My exploration of Software as a Service (SaaS)
11/05/2025
Mike is the inventor and architect of Pipi and the founder of Ajabbi.
This project is for people who speak different languages and write in various directions (left-right, right-left, vertical).
It is possible, however, how well that works with AJAX has yet to be discovered.
11/04/2025
Mike is the inventor and architect of Pipi and the founder of Ajabbi.
InfoQ is among the best.
11/05/2025
Mike is the inventor and architect of Pipi and the founder of Ajabbi.
InfoQ must be the best website I have come across in many years for broad vendor and language-neutral coverage on;
11/05/2025
Researchers have just released hacker-proof cryptographic code - programs with the same level of invincibility as a mathematical proof.
Programmers are human, but mathematics is immortal. By making programming more mathematical, a community of computer scientists is hoping to eliminate the coding bugs that can open doors to hackers, spill digital secrets and generally plague modern society.
Now a set of computer scientists has taken a major step toward this goal with the release today of EverCrypt, a set of digital cryptography tools. The researchers were able to prove — in the sense that you can prove the Pythagorean theorem - that their approach to online security is completely invulnerable to the main types of hacking attacks that have felled other programs in the past. “When we say proof, we mean we prove that our code can’t suffer these kinds of attacks,” said Karthik Bhargavan, a computer scientist at Inria in Paris who worked on EverCrypt.
EverCrypt was not written the way most code is written. Ordinarily, a team of programmers creates software that they hope will satisfy certain objectives. Once they finish, they test the code. If it accomplishes the objectives without showing any unwanted behavior, the programmers conclude that the software does what it’s supposed to do.
Yet coding errors often manifest only in extreme “corner cases” - a perfect storm of unlikely events that reveals a critical vulnerability. Many of the most damaging hacking attacks in recent years have exploited just such corner cases.
“It’s some cascading failure, and it’s hard to systematically find because [the events leading to it] are individually all very unlikely,” said Bryan Parno, a computer scientist at Carnegie Mellon University who worked on EverCrypt.
By contrast, Parno and his colleagues have specified exactly what their code is supposed to do and then proved it does that and only that, ruling out the possibility that the code could deviate in unexpected ways under unusual circumstances. The general strategy is called “formal verification.”
“You can reduce the question of how code behaves into a mathematical formula, and then you can check if the formula holds. If it does, you know your code has that property,” said Parno.
Because it’s practically impossible to formally specify the function of complex software such as a web browser, researchers have instead focused on programs that are both critical and amenable to being defined mathematically. EverCrypt is a library of software that handles cryptography, or the encoding and decoding of private information. These cryptographic libraries are innately mathematical. They involve arithmetic with prime numbers and operations on canonical geometric objects like elliptic curves. Defining what cryptographic libraries do in formal terms is not a stretch.
Work on EverCrypt began in 2016 as a part of Project Everest, an initiative led by Microsoft Research. At the time — and still today — cryptographic libraries were a weak point in many software applications. They were slow to run, which dragged down the overall performance of the applications they were a part of, and full of bugs. “I think there’s been some realization from app developers that there’s a disaster waiting to happen,” said Jonathan Protzenko, a computer scientist at Microsoft Research who worked on EverCrypt. “The software world is ripe for something new that does provide [EverCrypt’s] guarantees.”
The main challenge to creating EverCrypt was developing a single programming platform that could express all the different attributes the researchers wanted in a verified cryptographic library. The platform needed the capacity of a traditional software language like C++ and the logical syntax and structure of proof-assistant programs like Isabelle and Coq, which mathematicians have been using for years. No such all-in-one platform existed when the researchers started work on EverCrypt, so they developed one — a programming language called F*. It put the math and the software on equal footing.
“We unified these things into a single coherent framework so that the distinction between writing programs and doing proofs is really reduced,” said Bhargavan. “You can write software as if you were a software developer, but at same time you can write a proof as if you were a theoretician.”
Their new cryptographic library provides a number of security guarantees. The researchers proved that EverCrypt is free of coding errors, like buffer overruns, that can enable hacking attacks — in effect, provably ruling out susceptibility to all possible corner cases. They also proved that EverCrypt gets the cryptographic math right every time — it never performs the wrong computation.
But the most striking guarantee EverCrypt makes has to do with an entirely different class of security weaknesses. These occur when a bad actor infers the contents of an encrypted message just by observing how a program operates.
For example, an observer might know that an encryption algorithm runs just a little faster when it adds “0” to a value and just a little slower when it adds “1” to a value. By measuring the amount of time an algorithm takes to encrypt a message, an observer could start to figure out whether the binary representation of a message has more 0s or 1s in it — and eventually infer the complete message. “Somewhere deep in your algorithm or the way you implement your algorithm you are leaking information, which can completely defeat the purpose of the entire encryption,” said Bhargavan. Such “side-channel attacks” were behind several of the most notorious hacking attacks in recent years, including the Lucky Thirteen attack. The researchers proved that EverCrypt never leaks information in ways that can be exploited by these types of timing attacks.
Yet while EverCrypt is provably immune to many types of attacks, it does not herald an era of perfectly secure software. Protzenko noted there will always be attacks that no one has thought of before. EverCrypt can’t be proven secure against those, if only for the simple reason that no one knows what they will be.
In addition, even a verified cryptographic library has to work in concert with a host of other software, like an operating system and many common desktop applications, that are typically unverified, and likely will be for the foreseeable future. “We’re not targeting something as complex as a word processor or a Skype client,” said Protzenko, because it’s not obvious how you’d capture in a formal language what they’re supposed to do. “It’s hard to think about the intended behavior of those things.”
