita” SQLite admin tool that is sufficiently mature that I use it in my day-to-day work now and it definitely beats doing things by hand! There are still improvements to be made and features to be added, but when I’ve reported bugs and feature requests he’s been quick to respond and release updates.

So while I’m sure nobody’s been holding their breath waiting for me to finish the “admin tool” portion of my app, I just wanted to clarify the new direction I’m taking it – or rather, the fact that I’m not planning to take it in as many new directions! (Hence the change in title for the project from “AIR SQL admin tool” to “AIR SQL query testing tool.”)

That doesn’t mean I’m done developing this tool by any means. In past jobs where I did heavy database development, and in a project I’m currently working on that involves heavy database development, I find it very useful to have two different kinds of database tools – one for creating and managing database objects and structure, and another for testing queries. While Lita does in fact have a tab for testing queries, I personally find Doppler to be a bit (not a lot, but a bit =) more developed in that specific area. On the other hand, Lita certainly does a lot in the db management space that Doppler doesn’t do. So I find the tools very complementary in terms of my actual development work.

As always, I welcome feedback, questions, thoughts, etc. And thanks to everyone who’s already reported bugs and offered suggestions!