BillDay.com » Security http://billday.com Sun, 05 Feb 2012 10:59:00 +0000 en hourly 1 http://wordpress.org/?v=3.3.1 Android Open 2011 Highlights http://billday.com/2011/11/14/android-open-2011-highlights/ http://billday.com/2011/11/14/android-open-2011-highlights/#comments Mon, 14 Nov 2011 22:07:06 +0000 Bill Day http://billday.com/?p=3830 This October I was able to attend both the O’Reilly Android Open (@androidopen) and X.commerce Innovate conferences back-to-back in San Francisco. I wrote more about Innovate in a separate DevZone article. This time, I’d like to break down the most interesting bits of Android Open from a developer-centric perspective.

Fascinating morning keynotes

Android Open was jam packed with activities including a pre-conference day of workshops and then two days of main conference. Each morning of the regular conference began with a series of five to twenty minute long keynote talks and panels. You can see a complete listing of the speakers for both days in the conference schedule. You can also watch the keynote sessions via the Android Open 2011 Youtube video playlist (click here to access). I would encourage you to watch as many of the keynotes as possible; they contain a lot of interesting and inspirational material to get your Android juices flowing!

O’Reilly founder & CEO Tim O’Reilly (@timoreilly) kicked things off with his Day 1 opening keynote “What Android can learn from Steve Jobs“. Definitely an interesting choice of title for an Android conference! But Jobs’ passing the week before presented O’Reilly with an opportunity to discuss some of the key principles behind Apple’s success, especially the notion espoused by Jobs that a company needs to be “true to its soul”. O’Reilly examined Google’s “soul” at length, suggesting that it needs to never forget its original mission to help connect people to all the world’s information. Key takeaway for Android developers and businesses: Stay true to yourself and your mission while holding Google to its own high ideals, too.

The next keynote that caught my attention was a conversation between conference co-chair Marko Gargenta (@markogargenta) and Robert Stephens (@rstephens), CTO of Best Buy. Stephens is a pretty technical guy, even going so far as to say that Best Buy ought to get rid of their DVD section and replace it with an Arduino section! As you might imagine given the crowd, this was well received.

The thing that really stood out for me as a mobile payments developer, however, was Stephens’ discussion of the many issues with NFC deployment. He said Best Buy may bypass at least some NFC generations completely, going straight to purely cloud-based payments solutions. This joins the rising tide of anti-NFC sentiment and pragmatism that seems to be building, and echoes some of the many things PayPal has said publicly about NFC weaknesses in recent months. Takeaway: Watch major retailers such as Best Buy closely to pick up the beginnings of big shifts in mobile payments.

Day 2 saw a couple more morning keynotes that stood out for me. The first, “Android in Space” by Will Marshall (@wsm1) of NASA, dealt with building very cheap microsatellites based upon Android-based Nexus One smartphones, aka “phonesats“. “Very cheap” in this case means tens of thousands versus millions or billions of US dollars.

Marshall noted that because of the conservative nature of space flight, the CPU in phonesat Nexus Ones will actually be the fastest CPUs onboard a satellite to date when they’re launched into orbit later this year. He also asked the audience some provocative questions such as “What if we could each have personal satellites?” and “What if satellites became a software domain?”. Thing to note: Android software and off the shelf mobile phone hardware can reduce costs in some areas by two or more orders of magnitude versus traditional ways of doing things, and that could change everything in those areas.

You can read more about the phonesat project from this report from O’Reilly correspondent Alex Howard (@digiphile). Among other things, Alex links to an excellent documentary on early phonesat rocket launch testing.

