an HTML5 & Mobile App Developers Conference
July 21-22, 2015
RTC stands for Real Time Communications
Peter Dunkley, Technical Director, Acision
Businesses need to provide programs with BYOD (Bring Your Own Device), because people will bring their own software as well.
Franc Greco, Director, Kaazing Corporation
Matt Spencer, UI and Browser Marketing Manager, ARM
Tiego Garcia, Tech Manager at Avenue Code/Tech Lead at Macys.com
module.exports
import using require(dependency)
Pros
Cons
widely used on browsers (not so much on server side)
Pros
Cons
Publishers and Subscribers (w/ mediator)
Defining Real-time
- Same rate
- sometimes at the same time
voice and picture don’t really travel well over a distance
- speed
- absorption, reflection and interference
Boris Kock, Acision
-- voice
-- communicaiton between apps
-- across the globe vs in-room lan
- content
-- huge files vs small pictures
-- personal vs enterprise (sharing photos vs sharing medical xrays)
- perspective
-- which location you are
-- how you want your data to be presented
User Expectations on communications
- secure
- authenticated
- robust
“New" technologies available
WebSocets
- bi-directional
- switch protocols to web socets
(WeSocket, HTTP, TLS, TCP)
RTC
- RTCWeb
<RTCWeb Slide> - webrtc.org/reference/architecture
- voice/video/transport
Media flows between User Agents
Signaling happens between the servers (usually?)
OAuth 2.0
- enable a 3rd party app to obtain access to HTTP services
Nonblocking i/o in node.js
- event loop
- node is not single threaded
- but there is one javascript thread?
Has a thread pool
JS thread runs on V8 from javascript (so you don’t need to worry about it
"Event Loop”?
*events vs callbacks vs promises vs generators vs ...*
Be careful with
- execution time (never expect it to be consistent
- scope - returning a value or handline exception outside your functional block
- variable sc
ope and closures
- never use any global values
What’s wrong with callbacks
- instead of values we have function calls which can be really cumbersome to coordinate
Pyramid of Doom (nice slide with Street Fighter)
- extremely nested callbacks
Callback Hell
- always have to handle the error callback
<Look at examples when screen isn’t too bright>
async.waterfall? (using async.js library)
Collections
- each, map, filter, reduce, some...
Control Flow
- series, parallel, waterfall, compose...
Modularize
- expose your functions using package based modules
Promises
- hides the complexity of a callback into an object
- represents an eventual value of an asynchronous operation
- the promise doesn’t necessarily yet contain the value
- if it doens’t it must throw an error (most of the time) (it or you?)
- Here we get an object back right away - in pending mode
- The async operation does something and returns a value (fulfilled)
- The async operation fails and you will get an exception
- If you don’t respond to an exception, it will flow to anyone listening for an error (ie catch?)
Control Flow
- then - access value/reason
- all - wait for several promises
- race - wait for the first fulfilled promise
- catch
cascades in a linear way, rather than a nested way
Rule: From a promise... always return a promise if you don’t want to be in trouble (for error handling?)
(use a .catch after the last promise)
Always expose your package api as callback-based function
It’s a standard!
But no one prevents you to also return a promise ;)
Which will be standard with ES7?
Generators - ES6 feature
function* keyword?
yield (keyword)
Q.spawn?
blocking is easy
Not promises,
Not callback
Problem is we need an iterator... Not the same code, but I can read what’s going on
In node since v0.11.2
In chrome since 8.3.19
requires --harmony or -harmony-generators params
generators aren’t only iterators, you can push values into them as well to communicate between two places in the code
Like to see async/await keywords coming with ES7 (this is the future, but it’s not there yet - from .net and C#)
Async/Await
- Use babel experimental transpiler (to convert to C code and run there)?
What about “Go” from node.js (using channels to communicate between different parts of the code)
Modularize
- maintenance a lot easier
- promises and callbacks
- unit testing
Links
- developer-autodesk
-
Node vs apache
- apache is good as quick out of the box server of content
- if you want to use a language like php or python, you have to do a lot of more configuration
- lots of configuration with apache
- we can kill apache very quickly with DDoS (node copes better)
- good with CPU intense operations
- node, whatever you do, serves static or native javascript - node less than an hour to set up a server
- quick with heroku
- quick to get server up and running
- for CPU intense operations (need to delegate to someone else)
- good for writing webapps
- same code frontend and backend
- google V8 engine is very fast, so performance is good vs other scripting languages
npm-js.org (lots of libraries available)
Cyrille Fauvel, Senior Manager, Autodesk
Sumit Amar, Director of Engineering, Electronic Arts
Resources (tab)
Chrome Advanced tooling
chrome://about
chrome://memory-internals (and chrome://memory
- different pid for each tab
- similar to task manager - but with a lot more data
chrome://webrtc-internals
chrome://blob-internals (saved heap snapshots)
Remote Debugging in Safari
Firebug lite on a mobile device?
