A Peek into the AS3 and AVM2 Virtual Machine and ‘Elastic Racetrack’

PyAMF 0.3 Released and Sample on Google App Engine

A great Action Message Format (AMF) remoting kit for server side for the pythonistas is pyAMF, they recently released PyAMF 0.3 and have a sample running up on Google App Engine. There is also a tutorial for getting PyAMF running on Google App Engine. Aral Balkan got this running as well.

Features of pyAMF currently:

More on the PyAMF library:

Flash/Flex Application Proofs: Adobe Launches Photoshop Express

If there ever was a proof that more intense applications like word processors and image manipulation software are capable of being built and some aspects even better than their desktop counterparts with flash and flex then Scrapblog, Buzzword, Picnik and Photoshop Express are that (in fact Photoshop Express is a direct competitor with Picnik it seems…).  

Adobe launches Photoshop Express today to add to that set that are very usable, quality applications built with Flash9/Flex and most of all actionscript 3 (as3) and the new AVM2. These apps just weren’t possible with AS2 and with Flex they can be easily managed codebases (one major problem with old skool flash actionscript is it was throwaway many times because it was so scripter specific and full of optimizations just to barely perform – now these are actual code bases made by programmers and you see the results).  The great thing about buzzword, picnik and photoshop express are that they are easy to use. Flash/Flex make sense in their case and they tend to mimic and use very good usability patterns.There is no way an AJAX app (even though I build lots of those too) can come close to this integration of style, usability and expected results on all browsers.One important point of this article on news.com mentioning this:

The service will go live in beta test mode on Thursday. Mack said that the company intends to use the test period as a way garner feedback from customers.Adobe intends to offer more features to consumers who pay a yearly fee. Some planned features include a printing service, more storage, support for audio and other media, and the ability to read additional image file types (the service works with .JPGs now.)Adobe also plans to build an offline client using AIR (the Adobe Integrated Runtime) so that people can edit photos offline, executives said.

A couple things here.  First there is going to be an AIR version for the same experience on the web and the desktop for a major application.  Second, flash IS limited to certain file types JPG, SWF, PNG, GIF, and a few others for sound and video.  So why an online photoshop is great, it is still only web based photos, simple edits, etc.  Photographers and users above 72dpi in the 300 600 ++ ranges will still be using Photoshop.  Users with EPS,RAW, etc will still have to use Photoshop until Adobe figures a way to either proxy an image and handle the real source (be it another format) behind the scenes.  Or, improve the flash player to handle other raster and vector image types.A project a while back we had this issue where it was a approval system of media types but the types could be PDF or EPS in addition to web image formats or on occasion other formats and it became a challenge where the content was marked up with flash.  Eventually it was in a div overlay so we could load in the unsupported types behind and sync them with javascript, where flash was just a canvas or screen on top to put notes and markings.  But when it comes to editing that is different, you expect to edit. Also, working with the real source in image manipulation is extremely important so a proxy to the real image seems unlikely a good choice except for simple web uses.In any case, Photoshop Express is a great web based image tool but there are limitations that prevent it from taking any large swath of share from the normal old desktop Photoshop any time soon.

Flash Deep-Linking and the YouTubeAPI with SWFAddress

Rostislav added a sample for his excellent SWFAddress kit using the new YouTubeAPI and deep linking to parts of the video. Part of the YouTubeAPI is by Geoff Stearns (the creator of SWFObject who works at YouTube now) and allows much more script control and embedding of the youtube player (chromeless with just the video canvas).

The sample Rostislav at Asual has, shows how you can incorporate SWFAddress now that the youtube player can be embedded by script, and thus how it can have deep-linking to sections of the video from the url.

So, today I spent some time trying to integrate SWFAddress with the sample YouTube video and the result is now available online. There were some tricky parts and probably the code can be encapsulated better, but overall I’m satisfied with the result. Every pause action or significant jump in the playback produces a deep link which will definitely make sense for long videos or specific scenarios. If you want to automatically start the video from the second verve just try this deep link. For this case I decided that it will be better to disable the generation of browser history and the SWFAddress strict mode.

The sample is available in the SWFAddress repository and will become a part of the upcoming 2.1 release.

The cool part about all this is is makes it extremely easy to add commenting at moments in time throughout youtube videos, enables deep-linking, allows snapshots of not just the flash application but also the video that might be playing in that chapter. This is done on services like viddler and others but now you can do it for youtube videos and this will also possibly start a standard way to do this across media players so that a platform of video commenting emerges.

