Summary of Bayjax May 2009 Meetup

Facebook branded drink fridgeOn Thursday, May 7, I attended the May meetup of the Bayjax meetup group. As the name suggests, Bayjax meetups focus on interesting applications of JavaScript and Ajax. This particular meeting was held at one of the many (but soon to be vacated) Facebook offices littered throughout Palo Alto. The May meeting featured three speakers and an informal discussion on real-time web applications.

Case-Hardened JavaScript:
the Short, Fast Version (Build a Twitter Search Badge in 15 Minutes)
by Kent Brewster

Kent Brewster explaining his twitter badge JS code

Kent Brewster explaining his twitter badge JS code

The first talk was given by Kent Brewster on how to create interesting interactive gadgets. Kent is currently at Netflix but began his foray into JavaScript widgets while at Yahoo!. Kent’s presentation was a 15 minute condensed version of his normal 2 hour talk. While not correlated to the quality of the talk, what I first noticed was that his presentation didn’t work when loaded in Safari.

Kent’s twitter badge example avoids using document.write() by instead using DOM manipulation and attaching elements. It uses clever uses of SCRIPT tag addition and deletion to get around browser sandboxing limitations. It iterates through all script tags looking for a defined target and then inserts a DIV tag before the SCRIPT tag and then removes the SCRIPT tag.

An example of this use is the search box:

  1. The JS polls the input box every second looking for changes
  2. If changes are detected, the current value of the box is used as a search query to Twitter’s API
  3. A callback is created to handle the result of the search
  4. A new SCRIPT tag is created to call the API and registers the callback to receive the resulting data
  5. When the result returns, execute callback, delete callback, delete SCRIPT node to keep the DOM tidy

JSConf2009 Highlights by Ozgur Cem Sen

Cem is a core contributor to MiaCMS and attended the recent JSConf2009 conference held April 24 and 25 in Washington D.C. His presentation was an overview of the talks given with a focus on those he found most interesting and insightful.

“Deploying to the Edge with CouchDB by Chris Anderson was described as being a great talk but, while explaining about ease of scaling, was not very hands on about how CouchDB actually works.

“Secret Topic” by John Resig covered distributed testing of jQuery using Resig also showed a demo of a web based guitar hero app and talked about issues with browser garbage collectors and difficulties around the fluidity of game play.

“PhoneGap for building iPhone and Android applications” by Brian LeRoux at Nitobi was described as a “brilliant and funny presentation full of F-bombs”. Essentially, the talk was about PhoneGap’s hack of certain phone SDK’s to let their application run through the browser and let JS execute phone functionality. Regardless of the content, I, for one, am sad I missed it.

“High Performance, Kick Ass Web Apps” by Stoyan Stefanov at Yahoo! was also very interesting, informative, and fun. Great insight into the business need for optimizing your web application for speed and how to do it.

Cem lauded Chris and Laura Williams’ production of the JSConf2009 conference as a successful conference with great speakers and interesting attendees. He will definitely be attending JSConf2010 and also mentioned talk of a CouchDB coordinated JSConf.EU. The Hosted Relational Database by Brent Hamby

Brent Hamby Explaining

Brent Hamby Explaining

Brent Hamby presented on, a new hosted database that will remind some of CouchDB. is focused on lowering the barrier to entry for web developers who want to work with databases by rethinking database design to simplify the development and deployment of web applications. The lofty ultimate goal is to eliminate the need for middleware server code and in-house DB administration.

Overview of is a service that allows you to use a web-based UI to create database entities, map entity relationships, define available queries, and format result sets in JSON. Unlike in a standard relational database where you define relationships via foreign-keys, relationships are considered first-class citizens directly integrated into the security model. relationships are enforced behind the scenes and defined via the same UI as entity creation. Queries are all written and stored in using an admin tool. The query language is not based on SQL and all queries are implicitly constrained by the integrated security model. Query examples can be found in their developers guide.


Integrating a web application with is accomplished via a lightweight, framework agnostic JavaScript API. The API is designed to allow entirely JS driven form creation, validation, and submission thus eliminating SQL injection attacks and the need to write custom form HTML. There are many built in widgets designed to handle operations such as file uploading and CAPTCHA protection. Validation is entirely implemented via client-side JS code. The need for object-relational mapping (ORM) is side-stepped by the JSON definition of result-set formatting. Security enforcement is tied to an encrypted token issued at login that must be included in all requests to Brent described the classic example of the utility of driven applications being mashups.

For more information on how to use the JavaScript Form Builder API with, there is an excellent video.

Limitations of’s approach to developing and deploying database-driven web applications is sure to attract web developers who want to quickly create simple, database-backed applications without having to learn SQL or maintain database servers. However, for developers creating more complex applications and concerned with performance, has limitations that are sure to cause significant apprehension. replaces middleware-to-database latency with remote latency. Each query requires a separate request to Thus, the standard tactic of reducing requests to improve performance is often not possible when using

Because requires all validation to be done client-side using JavaScript, it is not possible to prevent request manipulation (via tools like Firebug and TamperData). If you need to impose a password strength rule, there is no way to prevent a savvy user from violating your rule. Brent explained that an initial version of included validation through specific database data types but this became unwieldy for complex validation (i.e. regexs) so validation was moved to client-side JavaScript. This validation will soon be augmented by column-level regex registries that will perform custom server-side validation. Of course, for performance and usability reasons, server-side validation should not be one’s sole form of validation. User interface feedback latency and unnecessary round trips to the server can be avoided by employing both server-side and client-side validation.

Future of

In addition to the server-side validation features previously mentioned, the team is currently working on features to allow exporting a database into Apache DB format. Brent also mentioned that is interested in providing a host-your-own deployment option.

Real-Time Web Discussion led by Michael Carter

As an alumnus of the Claremont Colleges in Claremont, California, I’m always pleased to see fellow graduates doing interesting work. Michael Carter is one such alum. Michael’s bio at Brand-Up includes his Pomona College roots and details his association with Orbited, an open source Comet server.

Michael led a discussion on the future of real-time web applications with specific focus on the technical challenges of migrating from long-polling to a truly real-time web and the current efforts towards developing new standards.

Michael specifically mentioned the discussions occurring on the IETF HYBI mailing list about how to standardize the real-time web and the need to ensure broad community involvement. Michael mentioned that a number of the participants are pushing the idea of a base protocol similar to HTTP so as to capture all the advantages and optimizations that exist for the non-real-time web. Michael highlighted various examples where there is not advantage to the existing HTTP semantics, though he admitted that there are some cases where HTTP features are helpful, such as allowing caching intermediaries into the loop.

It was discussed that, since firewalls, proxies, and other intermediaries are hostile to long-polling, any new standard must include baked-in reliability. Michael advocates a TCP-style windowing on top of a streaming protocol and is considering a technical proposal to present to the IETF.

The discussion also included audience examples of current real-time web implementations. Facebook chat is implemented in Erlang with multi-threaded long-polls. They have a collection of presence servers that handle chat, notifications, and real-time stream updates. Many people concurred that using Comet based servers greatly improve the scalability of a site.

  • Digg
  • StumbleUpon
  • Facebook
  • Twitter
  • Google Bookmarks
  • DZone
  • HackerNews
  • LinkedIn
  • Reddit
  • Website_Kent

    Nice to see neat code avoiding sql injection attacks and website hacks.