In web domain, web services are meant to facilitate the communication between two different platforms over the internet. We can easily exchange data between various applications by making use of this technology and there are so many ways to implement it. The security of web services is equally important as its implementation. The most widely and frequently used kinds of web services are SOAP and REST.

Securing SOAP web services:

SOAP was not designed with security in mind; SOAP messages can be viewed or modified by attackers as the messages traverse the Internet.  The most basic thing to be done to secure a web service is to implement SSL over the channel. As a result, the message gets encrypted and difficult to understand for a third party who is monitoring the data transmission over the wire.

Next step is to authenticate the sender of the message. WS-security is the best protocol/framework that can be used for the authentication, message integrity and message encryption. It is a security architecture introduced by IBM, Microsoft and VeriSign, which introduced the concept of security headers.

Hence WS-Security describes how to Sign SOAP message, how to encrypt SOAP message and also shows how to attach security tokens to make sure of the sender's identity.

A SOAP header element <Security> is the entry point to WS-Security. It holds the security-related data and information for implementing mechanisms like security tokens, signatures or encryption. This element can be present as many times targeting different receivers. The <Security> element is declared with the use of another element <role> which specifies the type of recipients for which the message is intended for. These are implemented in different header blocks, i.e. if a <role> value is specified for a header then that message can be consumed by only those having the privilege. A header without a <role> value can be consumed by anyone.  

By signing a SOAP message it ensures message integrity, i.e. the recipient can be certain that the message he received has not been altered during transmission. This is achieved by the use of XML signature specification, which defines the methodology for cryptographically signing XML. The element <Signature> will be used as a security header. The signature is created based on the SOAP message content and the security token; hence the chance of being hacked by external party is less.

Encrypting the SOAP message gives assurance that the data cannot be read during transit. Here XML Encryption specification is used for encrypting SOAP message content. All the portions including headers, body blocks, and substructures, will be encrypted. Encryption and Decryption is done using symmetric keys shared by the sender and receiver.

Benefits to the user:

User data like credit card information, passwords will be secure and no third party interference is possible herewith. The site will be trust worthy and reliable due to the implementation of the web service security. If your application requires the customer to share sensitive information, it is very important that all the necessary measures are taken in order to secure this data. By implementing web service security we can assure the users that their data is encrypted and not vulnerable to external attacks. 

As developers who work with the Flash platform, we like to point out a few of our observations.

HTML5 promises to bring rich interactive web in the future. Object animation, tweening effects, and video that have long been the domain of Flash. One of the upcoming features of HTML5 which is considered as  a Flash killer is the new video tag. You can view the videos without a flash player plug-in !!

But there is a  formidable hurdle to cross.  Browser vendors cannot get to agree on which codec the video tag will support. “Ogg Theora” was the recommended standard video format in HTML5 and now will support H.264 video codec.

Firefox, Opera and Chrome support the Ogg Theora/On2 VP3codec. Safari, IE 9 and Chrome supports the newer H.264. All major browsers support either of the two codec. YouTube is already showing some videos in HTML5.

Ogg Theora is an open and royalty-free codec, but it is not as efficient as H.264. Google’s Chris DiBona stated that if Youtube were to use Theora as its codec, it would take up most of the available bandwidth on the internet.

Mozilla has also problem with H.264 codec because it would violate the principles of free software.

And there are few questions; Do we have facility to videoconferencing in HTML5? Do we have facility to live audio/video recording in HTML5? Are we able to add dynamic objects over the video? Can one add captions for the video?

HTML5 standards are yet to finalize and formulating them would take time. This would mean a lot of pain for the web designer / programmer over browser compliance.

HTML 5 is a programming language which needs to be interpreted by the browser. It is up to the browser to interpret that language and display the content. If the browser can't render the code, strange things start to happen in the display. Different browsers on different platforms interpret the code differently and browsers display the content as they see fit. Until HTML 5 gets standardized, each browser will interpret it differently.

Here are some lines from Lee Brimelow’s blog

“Now this is not to say that in the future, maybe they will all agree on an implementation. If that happens and it performs better than Flash, then that is how I will be delivering my videos as well. But another thing to point out is that Flash video is used for a lot of things beyond basic playback. Flash supports embedded cue points and alpha channels and is often used in ways beyond the traditional YouTube playback scenario. So while HTML 5 video looks promising, it is clearly way too early for people to be writing an eulogy for Flash video. Remember also that while the browsers get their acts together, Flash video will continue to evolve as well.”

Let us look through the flash gaming industry. Sony has sold 33.5 million playstation 3 units, Microsoft moved 40 million X-box 360 units, Nintendo 70 million and Farmville alone has 80 million active users.

Flash has so many attributes which cannot be easily replicated in HTML5.

Speed – ActionScript 3 Flash is so much faster than current Javascript implementations with the use of new Action script Virtual Machine 2.

Preloading – In flash it is byte-level preloading but in HTML5 it is object-level preloading.

Tweening and timeline animation – It is not easy to create time animations and tweening in HTML5.

Flash games can easily distribute as a single swf file and converted in to desktop applications using Adobe AIR.

Testing Flash and HTML5

Jan Ozer, an expert in video encoding technologies recently put HTML5 up against Flash in a series of tests that pitted the two  against  each other on both the Mac and PC and on web browsers including Internet Explorer 8, Google Chrome, Apple Safari and Mozilla Firefox.

Mac Tests

The much awaited HTML5, the major revision of HTML, is expected to take over the world wide web by the end of 2010. It is considered to be the major replacer for HTML 4.01, XHTML 1.0. The most notable feature of HTML5 is its big foot over the plug-in-based rich internet application (RIA) technologies such as Adobe Flash, Microsoft Silverlight, and Sun Java FX. The reason is that, HTML 5 can do whatever these applications can, in a perfect manner with its powerful set of tags and related attributes. If it is about the origin of HTML5, it’s a different story.

The core developers of HTML, the W3C was found to focus much on XML and XHTML rather than looking forward to real world application needs. The HTML working group felt disturbed over this and they formed a new group called Web Hypertext Application Technology Working Group (WHATWG).It focused purely to evolving web and its future .This group is the core team behind HTML5 and maybe that is why HTML5 is not a W3C recommendation yet. The latest news from Adobe Dreamweaver is that the new version Dreamweaver CS5 will be supporting the HTML5 and CSS3 in its full flavours.

Now looking over to HTML5 and conventional HTML, the following are the basic changes as an overview.

1) Simple DOCTYPE

 HTML5 requires very simple DOCTYPE: <!DOCTYPE html>.

2) Easy attributes for language

In HTML5 we don’t need to remember xml:lang attributes in the <html> tag. <html lang=”en”> will now make it work.

3) Trailing slashes taken off

Void elements in HTML5 such as the br, img and input elements don’t require a trailing slash.

4) Elements disappeared

These are the following set of element not supported in HTML5:

<acronym>, <applet>, <basefont>, <big>, <center>, <dir>, <font>, <frame>, <frameset>, <noframes>, <s>, <strike>, <tt>, <u> and <xmp>

New tags on deck

HTML5 Introduces, a very distinct set of powerful new tags.

·         audio – denoting an audio stream
·         source – the video or audio source files
·         video – denoting a video stream
·         canvas – a place to draw dynamic graphics
·         command – denotes a command button that has information sent to the server or script
·         datagrid – references dynamic data in a tree form or tabular data form
·         datalist – references a list of data in a drop-down list
·         details – provides additional details of a page element, like pop-up help text
·         output – references the output of a script or calculation
·         progress – represents a progress bar in the completion of a process
·         dialog – a conversation or people talking
·         hgroup – a grouping of header tags that should stay together
·         meter – a scalar gauge of measurement
·         time – a date or time

Features

High level of user privilege is the most highlighted feature of HTML5.The very new set of tags plays a crucial role for this achievement. . Of all tags  <video> takes the videos through web to a new level. HTML 5 video ensures maximum reach by allowing you to encode your video in as many formats as you need, so that your customers don’t need an additional plugin for viewing the video. It also lets you control every aspect of your video, from who can view it, how long it is, what the content is, where it's hosted and how the server performs etc as far we know till now.

Considering the Browser side, Google chrome, upcoming IE9, Apple safari, firefox 4.0 etc   are all set up for providing a perfect support for HTML5 pages.

Drawbacks

Some of the drawbacks pointed against HTML5 are based on hosting HTML5 videos to sites like youtube. They are

·         Encoding of video in at least three different codecs is needed
·         Browsers that don't support HTML 5 will work only with the aid of some set of java scripts
·         Bandwidth requirements of hosting videos must be satisfied

Another problem developers have to face is the conversion of XHTML 1 to HTML5, unless we have a well formed and valid XHTML document

HTML Team @ Software Associates