funkatron.com

We don’t sign Spaz with a code signing certificate generated by one of the 4 (as of this writing) certificate authorities Adobe accepts. This means that when you install Spaz, you get a scary “Publisher:UNVERIFIED” warning. This is why we don’t sign, from a letter I wrote when asked about it in Spring 2008:

If I sign Spaz with a paid-for Thawte cert, I am on the hook every year for a Thawte cert. I can’t change my cert signer or go back to a self-signed cert without breaking auto updating (at least as I understand it), and I’m therefore locked into a $300 expense every year. That’s not terrible for a commercial app backed by a company, but that’s a pretty significant chunk of change for a free, open-source app developed by one person as a hobby to lay out.

I’m familiar with how certs work, and how Thawte handles certification as compared to other, less expensive cert vendors. Were I convinced that Thawte did some kind of verification process/background checking on the applicant I could see the value, but at least with SSL certs, they certainly didn’t do anything more than vendors who donate free certs to EDUs.

Currently, there are 3 other CAs in addition to Thawte, and the prices range between $180 and $300 per year. Some of these CAs do seem to do a little more background checking. Still, the same arguments apply, especially the one related to cost.

Spaz doesn’t generate revenue, and relies on donated time from myself and a handful of other generous folks. Committing to a yearly expense in the hundreds of dollars seems unwise.

If this is something you would like to see change, I’d encourage you to ask Adobe to make code signing a realistic option for Free, Open-Source Software like Spaz by providing certificates free-of-charge – after a reasonable review process – to projects like ours.

As I’ve mentioned in the past, I’m currently working on a new project that’s been taking my time away from Spaz. While most details are still under wraps, I can say now that the new project is a version of Spaz for mobile devices. Rather than a port, this is a whole new codebase that takes advantage of all the stuff I’ve learned writing Spaz for AIR.

While I will still be working hard on the mobile app for at least another month, I have been thinking a lot about where the desktop app should be going. Here’s the plan:

• Version 0.8 will be the last version of Spaz using the current codebase. We are currently being held back by the design decisions I made, and they need to be tossed. Versions 0.9 and later will be based on a complete rewrite of the codebase. It will use an MVC-style pattern, and will be powered by the SpazCore component library. SpazCore being worked on now, and is hosted on GitHub at http://github.com/funkatron/spazcore/.

• I may switch from the AIR platform to Titanium for the new Spaz codebase. I am still weighing this decision, but I’m very interested in TI, especially after having the opportunity to meet the development team last week. They have a very strong platform, and their approach is very much in line with the “Spaz philosophy.” http://titaniumapp.com.

• Feature-wise, I’m targeting all¹ existing features, plus:

  • multiple instances of the “main” windows (basically the current Spaz window, multiple times for multiple accounts)
  • multiple search windows with auto-updating results
  • less reliance on the web site for user and message details

Spaz should still be very suitable for average Twitter users (under 100 friends), but will also offer powerful search features for folks who need them. And of course, Spaz will still be completely open-source under a New BSD-style license.

Questions? Comments? Post them in the Google Groups thread

I’ve been developing with AIR for over a year now. It’s all been HTML/JavaScript apps, but the complexity of most of them has been pretty low. Spaz, the Twitter client I created, definitely isn’t simple, though – mostly because I’m kind of a crappy coder, but also because it just does a lot of stuff.

Lately I’ve been getting a little bummed about AIR, because I’m starting to bump into limitations of the platform more and more. What’s particularly frustrating is that some of these limitations are specific to HTML AIR app dev. So what follows is a couple of issues that have been particularly troublesome when developing Spaz and other HTML/JS AIR apps.

AIR gets greedy under OS X

Julien Viet, who has contributed significantly to Spaz, made a post recently about the base resources used by the AIR runtime. In it he finds that the basic “Hello World” sample app provided by Adobe used about 20MB of RAM, and hovered at about 2% CPU usage even when idling. I replicated these tests on my Macbook (2.2Ghz, 4GB) under OS X 10.5.4 and WinXP SP2, and had similar results:

I also created a Flex-based “Hello World” application to compare base usage if the Webkit renderer isn’t being used. Memory usage was slightly lower, but otherwise it was comparable to the HTML app.

The constant CPU usage seems to be specific to OS X: WinXP will jump back and forth between 0% and 2%. This is consistent with my observations of CPU usage in Spaz as well: in OS X, we get 10-15% CPU usage constantly, but under XP and Vista, CPU usage is 0% while idling. Initial memory usage is also about 30% higher with Spaz under OS X than it is under Windows. Something is goofy with AIR on OS X.

That aside, I don’t think the memory and CPU usage of AIR are surprising, considering the technology. AIR is a full Flash runtime, and HTML apps add a Webkit renderer on top of that. The memory and CPU usage is in line — or a bit lower — than most SSBs. Using traditional browser tech to build a desktop app is going to be a tradeoff in terms of memory and CPU usage, just like many other technologies that make development easier. But for one reason or another, the expectation seems to be that AIR is a lightweight technology, and it’s really not.

AIR HTML apps are leaky

What is particularly problematic is that there seem to be memory leaks within the Webkit engine as used in AIR – or at very least, it’s pretty easy to leak memory. Apps like Spaz run into this problem because it’s constantly pulling in large amounts of new data and images, and is often left running for hours or days on end.

Some of this is almost certainly because you can get away with that kind of thing on a web site, where users are unlikely to leave a single page open for days on end. Even if a web site does causes a big leakage, the browser almost always gets blamed. The libraries and tools available for HTML/JS devs, being browser-focused, typically don’t pay much attention to long-term performance issues.

