Tag Archives: mobile

IBM Dives Head First Into Mobile

IBM moves into mobile

IBM last week unveiled an expansive new strategy to deliver mobile business solutions under MobileFirst, its new brand of software and services for delivering apps on smartphones and tablets. With MobileFirst, IBM seeks to bring together all of the elements required by an enterprise to successfully roll-out mobile solutions, including development, deployment, device management, and security tools. And, IBM being IBM, it also includes a healthy dose of professional services, but no apparent IBM i hooks at this time.

MobileFirst is an umbrella brand that brings together many pieces of software that already existed in IBM’s portfolio, but it introduces some new software as well. There are literally dozens of products parked under the new MobileFirst banner, including products from familiar IBM brands like WebSphere, Rational, Domino, Tivoli, and Cognos. Recent IBM acquisitions, like Q1 Labs (security), Emptoris (expense and expenditure management), and Tealeaf (customer experience management) also play a part.

IBM breaks MobileFirst products down into four main categories, including MobileFirst Platform, MobileFirst Security, MobileFirst Management, and MobileFirst Analytics. Within these four, there are no less than 28 individually named products and services sitting under Big Blue’s new mobile umbrella. Simplicity has never been IBM’s strong suit, and apparently it’s not going to start now.

The key product under the new MobileFirst Platform is Mobile Foundation, a pre-existing suite that previously combined three tools but now appears to sport only two: Worklight, an HTML 5 mobile application development and runtime environment that includes a Java-based server component and an Eclipse-based studio; and WebSphere Cast Iron, an integration framework for connecting on-premise and cloud applications and systems.

Worklight, you will remember, is on the short list of IBM apps that several prominent IBM i experts, including Roxanne Reynolds-Lair, the Power Systems champion and CIO of the Fashion Institute of Design and Merchandising, want running and supported on IBM i. The work done by Reynolds-Lair and another Power Systems champion, Steve Pitcher, were instrumental in getting other new IBM offerings supported on the platform, including Notes Traveler and IBM Connections, both of which IBM has committed to supporting on IBM i.

And lo! What do we have here but an IBM announcement letter on February 19 for Worklight version 5.0.6. Could it, would it, include a statement of direction in support of IBM i? As diligent readers scroll down, they read:

"IBM intends to provide additional platform support for the IBM Worklight product offerings in response to customer feedback and market demand…IBM anticipates extending support to IBM System z hardware and the IBM z/OS operating system in the future." Actually, IBM committed to supporting z/OS with Worklight back in September, so this isn’t news. What is disheartening is that Worklight apps can be served up from z/OS, Windows, AIX, Solaris, Linux, and Mac OS–every "major" business OS but IBM i (and HP-UX).

Worklight isn’t the only component of MobileFirst Foundation. IBM CLM [collaborative lifecycle management] suite, which in turn is composed of Rational Requirements Composer, Team Concert, and Quality Manager, is also a part of MobileFirst Foundation. Others include Rational Test Workbench; Web Experience Solutions; Lotus Domino Designer; and WebSphere MQ.

MobileFirst Management is based largely on IBM Endpoint Manager for Mobile Devices, which previously was called just Endpoint Manager when it was part of the Mobile Foundation. Endpoint Manager is a Windows/SQL Server-based app that enables businesses to adopt "bring your own device" (BYOD) strategies, and supports all popular mobile platforms, including iOS, Android, Blackberry, Windows Mobile, Windows Phone, and Symbian. MobileFirst Management also includes Tivoli Netcool/OMNIbus, WebSphere Datapower, and Emptoris Rivermine Telecom Expense Management.

MobileFirst Security includes a new release of Security AppScan that has been gussied up to spot potential vulnerabilities in iOS apps; it previously supported Android. The Security Access Manager for Cloud and Mobile component delivers single sign on (SSO) capability for mobile apps–definitively a nice thing to have in enterprise environments. Integration with the security information and event management (SIEM) product QRadar is also part of MobileFirst Security, turning tablets and smartphones into listening posts to detect the activities of hackers and cybercriminals, while Mobile Connect establishes a virtual private network (VPN) connection between a mobile device and a server.

On the analytics front, IBM has crammed several apps into MobileFirst Analytics boat, including: Tealeaf CX Mobile, for detecting potential problems in the mobile user’s experience; Mobile Commerce, for mobile e-commerce; and Cognos Mobile, for accessing Cognos reports, dashboards, and metrics from mobile devices.

Bringing all these tools to bear on customers’ mobile strategies may be difficult, but never fear: IBM Global Services is here! MobileFirst has a wide array of services components, including: mobile application development; integration with back-office systems; infrastructure and planning; network integration; running mobile apps from the cloud; and embedding unified communications and collaboration (UCC) capabilities into mobile apps.

