how secure is a mobile website developed using moovweb - moovweb

I want to know, if I am developing some website that involves making banking transactions etc. How much safe is it to develop it in moovweb platform. Does moovweb provides some extra security measures or any external user can hack the layer developed using Moovweb?

Moovweb has been architected with two guiding principles:
Stateless system. The Moovweb Platform does not maintain state; all operations are processed in real time.
Personally Identifiable Information is never stored.
Moovweb is a Level 1 service provider under the Payment Card Industry (PCI) Data Security Standard (DSS) and is HIPAA (Health Insurance Portability and Accountability Act) compliant.

Related

B2B, Are Microservices a bad integration solution?

Is it bad idea to base business to business (B2B) type of integration projects on the microservices architecture?
By Microservices we mean autonomous services directly interfacing with each other by loosely coupled interfaces, typically REST. Dump pipes and smart endpoints. Could this lightweight principle work in the large scale B2B integration? Or is this where the more heavyweight SOA solutions are still more justified?
Consider the X-Road, national service portal of Estonia for example.
According to their web page, "The X-Road is an open source data exchange layer solution that enables organizations to exchange information over the Internet. The X-Road is a centrally managed distributed integration layer between Information Systems that provides a standardized and secure way to produce and consume services. The X-Road ensures confidentiality, integrity and interoperability between data exchange parties.
How would the microservices approach adapt to the integration project of this scale if we ignore juristic requirements for centrally managed gateway? Would it end up as unmanageable without central integration provider and well-defined WSDL contracts? Also, important thing to consider is the identity management and access control across the autonomous systems.
X-Road is the software that is used nationwide in the Estonian data exchange layer X-tee and in the Suomi.fi Data Exchange Layer service in Finland. X-Road is the data exchange layer between the national service portals (eesti.ee , suomi.fi) and various data sources, registries and information systems. Therefore, X-Road and a national service portal are two different, independent information systems.
I think that a contract, an agreement between a service provider and service consumers, is a must have requirement in both SOA and microservice-based solutions. One of the key aspects of both approaches is the ability to deploy services independent of one another. The independence is achieved using versioned and well-defined contracts. The underlying technology and implementation of a service can be changed as long the contract does not change.
X-Road can be used as a data exchange layer for solutions based on both SOA and microservices. Compared to direct point-to-point integrations X-Road implements a set of common features to support and facilitate data exchange. X-Road provides the following features out of the box:
address management
message routing
access rights management
organization level authentication
machine level authentication
transportation layer encryption
time-stamping
digital signature of messages
logging
error handling.
The identity of each organization and technical entry point (Security Server) is verified using certificates that are issued by a trusted Certification Authority (CA) when an organization joins an X-Road ecosystem. The identities are maintained centrally, but all the data is exchanged directly between a consumer and provider. Message routing is based on organization and service level identifiers that are mapped to physical network locations of the services by X-Road. All the evidence regarding data exchange is stored locally by the data exchange parties, and no third parties have access to the data. Time-stamping and digital signature together guarantee non-repudiation of the data sent via X-Road.
In addition, each service published on X-Road must provide a service description, currently a WSDL description. However, a native REST support will be available in 2019 and then OpenAPI service descriptions will be supported too.
No, Microservices is an absolutely fine and cool way of building B2B integration systems because it showcases a lot of qualities that you want to have when building such systems:
Higher fault tolerance via circuit breakers
No domino effect if other systems are down
Eventual consistency
High availability via CRQS and event sourcing.
Ease of maintenance and disposability of sync systems.

Difference among Comet servers and XMPP servers

In my next planned project I suppose to implement an online classroom website in which I want to share a black board (Say a simple text area) among the Tutor and the participating online students {These all are logined through the website}. Whatever the text Tutor writes over the Black board has to be seen by the other participants in Real-time.
I want to use Java as my development platform.
To implement this I started googling on PUSH technology. I read that XMPP implementation servers and XMPP libraries can be used to implement near-realtime applications like collaberative applications/mutiparty games/IM applications etc.,
But I also read about BlazeDS usage for real-time and low-lattency web applications.
My questions are,
what is the difference among these XMPP java based implementation and BlazeDS? Is not both the techs final goal is to achieve low-lattency web apps using PUSH technology?
What is the difference among Comet servers and XMPP Servers? Do they just differ in the way they implement the PUSH technology or any thing else?
I am confused. Please someone explain me these little more so that I will know what I do before I do the things and where to start on next in my project.
Thanks
To answer your first question: No, XMPP's goal is not simply to "achieve low-latency web apps using PUSH technology". XMPP far pre-dates the "realtime web", and is a much more extensive platform than basic comet/push servers.
Features in XMPP that won't typically be in plain push servers include:
Support for non-web clients (including existing desktop clients)
A choice of authentication methods from strong credential-based mechanisms such as SCRAM-SHA-1 to temporary anonymous accounts
Support for federation (communication with other XMPP servers)
Lots of chat-centric capabilities available (contact lists, offline messaging, file transfers) - this can be a bonus or worthless, but most features like these can be disabled in some XMPP servers.
If you are just looking for a component to push messages to website visitors in realtime, and you're using Java which BlazeDS integrates tightly with, then BlazeDS is probably your best choice.
If your push system is part of a larger realtime platform which may involve multiple clients (including non-web for example), multiple languages, and even possibly multiple servers (e.g. you could allow users to use existing XMPP accounts to receive updates) then XMPP is more than likely worth looking into.