The integration of SWFAddress is simple, on the normal onSWFAddressChange you just pass in the value to the seekTo call:

function onSWFAddressChange(event) {
                time = seek = parseInt(event.value);
                ytplayer = document.getElementById('myytplayer');
                ytplayer.seekTo(time, true);

Google video always had jump to time params like:http://video.google.com/videoplay?docid=-5830318882717959520#01m30s (this is a classic/hilarious Erlang video)

…but this is not very workable with the google video player, also you can always add this to other players but having this ability for youtube is a great leap in allowing a more integrated commenting, chapter and community like feel to video.

Since youtube is so big finally having some more control with the YouTubeAPI will allow much more great additions to the capabilities of using youtube video in many more ways and integration of more great javascript kits like SWFAddress.

The YouTube API is really quite useful. Here are some links of interest:

Adobe AIR 1.0 and Flex 3 Launched Today


AIR 1.0 and Flex 3.0. have launched.

AIR is finally 1.0 and live as well as Flex3, both launched today. That is quite a 1-2 punch.  These are both great technologies and AIR extends the reach to the desktop and lots of power with that being finally 1.0 and officially launched.  It has been hard to convince people to develop on it other than tech demos and prototypes, this should help.

Ajaxian has the run down: 

Adobe AIR

The AIR runtime and SDK has gone through an especially long beta cycle (since June 2007) to ensure that both security and compatibility with existing frameworks was achieved. Some key new and/or updated features include:

  • Enhanced Desktop Fucntionality: Drag and drop to the operating system, copy and paste between applications, launching of AIR applications from the desktop or the browser, and run in the background with notifications.
  • Data Access: Adobe AIR now provides both synchronous and asynchronous access to the local file system, as well as structured data within a local database. This database is implemented using the open source SQLite database.
  • JS Library Support: Most major Ajax frameworks can be used to build AIR applications. Supported frameworks include jQuery, Ext JS, Dojo, and Spry. Adobe AIR integrates JavaScript and ActionScript to allow cross-scripting between the two languages, and integrated rendering of Flash and HTML content.
  • Security: Applications built on Adobe AIR can only be installed through a trustworthy install process that verifies that the application is signed via industry standard certificates, providing users with information about the source and capabilities of the application.

Flex 3.0

Adobe’s Flash-based RIA development platform, Flex, continues to mature and has been picking up steam in both the corporate space as well as sites such as blist and Scrapblog who have embraced Flex whole-heartedly. Some of the new features in Flex 3.0 include:

  • Intelligent coding, interactive step-through debugging, and visual design of user interface layout
  • New capabilities for creating RIAs and building applications on Adobe AIR
  • Integrates with Adobe Creative Suite® 3 making it easy for designers and developers to work together more efficiently.
  • New testing tools, including memory and performance profilers and integrated support for automated functional testing, speed up development and lead to higher performing RIAs.

One of the most compelling parts of the Flex announcement is the fact that Adobe has released the Flex SDK under the open source Mozilla Public License.

AS3 Cryptography and Hashing Libraries for Encryption and Security (crypto)

AS3 libraries for crypto are pretty robust from the new RAW POWER in the AVM2 virtual machine that runs flash9/as3, cryptography, like compression, is very processor intensive and needs a fair amount of power to be worth the time (usually a balancing mechanism). I am working on a few security apps in AIR and Flash9 for a project and a product so this is the best of what I have found to share. I will be sure to post here when these projects are complete.

There are two that are pretty good as3 kits that have decent support for crypto and hashing, actually as3crypto is quite broad in their support or most common crypto algorithms, even hashing support up to SHA-256 and ciphers 3DES, AES, RC4.

This is not really a comparison just some kits that have tools you might need. as3crypto is definitely the way to go for more heavy ecryption with common ciphers, but if you are just hashing some text as3corelib might work for your project. as3corelib is a more broad toolkit that is made or sponsored by Adobe that has JSON, RSS, support and other tools. It is a great core lib, but not as deep in the encryption area. I am actually using both in the stuff I am working on, as3corelib for some other uses (JSON,RSS) and as3crypto for all encryption and hashing.

The two are:

  • as3crypto
    • Robust, broad encryption and security support
    • Open source
    • Demo
    • Browse source
    • Broad support of algorithms
        • TLS 1.0 support, exposed through TLSSocket and TLSEngine classes
        • X.509 Certificate support, including parsing, and validation
        • built-in list of common root Certificate Authorities
        • symmetric ciphers: AES, Blowfish, DES, 3DES, XTEA, RC4
        • confidentiality modes: CTR, CBC, CFB, CFB-8, OFB, ECB
        • public key crypto: RSA (encryption, decryption, signing, verifying and key generation)
        • padding: PKCS#1 (type 1 and 2), PKCS#5
        • BigInteger library
        • hashing function: SHA-256, SHA-224, SHA-1, MD5, MD2
        • HMAC support
        • prng: TLSPRF and stream-cypher-based PRNG.
        • minimal ASN-1/DER support for PEM key parsing and X-509 cert parsing
        • Crypto – Shortcut class to access many classes above.
        • Hex, Base64 – Static methods to convert binary data to and from text formats

As3 Crypto is a cryptography library written in Actionscript 3 that provides several common algorithms, as well as TLS 1.0 support. The library is offered under the BSD license, and include several derivative works from Java, C and javascript sources.

