Custom Flash Remoting Notes

Sometimes you need to build a custom remoting protocol layer in Flash. I had an XML-based one but it was slow. Aside from verbosity, it was slow to process on both sides because XML must be parsed as a whole (stopping is possible through streaming API but not skipping selectively). That costs time and space which one can't afford in use cases like mine. Also, it's rather awkward to add encryption and compression layers transparently on top of XML, awkwardness stemming from having to use HTTP headers to get the job done.
In my use case, most of the payload was intended to opaque to the server because the server acts only as a distributor. Server just reads what's on outside of the box, saves a time limited copy for latecomers then forwards the box to destination clients without knowing what's in the box. This means I can compress the content if it's big enough. I can also encrypt it using a symmetric key then encrypt the key for each intended audience with their respective public key. Each step adds only a sticker ("Inflammable!") on the box. Archiving is done by a server-side subscriber that saves anything with a specific sticker.
I suppose I could have used Flash's built-in support for remoting but it was tedious to figure it out enough for me to use. Breaking things down to headers and bodies is easy but figuring out headers I need to support and handling body and result the way Flash expects is non-trivial and unnecessary in my case.
So I built my own and it's looking fast and flexible enough for my app. Here are some notes from my workbench:

  1. Java Preferred – Adobe's server teams use Java so a lot of Java leaked into serialization API and encoding format. You'll find it somewhat easier to build the server-end in Java.
  2. writeObject saves space – most of IDataInput and IDataOutput methods writes out data as-is. writeInt will write out 4 bytes. To write out in compact AMF3 format, use only writeObject. Rest of the methods will be necessary if you are using non-Flash object serialization like that of Java's built-in object serialization.*
  3. Use registerClassAlias – [RemoteClass(alias=…)] trick seems to work only when Flex classes are used.
  4. ActionScript is single-threaded – a fact that both simplifies and complicates. Very forgettable too.
  5. ActionScript is not Flash – ActionScript runs inside Flash but the two are not the same. For example, Flash may have other threads than the one ActionScript is on.
  6. Flex is not Flash – Flex adds a boatfull of ActionScript classes, source of much but not all of which is included in Flex SDK. Each Flex class you use will add byte codes to the output Flash movie and class dependency will often result in surprising size increases.
  7. Watch your weight – A minimal Flex app weights around 100K. A few more lines and, wham, your app is 200K. If you don't use any Flex classes, you only have to worry about embeded resources. My custom remoting fancy app with encryption and compression is about 40K and loads seemingly instantly.
  • One problem with using IExternalizable is that AMF3 doesn't offer no hint as to where externalized object data ends because a matching Java class is expected 'know' internally. You'll have to write ObjectInputStream equivalent for AMF3 or, if your AS3 class hierarchy is simple, add the hint yourself. I do this by adding an intermediate serialization step using an interface like this:
    public interface Shareable {

      function readAMF(input:Array);

      function writeAMF(output:Array);

    }
    readAMF() implementations just shift() values out in turn and writeAMF() does the opposite by pushing values into the array in the same order. In writeExternal(), writeAMF is called to build an array of data across class hierarchy then it's written out together. Equivalent is done in readExternal(). This way, server-end logic gets not only simpler but need zero knowledge about client-side classes.
    That's it for now. There are other Flash related funkiness I can enumerate but where is the fun in that? ;-p

Cute Overload Babble

Cute Overload is on my daily visit list because I love pets and a quick dose of cute animals has become a morning routine for me. But, being a grouch by nature, I have a couple of complaints with Cute Overload.
First, I can't decipher the poster's babytalk-style writing. Second, I want more background story or pointers to the source. Videos of cat-chasing turtles is worth some hee-hees and ha-has but I want to hear from the pet owner and stories of each pet weaved into a series so I can have some ahs and woos. Instead, all I get is a handful of mutilated words. Babytalk is fine for babies but how am I suppose to understand the ct'zy w'zy booboo?

Flash 9 AMF3 Bug?

Looks like I hit a design bug in Flash 9's AMF3 encoding and checking the sources of AMF3 deserializers out there tells me that the Array related condition this bug affects is not being handled properly, probably causing Flash servers to throw up mysteriously and leave developers scratching their heads.
An array in AMF3 can be either a list of typed values or an associative array of name/value pairs. The former has entry count greater than zero and empty key. Later has zero entry count and non-empty key. So far so good although I see no good reasons for them to squeeze the two under one type code (9).
Problem starts with special cases. Empty arrays have zero entry count and empty first key without subsequent data. Associative arrays with a name/value pair with empty name also starts with the same sequence of bytes (09 01 01). I don't see a way for deserializers to tell the two apart.
To be more specific, following two arrays are starts with same 3 byte sequences when encoded in AMF3:

var array1:Array = [];

var array2:Array = new Array();  array2[""] = 1; array2["2"] = 2;

<p>I am too lazy to file a bug report so this blog post is the equivalent of yelling at the end of my driveway in pajamas. Can someone from Adobe confirm? How am I suppose to handle arrays starting with 09 01 01 byte sequence when the array is not at the end of the payload?
My apology to non-geeks for this blatant display of geekery.