IBM also unveiled a new partnership with AT&T to integrate Worklight apps with AT&T’s cloud APIs. There’s also a new program called "Ready for IBM MobileFirst" to get ISVs going with the new brand, and new initiatives with colleges, too. IBM financing also got into the MobileFirst act.

It is almost as if every department in IBM gets to play a part in MobileFirst, which is undoubtedly what led IBM to call MobileFirst the first "true end-to-end mobile solution" that businesses can use to "transform their entire business model." Considering that most of the tools already existed in IBM’s portfolio, that claim is a stretch. (It is even more of a stretch unless IBM has done the hard work to integrate the tools, not only from a functional aspect, but from a licensing aspect, too). Every organization will have specific needs as it relates to mobile, so there will never be a one-size-fits-all solution, despite whatever messaging IBM’s marketing committees agree on.

With so many components in MobileFirst, it is likely that any given organization will find something that addresses at least some their mobile needs. And customers can even look outside of the MobileFirst family, to tools such as Rational Application Developer and Rational Business Developer, which gained Dojo X Mobile support in 2011, but which missed the first departure of the MobileFirst train.

It is clear that MobileFirst represents the product branding that IBM is using for its smartphone and tablet computing solutions, and it will undoubtedly evolve in the future. Now all that IBM needs to do is support IBM i with Worklight–the foundational element of MobileFirst–and it will have piqued the attention of 150,000 of its best customers.

Source: http://www.itjungle.com/tfh/tfh022513-story05.html

Did you like this? Share it:

Mobile app security: Always keep the back door locked

In the 1990s, client-server was king. The processing power of PCs and the increasing speed of networks led to more and more desktop applications, often plugging into backend middleware and corporate data sources. But those applications, and the PCs they ran on, were vulnerable to viruses and other attacks. When applications were poorly designed, they could leave sensitive data exposed.

Today, the mobile app is king. The processing power of smartphones and mobile devices based on Android, iOS, and other mobile operating systems combined with the speed of broadband cellular networks have led to more mobile applications with an old-school plan: plug into backend middleware and corporate data sources.

But these apps and the devices they run on are vulnerable… well, you get the picture. It’s déjà vu with one major difference: while most client-server applications ran within the confines of a LAN or corporate WAN, mobile apps are running outside of the confines of corporate networks and are accessing services across the public Internet. That makes mobile applications potentially huge security vulnerabilities—especially if they aren’t architected properly and configured with proper security and access controls.

Speed (to market) kills

Today we have tools like PhoneGap and Appcellerator’s Titanium platform as well as a host of other development tools for mobile platforms that resemble in many ways the integrated development tools of the client-server era (such as Visual Basic and PowerBuilder). So individual developers and small development teams can easily crank out new mobile apps that tie to Web services, hooking them to backend systems launched on Amazon at high speed.

But unfortunately, they all too often do so without considering security up front, creating the potential for exploitation. While a lot of attention has been paid to security on the device itself, the backend connection is just as, if not more, vulnerable.

If companies are lucky, like Montreal-based SkyTech Communications, those holes merely produce public embarrassment. When a computer science student at a vocational college used a freely downloaded security scanner on SkyTech’s mobile app (which allows students to access their records and register for classes), he found major security flaws in the application. These flaws allowed anyone to gain access to students’ personal information.

Small developers aren’t the only ones who can get caught by their mobile app backends. Take, for example, General Motors’ sudden leap forward with its OnStar Web API. The company was forced to accelerate a public API effort when it discovered an enterprising Chevy Volt owner had reverse-engineered its mobile application API for retrieving vehicle statistics from OnStar’s data centers for personal use. Fortunately, he wasn’t malicious. But he did build a website for other drivers to do the same—which potentially exposed personal data in the process by using those drivers’ OnStar account logins, in violation of GM’s privacy rules. The site now runs on a new, more secure API.

Keeping the client (mostly) dumb

"This sort of thing has been a problem since computers started talking to each other," said Kevin Nickels, the president and CEO of "backend as a service" provider FatFractal. To prevent these sorts of problems—or worse—developers need to address issues like security and access control early on. "Too often, developers try to address these after the fact, and not from the very beginning," Nickels explained.

One of the key elements of security design in mobile applications is making sure that the client—the phone app itself, or the browser app—does very little processing. "The general best practice is to let the code on the device do as little as possible," said Danny Boice, the co-founder and CTO of Speek, a cloud-based conference call service that works through native mobile clients and Web browsers. (Boice is also a former executive in charge of Web and mobile development for the SAT testing company, The College Board.) "There are things on a person’s phone that you can’t control. We put most of the heavy lifting off of the client, because you can control what the application sends and receives."

It’s especially important to handle all data integration with other services on the backend and not on the mobile device, says Nickels. "Ads exposed in an app, for example, could have malicious code. We recommend people do that sort of integration via the backend. That way, things coming from outside the app won’t have any access to any system resources at all."