Here’s some numbers from as3Crypto home page that show the speed, note it has not been optimized just yet (since most of this is client side and only one user would be using it this is not an issue – server side is where this can have scale problems from parallel execution but flash is rarely server side if it is too slow, but it is quite fast)

The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
md2                  1.01k        3.64k       15.08k       53.89k      171.76k
md5                221.85k      447.32k      739.54k      893.72k      905.82k
sha1                82.28k      184.78k      286.76k      336.03k      345.41k
sha224              60.84k      125.67k      200.27k      234.28k      247.58k
sha256              60.52k      126.30k      199.19k      234.04k      246.01k
hmac-md5            48.37k      159.37k      282.87k      295.15k      341.21k
hmac-sha1           18.29k       64.82k      165.72k      277.60k      342.52k
hmac-sha224          5.75k       24.84k      125.71k      204.35k      256.36k
hmac-sha256         15.10k       49.33k      123.71k      206.17k      249.08k
rc4                117.24k      381.34k      878.93k     1315.01k     1539.44k
xtea-cbc             2.49k        6.48k       12.80k       33.00k       44.48k
aes128-cbc           1.61k        4.01k       22.97k       78.55k      205.01k
aes192-cbc           1.34k        5.13k       20.91k       69.45k      172.43k
aes256-cbc           1.48k        5.63k       18.87k       63.45k      150.39k
blowfish-cbc         2.77k       10.81k       42.28k      140.27k      343.05k
des-cbc              2.53k        9.73k       35.20k      124.84k      624.88k
3des-cbc             2.50k        9.72k       35.61k      115.21k      253.42k

The library has not been optimized for speed, and those numbers could probably be improved.

They both have minimal or none ASN.1 support which I will need but I can port much of this from my favorite Java/C# crypto kit from the legion of the bouncy castle of which I was happy to find was a substantial base for this kit.

Whatever you do don’t send any type of message from your crypto kits with aes 256 cipher and sha-256 hashing to Iran from the US. :)

AS3 Parsing RSS Feed

Mike Chambers has a great post on parsing RSS in AS3 with as3syndicationlib. I had some info on this in development but Mike’s post is very simple and just posting the code here for reference.

import com.adobe.utils.XMLUtil;
import com.adobe.xml.syndication.rss.Item20;
import com.adobe.xml.syndication.rss.RSS20;

import flash.events.Event;
import flash.events.IOErrorEvent;
import flash.events.SecurityErrorEvent;
import flash.net.URLLoader;
import flash.net.URLRequest;
import flash.net.URLRequestMethod;

private var loader:URLLoader;

//url of rss 2.0 feed
private static const RSS_URL:String = "http://feeds.feedburner.com/MikeChambers/";

//called when user presses the button to load feed
private function onLoadPress():void
 loader = new URLLoader();

	//request pointing to feed
 var request:URLRequest = new URLRequest(RSS_URL);
 request.method = URLRequestMethod.GET;

	//listen for when the data loads
 loader.addEventListener(Event.COMPLETE, onDataLoad);

	//listen for error events
 loader.addEventListener(IOErrorEvent.IO_ERROR, onIOError);
 loader.addEventListener(SecurityErrorEvent.SECURITY_ERROR, onSecurityError);

	//load the feed data

//called once the data has loaded from the feed
private function onDataLoad(e:Event):void
 //get the raw string data from the feed
 var rawRSS:String = URLLoader(e.target).data;

	//parse it as RSS


//parses RSS 2.0 feed and prints out the feed titles into
//the text area
private function parseRSS(data:String):void

	//XMLSyndicationLibrary does not validate that the data contains valid
 //XML, so you need to validate that the data is valid XML.
 //We use the XMLUtil.isValidXML API from the corelib library.
 	writeOutput("Feed does not contain valid XML.");

	//create RSS20 instance
 var rss:RSS20 = new RSS20();

		//parse the raw rss data

		//get all of the items within the feed
 	var items:Array = rss.items;

		//loop through each item in the feed
 	for each(var item:Item20 in items)
 		//print out the title of each item

private function writeOutput(data:String):void
 outputField.text += data + "\n";

private function onIOError(e:IOErrorEvent):void
 writeOutput("IOError : " + e.text);

private function onSecurityError(e:SecurityErrorEvent):void
 writeOutput("SecurityError : " + e.text);

Check out the full post on this at Mike’s blog.


Get every new post delivered to your Inbox.