Wish List
Tags
adobe air ajax coldfusion examples ext flex javascript max2007 misc technology ui
Recent Entries
Adobe Releases Flash 10 (beta)
Adobe Needs Your Feedback - Enter to win a prize!
A Question of Speed
It's a BOY!
Unit Testing Functions that Access Web-Services
Search
RSS
Subscribe
Curl VS Adobe Air
On April 14 Infoworld released an article titled "Curl moves to take on Adobe Air in offline RIA business".
The article introduces Curl as "the latest vendor looking to garner part of the expanding offline RIA business". Curl also claims to provide an engine that "provides high performance, rich graphics, enterprise security constraints that enterprises need to run RIAs on the desktop."
Curl further claims that they offer stronger performance than AIR. Typically claims like this are substantiated in some way with either technical white papers with fancy benchmarking graphs or with executions times and what not.
I decided to head over to Curl and nose around a bit
A downloaded-and-installed application is not like a webpage. You want to be able to visit the webpages of strangers safely. But you won't install software from people you don't trust. There are multiple sandboxes in AIR. A certificate helps establish the identity of someone, but is <a href="http://www.google.com/search?q=verisign+microsoft+... panacea</a>.
This seems to be the most objectionable paragraph: <em>"The resulting situation will be a bonanza for criminal hackers. AIR will become the first truly cross-platform tool for distributing malicious applications. Macintosh and Windows, home and business computers will all be equal-opportunity targets for Trojan horse attacks, keystroke loggers, etc., truly realizing the dream of "write once, hack everywhere!""</em>
If he read a little more, or opened himself up to feedback, he might not be predicting that large numbers of people will suddenly start installing applications from people they don't trust.
tx, jd/adobe
I can understand your skepticism about Curl, but the claims we make have been substantiated not only by our own engineers but also by Sonta software. You can read their data on performance here ( http://www.curl.com/knowledge-center/technology-st...).
However, I'm sure that's probably not going to be convincing enough so I have a suggestion: Lets have a 3rd party we can both agree on test out our claims that Curl Nitro is both more secure and provides better performance than Adobe AIR. That way people can take the information and judge themselves. I know we are game but I'm betting that Adobe would never take that challenge because you know we are right - or at least you suspect we are right.
The fact is that Adobe AIR is a step backward when it comes to security and performance for desktop applications. AIR offers no additional protections beyond regular desktop installation of arbitrary applications. Yet you encourage people to download the AIR applications built by other people and "self signed" which is kind of like no singing at all. AIR does nothing to advance the security architecture for downloaded applications. Curl on the other hand allows you to use the same runtime for both secure RIA applets and desktop applications. Curl is also much faster. In fact, we found Curl to be 10 times faster at compressing JPEG files, for example, than ActionScript 3.
Again, if you want to challenge our claims than why don't we hire a respected 3rd party that we both agree to test those claims. We can release their findings about security and performance to the public so people can judge for themselves. What do you say?
I really don't understand why does this Curl project has to have this kind of attitude. This product is destined for developers, and developers read and research products before they try to adopt them.
No sensible developer would choose Curl, when AIR is free and is published directly by Adobe and it's on it's way to becoming the defacto solution for Flash offline RIAs, especially if the company that is developing Curl resorts to lowly behavior of trying to smudge and attack an other company in order to promote their own greedy product.
These tactics might work on consumers, but developers are usually smarter than that, and can see right through a greedy companies false and pointless claims.
What exactly is "lowly" about defending our own claims? Is it "lowly" to ask for a 3rd party to judge the products?
This blogger said our claims are "empty words". I've simply asked Adobe to step forward and allow us to choose a neutral third party to validate our claims. We say that Curl is (1) better preforming than Adobe AIR and (2) Curl is more secure. How is that "lowly"? I don't understand. Can you explain your comment?
Don't you believe in fair competition? Are we not allowed to differentiate ourselves from our competitors? Is it wrong to point out the virtues of our own product?
Richard
It seems that you lack some reading comprehension, as you lack the ability to understand what AIR is. If you read my previous comment I stated that "lowly behavior of trying to smudge and attack an other company" NOT "lowly behavior of trying to prove their claims". Lowly behavior is trying to focus on the "bad" characteristics of a competitive product. It makes no sense for a developer, since it's usually something that each developer will find out by him self, after testing the product.
Aggressive marketing, although it has it's uses in some areas, doesn't work for a development tool. It's pointless for a third party to test the security, since that is something that is the lowest priority for a developer. As a developer I care about the easiness of transition, about penetration of the platform, about support and of course about cost.