Dan Kuykendall, Co-CEO and chief technology officer of security testing firm NT Objectives, said the less mobile apps store and process data on the client device, the better. "A lot of developers think, ‘The only traffic that’s going to come in is from my mobile app’," Kuykendall explained. "And they build logic into the mobile client"—building queries to be sent to the backend systems and processing raw data sent back. But requests from the app can easily be "sniffed" by someone who has the application on a device of their own, by malicious software on the device that might monitor outbound traffic, or by someone maliciously monitoring what comes off mobile devices. "You don’t want the app passing SQL statements back to the backend," Kuykendall said. "That’s crazy." But as he says, that’s also all too common.

The most basic bit of hardening required for mobile applications is to encrypt traffic to the backend—at a minimum, by using Secure Socket Layer (SSL) encryption. But SSL by itself isn’t enough because of the nature of how mobile devices connect. Many smartphones will automatically connect to available open Wi-Fi networks they remember, making it relatively easy to get them to connect to a rogue device that can act as an SSL proxy, decrypting and re-encrypting traffic while recording everything that passes through.  While SSL is usually a defense against attacks on browser-based sessions on PCs, some mobile apps are vulnerable because they rely on WebKit to handle SSL. WebKit doesn’t fail by default with bad certificates like those used in "man in middle" (MIM) attacks—it sends an error message to the app that a cert is bad, and lets the code decide what to do about it. In some cases, to get around errors, apps get set to accept any cert, so they’re vulnerable to MIM attacks.

"I can sit in a public place, like the mall, with a Wi-Fi Pineapple and my laptop," Kuykendall said, "and deliver real Internet access with me as a ‘man in middle’, and see the traffic coming from people’s smartphones without them knowing their smartphone is connected to me. And when apps fetch updates, I see that." Since many mobile apps fetch updates without user interaction, "the users aren’t instigating the connection—it just happens." If data pulled from a man-in-the-middle attack doesn’t have additional sorts of controls and protection, it could then be used to attack the backend systems.

Another vulnerability caused by putting too much reliance on the client is that it requires more data to be stored on the client—data that could be exploited. Even ephemeral data (information stored locally to be processed for display or to be sent to the backend and then be disposed of) is vulnerable. "It’s not so easy to get into a running app and steal stuff," Nickels said. "It’s more of an issue with a data cache or on-phone storage, using databases like SQLite. You need to obfuscate that data as best as you can, encrypt it at rest, and store things that are not easy to associate with each other."

Source: http://arstechnica.com/security/2013/02/mobile-app-security-always-keep-the-back-door-locked/

Did you like this? Share it:

Whatever happened to the art of software testing?

Over the last year I’ve had the opportunity to attend a number of extremely interesting and mind-expanding conferences focusing on emerging and somewhat disruptive technologies and companies: APIs, mobile, cloud, big data – the works. Coming from a quality background, it has stricken me how little focus these companies give to testing. They talk plenty about continuous integration, agile methodologies, user groups and continuous deployment – but testing? Nope.

Why is that?

First, let me elaborate a little on what I mean (and don’t mean) by "testing." I don’t mean unit tests. I don’t mean BDD or TDD based on some cool-named framework using a custom DSL to describe scenarios. I don’t mean recorded and automated scripts of your website or application. Much of this is being done by many of these companies – which is great, and I’m positive it increases the quality of their products.

What I do mean with “testing” is testers who try to break stuff; who do those things with your software that users weren’t intended to do; who provoke the hardware hosting your application to behave like it usually doesn’t; and who continuously challenge the design and architecture of your products by thinking outside the box and applying this in a methodological and structured way. When it comes to quality, these testers will be your greatest pain and your biggest gain. They take the quality of your products to the next level by doing all that crazy stuff your users do (and don’t do), giving your team the opportunity to fix them first.

So, back to the question: why is it that these oh-so-crucial testers and the art of testing are so absent from these companies and conferences?

I have three possible explanations in my mind:

Strike One: Developers aren’t testers

Developers – I love you – but you aren’t testers. A tester’s mentality and talent when it comes to quality is to find defects and ultimately break stuff. Developers, on the other hand, want to make sure things work. This might sound like a small difference but the implications are huge. The “developer” of a steering wheel will make sure it turns the car left or right when you turn the wheel left or right (at the required rate/degree/whatever). The tester, on the other hand, will jerk the wheel back and forth to bring it out of balance, will submit the wheel to extreme (but plausible) conditions at the north pole and in the Sahara desert, and he might even compare the wheel to the competitors and tell you why theirs is better. Developers confirm, testers overhaul. That’s just how it is. Unfortunately, though, developers are usually at center stage in a development team, and often lack the insight into both the craft of testing and the time it takes to do it right. You need both on your team for your quality to be top-notch – neither can stand in for the other.