What is middleware exactly?

I have heard a lot of people talking recently about middleware, but what is the exact definition of middleware? When I look into middleware, I find a lot of information and some definitions, but while reading these information and definitions, it seems that mostly all 'wares' are in the middle of something. So, are all things middleware?
Or do you have an example of a ware that isn't middleware?
Lets say your company makes 4 different products, your client has another 3 different products from another 3 different companies.
Someday the client thought, why don't we integrate all our systems into one huge system. Ten minutes later their IT department said that will take 2 years.
You (the wise developer) said, why don't we just integrate all the different systems and make them work together? The client manager staring at you... You continued, we will use a Middleware, we will study the Inputs/Outputs of all different systems, the resources they use and then choose an appropriate Middleware framework.
Still explaining to the non tech manager
With Middleware framework in the middle, the first system will produce X stuff, the system Y and Z would consume those outputs and so on.
Middleware is a terribly nebulous term. What is "middleware" in one case won't be in another. In general, you can expect something classed as middleware to have the following characteristics:
Primarily (usually exclusively) software; usually doesn't need any specialized hardware.
If it weren't there, applications that depend on it would have to incorporate it as part of their application and would experience a lot of duplication.
Almost certainly connects two applications and passes data between them.
You'll notice that this is pretty much the same definition as an operating system. So, for instance, a TCP/IP stack or caching could be considered middleware. But your OS could provide the same features, too. Indeed, middleware can be thought of like a special extension to an operating system, specific to a set of applications that depend on it. It just provides a higher-level service.
Some examples of middleware:
distributed cache
message queue
transaction monitor
packet rewriter
automated backup system
Wikipedia has a quite good explanation: http://en.wikipedia.org/wiki/Middleware
It starts with
Middleware is computer software that connects software components or applications. The software consists of a set of services that allows multiple processes running on one or more machines to interact.
What is Middleware gives a few examples.
There are (at least) three different definitions I'm aware of
in business computing, middleware is messaging and integration software between applications and services
in gaming, middleware is pretty well anything that is provided by a third-party
in (some) embedded software systems, middleware provides services that applications use, which are composed out of the functions provided by the hardware abstraction layer - it sits between the application layer and the hardware abstraction layer.
Simply put Middleware is a software component which provides services to integrate disparate systems together.
In an complex enterprise environment, there are a number of challenges when you need to integrate two or more enterprise systems together to talk to each other. Normally these systems do not understand each others language as they are developed on different platforms using different languages (like C++, Java, Cobol, etc.).
So here comes middleware software in picture which provides services like
transformation of messages formats from one app to other,
routing and enriching messages besides taking care of security,
encryption,
validation and
applying different business rules to these messages.
A typical example of middleware is an ESB products like IBM message broker (WMB/IIB), WESB, Datapower XI50, Oracle Fusion, Mule and many others.
Therefore, middleware sits mostly in between the service consuming apps and services provider apps and help these apps to talk to each other.
Middleware is about how our application responds to incoming requests. Middlewares look into the incoming request, and make decisions based on this request. We can build entire applications only using middlewares. For e.g. ASP.NET is a web framework comprising of following chief HTTP middleware components.
Exception/error handling
Static file server
Authentication
MVC
As shown in the above diagram, there are various middleware components in ASP.NET which receive the incoming request, and redirect it to a C# class (in this case a controller class).
Middleware is a general term for software that serves to "glue together" separate, often complex and already existing, programs. Some software components that are frequently connected with middleware include enterprise applications and Web services.
There is a common definition in web application development which is (and I'm making this wording up but it seems to fit): A component which is designed to modify an HTTP request and/or response but does not (usually) serve the response in its entirety, designed to be chained together to form a pipeline of behavioral changes during request processing.
Examples of tasks that are commonly implemented by middleware:
Gzip response compression
HTTP authentication
Request logging
The key point here is that none of these is fully responsible for responding to the client. Instead each changes the behavior in some way as part of the pipeline, leaving the actual response to come from something later in the sequence (pipeline).
Usually, the middlewares are run before some sort of "router", which examines the request (often the path) and calls the appropriate code to generate the response.
Personally, I hate the term "middleware" for its genericity but it is in common use.
Here is an additional explanation specifically applicable to Ruby on Rails.
Middleware stands between web applications and web services that natively can't communicate and often are written in different languages/frameworks.
One such example is OWIN middleware for .NET environment, before owin people were forced to host web apps in a microsoft hosting software called IIS. After owin was developed, it has added capacity to host both in IIS and self host, in IIS was just added support for Owin which acted as an interface. Also it become possible to host .NET web apps on Linux via Mono, which again added support for Owin.
It also added capacity to create Single Page Applications, Owin handling Http request/response context, so on top of owin you can add authentication/authorization logic via OAuth2 for example, you can configure middleware to register a class which contains logic of user authentification (for ex. OAuth2 implementation) or class which contains logic of how to manage http request/response messages, that way you can make one application communicate with other applications/services via different data format (like json, xml, etc if you are targeting web).
Some examples of middleware: CORBA, Remote Method Invocation (RMI),...
The examples mentioned above are all pieces of software allowing you to take care of communication between different processes (either running on the same machine or distributed over e.g. the internet).
From my own experience with webwork, a middleware was stuff between users (the web browser) and the backend database. It was the software that took stuff that users put in (example: orders for iPads, did some magical business logic, i.e. check if there are enough iPads available to fill the order) and updated the backend database to reflect those changes.
It is just a piece of software or a tool on which your application executes and rapplication capabilities with respect to high availability,scalability,integrating with other softwares or systems without you bothering about your application level code changes .
For example : The operating system on which your application runs requires an I.P change , you do not have to worry about it in your code , it is the middleware stack on which you can simple update the configuration.
Example 2 : You experience problems with your runtime memory allocation and feel that the your application usage has increased , you do not have to much about it unless you have a bug or bottleneck in your code , it is easily achievable by tuning middleware software configuration on which your application runs.
Example 3 : You have multiple disparate software and you need them to talk to each other or send data in a common format which is understandable by all the systems then this is where middleware systems comes handy.
Hope the information provided helps.
it is a software layer between the operating system
and applications on each side of a distributed computing system in a network. In fact it connects heterogeneous network and software systems.
If I am not wrong, in software application framework, based on the context, you can consider middleware for the following roles that can be combined in order to perform certain activities in between the user request and the application response.
Adapter
Sanitizer
Validator
I always thought of it as the oldest software I have had to install. The total app used a web server, a database server, and an application server. The web server being the middleware between the data and the app.