Essential tools, like profilers and step debuggers, are non-existent

But memory leaks are a problem for most desktop app developers. That’s why memory profiling tools are common in desktop frameworks. And Adobe certainly understands this to be the case with Flex, as it’s FlexBuilder 3 IDE ships with memory and peformance profiling tools, as well as a full-featured debugger with breakpoints et al. That’s perfect if I was writing something in Flex, but it is completely useless for HTML/JavaScript AIR apps. I was able to get Spaz to run from within Flex Builder with a tiny bit of hackery, but the profiler gets no information about what’s going on within Webkit.

Other common choices for debugging web apps aren’t available either: Firebug is Mozilla-specifc, and the Drosera debugger and Web Inspector tools can’t hook into AIR’s Webkit instances. The information on Drosera does say:

In WebKit there is a WebScriptDebugServer which is started when WebKit starts and listens for a DCOM connection. Once a connection is made it will begin to interact with Drosera via Drosera’s ServerConnection class. WebScriptDebugServer informs Drosera about every line of JavaScript executed.

I would assume that WebScriptDebugServer exists inside AIR’s Webkit, but AFAIK this has not been utilized in any way. Adobe does have a nice AIR-specific tool called the AIR Introspector in the SDK, and it does offer some very useful functionality, but it too lacks step debugging and profiling capabilities.

That leaves us with good old console logging as our only option for debugging AIR HTML apps. That’s okay for simpler stuff, but tracking down execution bugs in more complex applications becomes extremely tedious. And console logging is basically useless for memory profiling, as there’s no insight into the underlying operations of Webkit.

I’m proud of the work I’ve done on Spaz, but as the application has grown in complexity, I’ve found the limitations of HTML app dev in AIR more and more problematic. Adobe has consistently stated that the HTML dev side of AIR is as important as the Flash/Flex side. To quote Mike Chambers:

Adobe AIR is as much about JavaScript, HTML, CSS, etc… as it is about Flash / Flex. #

If that truly is the case, Adobe needs to commit to providing a toolset for HTML/JS developers comparable to what Flex developers have. Until that’s changes, Mozilla’s XULRunner and Prism platforms are looking more and more appealing.

It’s been many months since I’ve posted about Spaz here, but I’ve actually still been working on it quite a bit. Spaz recently had its 1 year anniversary, which is a pretty good milestone for one of my projects – I usually lose interest well before this. Not only is Spaz one of the oldest Twitter desktop clients still under development, but it’s also one of the few FOSS clients. I also believe Spaz is one of the most sophisticated AIR HTML apps out there, and is a good example of what can be done with HTML and JavaScript on the desktop.

The newest release of Spaz, which came out a couple days ago, adds some significant new features:

• Image uploading via Twitpic.com
• Crossposting support via Ping.fm. Try beta code “vivalaping”
• Support for microblogging services with Twitter-compatible APIs, including Identi.ca
• A Dock icon badge with the unread message count. This is probably less significant if you are not running OS X.

You can read the whole fat list of what’s new. Also, if you want to talk to other users or help with development, here are some resources:

• Spaziki – The Spaz Wiki and FAQ
• Spaz-users Google Group
• Spaz-SVN Google Group
• IRC: #spaz on irc.freenode.net

I’m not dead — I’m just busy. Spaz has had a few long-standing issues since the upgrade to AIR Beta 2, and this new version (0.3.0) fixes many of them. If you already have Spaz, just go to the Prefs tab > Upgrades > Check Now. If you don’t have Spaz installed, you can install it from the Spaz homepage.

Here’s a breakdown of what’s new in 0.3.0:

3.0 (2007-10-30)

• All timelines now retrieve all data, not just from last 24 hours (including DMs, @s, sent messages, followers/following lists)
• New theme: “Dumb Terminal.” Works best on Windows with Bistream Vera Sans Mono or Iconsolata font; OS X has readable mono fonts by default
• New window behaviors: Minimize to systray (on by default), minimize when in background, restore when in foreground
• Added Native Shell Menus under OS X
• Added System Tray Icon in Windows w/ context menu
• Added Dock item menu
• User-defined CSS tweaks file now works again
• Tweets can now be “selected.” Hit ‘@’ (SHIFT+2) to send reply to selected tweet’s user
• Prefs that require restart to be applied are now indicated
• Better descriptions of data retrieval errors; should properly determine if response timed out or if request limit is exceeded
• Fixed charcount to reset properly after successful send
• Added simple DOM context menus - currently allow user to copy URLs to clipboard
• Use ‘-khtml-user-select’ to limit selectability of elements; should eliminate many problems with onlick operations
• Popup panels should work a bit better; center properly and drag more easily. Popup panels will be moved to modal windows soon
• Upgraded to jQuery 1.2.1
• Dumped Interface lib, added jQuery.UI lib
• Fixed size of protected post icon
• Lots of code cleanup and refactoring

I’ve also created a simple screencast in Jing to show off what I think is one of the coolest, most underused Spaz features: User CSS tweaks. It lets you load up your own CSS file to modify the current theme. If you don’t like the font size or a color, you can change it yourself, without having to author a whole theme.

• Screencast: UserCSS in Spaz - a simple example (Flash required)

I didn’t record any audio with this screencast, as I didn’t have a decent mic handy. Hope it’s still helpful!

As always, direct bug reports, questions or suggestions to Spaz at Twitter.