Strike Two: Agile Testing = Automated Testing

Don’t get me wrong – agile development can be fantastic when executed correctly, and has surely improved the lives of many a developer/tester/product-owner out there. Unfortunately, though, agile teams (at least in their infancy) often put testing efforts into the hands of developers (see point 1), who often believe that you either need to be able to automate all your tests or that a BDD/TDD specification is a valid substitute for testing. Neither is correct. Using a BDD/TDD specification as a test is just another way of checking that your software performs as required/designed/specified. And, as already argued above, exploratory testing is key to finding those out-of-bounds conditions and usage-scenarios that need to be fixed before users encounter them.

Strike Three: Cheap-skating quality

OK – you’ve convinced your agile team they need to do exploratory testing during their sprints, and your developers have reluctantly agreed that they aren’t testers at heart. So what happens when you approach the management team with a request to hire an expert tester?! Hands in the air if you think they might answer something like:

+ "We have a deadline – we need to release – we’ll invest in development now and testers later."
+ "Don’t our developers have 90% code coverage? Do we really need testers?"
+ "Our users will help us iron out those out-of-bounds issues and quirks. That will be ample feedback for future improvements."
+ <any other “explanation” that is based on the reluctance to spend money on quality>

No one raised their hands? Phew, that’s a relief! Otherwise, given the already stated arguments, this is an obvious and probably the most common mistake. Your story-telling talents will be put to test. Hopefully you can convince management to make the investment.

What to learn from this mini-rant? To put it simply:

+ Understand that testing, just like development, is a craft of its own
+ Cherish your testers and their expertise
+ Invest in quality – your users will love you for it.

Source: http://www.networkworld.com/community/node/82273

Did you like this? Share it:

HTML5 vs. Apps: Here’s Why The Debate Matters, And Who Will Win

HTML5 is a new technology that allows developers to build rich web-based apps that run on any device via a standard web browser.

Many think it will save the web, rendering native platform-dependent apps obsolete.

So, which will win? Native apps or HTML5?

A recent report from BI Intelligence explains why we think HTML5 will win out, and what an HTML future will look like for consumers, developers, and brands.

Here’s why the Apps-vs-HTML5 debate matters:

+ Distribution: Native apps are distributed through app stores and markets controlled by the owners of the platforms. HTML5 is distributed through the rules of the open web: the link economy.

+ Monetization: Native apps come with one-click purchase options built into mobile platforms. HTML5 apps will tend to be monetized more through advertising, because payments will be less user-friendly.

+ Platform power and network effects: Developers have to conform with Apple’s rules. Apple’s market share, meanwhile, creates network effects and lock-in. If and when developers can build excellent iPhone and iPad functionality on the web using HTML5, developers can cut Apple out of the loop. This will reduce the network effects of Apple’s platform.

+ Functionality: Right now, native apps can do a lot more than HTML5 apps. HTML5 apps will get better, but not as fast as some HTML5 advocates think.

In full, the special report analyzes:

+ What HTML5 is, giving an overview of how it is a technology done by committee.

+ Why the HTML5-vs-Apps debate matters, breaking down its impact on distribution, monetization, platform power and network effects, and functionality.

+ The pluses and minuses of HTML5 vs. native apps, comparing each by cost, user experience, features, distribution, and monetization.

+ How and when HTML5 will take over, laying out how it has all the hallmarks of a disruptive technology.

+ The success of an HTML5 pioneer, The Financial Times.

+ What an HTML5 future will look like, with the promise of richer and more interactive experiences.

Source: http://www.businessinsider.com/html5-vs-apps-heres-why-the-debate-matters-and-who-will-win-2012-12

Did you like this? Share it:

Crafting a Mobile Security and Management Posture

If we look back to 2011, we observe that a tipping point of sorts was being reached with consumer mobile device proliferation into the workplace. As you may already know, the first wave of adoption of new mobile devices – smartphones and tablets – started in the executive ranks and they began to compel IT departments to support them. This phenomenon couldn’t be contained; rather it accelerated the second wave of adoption by a broader base of employees beginning to use their personal devices to improve their work productivity. IT departments have had to scramble to respond and many are still trying to develop a greater understanding and appreciation of what mobile enablement entails. In 2012 we began to see a shift in organizational posture. Organizations are now actively embracing mobile for the business value it delivers. Nielsen’s 2012 Social Media Report found that over 50% of companies stated that supporting smartphones and tablets was a high or critical priority.  According to Eurostat, among the businesses in the European Union that provided employees with portable devices to work remotely the percentage of companies issuing laptops versus smartphones or tablets is about equal (40% vs 39%).