3-tier architecture

Why do we use three tier architecture?
Here are a few possible reasons: client/server doesn't work well over the Internet, doesn't scale as well, and is harder to secure.
In the web development field, three-tier is often used to refer to websites, commonly electronic commerce websites, which are built using three tiers:
A front-end web server serving static content, and potentially some are cached dynamic content. In web based application, Front End is the content rendered by the browser. The content may be static or generated dynamically.
A middle dynamic content processing and generation level application server, for example Java EE, ASP.NET, PHP platform.
A back-end database, comprising both data sets and the database management system or RDBMS software that manages and provides access to the data.
The End-To-End traceability of n-tier systems is a challenging task which becomes more important when systems increase in complexity. The Application Response Measurement defines concepts and APIs for measuring performance and correlating transactions between tiers.
To keep the Internet away from machines that have no business being there.
Internet | Firewall | Load Balanacer | switch | <-> Web <-> Application <-> Database

What is the difference between ASP and SaaS models?

I am interested in finding a business model for a software product (iprocurement). However, I got quite confused between ASP (Application Service Provider) and Saas models. What are the differences?
Thanks in advance.
Though medium of delivery is the same i.e. internet, ASP takes a packaged-base approach while SaaS takes product approach. ASP provider need not be a manufacturer of the product. He can be a trader or a middleman who takes the responsibility of selling it and customising and implementing it when required. On the other hand, a system based on Saas model had been designed, built, delivered, configured and implemented normally by a single party who has total control of the system.
In case of ASP there can be multiple instances (or implementations) of a software running on a single server, suitable as per customer needs while in case of SaaS, a single software will serve to many clients allowing them to configure the service as per their requirement.
The fundamental difference is how software is built and used. ASP follows traditional development with a twist when it comes to deployment. It is built on data centric and it is deployed as an application with a centralized host sever. SaaS is built on service centric and deployed as web services.