Philosophically Secure

Yes, of course they do. They’re the government. Nothing moves quickly, and innovation is stifled 95% of the time. But alas, even Uncle Sam can’t hide under the information technology of the 90′s forever. As the web begins talk of Web 3.0 (whatever that really means), the federal government is beginning to look into taking advantage of some of the Web 2.0 technology that has been around for a couple of years.

The launch of A-Space, “MySpace for the intelligence community,” was very publicly announced as a new attempt to foster information sharing and collaboration across agencies. But whenever you deal with sensitive or classified data, security becomes a major hurdle to data sharing.

Anyway, this Federal Computer Week article, “Play it safe on the interactive Web,” caught my attention. It attempts to give tips to federal IT-types on how to avoid taking any risks while trying out some of the latest Web 2.0 tech. I couldn’t help but feel that the author misses the point of interactive, collaborative, service-based systems. It seems more like a list of how to safely give the appearance of venturing into these new technologies.

The very first suggestion is to isolate new cutting edge initiatives from the rest of the organization. Well, doesn’t that defeat a lot of the point? You can’t create a great new interactive, web-based analyst interface to query multiple, disparate databases across various agencies if you are going to keep things isolated (as an example). Tip number two: “keep an eye on XML.” Sorry, but XML is not some newfangled thing that might be useful. I’m positive that it’s already all over government IT systems. Sure, it can present new challenges in sharing data, but it also allows for new, innovative solutions to old problems. (Just remember that XML is not always the right tool for the job.)

I must say, the article isn’t all bad. It does bring out some issues with Web 2.0-type systems, such as the need to really validate untrusted user input. And I can’t argue with the last tip of embedding security into the development process. But overall, I think the government should be more aggressive in adopting new ideas and software technologies. Security should be included, but not a roadblock.

I love learning new technologies by first getting a quick overview, and then looking at lots of examples. This method usually gets me up and running fast, and helps me know what to focus on when I do further reading to go in depth. Nowadays, screencasts are the trendy way of doing demos, and they’re really quite good at helping people understand how something is done.

In this case, I’m talking more about programming – in particular with Django (the Python-based web framework). This Week in Django, which I had never heard of previously, has created an awesome series of screencasts to help users hit the ground running. They cover the basics, like installation and project creation, all the way to user authentication and the forms library.

The series is worth checking out even if you already know how to use Django in general. You might pick up a few tips, or discover a better way of doing something.

I recently started reading Dr. Dobb’s Journal again, and quickly came across this article on Ruby. It goes beyond just talking about how Ruby is really gaining momentum as a serious enterprise programming language, especially for dynamic web apps. The article also mentions two supposed new technologies from Microsoft: APAX and ARAX. Yep, that’s basically AJAX with Python or Ruby instead of the JavaScript. Unfortunately, I haven’t really seen anything official about either APAX or ARAX, except maybe this post from Savas (a Microsoft engineer). As a Python fan, I’m looking forward to more information becoming available.

On a side note, I recently learned that Ruby treats zero as a true value. I find that rather irritating.

This isn’t exactly breaking news, but it’s new to me! I just came across this screencast by Sean Kelly of NASA, where he does a bake-off between several web application frameworks: J2EE, Ruby on Rails, Zope/Plone, TurboGears, and Django. He starts out by creating a simple “Hello, world” application, just to get a feel for the frameworks. As he goes along, he gives each one a “fun level” rating, as well as making note of how many lines of code, configuration files, and XML sit-ups were required to get the desired functionality. Once that’s done, he goes into creating a more involved application, so that he can really try out a few of the advanced features each framework offers.

Not to spoil the ending, but it did make me want to give Plone a try. I currently do mostly Python with Django for the web stuff at work, and its been great so far. But it certainly couldn’t hurt to try out something different and see how it fits in…