Colbert vs Rain

If you missed it, checkout Colbert making fun of Rain, Korean pop star, and his version of one of Rain's video in which he is singin' in Korean. Very funny. I was getting tired of his political jokes so I am happy to see him spread his 'love' around.
What's even more funny is that Koreans not familiar with Colbert's brand of humor think Colbert is insulting Korea. We need Fair Trade agreement on humor! ;-p 

East Asian-style Fair Trade Investigated

Businesses in East Asia behave like bird flocks. If you want to sell knives, you have to open your shop in the Knife Street because that's where people go when they need a knife. When a shop lowers prices unreasonably, elders try to talk sense into the shop owner. When that fails, everyone is expected to work together to ruin the shop out of the neighborhood. Why? Because the store is ruining their business with unfair trade.
That's the East Asian concept of Fair Trade. So it's not surprising that FTC is investigating six South Korean portals.

Inside JavaFX

It was difficult to learn what JavaFX exactly is from tech journalists beyond strategic dribble and comparisons to Silverlight and Apollo so I went searching.  From news articles, I thought it was just an announcement. Surprise! You can download the full source code and documentations, plugins for Eclipse and NetBeans, demos, and tutorials right now at OpenJFX.org website.
So what is JavaFX? This is what it looks like:

import javafx.ui.*;

Frame {

  title: "Hello World JavaFX"

  width: 20

  height: 50

  content: Label {

    text: "Hello World"

  }

  visible: true

}
      As you can see, JavaFX script (*.fx) is basically JSON-like version of XAML which can be either compiled into Java bytecode or run as is using a java-based JavaFX player. Since JavaFX is just java, it can run as applets in browsers, midlets on mobiles, and applications on WebStart.
    Hmm. Technology itself is not new but it seems to be more polished than I have come to expect from Sun although I think Sun will have trouble attracting developers without tools for non-programmer. I wish them luck nonetheless. 
 <em>Urgh. Looks like I need to fix page styling.</em>

Update: Sam Ruby has more on savory dynamic features of JavaFX scripting language which I neglected to mention.

Technorati Authority Needs Categorization

Yesterday, I noticed that Technorati replaced "X links from N blogs" with Technorati Authority numbers. My TA is 542 which isn't bad for just having a habit and a temper. Their use of the word authority is questionable but then words can be stretched like spandex pants as long as no one is wearing them (read trademark) so I won't complain.
However, I think lumping every subject into one basket degrades even the loosy goosy way Technorati is using the word authority. They need to categorize authority by subject of interest so that authority in technology is different from authority in fashion.
There are many ways to do this but I think the simplest approaches are opt-in, leaving over-all authority as General Authority. Let blogs spell out what their subjects are with natural penalties for blogs covering too many subjects to curb abuse. There are many variations and tricks that can be thrown to spice it up a bit. To get it started, open a wiki to let people fight over the list or hierarchy of categories.

S3 and EC2

I have a small webapp that I am in midst of launching. I think it fulfills a common need effectively yet is dead simple to use (at least my wife and son didn't need any instructions). One problem the webapp has is that it needs to ping the server once a second or so. Storage wise, I am expecting 50K per session so it's not unusually high. Even with smart ping rate logic, server load will be much higher than your average webapp.
During a chat with a friend, S3 came up (I keep forgetting) so I quickly found a way to shove most of the server load to S3. But I overlooked the 1 cent per 10K request cost. Assuming average of 100K active sessions, S3 will get hit with 100K requests per second which will cost me well over $8000 per day just for requests. Since most of the unpaid-for-data won't survive more than 24 hours, storage cost is bearable and so is the transfer cost because most of those requests will return nothing. I know that 100K simultaneous users is rather high but that's the bill I will have to face if I get slashdotted, farked, or digged and I do expect the webapp to be popular enough to get that kind of load.
Thankfully, EC2 doesn't have request-related cost so I am going to look into that. I am concerned about reliability though since they are still in beta phase. At worst case, I am going to launch with a handful of dedicated or co-located servers which should cost me about $1000 per month then add as demand increases. If you have good suggestions, let me know. Come to think of it, my webapp's requirements are similar to applications like Hive7 so I'll be asking them as well.

I Don’t Digg 09ers

I pretty much ignored the clamoring over Digg censorship of DVD key numbers but Ed Felten's attempt to explain why so called 09ers revolted got my goat.
To me, publishing such sensitive key is no different from publishing credit card numbers, social security numbers, or passwords. They are all just numbers or random sequence of ASCII characters. No one owns them and they are of little value if they are not associated with anyone or anything. But if they are associated with a person, I don't think anyone will find it outrageous when they are asked to remove the sensitive information from public view.
Digg's post associated a sequence of numbers to a key that'll allow people to access valuable property and share it with people who didn't pay for it. The hacker who uncovered the key justified his action saying the DVD he bought didn't support his monitor. The right thing to do would have been to return the DVD for a refund. Instead, he chose to hack and then shared what he found with strangers.
Kevin Rose became a fool by [sorry, a gremlin escaped] was unwise to answer foolish demands from Digg users, placing his company at the mercy of its users' whims. There is value in a community of users. There is less value in a community of hooligans.