CrossSafe

This weekend I released CrossSafe. Briefly, CrossSafe provides secure cross domain JSON requests and partially implements the JSONRequest specification (the get and cancel methods). Ajaxian covered the release and you can also read more about at the project page, see a demo, or download it. Rather than repeat the project description here, I thought it would be more interesting to describe the approach and elicit feedback on the future of secure cross site request.

CrossSafe uses nested iframes with a different domain than the parent window to setup a secure channel of communication with cross site servers. This works by passing a JavaScript object to a child frame and then using an alternate host name (like webservice.json.com) to prevent cookie access and changing the document.domain to prevent window, DOM and other JS environment access. By bringing this together, the dynamic script tag/cross site scripting approach can be used to retrieve cross site JSON data, and the scripts that are loaded from the other site are sandboxed. The parent window can retrieve data from these scripts, but the scripts can not access the parent window. This approach is also described here, but as far as I know, this is the first implementation. This implementation also follows the JSONRequest API specification, which allows you to use a standard API, and the library defers to a native implementation when it becomes available.

There is another approach for accessing cross site data securely that uses iframe proxies called fragment identifier messaging (FIM). Dojo has a good implementation of this approach. However, I believe this approach suffers from a couple of problems. First, it requires a level of server cooperation that has not been widely implemented yet. Servers must have Dojo’s iframe proxy script available on their site. On the otherhand, CrossSafe requires that server implement callback parameters which is already available with web services from Yahoo, Flickr, Codinginparadise.org’s transclusions, and JSPON. FIM also relies on polling to transfer data. Second, I have not done any tests to verify this, but I would be inclined to believe this is a slower approach as well. However, that said, I am interested in possibly implementing the JSONRequest.post method using this approach. The JSONP/XSS technique is only capable of making GET requests. The FIM approach on the otherhand does support POST. If I integrated Dojo’s FIM implementation in CrossSafe, all three JSONRequest methods could be available, and it could just be recommended to use the get method whenever possible because of the performance and interopability advantages.

Another issue with these approaches is that there are no real standards about how to do these requests since they require server cooperation. With the JSONP/XSS callback approach has seen various callback parameter names used including jsonp, callback, and jsoncallback. CrossSafe supports changing the parameter name, but it would be great if we could standardize this. Despite the fact that the original JSONP article proposed jsonp, I propose that we use the parameter name of callback. This is very succint and clear, and let’s face it, Yahoo is the most significant provider for JSON out there, and this is the parameter name they use.

The FIM approach could also use standardization. Dojo has the best implementation that I know of, but I believe OpenAjax.org is currently working on standardizing this as we speak. At least I hope…

Let me know if you have any thoughts.

Testing Aware

testing

Reasons to be Thankful

It yet another attempt to do a trackback, I am responding to my sister’s post “10 reasons I Love my Life”. Seems only appropriate to respond with a list of thankfulness:

  1. The wonder of forever increasingly experiencing the glory and awe of God
  2. The priviledge of forever interacting with the true king and hero, His Son
  3. The cutest little girl in the world is most daughter
  4. The most beautiful girl in the world is my wife
  5. I am starting a really cool new self-directed R&D job, where I can work from home
  6. I am moving to Utah, the most beautiful place on earth :) . (OK, there are some more impressive places, but it ranks close to the top)
  7. I have a wonderful family that loves me

Christmas List 2007

Get Out and Don’t Vote

I am pretty sure I speak for the minority with this viewpoint. It seems as American as apple pie to believe that all good citizens should vote. However, I believe that there is fundamental flaw in logic that takes us from the founding principal of democracy that everyone be allowed to vote, to the idea that everyone should vote. That everyone can vote is essential to democracy. It is what ensures representation of the people in a fair and appropriate manner. However, is high voter turnout really important for democracy, or is informed voters more important?

The goal of democracy is that good decisions will be made by the government that properly represent the desires of the people. There are two parts to this: good decisions and representation. Good decisions require thorough understanding. In practice, democracy on a large scale is simply impractical. We must resort to a representational democracy. There are simply too many decisions that must be made by the government to ask everyone to thoroughly understand the issues. However, this concept is not just a necessary evil, that should be avoided as much as possible. In representational democracy, most decisions are made by people that study and research the issues. This is actually very beneficial. Rather than decisions being made by people that have only quickly glanced at the issues, decisions are made by representatives that understand the issues. This same concept should also apply to issues that are brought to the general public. My main point is simply that we should not be encouraging more people to vote, but rather that we should encourage people to only exercise their right to vote if they are really willing to research the issues.

The second goal of democracy is representation. If there are fewer voters will proper representation be lost. This can primarly be frame as a statistics question, with decent mathematical answers. In large populations, a small voter turnout has very little effect on representational accuracy. If a population of one million registered voters vote, and voter turnout dropped from %40 (typical for America), to %20, the impact on representational accuracy would be a fraction of a percentage. In short, if only highly informed people voted on issues, better decisions would be made, without signficant loss in representation.

James Bouvard said, “Democracy must be something more than 2 wolves and a sheep  voting on what to have for dinner.” How does democracy fail us in this situation? High voter turnout does not help this situation. Of course we can simply blame the wolves for the lack of consideration in voting, but in reality there are many situations, where the ethics are not so clearcut. The important aspect of successful representation that this example illustrates is that people’s opinions are not necessarily equal in the forcefulness. Some people are very close to indifferent on issues, the issue does not seem to have much impact to them. Others maybe deeply impacted by the issues. By encouraging everyone to vote, you are actually encouraging those who are impacted to lesser degree to a equal plane with high degrees of impact. By avoiding such encouragement, you allowing the natural process of less impact to result in lower turnout. Back to our example, if we had many wolves, there are probably lots of options for what to have for dinner. It is not a big deal for them, to choose something besides the sheep. Consequently, the natural inclination is for low voter turnout by wolves on this issue. On the otherhand, the sheep will naturally turn out in droves to vote on this issue. By simply allowing the natural process of allowing people to vote, but pushing them into, it is quite reasonable that voter turnout by wolves could be %30, and the sheep can win the vote (as they should).

Another aspect of voting is simply the cost of becoming informed enough to vote. If politics was the end goal of life, and good decisions by the government was the key to our happiness, we should certainly all spend every available moment researching issues and preparing to vote. However, this is not the situation. In fact, the time spent researching issues could be diverted to other activities, there is a vast amount of good that could be done. If half of voters decided not to vote and spend time researching issues, but rather taking that time and volunteering at the nearest rescue mission, what would be the impact? It would be hugely positive, with negligible impact on accurate representation.

Most Christians seem to think it is their spiritual duty to vote, but is that really what the Bible teaches? Actually this can go both ways. The Bible clearly teaches to protect the innocent. When issues come up where we can see the need to stand up for the innocent, we should clearly make our voices heard and cast our votes. Without getting into the issue, the Christian’s motivation for voting pro-life should be to protect the innocent. However, are most of the issues before us really about protecting the innocent? Or are they about making it easier for us to be Christian’s, or trying to get others to be more moral? Jesus said that if someone asks for your robe to give it him and more, and if someone asks you to go a mile with them, go two. I don’t believe this is just for individuals. The political implication: the church should be taking every opportunity to defer to the desires of the people around them.

Follow

Get every new post delivered to your Inbox.