Metrics are key from the start.
Segment.io (mvt framework?)
Eye tracking metrics from a usability testing lab.
Tweaking animations in realtime in chrome?
Make sure you know your target audience.
Leverage open source software.
Online tutorials of chrome dev tools.
Bandwidth atenurator CHROME DEV TOOLS.
Github is a breakthrough.
Bootstrap, React.
Stripe?
Forecast.io?
Google for performance...
Skack communitues are good to follow.
Radware does adaptive techniques...
Sean Allen, Kent Alstad, Courtney Hemphill
Radware does adaptive techniques...
Jafar Husain, Cross-Team Technical Lead, Netflix
Arrow Functions =>
function* and yelid keyword
How it works
Effectively a state machine - turned into by the compiler
Fibonnacci using this is cool (can use while true with yield, will compute forever!)
Iteration
Consumer and Producer
The Consumer pulls values out of the Producer until the Producer says they are done.
If generator functions return Iterators... why are they called generators?
Made of up a generator and an observer
Can take a value out and push a value in.
Can push a value in or you can push a value or an error in or a vfinal value in.
Really interesting and powerful.
Not just a one-way flow, like an iterator.
Generators allow feeback, both directions! Crazy!!!!!!!!
Waiting with Async Iteration
yield will evaluate to a value... not just a return statement
“Asyncronous iteration"
whatever I push back into the generator replaces the “yeild” portion... the consumer pushes the value in and gets a promise... you can use the value you got from the promise... or you can use a different value...?
Curly braces to declare tuplies
Task.js includes the spawn function (node ..........
Why should waiting be downloaded in a library
ES2016 - async functions
Light syntactic sugar
- spawn → async
- yield → await
Generators are coming in ES 2015
Symmetrical support for blocking and waiting
What’s the difference between an event and a collection...?
It doesn’t have to be that way (they are really the same)..
Events are just collections pushed at as...
Anything you can do to arrays or iterators, are things you can do with collection...
We can be more sophisticated than a bunch of callbacks
ES 2015 is used by netflix in prod by using transpilers
Babel - ES 2015 is totally safe (ES 2016 are not yet fully baked)
Browsers will let you debug in core technology
ES Feature Maturity Stages
0. Strawman
1. Proposal
2. Draft
3. Candidate
4. Finished
The await keyword is great if you want to wait on one value...
increasingly dealing with streams of data (waiting on multiple data)
ES 2015 - all collections are iterable
New for loops (for of loop
for(var x of [123,123,234234]) {
...
}
Future version (might see)
for...on (might be able to “wait on” this)
a loop that waits on values pushing at you
large majorities of code won’t need callbacks at all
The web has NO standard of watching apis?
introducing Observable
- swapped arguments and return type of Iterable
- accepts a generator and returns nothing
- iteration in reverse
Anything you can do in iteration... you can do in observation
Imagin writing sql queries over events...
Declaratively writing queries over
.observer({
regular()
done()
failure()
});
.forEach(regular()).
.then( done(), failure())
ADDING SUGAR TO OBSERVATION SLIDE ^^^^
For loop over an async dom stream
...what should an async function* return?
FUNCTION TYPES RETURN TABLE.... OBSERVABLE IS THE ANSWER... NOT GOING TO MAKE IT IN ES 2016... MIGHT HAVE TO WAIT FOR 2017
PUSH AND PULL ARE SYMMETRICAL (NETFLIX USES IT EVERYWHERE) - THINK OF THEM AS STREAMS OF DATA - USE MAP/FILTER/REDUCE
JHUSAIN/ASYNCGENERATOR
HE WILL TWEET A LINK FOR NEXT JAVSCRIPT
ASYNC AWAIT
RESOURCES
GO GET A TRANSPILER (YOU NEED A BUILD STEP FOR YOUR WEBSITE) - YOU NEED A BUILD STEP FOR YOUR WEBSITE
CODE TO THE TRANSPILER... YOU DON’T NEED OT WAIT
var {x, y} = {x: “hi”, y: “blah”}
Someone asked about typescript (a transpiler ++ and give you optional type stuff)
https://babeljs.io/docs/learn-es2015/
Destructuring allows binding using pattern matching, with support for matching arrays and objects. Destructuring is fail-soft, similar to standard object lookup foo["bar"], producing undefined values when not found.