The trend is irreversible. IT departments are recognizing that their inevitable responsibility is to manage and secure the organizational evolution into a mobile enterprise. When customers turn to vendors for guidance and education they encounter an alphabet soup of terms that represent requirements they need to consider when tailoring their mobile security and management posture to their operational priorities. Initially, it is important to get a frame of reference to understand the domain and the challenges that need to be addressed. First, there are the devices themselves, running platforms that have not yet fully matured for enterprise deployments. Next, invariably users of these devices will use them anywhere and everywhere to connect to back-end systems and access enterprise applications or resources. Finally, the organization may choose to serve the needs of its mobile audiences using apps that deliver rich user experiences but might be lacking basic security features. While there are different solutions to safeguard each of three main pillars and to gain oversight across them, the next step is to understand what the mobile enablement goals of the organization are so that the security and management requirements match the use cases that need to be supported. This enables prioritization and selection of capabilities when making a vendor decision.

One of the first demands made by employees choosing to use their own personal mobile devices for work is gaining device access to the corporate network. With this rapid influx of new devices, an IT operations organization may feel the need to gain the traditional level of visibility and control it had over computing assets such as servers, desktops and laptops. Especially in regulated industries the need to establish and enforce device level policies can be an important business requirement for mobile enablement. While the Bring Your Own Device (BYOD) trend is gaining momentum, organizations issuing mobile devices to their employees should not be overlooked. These organizations may apply even greater emphasis on the ability to control and ensure compliance of their devices. Mobile device management (MDM) solutions are best suited for providing device level reach for enforcing corporate policies. Corporate policies that can be enforced on the device include passcode settings, VPN configuration, device encryption, remote lock/wipe, blocking external data sharing, blacklisting apps and certificate management. Organizations can achieve administrative cost savings by employing a single management infrastructure for managing mobile devices as well as traditional endpoints such as laptops, desktops and servers.

Once users begin employing their mobile devices for work the vast majority of enterprises will encounter demand for mobile access to basic business tools – email, calendar and contacts. As reported by Eurostat, the primary purpose for using smartphones and tablets for work was email2. IT will need to protect email communications and locally stored enterprise data including contacts information. Sometimes referred to as Mobile Email Management (MEM), secure dedicated email, calendar and contacts apps for business use are offered. The objective is to guarantee that the emails are encrypted, avert data leakage due to attachment viewing on the device, prevent malware from accessing business directory, and segregate work email from the personal inbox. Some MDM solutions employ OS capabilities (i.e. iOS’ managed profiles) and email syncing protocols (i.e. Microsoft ActiveSync) to provide email management but support is not consistent across platforms and without app-level controls it is hard to prevent data leakage of email attachments.

Beyond email, employees may need secure access to existing intranet resources. To address this need a secure browser app is often bundled with the secure email, calendar and contacts apps. The secure browser can be employed to browse the corporate intranet and select internal web applications. Policy-based governance can be enforced on the secure browser to provide role-based control over browsing behavior. The secure browser would also encrypt the local cache.

According to Forrester, mobile users are showing growing preference to mobile apps and in recognition of this some internal business teams may look to deliver enterprise mobile apps to deliver a mobile compatible rich user experience. In addition, whether it is optimizing field deployment of resources, enabling mobile transactions or streamlining the supply chain, mobile apps are forming the foundation for business transformation in several industries. To build and run safe apps, organizations should look to incorporate security as early as possible in the app lifecycle. A mobile application platform (MAP) can provide disparate mobile development teams core security features and capabilities that can be reused in each app without requiring the developers to have significant security expertise. This includes encrypting app data, performing app authenticity testing and enabling direct updates. Vulnerability testing can be employed in the testing phase to enforce security best practices in coding. Quality of the technique employed to perform vulnerability testing is important because without full trace analysis it is possible that the testing results can include a large number of false positives which negatively impacts development cycles and developer education for subsequent development activities.

As mobile interactions grow in sophistication there will be additional demand for enhanced mobile collaboration capabilities – document sharing, instant messaging and social networking. To streamline the user experience and to provide more explicit segregation between the personal zone and the work zone on the device, the concept of a secure container is appealing. A secure container encapsulates all the enterprise apps including email, calendar, contacts and secure browser. Data from the work zone is prevented from leaking into the personal zone and content from the personal zone is inhibited from diffusing into the work zone. Organizations can choose to just manage just the containerized work zone and not the whole device. Given that only enterprise apps are being managed as a collection, secure containers are also referred to as mobile application management (MAM) solutions. MAM solutions allow for policy based governance of specific apps or subsets of enterprise apps. There are parallels to MDM features but in the case of MAM those features only apply to the container and not the whole device. The overlap between MAM, MDM and MAP solutions arises in providing a secure channel of delivery of enterprise apps and their updates – an enterprise app store. An enterprise app store can provide a robust process for on-boarding home-grown mobile apps or third party apps, provisioning them to mobile users based on roles and automating installation.

