Apparently there are issues with inexperienced developers, there are issues with the cross-site scripting, there are issues with Web services. Even Jesse James Garrett who founded the term AJAX said there are a lot of issues and we're going to have to almost patch them one by one. So how can people rely on AJAX if it's got all these security issues? I talked to one AJAXWorld attendee yesterday, and she said she wasn't using AJAX yet, but the one thing she knew was that it apparently had a lot of security concerns.

So there are security concerns. Actually, if you look at the security concerns you have when doing Web services, there actually was work done for Web services in the area of WS-Security. A lot of folks who are looking at this are looking at it for the first time. Well, the folks that actually have looked at service-oriented architecture said, "Well, if I'm actually going to start calling something, I want to, No. 1, ensure that I can call the resource, and then if I can call the resource that I'm actually entitled to, go deeper and actually access the data." The second piece of this is this cross-site scripting; this has been a known problem in the Web, and it's a server-side problem that people have been dealing with.

Now, the other issues that you start looking at in the area of mashups, again, this is -- you're absolutely correct. You have people that are writing JavaScript that don't really know how to write it, and if you create a mashup, you could end up with a serious problem. Now, if you look at the mashups that have been created up to this point, they've been done by very highly skilled and very knowledgeable Web programmers who know what they're doing. Now, one of the reasons why we founded OpenAjax was this exact problem was when Scott [Dietzen, CTO of Zimbra, who helped co-found OpenAjax,] and I looked at this problem in late 2005, we pretty much decided that the number of problems that would be confronting people, you'd probably find one in 40 developers actually having all of the right capabilities to actually write good AJAX and secure AJAX.

So what are you going to do?

The first thing we started doing is we're attacking the problem not one at a time, we're doing it in multiple fronts. The first thing was, How do we basically build AJAX, and how do we debug AJAX? And how do we see what's going from the client side of this to the server? And that's what IBM was working on, and Bob [Goodman, a senior programmer at IBM,] was doing with the AJAX Tooling Framework.

The second side of this is that we needed to get the knowledge out about what are the issues. You don't want to scare people away, but at the same token, you need to basically educate them. And this, again, was part of this whole side of what OpenAJAX was about. The third side of this is, How do you then look at it from an industry standpoint of coming out with the best practices? So this is a document that people [would] write to give to AJAX programmers. And then the fourth thing is to look for the technology side of it. How can we basically start securing the technology? And that work is under way right now. And [while] there are no great answers at this exact second, there's a very good understanding of the problem, and people are discussing what's the right way to do it.