// list matching var [a, , b] = [1,2,3]; // object matching var { op: a, lhs: { op: b }, rhs: c } = getASTNode() // object matching shorthand // binds `op`, `lhs` and `rhs` in scope var {op, lhs, rhs} = getASTNode()
function* getNumbers() {
yield 42;
yield 32;
return 19;
}
var iterator = getNumbers();
iterator.next(); // {value: 42; done: false};
iterator.next(); // {value: 32; done: false};
iterator.next(); // {value: 19; done: true};
“Returns power back to the user"
“Resumes right in the middle of a function"
Iteration
Consumer and Producer
The Consumer pulls values out of the Producer until the Producer says they are done.
If generator functions return Iterators... why are they called generators?
Curly braces to declare tuplies
Why should waiting be downloaded in a library
(ES2016 - async functions)
Light syntactic sugar
Generators are coming in ES 2015
Symmetrical support for blocking and waiting
It doesn’t have to be that way (they are really the same)..
Events are just collections pushed at as...
Anything you can do to arrays or iterators, are things you can do with collection...
We can be more sophisticated than a bunch of callbacks
ES 2015 is used by netflix in prod by using transpilers
Babel - ES 2015 is totally safe (ES 2016 are not yet fully baked)
Browsers will let you debug in core technology
0. Strawman
1. Proposal
2. Draft
3. Candidate
4. Finished
for(var x of [123,123,234234]) {
...
}
Future version (might see):
The web has NO standard of watching apis?
Introducing Observable
- swapped arguments and return type of Iterable
- accepts a generator and returns nothing
- iteration in reverse
Anything you can do in iteration... you can do in observation
Imagin writing sql queries over events...
Declaratively writing queries over
.observer({
regular()
done()
failure()
});
.forEach(regular()).
.then( done(), failure())
ADDING SUGAR TO OBSERVATION SLIDE ^^^^
For loop over an async dom stream
...what should an async function* return?
FUNCTION TYPES RETURN TABLE.... OBSERVABLE IS THE ANSWER... NOT GOING TO MAKE IT IN ES 2016... MIGHT HAVE TO WAIT FOR 2017
PUSH AND PULL ARE SYMMETRICAL (NETFLIX USES IT EVERYWHERE) - THINK OF THEM AS STREAMS OF DATA - USE MAP/FILTER/REDUCE
JHUSAIN/ASYNCGENERATOR
HE WILL TWEET A LINK FOR NEXT JAVSCRIPT
ASYNC AWAIT
RESOURCES
GO GET A TRANSPILER (YOU NEED A BUILD STEP FOR YOUR WEBSITE) - YOU NEED A BUILD STEP FOR YOUR WEBSITE
CODE TO THE TRANSPILER... YOU DON’T NEED OT WAIT
var {x, y} = {x: “hi”, y: “blah”}
Someone asked about typescript (a transpiler ++ and give you optional type stuff)
https://babeljs.io/docs/learn-es2015/
Destructuring allows binding using pattern matching, with support for matching arrays and objects. Destructuring is fail-soft, similar to standard object lookup foo["bar"], producing undefined values when not found.
// list matching var [a, , b] = [1,2,3]; // object matching var { op: a, lhs: { op: b }, rhs: c } = getASTNode() // object matching shorthand // binds `op`, `lhs` and `rhs` in scope var {op, lhs, rhs} = getASTNode()
https://babeljs.io/docs/learn-es2015/
Destructuring allows binding using pattern matching, with support for matching arrays and objects. Destructuring is fail-soft, similar to standard object lookup foo["bar"], producing undefined values when not found. // list matching var [a, , b] = [1,2,3]; // object matching var { op: a, lhs: { op: b }, rhs: c } = getASTNode() // object matching shorthand // binds `op`, `lhs` and `rhs` in scope var {op, lhs, rhs} = getASTNode()
Automotive Disruption (kitt as disruption)
"Biggest mistake was to look for buy-in from other people. All that matters is that you wake up and take a chance."
“People need other people to believe in them."
Lead Singer - stage presence
Drummer - who’s keeping the beat and making sure things are still running
Cover band or Original Music
What genre of music? Or new type of music?
People who ask for your financials aren’t interested in you.
Never interested on their forecasts, but investing based on the people and their ability to pivot.
Almost every successful company is not doing what they set out to do, but they were able to adapt and find the successful path.
Know within 5 minutes if i want to invest... Then the rest of the 25 minutes is for them trying to convince me that I shouldn’t.
Do what makes you happy. You can always go back to what you hate.
Underground Security
Recon - research, social engineering
Scan/Probe - scan for vulnerabilityies
Gain Access - exploit vulnerabilityes
Main Access - establish persistence
Cover up tracks - delete logs
Threats
- BaaS Service Exploitation
- Social Network oAuth Exploitation
- eCurrency Theft
- HTML5 Exploit Vectors
- MITB (Man in the Browser Malware)
securityscorecard.com
The risk of the third party... only as strong as the weakest link
Brian Krebbs blog?