There is one significant security and management requirement not yet mentioned. Its relevance spans across the various mobile initiatives an organization may wish to pursue – whether it is basic intranet access or access to email or access to enterprise apps. This security requirement is mobile access control. Mobile access control is unique from traditional access control because it has to account for context and context influences risk. In the mobile domain the context of the user changes dynamically. Context can include location, the set of app on the device, the network and even time. Risk should be computed every time a mobile interaction is initiated because the context may be different. The risk can influence the authentication scheme to employ, the features of an app that are authorized for a specific user in a specific context. With granular mobile access control an organization can more effectively convey to the user the reason for added security and inculcate security best practices in its users.

Armed with this overview of matching the mobile adoption phases to security and management requirements, you are all set to begin delivering confidence to your mobile enterprise.

Source:http://www.wired.com/insights/2013/01/crafting-a-mobile-security-and-management-posture/

Did you like this? Share it:

Code signing: Stamp of approval for Android and iOS apps

An application security technique known as code signing is gaining importance as the Apple and Android mobile distribution centers require developers to provide the apps they write with a stamp of approval.

Code signing indicates that "you know where the code came from and it hasn’t been corrupted," said August Detlefsen, a security consultant for AppSec Consulting, in San Jose CA.

"The purpose is to basically guarantee that when you get some code, you know who it’s from," said Frank Kim, principal of security consultancy ThinkSec and curriculum lead for application security, SANS. "It’s to give you some level of trust."

Mobile application distributors use code signatures to help prevent malicious code from being distributed among mobile devices. "Both iOS and Android enforce the fact that your code must be signed in order to distribute it through the App Store or Google Play Store, so in order to get your software out there, you must sign it so that at least the identity of the person who created the code is verified," Detlefsen said.

Apple goes a step further and adds its signature to the applications distributed via its App Store. Before any code runs on an iOS device — assuming it hasn’t been jailbroken — the device verifies the signatures. This helps ensure the code has not been modified.

Developers who submit code for distribution via Apple’s App Store don’t have to be concerned with the details of code signing. "When I register for the iOS development program, it’s pretty straightforward," Kim said. "Apple makes the process as seamless as possible."

In other scenarios, the process of code signing is a bit more involved. "If you’re developing other types of software, server-side apps, or those distributed to enterprise customers in a different way, then it’s more cumbersome because the infrastructure is not there," Kim said.

Code is signed using public key cryptography. The process begins with the generation of a cryptographic hash. This is done by running the source code or compiled executable through a one-way function that calculates a checksum based on the bits in the code, Detlefsen explained. The resulting cryptographic hash is unique and non-reversible. The hash is sent through another cryptographic function along with a unique key known only to the user, resulting in a signature. It is a short alphanumeric string that is associated with the code. A public key, associated with the private key but freely sharable, can be used to verify the code is signed with the private key by running the signature and the corresponding public key though a signature verification function.

Public and private keys can be generated at no cost using one of the many key generator tools that can be found online, Detlefsen said. However, these keys do not offer verification that you are who you say you are. After all, Detlefsen pointed out, "Just because the code is signed doesn’t mean that the [developer of that code] knows what they’re doing."

An alternative is to purchase keys from a certificate authority, like VeriSign or DigiCert. These companies validate the identities of their customers. Information such as the signer’s name and organization is included with the code signature, and can be verified with the certificate authority.

There are no risks involved with the code signing process itself. However, the private key must be kept private. If an attacker were to obtain the private key, he could modify the code and sign it with the private key, leading people to believe the code came from a trusted source when in fact it did not.

While developers benefit from signing their own code, they also benefit from the signatures on the code they use. "A lot of developers use third-party code and open source libraries. If you’re building significant apps that require security, you should also check the authenticity of the code you’re using," Detlefsen said. An attacker could insert malicious code into an open source library. "Code signing provides one way of knowing that the code you’re downloading is verified to be the original and hasn’t been tainted in some way," he said. "Before you run it, verify the signature."

But not all code is signed in the first place. "Code signing is becoming more well-known and practiced because these distribution centers are requiring it. But as far as code you download over the Internet, or let’s say there’s an applet in your website or a flash app on a website, you might not know where it came from or whether it was something the original developers put there," Detlefsen said.

Source: http://searchsoftwarequality.techtarget.com/news/2240176128/Code-signing-Stamp-of-approval-for-Android-and-iOS-apps

Did you like this? Share it:

iOS app development powers Objective C to top the charts

Thirty years after its release, Objective C is still going strong. Software quality assessment company Tiobe’s Programming Language Award went to Objective C for the highest rise in market share in 2012. Objective C gained 3.37 percent this month since January 2012, according to Tiobe. C++ gained 1.09 percent year-on-year and Python 0.96 percent, while C# lost 2.57 percent and Delphi 0.65 percent. Objective C won the award for the second year in a row. 

