Six Apart Hackathon Wrap-up and Caja Intro

Posted by Dan Peterson, Product Manager

Last week's hackathon at Six Apart was a great opportunity to sit down with engineers from a good mix of containers supporting OpenSocial as well as chat with app developers about what they're planning to build. For example, we saw a neat demo from the folks at Zynga who wrote a Battleship application running in Hi5.

In case you weren't able to join us, the presentation slides and meeting notes are available, some video interviews are embedded below, and here are some high-level takeaways:

• The hi5 sandbox has been updated to version 0.6.
• The orkut sandbox has also been updated to version 0.6, and is being powered by Shindig (and the orkut developer's guide has been updated).
• MySpace showed a live demo of an OpenSocial app running on their site.
• We have published an OpenSocial Getting Started Guide, which includes links and status information about live containers.
• The OpenSocial Developer's Guide has been updated with code samples for new features introduced in version 0.6.
• From a roadmap perspective, OpenSocial 0.7 will be defined quite soon; you can get a glimpse in the slides above and in the feature priority list.

In addition to talking in-depth about the evolution of the OpenSocial API from 0.6 to 0.7, we also talked quite a bit about Shindig and Caja. The former, you may have read about previously, but let's discuss the latter now:

Today's method for including apps safely in a web page is to sandbox each application gadget within its own iframe element. This method lets the gadget authors use regular JavaScript syntax, but has performance implications -- each gadget requires a separate iframe and a separate network retrieval, so large numbers of gadgets add noticeable latency and resource overhead. We believe these issues can and should be addressed to make the web faster and safer for users.

Our long term approach, embodied in the Caja project (pronounced KA-hah), to addressing latency, security, developer convenience, and, most of all, user experience, is to safely inline a subset of JavaScript code via rewriting and an object-capability security model. The initial work is already open source, and you can find it at http://code.google.com/p/google-caja, and the good news is that this work is being integrated as an optional feature of Shindig (more on that below).

We have not yet proven that this approach is a full substitute for iframes, but we are making fast progress. Details on the approach can be found in the Caja draft specification. We welcome feedback; please discuss on the OpenSocial API group.

You can experiment with a sample OpenSocial app, which is being hosted by Shindig's out-of-the-box sample container that offers optional "cajoling," by visiting this link (note: this is intended for developer testing only, and is available with "best effort" reliability, but we do plan to offer bleeding-edge functionality).

This sample container lets you specify an arbitrary app xml file as well as manipulate the "state" of the container (e.g. for getFriends() or calls to AppData). In addition, if you want to test your app against Caja, simply check the "Caja" box. You can read more about using Caja with this sample container in this Shindig+Caja doc.

With that, I'll leave you with the video interviews. Of course, we really appreciate Six Apart's hospitality and look forward to the next hackathon. In the meantime, please let us know if you have any questions on the developer forum.