The final keynote that fascinated me was “The African Laptop Killer: Android and the Developing World” by Claire Hunsaker (@chunsaker). Hunsaker discussed the tremendous rise of mobile technology in Kenya and elsewhere and how that technology is revolutionizing lives and economies. Some of the statistics quoted include:

  • 99% of Internet access in Kenya is via mobile device.
  • Cheap Android phones have dropped Internet access in Kenya from 31% of an average worker’s annual income to about 5%.
  • Fully 20% of Kenyan GDP runs through the mobile wallet (predominantly M-PESA).
  • According to Hunsaker, “Facebook will have access to most (Kenyan) users before thy can even own a mobile handset themselves” via borrowed/shared mobile handsets.

Please watch Hunsaker’s talk. It may change your perspective on the power and importance of mobile techologies.

Session highlights

There were a lot of great sessions at Android Open. Here are some notes from my favorites:

  • Aleksandar Gargenta (yes, Marko is his brother) presented an excellent “Securing Android” session discussing how security is enforced. He made a number of comparisons to Java ME and desktop Linux security, noting that “Anytime something is in RAM, there are ways of recovering it”. I’d recommend spending a little time reading through Aleksandar’s slides (click here).
  • Eric Burke (@burke_eric) from Square gave a nice “Beautiful Android” talk. I’d been hoping for a few payments fireworks, but Burke stuck closely to how to build attractive and functional Android apps. Among the things he noted, Android clip paths don’t handle antialiasing. This leads to very ugly interfaces unless you use offscreen bitmaps.
  • Nick Farina (@nfarina) spoke about the importance of using WebViews in “From iOS to Android” (also, XCode is painful).
  • Sean Byrnes of Flurry knocked it out of the park with his “Android App Engagement by the Numbers” talk! In particular, he called out the importance of releasing early and quickly to your followers, as statistics show that on average, an Android developer loses 38% of their users on the day they install your app, 50% in one week.
  • Jesse Vincent (@obra) talked in “Dancing App Stores” about the somewhat suprising fact that new app versions dramatically increase sales, even with minimal changes to the app itself. He also made some good suggestions on secondary and tertiary app markets besides Google’s Android Market; check out his slides for more details.

All in all, the sessions had enough code and technical details while still being able to spark ideas in a wide variety of attendees, some Android programmers, some not.

Additional coverage and news from the conference

Conference organizers made a number of other news and information sources available to attendees. You can search some of the best via these links:

One more highly recommended resource: The online show “All About Android” (@androidshow) broadcast live from Android Open at the end of Day 1. The conference co-chairs along with several speakers including Tim O’Reilly make appearances on the show. It’s probably worth your time to watch and get their perspective on the major Android developments flowing out of the conference.

Did it blend?

I found this first ever Android Open to be a great mix of community and technology. It struck the right tone of openness and provided both developer how-to and business oriented material. If you are interested in Android and appreciate a balanced perspective of the entire ecosystem, I would recommend this conference as a good place to tap into all things Android.

Click here to access the full article on X.com.

]]> http://billday.com/2011/11/14/android-open-2011-highlights/feed/ 0 Senior Web Developer position http://billday.com/2011/11/11/senior-web-developer-position/ http://billday.com/2011/11/11/senior-web-developer-position/#comments Fri, 11 Nov 2011 22:23:45 +0000 Bill Day http://billday.com/?p=3819 Passing this along for Nick Berra at Inceed. Nick has a client needing two senior Java developers for short term contract-to-hire positions.

SENIOR WEB DEVELOPER

The successful candidate will be responsible for developing, testing, enhancing and maintaining Java/J2EE applications. This role will participate in the design, development and test phases of the application development lifecycle. This is a technical role which requires object-oriented programming skills, understanding of J2EE application architecture, XML and Web application security.

Responsibilities include:

  • Develop, test, debug and document web based Java/J2EE applications in accordance with system architecture requirements.
  • Apply industry standard object-oriented programming best practices and J2EE design patterns.
  • Plan, initiate and conduct unit testing of applications as well as facilitate system testing.
  • Support and troubleshoot production applications.
  • Understand system performance associated with the introduction of new technologies.
  • Strong problem solving skills; find solid solutions to complex problems quickly.
  • As a part of a project team, share technical and product knowledge with other team members.
  • Participate in technology/tools evaluation and software technical proof of concepts.