Because vulnerabilities in adjacent, unverified programs can undermine a cryptographic library, Project Everest aims to surround EverCrypt with as much verified software as it can. The overarching goal of the initiative is to complete a fully verified implementation of Hypertext Transfer Protocol Secure (HTTPS), the software that secures most web communication. This will involve half a dozen individual software elements like EverCrypt, each of which is formally verified to work on its own and all of which are formally verified to work together.
“Project Everest is trying to build out a larger stack of software that’s all been verified and verified to work together. Over time we’re hoping the frontier [of verified software] will continue to grow,” said Parno."
My first steps into the world of ontologies.
11/05/2025
Mike is the inventor and architect of Pipi and the founder of Ajabbi.
"In computer science and information science, an ontology encompasses a representation, formal naming, and definition of the categories, properties, and relations between the concepts, data, and entities that substantiate one, many, or all domains.
Every field creates ontologies to limit complexity and organize information into data and knowledge. As new ontologies are made, their use hopefully improves problem solving within that domain. Translating research papers within every field is a problem made easier when experts from different countries maintain a controlled vocabulary of jargon between each of their languages.[1]
Since Google started an initiative called Knowledge Graph, a substantial amount of research has gone on using the phrase knowledge graph as a generalized term. Although there is no clear definition for the term knowledge graph, it is sometimes used as synonym for ontology.[2] One common interpretation is that a knowledge graph represents a collection of interlinked descriptions of entities – real-world objects, events, situations or abstract concepts.[3] Unlike ontologies, knowledge graphs, such as Google's Knowledge Graph, often contain large volumes of factual information with less formal semantics. In some contexts, the term knowledge graph is used to refer to any knowledge base that is represented as a graph." - Wikipedia
30/05/2025
Mike is the inventor and architect of Pipi and the founder of Ajabbi.
From the website ..."Roger Sessions is the world's leading expert in IT Complexity Analytics. He has been interviewed by ComputerWorld, CIO, Information Age, and Information Week, among others, and is often quoted by Gartner and other industry pundits. For more than a decade, his books and white papers have defined the field of IT Complexity Analytics. He has been honoured as a Fellow of the International Association of Software Architects for his many contributions to the field. His SIP methodology is the gold standard for Complexity Management, and is the only approach to simplification that has ever been granted a U.S. patent."
Training is available at RogerSessions.com
11/05/2025
Mike is the inventor and architect of Pipi and the founder of Ajabbi.
"Chris Richardson is a developer and architect with over 20 years of experience. He is a Java Champion and the author of POJOs in Action, which describes how to build enterprise Java applications with POJOs and frameworks such as Spring and Hibernate. Chris is the founder of the original CloudFoundry.com. He now spends his time providing microservices consulting and training and working on his third startup, Eventuate, Inc. Chris has a computer science degree from the University of Cambridge in England and lives in Oakland, CA."
From the home page ..."Microservices - also known as the microservice architecture - is an architectural style that structures an application as a collection of services that are
The microservice architecture enables the continuous delivery/deployment of large, complex applications. It also enables an organization to evolve its technology stack."
Application architecture patterns
Decomposition
Deployment patterns
Cross-cutting concerns
Communication style
External API
Transactional messaging
Service discovery
Reliability
Data management
Security
Testing
Observability
UI patterns
A note to myself as I ponder what is next to do.
18/04/2025
Mike is the inventor and architect of Pipi and the founder of Ajabbi.
Having completed a crash course in DevOps over the last few months, the next task is setting up DevOps as part of the stack before I go any further.
So far, I haven't even needed to use formal version control with the refactoring. Over the last 18 months, it was pretty much "snip snip snip" into microservices with a bit of a tidy-up along the way. All looks good, and it works roughly.
But it is a very different story now, getting it ready to deploy to the cloud so people can use it.
What am I looking for when setting up DevOps?
I prefer to go open-source, with a command line and a good GUI available, and be well-documented. So what is out there?
11/05/2025
In What’s a service—part 1? I described the key aspects of a service, including its API and dependencies. A good way to document a service and its structure is to use a microservice canvas. A microservice canvas is a concise description of a service. It’s similar to a CRC card that’s sometimes used in object-oriented design.
I first read about the canvas in a 2017 DZone article by Matt McLarty and Irakli Nadareishvili. I’ve since adapted its structure so that it emphasises the interface (top of the canvas) and the dependencies (bottom of the canvas) and de-emphasises implementation (middle of the canvas).
Here is an example of a microservice canvas. It describes the Order Service, which is part of my book’s example FTGO application.
The service’s external view is described by the following sections:
The canvas can also describe the service’s implementation, such as its domain model.
11/05/2025
Mike is the inventor and architect of Pipi and the founder of Ajabbi.
"I am an author, speaker… essentially a loud-mouthed pundit on the topic of software development. I work for ThoughtWorks, a software delivery company, where I have the exceedingly inappropriate title of “Chief Scientist”. I’ve written half-a-dozen books on software development, including Refactoring and Patterns of Enterprise Application Architecture. I write regularly about software development on martinfowler.com.
My main interest is to understand how to design software systems, so as to maximize the productivity of development teams. In doing this I’ve looked to understand the patterns of good software design, and also the processes that support software design. I’ve become a big fan of agile approaches and the resulting focus on evolutionary software design. I don’t come up with original ideas, but do a pretty good job of recognizing and packaging the ideas of others, or as Brian Foote describes me “an intellectual jackal with good taste in carrion”. - martinfowler.com