Might I suggest you leave the childish "mine is better that yours" attitude and actually focus on building a better product and let the developers be the judge of the pros and cons of each platform. Because no intelligent developer will just take your word for it and leave it at that.
p.s. at your product features page ( http://www.curl.com/products_features.php ), at the comparison chart, Flex/Air does everything that you have put a dash, except H/W 2D,3D
Thank you for your comments. I do tend to disagree with your claim that AIR is a step backwards. If AIR offers no additional protections beyond regular desktop installations than at the very least would I say that in the realm of desktop applications it isn't a step forward. But, AIR provides web-developers the ability to create desktop applications, and that is a huge step forward (in my opinion). Web developers now have the ability to, with the same, or similar technology, build an application that releases them from the prision that is the web browser. For many web developer solution providers this opens up a whole new revenue stream that they didn't have access to before.
At least from my understanding Adobe never claimed that they were going to build a desktop runtime to allow web developers to build safer desktop applications. They have delivered exactly what they have claimed, the abilty for web developers to create desktop applications.
As for your performance white-paper, I would like to suggest that it be made publicly available without the need to sign up. Additionally, I was in no way challenging your claims I was simply looking for substantiation. To date I havent seen any performance claims by Adobe concerning AIR but I will go out on a limb here and say that mileage will vary greatly depending on whether an app is built using Ajax technologies or Flex and naturally by developer ability.
Lastly, just for the record. I am in no way affliated with Adobe, sure my blog is about 90% Adobe technologies but not because I work for them but because they work for me.
LOL !!!
"I am in no way affliated with Adobe, sure my blog is about 90% Adobe technologies but not because I work for them but because they work for me."
That's so relatable for me .. I get the sarcastic "do you work for Adobe?" all the time :P
I think its fine that you don't find security interesting, but I know you don't speak for other developers. I think it's likely that you are very young and have not seen the consequences of a poor security architecture so I will forgive that naiveté.
As far as our focus goes, we already have a better product in many ways. Adobe Flash is great for animations and multi-media and its pretty good at the GUI stuff as well, but Curl has a better story in terms of security and performance and to many people, including young developers, that's important.
All the best,
Richard
I can see the value for existing Flash/Flex developers in terms of opening a new market (i.e. desktop). It makes sense for those folks to embrace AIR.
Still AIR, to put it mildly, is dangerous. There is a technical and social engineering aspect to this.
Technically AIR doesn't provide a sandbox for its desktop applications. After all we've learned with RIA and the importance of sandboxes going back to a permissive security model is, IMO, a step backward. Why not improve the desktop model by bring better security to that environment too? That's what Curl does and Adobe AIR should have done the same. Sadly, AIR is so permissive that you can essentially "write once, hack anywhere" with the Adobe AIR platform. Good for hackers, bad for everyone else.
From a social engineering perspective Adobe is actually training end-users to trust anything for download to their desktop. Let me ask you a question (others can think of this as well) how many self-signed applications where the Publisher is "UNKNOWN" have you downloaded? I suspect a lot. This is all well and good right now because applications are coming from Adobe Market place for the most part, but as the ecosystem around AIR grows AIR applications will be downloadable from everywhere. Adobe is training end-users to trust any AIR applications and that's bad. It's not to say that end-users are stupid, but security experts will tell you that end-users exercise very poor judgment when it comes to assessing the security risk of an application.
With Curl all applicaitons are sandboxed even those on the desktop. The only exception are fully privilages applications for which MUST be signed by a valid certification authority (e.g. Versign) and for which you have to aquire a special license from Curl. We don't make it easy to do fully privaged applications because the security risk is too high.
With Curl Nitro you can run RIA applications and desktop applications that both have access to their own section of the disk can use a SQLite database, BUT do not have access to user directories which is how rootkits and spyware get installed.
Sorry for mixing you up with the dozens of Adobe AIR/Flex evangalists that Adobe has hired - there are so many of them on the payrole its easy to assume that someone with your focus is an Adobe employee.
All the best,
Richard
Sorry, both AIR and Curl, you aren't getting on my desktop...
Thanks for your comment. I don't think this is a brawl but just one competitor pinpointing their strengths compared to another.
As I understand it, AIR applications are interpreted by either a modified Flash runtime or embedded Ajax environment. This is very different from Curl. Curl applications run in their own process, separate form the browser, and are compiled into native code so that they run at native speeds.
I don't think that either AIR or Curl is built on .NET - you may be thinking of Silverlight which is a Microsoft RIA product.
All the best,
Richard
However, to me, the real advantage to Curl (which indeed is not built on top of .NET) is not its performance, but the power and expressiveness of the Curl language. I rarely find myself confined by the limits of the language, and when I do, I usually write some macros to extend the syntax. Curl is a hybrid language that can just as easily express textual content (all our documentation is actually written in Curl), data or code. I am biased, of course, but there is no other language that I would wish to code in.