Qualifications:

  • Bachelors Degree in related field preferred, work experience may be substituted.
  • Java certification preferred.
  • 5+ years experience in a similar role preferably in a mid-size to large corporate environment.
  • Experience with Web Content Management Systems (WCMS) a plus.

Skills and knowledge:

  • Expert knowledge of Java (J2SE and J2EE), XML, HTML, DHTML, JavaScript, CSS, PL/SQL, and open source projects (Spring, Log4j, AJAX, Subversion, Ibatis, etc.).
  • Familiarity with J2EE design patterns, software architecture concepts and web application security.
  • Excellent object-oriented programming skills and strong analytical and design skills.
  • Strong interpersonal skills.
  • Must possess the ability to read and interpret technical specifications, use case scenarios, test cases, and software requirements.
  • Knowledge and understanding of relational database design and programming using Oracle 9i.
  • Strong written and oral communication skills.

Please tell Nick I sent you if you’re interested.

]]> http://billday.com/2011/11/11/senior-web-developer-position/feed/ 0 Health Graph tip: Authorization removal callbacks http://billday.com/2011/11/10/health-graph-tip-authorization-removal-callbacks/ http://billday.com/2011/11/10/health-graph-tip-authorization-removal-callbacks/#comments Thu, 10 Nov 2011 15:43:45 +0000 Bill Day http://billday.com/?p=3810 This deauthorization callback how-to is the first of an intermittent series of tips-and-tricks posts.

The Health Graph now supports callback URLs for removal of user authorizations. You should specify your callback URL when you register your application in the Partner portal.

Here’s how it works: Whenever a user permanently disconnects your application from their RunKeeper account, the system will send an HTTP POST to the callback URL (in application/json format) with a single parameter, “access_token“, that contains the now-invalid token. The request from the Health Graph system will look like this:


POST callback_url HTTP/1.1
Host: callback_host
Content-Type: application/json
Content-Length: nnn

{"access_token":"some_token"}

where callback_url is the URL supplied during registration, callback_host is the host portion of callback_url, nnn is the length of the request body, and some_token is the revoked token.

Please refer to the Health Graph Registration and Authorization documentation for more.

Additional notes: This callback is largely intended to help out those applications that perform a lot of non-interactive processing. Because network connections can be interrupted, watching for an HTTP 401 response from a Health Graph call with a purportedly-valid token has previously been the most reliable means of detecting a user disconnection. Note that this callback is patterned after a similar callback in Facebook’s OAuth deauthorization implementation.

Questions? Please post them to the callback discussion on the Health Graph group.

Cross-posted from the Health Graph blog.

]]> http://billday.com/2011/11/10/health-graph-tip-authorization-removal-callbacks/feed/ 0 Free O’Reilly ebook “Building eCommerce Applications” http://billday.com/2011/10/13/free-oreilly-ebook-building-ecommerce-applications/ http://billday.com/2011/10/13/free-oreilly-ebook-building-ecommerce-applications/#comments Thu, 13 Oct 2011 07:24:22 +0000 Bill Day http://billday.com/?p=3752 Cover of

I’m a contributor to an O’Reilly book, “Building eCommerce Applications“, being handed out at the X.commerce Innovate 2011 conference.

The book contains four chapters by yours truly: A three part series on using and building your own PayPal-enabled plugins in WordPress, plus one chapter on the ins and outs of Bitcoin.

In order to get a print copy, you need to be at the conference and stop by the O’Reilly booth.

But no matter where you are, you can download free epub, mobi, and/or PDF copies of the ebook from O’Reilly’s site. Click here to get a copy for yourself.

I’d love to hear any feedback you have on my contributions or other parts of the book. Thanks in advance!