Github and Dropbox
***Everyone is going to get breached... it’s going to be about how people respond to it...***
What shall we do...?
- as a company?
- as a person with a blog?
- as a person with a personal website?
As a person... what should I be doing to help protect my information.
Just need the last 4 of social (and can be brute forced) - Security questions can all be gleamed off of a credit report...
aheid@securityscorecard.io
www.securityscorecard.com
Default embedded passwords can send booter passwords (router passwords - toasters - etc)
brute forces passwords...
keepass keeypass x
create local encrypted container (local password manager)
windows or mac os should not be used
mac is where windows was 10 years ago...
run a flavor of linux lput a virtual box on it and run terrible vulnerable interface and run it in a sandbox
for developers
- php - rips project - free source code review
- google.com (search owasp source code review (code review project) - www.owasp.org
wordpress
- wordfence (reports and blocks reports) - autoupdating
threatmap.securityscorecard.com
Progressive JPEGs... Good? Evil?
Kent Alstad
StrangeLoop Networks (sold to radware) and accelerates offline
Initial idea - faster the pixels on the screen the better, right?...right?
Images are usually 60% of the total.
httparchive.com (steve souders)
--you can look at for day to day
Progressve JPEGs FTW?
Assumption: that pixels are coming to the screen earlier will be appreciated (not a white screen)
Connected with Neorostrata
Normal way (JPEG loads from top down)
Progressive JPEG (becomes sharper and sharper)
*Stoyan Stefanov*, The Book Of Speed
- Progressive images are better (smaller payload - more on screen faster)
Even webpage test was telling you to convert to progressive JPEG (used to be F if not using them)
Test 1: Facial Action Coding
which type of image, induces the greatest engagement
if you aren’t engaged, then you haven’t registered and are digesting it...
hypotheseis above ^^ +more
said aside "($25 K dollars on these technologies)"
Test:
- original image
- perfect image (lossy image that is carefully degraded using a DCIM (resulting in 5% loss in quality with a much smaller total file size)
-- wepi format
-- progressive JPEG (blurry to less blurry)
Results :
- original
- PI
- PJ
- male vs female (male more flat)
- anomoly on youtube for men...
-- maybe men are more used to progressive images?
photograph in your eye or skin, then blow it up 150x or more, then you can see the blood going through their eye... same on skin (red/white/red/white)
Test 2
Implicit responses
- congruent stimuli vs incongruent stimuli
bold italics
vs
bold italics
pi (pie pye) gaze for i tracking on laptops etc (free? now)
important task is embedded in the image, vs not embedded in the image (mostly text)
Overall
- progressive jpegs for males are bad
Faster doesn’t mean more engaged...
They don’t even use progressive image rendering anymore because it might degrade conversion
Whole industry got it wrong.
Conclusions and interpretations
brain wants to do things in the least way possible
skip to the end
get to the punchline
if you introduce multiple steps
took more brain sugar to view images multiple times? (hypothesis)
brain has more work to do... and it has an easy button... don’t trick the brain with a teaser
can you just bottom line it (yes or no before the explanation)
yes, but here’s my reason
progressive images give you reason first, then give you the answer ☺︎ (talking with wife example)
if you make brain work harder people won’t like it
Suggestions
Different sized well optimized images for different sizes
webperformancetoday.com progressive image rendering good evil
radware neurostrata fall 2014
Takaways
Is faster better? Maybe not...
Where do we go from here?
October, in NY presenting next study...
hypothesis: faster is not always better, processing fleuency
brain processes images
- prototypicality is one of the keys (should look like what you expect it to)
aim for highest process fluency
(tracked heat maps - often used for usability) animated heat maps
hypo: slower web page, but take the elements of it that are important and present them in a way that doesn’t jump around - and keep them in focus
--- don’t use default font first (don’t let things jump around...)?
slower isn’t by default a bad idea
if only we understood websites as well as the guy drawing where’s waldo :)
check out spar.com (from the uk)
Put an image with everything there...
don’t place it and move it around
rotating banner or photoflipper has moved
don’t start the rotaing thing until after the on-load event
general principle
Design for Performance!
questions:
- what was the compression on the original image vs pi? (what if your pi was the same)
- which tool for compressing image (the “perfect image”)
- is using babies cheating... because normally we wouldn’t smile necessarily at a regular page... what about the ignoring the photo example
------ youtube with friendly cats
- when was the test run? (i feel like i’m more used to them now, so i might not be as opposed to them)
- do you think if we train people on progressive images, it will be easier?
260 people