Regarding the cost. The Curl RTE and IDE are free although some advanced features such as profiling or coverage measurement require licensing (i.e. $$) once you have used up the free trial. Curl makes its money from licensing enterprise applications built using Curl, the Pro version of the IDE, and from maintenance. In other words, we are not trying to extort money from small developers who want to use Curl; we just want to get a fair price from business customers who want to write enterprise-class applications using Curl. That model has worked well for us in Japan and Korea, and we expect it to work here in the U.S. as well.
What you don't understand is the reach of the Flash Platform. YouTube is the third most visited site on the internet ( http://www.alexa.com/site/ds/top_sites?ts_mode=glo... ), if YouTube decided to publish an AIR app on it's page ( which it will eventually do ), then about 40-50% of the entire web population will get the AIR runtime. As hard as you try, you will never be able to beat that. So it doesn't matter if your platform is better, because there are other factors beyond your reach.
Before yesterday I haven't event heard of your company, so to me seeing your attempts to attack adobes platform, is like seeing a monkey trying to tease a tiger..it's all fun and games, but eventually you will get eaten.
1) Adobe takes security and privacy quite seriously, and has a history of applying the conservative approach. If you see a specific potential concern with any Adobe technology, then we'd really like to know about it, thanks:
http://www.adobe.com/support/security/alertus.html...
2) I haven't seen anyone at Adobe disparage Curl... the general attitude I see here is that if another group can satisfy needs that Adobe cannot, then that's all to the benefit of the overall publishing ecology. It's pretty clearly not a zero-sum game.
3) It may be corny to quote Dale Carnegie, but these basic principles still apply:
http://www.amazon.com/dp/0671723650
jd/adobe
Ive added that book to my wish-list (http://www.amazon.com/gp/registry/wishlist/18MOTJO...)if anyone wants to buy it for me :) We can all use a few pointers now and then!
Cheers and thanks for all of your input and comments, it's been an interesting read the last few days.
Admittedly i have not read all of the comments here. Frankly i'd rather spend this beautiful day playing frisbee at the park. But I do feel like just stating basically what I told Richard after he gave me a product demo with the "performance" spiel.
If you're going to make these performance comparisons then you should make two applications. One AIR and one CURL that do the same thing and show off performance in various scenarios (data load, 3d, etc...). Then provide the source code for both applications.
An after thought I had about it is make an awesome application that uses curl. Showing me a demo of a spinning DNA strand will get you no where when courting flash/flex developers. Its hot but I want something more substantial if we're going to be in it for more than a one night stand.
Adobe and the dev community is constantly showing me hot and substantial AIR/Flex applications. To me the idea of taking on Silverlight and AIR head on like in your curl.com home page airplane animation analogy (btw done using flash) is comical in a very sad way. You know Ha Ha sad, not Ha Ha funny.
So pony up some applications done in CURL people want to use. Not because its CURL but because they’re cool and useful applications. And show some clear differences on why CURL is better because it fulfills some needs AIR developers have but are not getting. Then maybe we’ll consider putting it on our ever growing tool belts.
On the plus side I did mention that the Adobe always buys the beer and they offered to take me out for one after the show. I wasn’t able to take them up on it but its a good first step in any developer relationship.
Off to the park. -s
BTW, I don't see what's wrong with using a Flash animation on our website. That is definitely one thing that Flash is quite good for and there is no doubt that the Flash player is on pretty much everyone's desktop. I do think it is a bit unfair to put Silverlight and AIR in the balloon with AJAX, they should at least get a propeller plane ;-)
First, the Curl blog was originally set up so that you had to be a member of the Curl developer site in order to post a reply. Since this was obviously a problem for discussion of my post, as pointed out by John Dowdell, we have reconfigured it so anybody can add comments, and several comments have now been added there.
Second, John asked for a specific statement of what we think Adobe should do, and I have addressed that in a comment on my Curl blog post. You can read the full comment there, but the short summary is that by far the best solution is to provide a safe, sandboxed execution mode for installed desktop applets, rendering the entire signing discussion moot for those applets. For an appropriately constructed sandbox, I believe that the vast majority of the Adobe AIR Showcase and Marketplace applications could in fact run in this safe mode, which would be the best solution for everybody.
Finally, I in no way intended to disparage AIR with my mention of "gadgets," which I think are an increasingly important way of delivering useful bits of functionality to users, nor did I intend to imply that AIR is good for nothing more than gadgets, though I do think that runtime performance will be an issue in many cases when attempting to replace functionality that is currently delivered by traditional installed applications. I just think, again, that when people are grabbing lots of little bits of functionality from here and there and installing them as desktop gadgets (or applications, or whatever we want to call them), the importance of providing an installation model that limits the cost of errors or oversights by unsophisticated or inattentive users will increase.