]]> http://billday.com/2011/10/13/free-oreilly-ebook-building-ecommerce-applications/feed/ 0 Google Wallet launches on Sprint with Citi Mastercard http://billday.com/2011/09/28/google-wallet-launches-on-sprint-with-citi-mastercard/ http://billday.com/2011/09/28/google-wallet-launches-on-sprint-with-citi-mastercard/#comments Wed, 28 Sep 2011 15:10:24 +0000 Bill Day http://billday.com/?p=3641 Google has launched their NFC-based Google Wallet payment solution.  Click here to read the announcement post.

There are some very particular requirements to use this first public release including:

  • You must have a Nexus S 4G phone on the Sprint network
  • You must pay with a Citi MasterCard or Google Prepaid Card (the latter is fundable using other credit cards)

If you have just the right hardware, network, and a workable card, trying out Google Wallet should be fairly straightforward.  According to the announcement:

In May we announced Google Wallet—an app that makes your phone your wallet—with Citi, MasterCard, Sprint and First Data. With Google Wallet, you can tap, pay and save using your phone and near field communication (NFC).

We’ve been testing it extensively, and today we’re releasing the first version of the app to Sprint. That means we’re beginning to roll out Google Wallet to all Sprint Nexus S 4G phones through an over-the-air update—just look for the 'Wallet' app.

Google's announcement also mentions that Visa, Discover, and American Express have each made their NFC specifications available, hinting that this might enable support for their cards to be added to Google Wallet at some point in the future.  Of course, that support also might not be added, who knows until it's a done deal.

For more information on Google Wallet, you can read coverage from Wired and Mashable.  You can also watch Google's launch video embedded in the announcement (click here to watch on Youtube).

I've written a fair amount about mobile wallet competition over the last year. In my opinion, it's too early to call the ultimate winners and losers. But with Google Wallet, Google is clearly in the game with PayPal. It will be very interesting to see how Wallet plays out versus PayPal's all encompassing vision and solutions.

Who do you think has the advantage, if any, in the mobile wallet wars?  Please leave a comment on the complete X.com post.

]]> http://billday.com/2011/09/28/google-wallet-launches-on-sprint-with-citi-mastercard/feed/ 0 Notes from the week of 2011-09-25 http://billday.com/2011/09/25/notes-from-the-week-of-2011-09-25/ http://billday.com/2011/09/25/notes-from-the-week-of-2011-09-25/#comments Sun, 25 Sep 2011 10:59:00 +0000 Bill Day http://billday.com/2011/09/25/notes-from-the-week-of-2011-09-25/

RunKeeper and the Health Graph API

PayPal X Platform

Big data

APIs and development

  • Researchers successfully hack SSL http://t.co/njh1f7vO (and use their trojan to decrypt a @PayPal authentication cookie, no less) #
  • How to supercharge your favorite web apps with If-This-Then-That http://t.co/buwzbqQQ (easier than it sounds) #
  • Note to self: Setup tweet-to-Google+ as soon as there's a G+ IfTTT channel supporting that action #
  • “Your API is not a website!” @apigee webinar video and slides http://t.co/NAthF352 #
  • "Thinking like a platform…helps your business prepare for disruptive forces you cannot possibly predict" http://t.co/V9MUOavK #

Personal things

Running

]]> http://billday.com/2011/09/25/notes-from-the-week-of-2011-09-25/feed/ 0 X.commerce Innovate conference speakers and tracks http://billday.com/2011/09/23/x-commerce-innovate-conference-speakers-and-tracks/ http://billday.com/2011/09/23/x-commerce-innovate-conference-speakers-and-tracks/#comments Fri, 23 Sep 2011 15:10:45 +0000 Bill Day http://billday.com/?p=3624 We're less than one month away from the X.commerce Innovate Developer Conference and if you're attending, it's time to start sorting out which speakers you'd like to listen to and maybe meet and discuss your questions, issues, or problems with.