Objective C is the main programming language for OS X and iOS, Apple’s operating systems for desktops and mobile phones respectively and also their APIs. Tiobe attributes the rise in the market share of Objective C to the growing development of mobile applications. Objective C was ranked 45 in the index in 2008, the year in which the iPhone started supporting apps. With the spate of iOS app development, the language was ranked at position three in Jan 2012.

However, Objective C may have reached its peak as the language isn’t used for much else anymore. Languages used in coding mobile apps are forecast to gain market share further. Java for Android and C++ and C# for Windows Mobile will regain lost ground, according to Tiobe. C++ is preferred where large programs are written for exacting systems. It will be interesting to see how C++ is also used for Windows mobile development applications.

graph

Trends over time. The complete dataset is available with Tiobe for a fee.

The languages accounting for products with the most market share according to the Tiobe Programming Community Index for January 2013 are: C (17.855%), Java (17.417%), Objective-C (10.283%), C++ (9.140%), C# (6.196%), PHP (5.546%), Visual Basic (4.749%), Python (4.173%), Perl (2.264%), JavaScript (1.976%).

Bash, the free scripting language for Unix, rose 52 positions on the index from January 2012. Other big gainers were Visual Basic .Net and MATLAB. VB.Net too is used for Android, iOS and OS X programs and apps, apart from various Windows applications. JavaScript and MATLAB are forecast to gain significant market share in 2013. JavaScript, versatile and weakly typed, has come to be widely used in applications as well as web pages. MATLAB is by far the most preferred language and environment for technical computing.

The Tiobe Programming Community Index is updated each month with ratings calculated using the number of page views on search engines, Wikipedia, Blogger, academic courses, the number of skilled technologists using the language, third-party vendors etc. The index defines a language as one that has an entry on Wikipedia and is Turing-complete, that is, can simulate a single-taped Turing machine. As a result, ASP, HTML and many others are not considered programming languages, but a few scripting languages have found their way into the index. The index seeks to rank the popularity of the languages rather than identify the best or the most used language or the ones that has the most lines of code.

The ratings can be used by students and working professionals to determine the languages in which they should acquire or enhance their skills. Enterprises can make use of this data while making decisions for new projects or purchases.

Source: http://tech2.in.com/news/science-and-technology/ios-app-development-powers-objective-c-to-top-the-charts/698632

Did you like this? Share it:

19 Tools to Test your Site for Mobile Devices

Is your ecommerce site ready for mobile commerce? Preparing your site for mobile customers can be daunting, considering the huge range of mobile devices and browsers. Fortunately, there are some great tools available to make sure your site is mobile compatible.

Here is a list of tools for testing your site on mobile devices. There are basic web-based emulators, which allow you to check your site on a simulated mobile screen. There are also larger testing applications — many include emulators — that evaluate your site’s mobile readiness. The basic emulators and several of the testing applications are free.

Mobile Testing

Gomez. The Gomez mobile readiness test evaluates how well your website will perform on a mobile phone. Instantly get a score based on an in-depth analysis of over 30 mobile web development best practices, including detailed suggestions on how to fix the issues identified.

 Gomez Mobile Readiness Test.

MobiReady. The mobiReady testing tool evaluates mobile-readiness using industry best practices and standards, such as W3C compliance. It provides a score (from 1 to 5) and in-depth analysis of pages to determine how well your site performs on a mobile device.

W3C mobileOK Checker. This checker performs various tests on a web page to determine its level of mobile-friendliness. It primarily assesses basic usability, efficiency, and interoperability, based on the WS3 Mobile Web Best Practices.

CrossBrowserTesting. CrossBrowserTesting allows you to test your site on over 130 browsers across 25 different operating systems, including mobile devices. Test site functionality. Receive automated screenshots of your site. Test for iPhone, iPad, Android, Blackberry, and more.

CrossBrowserTesting.

BrowserStack. BrowserStack provides web-based browser testing. It features fast access to remote browsers, developer tools, and live testing. Access official mobile emulators for Apple iOS, Android, and Opera Mobile. Test your site across a large range of devices.

Multi-Browser Viewer. Multi-Browser Viewer is a cross-browser compatibility application. It contains 11 mobile browsers and emulators, as well as 55 standalone browsers and 88 screen capture browsers.

Perfecto Mobile. Perfecto Mobile’s MobileCloud platform enables you to access a wide variety of real mobile handsets and tablets connected to live mobile networks spread in different geo-locations. It allows you to test and monitor processes on each handset and ensure the optimal compatibility of your site, application, or service.

 Perfecto Mobile.

DeviceAnywhere. DeviceAnywhere is a tool for spot-checking mobile web content on real mobile devices. Interact remotely with live mobile devices in real time so you can see exactly how your website content looks and acts across a range of different mobile devices.