The conference schedule is available online (click here to access).  The main conference runs October 12th and 13th.  There is also a special developers-only "X dev camp" slated for October 14th; if interested, you need to apply for it when you register to attend the conference.

You can also access information on all of the speakers including the session speakers as well as keynoters.  For my money, the sessions are "where it's at", so I'm studying the session speaker pages carefully to figure out whose sessions I might want to attend.

Perhaps the best way currently available to navigate and plan your conference is to look at the speakers broken out by track (click here), then click on each of those speakers to learn more.  It would be even better if there were links from the speaker pages to detailed session information, but as of now that information appears to be MIA.

Honestly, I find myself wishing that Innovate had a conference attendee session planner akin to the one that O'Reilly uses for their conferences.  For example, see the "Customize Your Own Schedule" feature in their Android Open conference schedule page to see what I mean.  (Yes, I'll be attending Android Open the same week as Innovate, so both of their scheduling features are front-of-mind for me right now.)

Will you be attending Innovate?  What speakers look interesting to you if so?

Click here to read and leave comments on the complete post on X.com.

]]> http://billday.com/2011/09/23/x-commerce-innovate-conference-speakers-and-tracks/feed/ 0 Google+ API launches for public data http://billday.com/2011/09/20/google-api-launches-for-public-data/ http://billday.com/2011/09/20/google-api-launches-for-public-data/#comments Tue, 20 Sep 2011 15:10:11 +0000 Bill Day http://billday.com/?p=3606 Google has launched the first iteration of their new Google+ API, and it's built on REST, JSON, and OAuth.

The new API was announced on the Google+ Platform blog thusly:

Google+ gives users full control over their information, supporting everything from intimate conversations with family to public showcases and debates. This initial API release is focused on public data only — it lets you read information that people have shared publicly on Google+.

The announcement provides several example API calls, including getting a user's public profile and retrieving their most recent public posts.  For more information on all of the API capabilities, click here to access the accompanying developer site including Google+ API documentation.

The announcement goes on to discuss how this first API release uses RESTful HTTP requests and JSON responses, standard payload formats, and OAuth 2 for secure access to user data such as which user is using the app.  It also links to libraries for languages including Java, Python, PHP, Ruby, and more.  Read the post for full details.

So what are developers saying about this first release?  Honestly, many aren't terribly impressed with the limited functionality available in this release.  Something's better than nothing, but by not allowing any access to information a user has marked as private to one or more of their Circles, Google has effectively neutered their API out of the gate.  It seems clear that a future release of the API must include access to Circles for the API to be viable long term.

What do you think about the Google+ API?  Useful web API goodness, or an irrelevant API for an also-ran social service? 

Please leave a comment on the complete X.com post with your thoughts.

]]> http://billday.com/2011/09/20/google-api-launches-for-public-data/feed/ 0 Notes from the week of 2011-09-18 http://billday.com/2011/09/18/notes-from-the-week-of-2011-09-18/ http://billday.com/2011/09/18/notes-from-the-week-of-2011-09-18/#comments Sun, 18 Sep 2011 10:59:00 +0000 Bill Day http://billday.com/2011/09/18/notes-from-the-week-of-2011-09-18/ RunKeeper and the Health Graph API

Wireless and mobility

Big data

APIs and development

Personal things

Running

]]> http://billday.com/2011/09/18/notes-from-the-week-of-2011-09-18/feed/ 0 Notes from the week of 2011-08-28 http://billday.com/2011/08/28/notes-from-the-week-of-2011-08-28/ http://billday.com/2011/08/28/notes-from-the-week-of-2011-08-28/#comments Sun, 28 Aug 2011 10:59:00 +0000 Bill Day http://billday.com/2011/08/28/notes-from-the-week-of-2011-08-28/ RunKeeper and the Health Graph API

PayPal X Platform

APIs and development

Personal things

Running

My weight over the last two years

]]> http://billday.com/2011/08/28/notes-from-the-week-of-2011-08-28/feed/ 0