Mobile Emulators

GoMoMeter. GoMoMeter, by Google, shows you how your current site looks on a smartphone, and provides a free report with personalized recommendations tailored to how your business can build a more mobile-friendly experience.

iPhone Tester. This iPhone emulator allows you to check your site in the dimensions for iPhone 3G and 4G, and iPod Touch. Just enter the URL of the site you want to test in the address bar.

iPhone Tester.

iPad Peek. This popular tool enables you to see how your website looks on the iPad or iPhone. For an accurate simulation, use a WebKit-based browser, such as Apple Safari or Google Chrome.

Screenfly. Screenfly allows you to view your website on a variety of device screens and resolutions. Enter a URL and click on GO to get started.

Mobile Phone Emulator. This emulator enables you to see your site on a variety of mobile phones, including iPhone, HTC, LG, BlackBerry, and Samsung.

Mobile Phone Emulator.

The Responsinator. The Responsinator helps you quickly get an indication of how your responsive site will look on the most popular devices, such as iPhone, iPad, Android, and Kindle.

Matt Kersley’s Responsive Design Testing. This is another responsive web design testing tool. Test your site in several widths at the same time. Enter your website’s URL into the address bar to test a specific page.

Browshot. Browshot is a service to create web screenshots in a variety of virtual devices. Capture websites on any mobile device: iPhone, iPad, Android smart phone, Nook Reader, and Android tablets.

Browshot.

Opera Mini Simulator. Opera Mini is one of the fastest and most advanced mobile web browsers. Take advantage of its free web-based emulator.

iPhoney. iPhoney gives you a pixel-accurate web browsing environment, powered by Safari, that you can use when developing web sites for iPhone. It’s the perfect 320 by 480-pixel canvas for your iPhone development.

iPhoney.

Source: .http://is.gd/2g5nD8

Did you like this? Share it:

Top 12 Mobile App Testing Tools

Bangalore: In the recent years, the world witnessed an immense growth in the mobile technology space with new handsets and features being made available in the market. This growth has in turn led to an increase in the demand for mobile applications. Analysts expect the mobile app downloads to increase from 30.1 billion in 2011 to 200 billion in 2016.

Mobile application stores are filled with apps from all horizons from games to business apps to entertainment. This posed a stiff competition among the developers on who can deliver the best. In order to be a competitor in this market, there is a need to produce quality apps. It is imperative to test your apps regularly as this will prevent bad feedbacks from the users.

However; without proper tools, developers as well as testers will face many problems when testing their apps. Here is an infographic created by asoprofessional.com which highlights the top 12 app testing tools.

Source: http://qa.siliconindia.com/news/Top-12-Mobile-App-Testing-Tools-nid-137691.html

Did you like this? Share it:

Mobile App Testing – An Overview

Mobile app testing as an entity and a profession is relatively new in the field of Information Technology. Some people perceive mobile app testing as just an extension of traditional software testing, while others see it as an entirely new concept. While, the concept, and for that matter ‘mobile devices’ are new; from purely a testing perspective, there is one statement that rings true, and that is “good software testing principles can be applied to any software, regardless of the platform.”

The experience required to adequately test a mobile app can be significantly reduced if the tester has experience testing other forms of software. Once the tester understands the new processes involved in mobile apps, then they should be able to quickly be in a position to test a mobile app with confidence. For someone new to the field of software testing who wishes to start their career in mobile app testing, then this is not advisable, as key software testing principles can be easily overlooked by the way that the software is presented in a mobile format.

Mobile apps normally fall into two categories, either they are professionally developed for a specific purpose with a clear business goal in mind, or they are developed for fun, often the latter is developed by a single person. Testing of any application is critical and I won’t go into the reasons here, but it is clear that with the vast amount of mobile apps out there and in development, if the quality is poor it will not be a success….fact!

All apps need to be tested, and while a developer may think that they can effectively test their own work, nothing can replace the effectiveness of a professional tester’s expertise. Software companies who have developed their app may choose to test the app themselves (in-house) or choose to pay a professional outsourced mobile app testing company.  Often the decision to outsource the testing is made easier due to compatibility issues. While an iPhone app can be tested on a handful of Apple devices, it is virtually impossible to do the same with Android devices, which is why they predominantly choose to outsource to a testing company that holds a wide selection of Apple and Android devices.

A mobile app tester is considered to be a niche role at this moment in time. As mobile apps are the fastest growing form of software development, the niche will disappear and be replaced by a dedicated industry. While some perceive a split between traditional software testing and mobile app testing, there is no evidence to support this and the two entities will undoubtedly remain tied together, and rightfully so.

The importance of software testing has risen in recent years, and this is now reflected in the world of mobile app testing. These testers effectively hold the key to an app’s success, and ultimately the success of the business or person who developed it.

source: http://www.testing4success.com/t4sblog/mobile-app-testing-an-overview/

Did you like this? Share it: