I heavily admire the concept of opensource and opensource community. Firstly what is the meaning of the term “OPENSOURCE”?
According to the opensource.com which is backed by RedHat[1], a program, software or software stub which gives the freedom for anyone with interest to inspect, modify and enhance can be put under the opensource category.
The very next question is, what is the claim of the developer who releases open source solutions. In other words, the legality aspect of these softwares. Every opensource software has to follow a set of standards from Open Source Initiative (OSI) and also OSI themselves issue required licensing for them. If you thinking of republishing an opensource software under your name you might think twice and check with OSI.
Let’s come to our original discussion, even though those solutions are freely available to hands-on by anyone, those solutions must be revised, update, manage their lifecycles and stack together to expand the capabilities. Due to that, there is neediness of a well-defined “FRAMEWORK FOR THEIR GOVERNANCE”. My intention throughout this post is to dive deep into the topic of “Framework for Governance in Open Source Communities”. The primary Article I have referred is Framework for Governance in Open Source Communities by Christoph Lattemann and Stefan Stieglitz (Lattemann & Stieglitz, 2005).
Analysis
In the context of OpenSource, Intrinsic motivation and learning identified as primary drivers.
Note that: Unlike proprietary domain which is opposite of the opensource context, the opensource context has no direct monetary intention.
Moreover, a traditional aspect of governance which regards to proprietary domain needs to be reinvented in accordance with an opensource aspect. To be more specific Macro and Micro governance required to be redefined. As a result of that, opensource communities introduce entirely new organizational culture pertaining to business management.
If we revisit the main article referring, the primary intention of the article is to examine central structures and coordination patterns in terms of open source communities.
Analysis 01: Conditions for Governance in Open Source Communities
According to the primary article, opensource licensing is covered under the General Public Licence (GPL). As mentioned earlier, the following has been identified that, to differ from proprietary context,
Free on permission to propagate software
Source code is to be available with zero cost
Source code is adoptable
Free licensing scheme to be provided for the end-users
Even though the common product is released by the community itself, stubs of the solution are heavily decentralised. For example, one of my favourite opensource projects is Kubernetes which is container orchestration solution originally introduced by Google. Even Kubernetes introduced by Google, Its features are redefined by various entities. For example, to manage the load balancing, proxying and routing external traffic to Kubernetes cluster, it uses a component/module call ingress controller. This particular module provides a couple underlining technologies to be used. These modules are from different entities either from the opensource or proprietary base such as
If I am generalising the factors from the original article, opensource products,
Keep enhancing by the contributions from the communities
Solutions itself stub into subprojects and develop by the various entities
Development of Individual sub stubs of the project is decentralized
An Opensource Project is consists of heterogeneous member groups where every group has their own primary motive in regards to the project. If we revisit to our previous example, each implementation (NGINX, HAProxy, Gloo, etc.) of Kubernetes Ingress module has to maintain their own life cycle.
Group of Programers required to develop the product, Group of Bug fixers supposed to attend the bugs and also in fact even it does not explicitly mention in the article, in my perspective separate teams of expertise are required manage documents, releases and quality control.
Note that: Each group have their own hierarchy pertaining to their object.
If we take a proprietary software, the stage of their life cycle is clearly identified and documented. According to the main article, since the opensource projects have no intentions regards to monetary aspects, the opensource organization seems to neglect the requirement of having a proper identification of the stages of their lifecycle. But according to the main literature, the lifecycle of an opensource project or organisation consists of the following phases,
Introduction
Growth
Maturity
Decline or Review
Even facts state that, in my opinion, the Opensource community itself moving towards to adopt their form of formal lifecycle management. Top-level bodies of the communities are trying to formally specify the stages of their life cycle. For instance, major project open source project like Kubernetes, Asterisk[4] and Docker[5] have taken this is to their serious consideration and no doubt that these projects may expand to more than a handful of generations. Apart from that, projects like Cyclone which I have referred a few years ago regards to mitigate vulnerabilities on C programming has come to the end. A question just pops into my mind, could they continue their life cycle if they could maintain the lifecycle more formally?
Note that: almost fifty percent of the opensource project was abandoned in their initial stages (Gordon, 2013)
Analysis 02: Governance in Open Source Communities
Lattermann and Stieglitz trying to discuss the opensource governance as a toolbox for control, supervision and monitoring.
The primary motive of the proprietory domain is the monetary value (aka profit) which is not suited for the organisations those which are based on voluntarily works. Even though I do not prefer to define that Open Sources projects are voluntary efforts rather than an art of enabling society to develop by themselves, since open source projects have no monetary incentives aspect, technically the word voluntarily is suited in the context.
Major stakeholders of a conventional organisation are,
Investors
Owners
Employees
Partners
And maybe their clients
But in opensource domain stake holders are consider the as heterogeneous community. Thus unlikely properly established organisations, when it comes to the definition of policies, policies ought to serve the interest of the community. Rather than that, my opinion towards this is, even it served the aspects of community interests, policies must adhere to overall legitimacy.
In the opensource domain, unlike the conventional organisation structure, the reward for the efforts is motivation. Here I am constructing a theory that opensource knowledge markets like Git repository, Stak Overflow or other opensource forums as a form of motivation even though their primary object differs from that.
It is vital to consider that the opensource communities are based on heterogeneous of individual from various backgrounds. As the main example in “Analysis 01: Conditions for Governance in Open Source Communities” section, even though Kubernetes originally designed by Google, now maintained by Cloud Native Computing Foundation (CNCF). CNCF has its own governing body which comprises the expertise from the various domain. (Linux Foundation, 2020)
Conclusion
Even though open sources communities are not required to organise as conventional organisations, they must have their own governing scheme to adhere.
A mechanism of social control is vital to be implemented. For example, in earlier, it has mentioned an opensource project call Asterisk. Asterisk community is allowed to change Asterisk’s source code but with this freedom, white labelling the product is not tolerable neither ethical. Thus trust is one of the foundations of the opensource community.
Have you ever heard about DockerCon, KubeCon or CloudNativeCon? These are real opensource events that discuss their new releases, bugs update and knowledge sharing. Further, enable community members to gather and have a friendly conversation. These events, according to the primary article there the rituals where motivate people on those specific opensource technologies.
Neither Sanction nor Bonuses are not fit to opensource culture, it is all about the motivation. Big Kudos for the good work and do criticize when something is not appropriate. Most of the high-value open source projects usually do have some sort of peer-reviewing strategy implemented to regulate the inappropriate interaction.
Since I have mentioned the word “inappropriate” earlier, I think it is better to elaborate more on that. According to the context “inappropriate interaction” can be defined as a violation of community ethics. For example, one of the simple and generic mistake people do when asking a question on an online forum, they do not use proper labels. Labels are to help the categorisation and make the forum post visible to correct entities. And also it is helpful for the people who might have the same problem in future. To regulate that most of the new forums tend to enforce the writers to put correct label on it. Please see the figure below which is from the official Kubernetes GitHub repository.
It is not practical to define a systematic approach to opensource governance yet it is ideal to follow the best practices where learn from the previous exercise.
References
Gordon, R. (2013, 08 06). 6 Things to Know About Successful (and Failed) Open-Source Software. Retrieved from MEDIASHIFT: http://mediashift.org/2013/08/6-things-to-know-about-successful-open-source-software/
Lattemann, C., & Stieglitz, S. (2005). Framework for Governance in Open Source Communities. Proceedings of the 38th Hawaii International Conference on System Sciences – 2005.
Linux Foundation. (2020). Governing Board. Retrieved from Cloud Native Computing Foundation =: https://www.cncf.io/people/governing-board/
Provider of enterprise open source solutions, including high-performing Linux, cloud, container, and Kubernetes technologies ↑
Following text is based on ideological concepts which are put together to define a programming language which supposed to be optimal for programming in the e-commerce domain.
The text itself divided into four chapters,
Chapter 01: Introduction
Chapter 02: Technical Specification
Chapter 03: Discussion
Chapter 04: Reference and Annexures
In technical specifications which explain in Chapter 02 is generalized to the eCommerce domain in Chapter 03.
CHAPTER 01: INTRODUCTION
Introduction
Buying or selling, service or goods through the internet, simply can be called as eCommerce. At the end of 2019, the global eCommerce market had reached $3.5 billion of sales and as a share of global retail, it is 14%. Further, the expected growth end of 2020 is 16%. (Meyer, 2020) On the other hand, even if we could rhapsodize the growth of the eCommerce today as a whole, actual magic happens in underline technologies.
Today’s market there are several numbers of programming languages are available for eCommerce domain. Most of them were general-purpose languages and optimized for eCommerce domain. Some of them were a collection of related technology to address the requirement of eCommerce domain (for an example MEAN stack).
In following text, it will be discussed about an ideological programming language which is specially focus on eCommerce domain. Apart from defined features of a programming language which will be discovered later in this text, following high level features were took in to account,
Security
Responsiveness (interaction handling and interrupts)
Memory management
Interoperability
Modularity
Community and support
The language here in the following discussion should address the common vulnerabilities related programming language. Since this language ought to specialize in eCommerce domain responsiveness for events and interrupts is vital. Further, the language should have the capabilities to stack with other related platforms/technologies and provide end to end support. In other words, language should well-supportive for full-stack development. Language should have minimum dependencies to another relevant component such as libraries. Moreover, it is one of the major concerns of the founders of this language to let the opensource community to adopt the language.
Let’s introduce the programming language as PLUnG, “Primary Language of Unified Generation”. It is clear that someone can argue that PLUnG is a high-level abstraction of tradition PERL programming language because PLUnG is influenced by PERL programming and programming structures and syntax may have similarities. Rather than introducing an entirely new layout is considered as negativity to simplicity and easy to learn factors. As a matter of fact, PLUnG offers PRUnG[1] (Primary Repository of Unified Generation) as their native repository while making CPAN (Comprehensive Perl Archive Network) which is PERL’s native library as a secondary repository. So, in this way, PLUnG refers a wide range repository.
Interaction handling is one of the main specialties of PLUnG. In the eCommerce domain, responsiveness to the interactions is the key to maintain precious relationships with the customers.
In following sections of texts, it will be discussed the technical aspect of PLUnG.
Since it’s need to be more significant with the differences regards to PERL, some of the explanation in the text may refer the PERL’s features.
CHAPTER 02: TECHNICAL SPECIFICATION
Compilers
There were major concerns regards to compilers, whether PLUnG should be a Compiled language or Interpreted language or like is patriarch language should it be a Hybrid language. Following factors were considered,
Portability
Maintainability
Execution Efficiency and,
Security
Compiled languages are less portable, since for every new deployment on new environment, it needs to be compiled. Compared to that, in interpreted context the source code may run directly on the machine which is more portable. In spite of that, Hybrid language user can use the byte code to run on their native Virtual Machine.
In maintainability aspect, compiled language can be considered as statically typed language and most of the errors are identified in compile time. Despite that, interpreted languages are opposite.
Both hybrid and compiled language source code is converted in to low level binary or bytecode. Therefore, unlike the interpreted program compiled code can be stored in secured manner.
Since interpreted languages reads each line of the source code prior to execution there is a significant delay on the execution compared compiled languages.
As discussed earlier in the text, Security and Efficiency is one of the major concerns of PLUnG because the domain which PLUnG address is eCommerce domain. Following the table, the summaries the general metrics. (Ampomah , Ezekiel , & Abilimi , 2017)
Compiled
Interpreted
Hybrid
Portability
Low
High
Average
Maintainability
HIGH
Low
Average
Execution Efficiency
High
Low
Average
Security
High
Low
High
Table 1: Summary of Compiler metrics
More importantly, as PERL[2] (to be more specific PERL 6+) PLUnG convert the source code to Parrot byte code (Torkington, n.d.). Rather than introducing a new Virtual Machine to run the byte code, the main reason to use Parrot byte code is to avoid the neediness of multiple Virtual Machines. In essence one VM for the entire stack. For instance, as mentioned in the Introduction section, one of the main specialties of PLUnG is to support full-stack development. In that case, PLUnG’s program ought to be integrated with other programs, since then these languages[3] can share the same VM to convert their bytecodes to machine code. (Dev, 2001)
It is worth note that followed by mentioned criteria on Introduction section Hybrid compiler was the obvious choice.
PLUnG uses Flex as the Lexer which is considered as the successor to Lex and Bison which is considered as the successor to Yaac is used as the parser.
Data types
As discussed earlier in the text, PLUnG required to keep their source code simple as possible while maintaining the ambiguity at their minimum. PLUnG is a loosely typed language but provides fewer data types to programmers to declare. Further, adequate flexibility is provided to programmers to design their own types.
PLUnG associated with five major data types,
Scalars
Simple Arrays (Arrays of scalars)
Maps
Interaction Objects
Abstract types (User-defined)
Boolean
To be more specific, programmers are not required to explicitly specify the type of data, PLUnG itself discover them during the PCUnG[4] process.
Numerical Data
When it’s come to the numerical representation, to be considered as an integer value programmer may not use any decimal places. When there is a decimal point present it will be initially considered as afloat by the compiler. If the value should not be represented using a float type compiler will automatically switch the type to double.
Floating point and double values are represented as a combination of an exponent and a fraction.
Strings
In order scalar to be a String, programmer can declare the Scalar value inside double quotation. Strings in PLUnG can comprised ACII or UNICODE and escape sequence. In order to provide the simplicity and reliability to the program, when a string assignment operator call for already defined Scalar,
It will create a new string Scalar and
Memory address will alter to use new string Scalar.
Arrays
PLUnG arrays can only contain same type of element. Since programmer does not explicitly defined the data type for numerical data, for numerical arrays PLUnG will induce a coercion process where all data types are converted to one particular type. For an instance, if a programmer trying to push a decimal element to an array which contain only integer elements, at the compile time all the elements in this array will be represent in double form.
Arrays in PLUnG can be,
a Static array which memory location and size are fixed prior to the execution
Figure 4: Static Array
a Fixed Stack Dynamic array where array size is fixed but memory allocation is taken place on the stack when specific subroutine is called
Figure 5: Fixed Stack-Dynamic Array
a Stack Dynamic array where neither size and stack memory location are not fixed (until particular subroutine call).
Figure 6: Stack Dynamic Array
a Fixed Heap-Dynamic Array where array size is fixed before the execution and memory is dynamically allocate from the heap when special subroutine called
Figure 7: Fixed Heap Dynamic Array
a heap dynamic array where array is not fixed before the execution and memory is dynamically allocate from the heap when special subroutine called
Figure 8: Heap Dynamic Array
Maps
Maps are allowing programmers to associate key value pairs to their program. Implementation of Maps in PLUnG is similar to most generic implementations of Hash Maps.
Behind the abstraction, there is contiguous array which maps to the Map and element in this array are singly linked lists. When programmer required to add an entry to the Map, key is hashed and linked list entry pushed to the array.
It is important note that, values in Maps can be stored in any valid type but keys should be always uniquely defined using either numerical or string values.
Figure 9: Map
Boolean
Programmers may explicitly ($^) or implicitly defined the Boolean variable in PLUnG. Even both the definitions are valid, it is encouraged to use explicit definition to be more robust and acquire more readability to the source code.
Figure 10: Boolean Data type definition
Interaction Object
Interaction Object (__obj(type)) is a special data type which allows programmer to manipulate interaction of their eCommerce platforms. Programmer can install the interaction type using PRUnG1 libraries and introduce them their program. This bring simplicity for the programmers by avoiding the neediness of the bulk coding to read and manipulate interaction’s meta data.
For an example, assume that when it receives a Facebook interaction, the interaction generally contain sender, timestamp, subject and etc., programmer can read this data to Interaction Object alter desired data or add new field to inject more information. Interaction Object can be easily convertible to Jason object or specify a REST API call or even convert it to a webhook to pass data to third party application. More importantly inside an Interaction Object there can be hundreds of fields predefined depend on the type7 which programmers can manipulate[5].
Table 2: Genesys’s Facebook interaction meta data (Genesys, 2019)
Figure 11: Interaction creation using PERL and PRUnG native libraries
Note that, with the shebang statement programmers need to specify the compiler version to use. In case of an empty argument it will be used latest and stable release of the PCUnG compiler. Secondly, to import the libraries, programmers may specify either using import keywork or relative path to PRUnG configuration directory (If the library is outside of the PRUnG configuration directory it needs to specify using import keywork). If programmer intended use PERL libraries/binaries it is required to explicitly specify[6].
Data type
Description
Example
Scalars
A single data unit. Can be number, character or string
$count = 87;
$city=”Adelaide”;
Simple Arrays
List of Scalars or Objects
@list = [“foo”, “bar”]
Maps
Set of key value pairs
%books= [“Key1” => “value1”,
“Key2” => “Value2”]
Boolean
Boolean values
$^keepalive=True
Interaction Objects
Specially introduced to store the interaction[7] details
To provide indirect addressing and to facilitate programmers to manage dynamic allocation of the memory, PLUnG uses pointers and references. Other than many other languages, in order to aliasing to be safe and to maintain compiler optimization, PLUnG uses a slightly different approach.
As it’s the fact, pointers supposed to point a particular memory location. In PLUnG when a programmer declares a pointer, they may use additional control operators called qualifier. Qualifiers enforce memory safety, compiler optimization and readability of the pointers. (Hicks, Morrisett, Grossman, & Jim, 2004)
Type of qualifiers,
Qualifier
Description
@nullable
Default
The pointer itself cannot be null
@notnull
Pointer itself can be null
@aliasable
Default
For the same memory location there can be multiple pointers
@notaliasable
For the same memory location there cannot be multiple pointers
@killonchange
If the value of pointing memory location is altered without referring the pointer (ex. By another pointer) pointer itself will be nulled. This qualifier Cannot use with @notnull qualifier
@killontype
If the type of the actual memory location is altered at runtime, pointer itself will be nulled. This qualifier Cannot use with @notnull qualifier
@uncahnge
Pointer cannot be altered during the execution of the program
@taint
Garbage collector will not act on the memory location pointed This option ought to be use with care since this could leads to memory leakage
Table 4: PLUnG Pointer Qualifiers
In PLUnG pointer is can be declared by adding “::ptr” keyword to the scalar and “::addr” is used as the address referencing operator.
Table 5: Pointers syntaxes
Note that, if programmer does not defined any qualifier explicitly, PLUnG compiler will refer the default qualifiers mentioned in Table 4: PLUnG Pointer Qualifiers.
Type Checking System
PLUnG is Type Safe language. Both Static and Dynamic type checking mechanisms are available to PLUnG programmers. In essence, Static type checking which is carried out at compile time is mandatory while Dynamic type checking which is supposed to carry out in runtime is optional. For an instance, in an event of Down casting[9] Dynamic type check is preferred unless it has not addressed in source code level. Note that as explained in Numerical Data section, PCUnG the compiler of the PLUnG will try to coerce the numerical data to suitable type.
By default, dynamic type checking may enable with the installation of the compiler. Programmers may disable the runtime type checking which is not recommended, by using toggle the environment variable “PCUNG_RTC_FLAG” or by explicitly defining it in Shebang section of the main program.
Figure 12: Runtime Type Check disabling using environment variables
Figure 13: Runtime Type Check disabling in source code level
Exception Handling
Generally, exceptions can be defined as events which are supposed to introduce during the execution of a program if the execution flow of the program deviate from the expected path. (Shankar, 2002) PLUnG programmers can observe following information related to an exception,
Exception type
Stack trace of the exception (Where the exception occurs)
Error and State information of the exception
In order to provide robust compile-time and runtime error handling mechanism, PLUnG has introduced additional subclasses under their throwable main class.
Figure 14 Hierarchy of Exception Classes
In this text, it will be more focusing towards to the exceptions which are specific to eCommerce applications rather than ordinary exception.
According to Oracle definition, exceptions can be categorized in to three categories,
Checked Exception
Unchecked Exception
Error
Checked exceptions are supposed to check at compile-time prior to run time while unchecked exceptions are supposed to checked at run time. Despite that, errors are irrecoverable circumstances where more likely to out of the control from programmer’s perspective.
Runtime Exceptions in PLUnG categorize in to 2 sub classes. Common exception are basic runtime exceptions which are useful with general[10] programing. For an instance, if user trying to divide a number by zero (0), it will trigger an ArithmeticException.
Real Time Controlled Exception are useful for the situation where a program manipulates real time interaction. Further, these exceptions are associate with interaction objects which have discussed earlier in this text. For an instance, assume that a program has written to handle VoIP[11] interaction,
SocketException exception can be triggered by,
Underline port is unreachable (server or client side)
If it’s using a sock[12] file to communicate, permission issues, SELinux issues or even file unavailability could cause this
ChannelException exception can be triggered due to various issues on the communication channel. For an example,
Under line codec is not compatible
If the program is supposed to convert one codec[13] to another, codec conversion errors
If signaling of the channel is unreadable due to encryption
Every time when a programmer refers/imports an interaction library, their related exception classes may attach to exception class tree. And these exceptions may or may not be runtime/unchecked exception. Considering above same VoIP example, assume that programmer user Asterisk[14] interaction libraries. Set of exception which are related to Asterisk’s interaction will be added to exception class tree. In that case programmer may follow the manual from vendor, in this case “Asterisk Manual” to configure exceptions.
Following key words are to be used with exception handler,
Keyword
try
This keyword is associate with except key word. The coding block which specify under this keyword should contain exception code
except
Followed by try block, this is where exception is handled
fin
Purpose of the keyword fin is to execute its code segment without considering the execution of except segment
throw
Used to throw an exception
throws
This keyword is used to declare an exception
Table 6: Keywords with Exception Handler
Following code segment is used to alter the Time Stamp of calls. The program will catch DataExceptions where could be possibly triggers when it violates the allowed date time format. If an exception triggers, it will pass a waring log to syslog service and execute the fin block by logging interaction status with unchanged time stamp to syslog service.
If exception is never triggered, time stamp will be altered and by executing fin block, it will be logged an entry on syslog with altered time stamp and interaction status.
Figure 15: Exception Handling in PLUnG
Memory Management
Garbage Collection
Programmers are not required to explicitly clean the dirty memory location since PLUnG uses Virtual Machine’s (Parrot) garbage collection mechanisms. (Parrot Foundation, 2011)
As a default garbage collecting mechanism[15], Mark and Sweep (MS) is used by PCRUnG. In MS,
Stage 1: Garbage Collector traces all memory object and test the health[16] of these memory object. If a memory object is unhealthy it will be marked as dead.
Stage 2: Memory objects which are marked as dead will be Swept and reclaim.
Additionally, for programmers to allow more control over memory management, it is possible to explicitly defined the garbage collector mechanism in the program. Programmers may use the main program’s shebang line to defined the Garbage Collection mechanism. Note that, this is may affect to behavior of the running VM.
Figure 16: Explicitly define the Garbage Collector
Scope of the Variables
Visibility of the variable in PLUnG can be highly manipulatable. Basically, PLUnG programmers may declare their variable either private of global manner. Programmer are not required to explicitly required to declare private variable by default all the declarations are private. Special scenarios like use same name for private and global scoped variable, programmer may explicitly define the private variable.
Figure 17: Private and Global variable
Further, PLUnG as most of the modern programming languages support only Static/Lexical scoping.
Figure : PLUnG Static Scoping example
In above code segment, value which returns by function_01 is independent from its calling function (function_02) and function_01 is always refer the value of the global variable. Importantly, in these type of scenarios, same variable ($varX) is used in both global and private scopes. It is recommended to explicitly declare the scope in such cases. For an example, in order to alter the value of the global variable it may use our::$varX or $varX.
Data Abstraction
PLUnG supports Object Oriented Programming (OOP) by providing interface and abstract classes and related features to the programmer. The declaration of these classes may slightly different than other OOP languages.
Figure 19: PLUnG classes
Objects in PLUnG can be created as an Interaction Object or ordinary object. Even though syntaxes are different, there is no significant difference when it comes to actual object.
Figure 20: Polymorphism and Object creation
CHAPTER 03: DISCUSSION
Discussion
This section is dedicated discuss above mentioned features of the programming language in terms of eCommerce domain. In essence, previous chapter of the text describe the features of the programing language in technical aspect but in this section those concepts relate to eCommerce domain and try to evaluate those features against various matrices.
Evaluation against Readability metrices
Readability in Simplicity aspect
PLUnG itself is a loosely typed language and programmers do not need to explicitly define type of the variable. Even though this can be argued, since the exact primitive type is not explicitly defined in the source code the “it may cause some readability issue”, it is worth to mention that the ultimate goal is here to lift the burden from the programmers. For an instance, if a programmer defined a numerical variable, underline primitive type of the variable is to be cast in the compile time or during the runtime. Further, when programmers are required to deal with object, they may use the syntax which are native to interaction objects or ordinary object (refer: Figure 20: Polymorphism and Object creation). Further, with aliasing, it has been introduced an advance concept of qualifiers which is enhanced the distinct readability of the code.
Readability in Orthogonality aspect
Finest example here regards to Orthogonality in readability perspective is, PLUnG static scoping. According to Figure 18: PLUnG Static Scoping example, programmers are able to draw a fine line what variable should be accessible locally and how global variable are to be used.
Evaluation against Writability metrices
Writability in Simplicity aspect
As mentioned earlier sections, PLUnG provide adequate number of datatypes to the programmers. For an example, programmers do not need to defined primitive type of numerical scalars in PLUnG, it will be constructed by PLUnG itself.
On the other hand, PLUnG supports data abstraction, programmers may define their own types to use in the system. Despite that, regards to interaction objects, programmers can directly refer underline type and create Interaction Objects without having the burden of implementing it.
Further, rather than native repository, PLUnG support cross library support with PERL native repository which was introduced as CPAN, which provides programmers to wide range of support in terms of libraries.
As mention in Introduction sections, this whole PLUnG project ought to be adopt under open source community, due to that the syntax styles using in the PLUnG more likely to show a relativeness to LINUX and PERL style which opensource community may easily familiarize with.
Writability in Orthogonality aspect
In order to maintain the orthogonality matrices regards to working with libraries (native and CPAN), programmers are required to use different syntaxes. Which enhanced both writability and readability aspects (refer Figure 11: Interaction creation using PERL and PRUnG native libraries).
Another example is the usage of Interaction Object where programmers are able to separate ordinary object from Interaction Object.
Evaluation against Reliability metrices
PLUnG provide both static and dynamic type checking. Further, dynamic type checking is optional but recommended while static type checking is mandatory.
Exception Handling in PLUnG has been optimized by introducing additional exception classes which are native to real time communication which ought to be more useful in the eCommerce domain. (refer: Exception Handling)
Last but not least, with aliasing, PLUnG has introduced a concept where programmers can use qualifiers to avoid memory leakages while optimizing their code.
Ideality on ECommerce domain
Sole purpose of this language to provide maximum support to the eCommerce domain. Following discussion based on the feature and their suitability as a programming language which dedicated to eCommerce domain. The discussion is divided to separate sub section to be more subjective.
Data Types
In order to provide more simplicity, PLUnG is introduced as a loosely typed language. There is a tradeoff between simplicity and reliability in this context but the reliability has been achieved through mapping variable to most suitable primitive type during both compile and execution time.
In this context, the main feature that PLUnG provide in terms of Data Types is Interaction Objects. Programmers are not required create a series of classes to handle interactions. Associate the related Interaction library and just use the Interaction Object in the program. (Refer: Interaction Object)
Exception Handling
One of the major hurdles in eCommerce domain regards to programming is handling Realtime data from various channels. As described in Exception Handling section, it has introduced additional exception classes to the language. The events related to these exceptions are considered as common in eCommerce applications. Further, programmer defined exception and exceptions from third party plugins can easily pluggable to throwable inheritance tree.
Compiler
In Compilers section it has been explained well enough why PLUnG uses a hybrid compiler which was introduced as PCUnG.
Since eCommerce solutions are frequently deal with Realtime interactions the speed of the execution was considered and also reusability or portability of the source code is considered. The other, concern was the security of the source code. Security indeed ought to be considered severely, it is assumed that there are many other factors ought to be taken in to account, rather than code interpretation to secure the source code. Either way, as mentioned in the text, the security feature can be considered as a bonus feature.
Further, today’s programming is not bounded to one single programming language or technology but they are stacked with other related technologies. In this case, the language here discussed also considered to be used similarly. That is one of the reasons where the selection of an existing Virtual Machine preferred over developing an entirely new one.
CHAPTER 04: ANNEXURES AND REFERENCES
REFERENCES
Ampomah , E. K., Ezekiel , M. M., & Abilimi , G. C. (2017). Qualitative Assessment of Compiled, Interpreted and Hybrid Programming Languages. New York: Foundation of Computer Science FCS, New York, USA.
Dev, P. T. (2001). introductions. Retrieved from docs.parrot.org: http://docs.parrot.org/parrot/latest/html/docs/book/draft/ch01_introduction.pod.html
Genesys. (2019, 09 06). Metadata. Retrieved from Genesys docs: https://docs.genesys.com/Documentation/GWC/latest/WidgetsAPI/WebChatMetadata
Hicks, M., Morrisett, G., Grossman, D., & Jim, T. (2004). Experience With Safe Manual Memory-Management in Cyclone. Vancouver: ACM. Retrieved from Cyclone.
Meyer, S. (2020). Evolving ECommerce: 14 Trends Driving Online Retail In 2020. Retrieved from bigcommerce: https://www.bigcommerce.com/blog/eCommerce-trends/#weighing-your-options-deciding-if-a-trend-makes-sense-for-your-business
These are socket files where the endpoints of communication pipes ↑
Codec define, encoding or decoding characteristic of a media stream ↑
An opensource IP base communication system (PBX) ↑
Parrot VM’s Garbage collection mechanisms: MC, Tri-color MC, Copying collection and etc. ↑
Health: Whether a particular memory object is used by the program ↑
Note to the Readers
Following text is based on ideological concepts which are put together to define a programming language which supposed to be optimal for programming in the e-commerce domain.
The text itself divided into four chapters,
Chapter 01: Introduction
Chapter 02: Technical Specification
Chapter 03: Discussion
Chapter 04: Reference and Annexures
In technical specifications which explain in Chapter 02 is generalized to the eCommerce domain in Chapter 03.
Buying or selling, service or goods through the internet, simply can be called as eCommerce. At the end of 2019, the global eCommerce market had reached $3.5 billion of sales and as a share of global retail, it is 14%. Further, the expected growth end of 2020 is 16%. (Meyer, 2020) On the other hand, even if we could rhapsodize the growth of the eCommerce today as a whole, actual magic happens in underline technologies.
Today’s market there are several numbers of programming languages are available for eCommerce domain. Most of them were general-purpose languages and optimized for eCommerce domain. Some of them were a collection of related technology to address the requirement of eCommerce domain (for an example MEAN stack).
In following text, it will be discussed about an ideological programming language which is specially focus on eCommerce domain. Apart from defined features of a programming language which will be discovered later in this text, following high level features were took in to account,
Security
Responsiveness (interaction handling and interrupts)
Memory management
Interoperability
Modularity
Community and support
The language here in following discussion, should address the common vulnerabilities related programming language. Since this language ought to be specialize in eCommerce domain responsiveness for events and interrupts is vital. Further, the language should have the capabilities to stack with other related platforms/technologies and provide end to end support. In other words, language should well supportive for full stack development. Language should have minimum dependencies to other relevant component such as libraries. Moreover, it is one of the major concerns of the founders of this language to let opensource community to adapt the language.
Let’s introduce the programming language as PLUnG, “Primary Language of Unified Generation”. It is clear that someone can argue that PLUnG is a high-level abstraction of tradition PERL programming language because PLUnG is influenced by PERL programing and programing structures and syntax may have similarities. Rather than introducing an entirely new layout is considered as a negativity to simplicity and easy to learn factors. As a matter of fact, PLUnG offers PRUnG[1] (Primary Repository of Unified Generation) as their native repository while making CPAN (Comprehensive Perl Archive Network) which is PERL’s native library as a secondary repository. So, in this way PLUnG refers wide range repository.
Interaction handling is one of the main specialties of PLUnG. In the eCommerce domain, responsiveness to the interactions is the key to maintain precious relationships with the customers.
In following sections of texts, it will be discussed the technical aspect of PLUnG.
Since it’s need to be more significant with the differences regards to PERL, some of the explanation in the text may refer the PERL’s features.
CHAPTER 02: TECHNICAL SPECIFICATION
Compilers
There were major concerns regards to compilers, whether PLUnG should be a Compiled language or Interpreted language or like is patriarch language should it be a Hybrid language. Following factors were considered,
Portability
Maintainability
Execution Efficiency and,
Security
Compiled languages are less portable, since for every new deployment on new environment, it needs to be compiled. Compared to that, in interpreted context the source code may run directly on the machine which is more portable. In spite of that, Hybrid language user can use the byte code to run on their native Virtual Machine.
In maintainability aspect, compiled language can be considered as statically typed language and most of the errors are identified in compile time. Despite that, interpreted languages are opposite.
Both hybrid and compiled language source code is converted in to low level binary or bytecode. Therefore, unlike the interpreted program compiled code can be stored in secured manner.
Since interpreted languages reads each line of the source code prior to execution there is a significant delay on the execution compared compiled languages.
As discussed in earlier in the text, Security and Efficiency is one of the major concerns of PLUnG because the domain which PLUnG address is eCommerce domain. Following table, the summaries the general metrics. (Ampomah , Ezekiel , & Abilimi , 2017)
Compiled
Interpreted
Hybrid
Portability
Low
High
Average
Maintainability
HIGH
Low
Average
Execution Efficiency
High
Low
Average
Security
High
Low
High
Table 1: Summary of Compiler metrics
More importantly, as PERL[2] (to be more specific PERL 6+) PLUnG convert the source code to Parrot byte code (Torkington, n.d.). Rather than introducing a new Virtual Machine to run the byte code, the main reason to use Parrot byte code is to avoid the neediness of multiple Virtual Machines. In essence one VM for entire stack. For an instance, as mentioned in Introduction section, one of the main specialties of PLUnG is to support full-stack development. In that case PLUnG’s program ought to be integrated with other programs, since then these languages[3] can share the same VM to convert their bytecodes to machine code. (Dev, 2001)
It is worth note that followed by mentioned criteria on Introduction section Hybrid compiler was the obvious choice.
PLUnG uses Flex as the Lexer which is considered as the successor to Lex and Bison which is considered as the successor to Yaac is used as the parser.
Figure 1: Execution Life Cycle
Data types
As discussed earlier in the text, PLUnG required to keep their source code simple as possible while maintaining the ambiguity at their minimum. PLUnG is a loosely typed language but provides fewer data types to programmers to declare. Further, adequate flexibility is provided to programmers to design their own types.
PLUnG associated with five major data types,
Scalars
Simple Arrays (Arrays of scalars)
Maps
Interaction Objects
Abstract types (User defined)
Boolean
To be more specific, programmers are not required to explicitly specify the type of data, PLUnG itself discover them during the PCUnG[4] process.
Numerical Data
When it’s come to the numerical representation, to be considered as an integer value programmer may not use any decimal places. When there is a decimal point present it will be initially considered as a float by the compiler. If the value should not be represent using float type compiler will automatically switch the type to double.
Floating point and double values are represented as a combination of an exponent and a fraction.
1
Exponent (8 bit)
Fraction (23 bit)
1
Exponent (11 bit)
Fraction (52 bit)
Figure : Memory representation of Floating
Figure : Memory representation of Double
Strings
In order scalar to be a String, programmer can declare the Scalar value inside double quotation. Strings in PLUnG can comprised ACII or UNICODE and escape sequence. In order to provide the simplicity and reliability to the program, when a string assignment operator call for already defined Scalar,
It will create a new string Scalar and
Memory address will alter to use new string Scalar.
Arrays
PLUnG arrays can only contain same type of element. Since programmer does not explicitly defined the data type for numerical data, for numerical arrays PLUnG will induce a coercion process where all data types are converted to one particular type. For an instance, if a programmer trying to push a decimal element to an array which contain only integer elements, at the compile time all the elements in this array will be represent in double form.
Arrays in PLUnG can be,
a Static array which memory location and size are fixed prior to the execution
Figure 4: Static Array
a Fixed Stack Dynamic array where array size is fixed but memory allocation is taken place on the stack when specific subroutine is called
Figure 5: Fixed Stack-Dynamic Array
a Stack Dynamic array where neither size and stack memory location are not fixed (until particular subroutine call).
Figure 6: Stack Dynamic Array
a Fixed Heap-Dynamic Array where array size is fixed before the execution and memory is dynamically allocate from the heap when special subroutine called
Figure 7: Fixed Heap Dynamic Array
a heap dynamic array where array is not fixed before the execution and memory is dynamically allocate from the heap when special subroutine called
Figure 8: Heap Dynamic Array
Maps
Maps are allowing programmers to associate key value pairs to their program. Implementation of Maps in PLUnG is similar to most generic implementations of Hash Maps.
Behind the abstraction, there is contiguous array which maps to the Map and element in this array are singly linked lists. When programmer required to add an entry to the Map, key is hashed and linked list entry pushed to the array.
It is important note that, values in Maps can be stored in any valid type but keys should be always uniquely defined using either numerical or string values.
Figure 9: Map
Boolean
Programmers may explicitly ($^) or implicitly defined the Boolean variable in PLUnG. Even both the definitions are valid, it is encouraged to use explicit definition to be more robust and acquire more readability to the source code.
Figure 10: Boolean Data type definition
Interaction Object
Interaction Object (__obj(type)) is a special data type which allows programmer to manipulate interaction of their eCommerce platforms. Programmer can install the interaction type using PRUnG1 libraries and introduce them their program. This bring simplicity for the programmers by avoiding the neediness of the bulk coding to read and manipulate interaction’s meta data.
For an example, assume that when it receives a Facebook interaction, the interaction generally contain sender, timestamp, subject and etc., programmer can read this data to Interaction Object alter desired data or add new field to inject more information. Interaction Object can be easily convertible to Jason object or specify a REST API call or even convert it to a webhook to pass data to third party application. More importantly inside an Interaction Object there can be hundreds of fields predefined depend on the type7 which programmers can manipulate[5].
Table 2: Genesys’s Facebook interaction meta data (Genesys, 2019)
Figure 11: Interaction creation using PERL and PRUnG native libraries
Note that, with the shebang statement programmers need to specify the compiler version to use. In case of an empty argument it will be used latest and stable release of the PCUnG compiler. Secondly, to import the libraries, programmers may specify either using import keywork or relative path to PRUnG configuration directory (If the library is outside of the PRUnG configuration directory it needs to specify using import keywork). If programmer intended use PERL libraries/binaries it is required to explicitly specify[6].
Data type
Description
Example
Scalars
A single data unit. Can be number, character or string
$count = 87;
$city=”Adelaide”;
Simple Arrays
List of Scalars or Objects
@list = [“foo”, “bar”]
Maps
Set of key value pairs
%books= [“Key1” => “value1”,
“Key2” => “Value2”]
Boolean
Boolean values
$^keepalive=True
Interaction Objects
Specially introduced to store the interaction[7] details
To provide indirect addressing and to facilitate programmers to manage dynamic allocation of the memory, PLUnG uses pointers and references. Other than many other languages, in order to aliasing to be safe and to maintain compiler optimization, PLUnG uses a slightly different approach.
As it’s the fact, pointers supposed to point a particular memory location. In PLUnG when a programmer declares a pointer, they may use additional control operators called qualifier. Qualifiers enforce memory safety, compiler optimization and readability of the pointers. (Hicks, Morrisett, Grossman, & Jim, 2004)
Type of qualifiers,
Qualifier
Description
@nullable
Default
The pointer itself cannot be null
@notnull
Pointer itself can be null
@aliasable
Default
For the same memory location there can be multiple pointers
@notaliasable
For the same memory location there cannot be multiple pointers
@killonchange
If the value of pointing memory location is altered without referring the pointer (ex. By another pointer) pointer itself will be nulled. This qualifier Cannot use with @notnull qualifier
@killontype
If the type of the actual memory location is altered at runtime, pointer itself will be nulled. This qualifier Cannot use with @notnull qualifier
@uncahnge
Pointer cannot be altered during the execution of the program
@taint
Garbage collector will not act on the memory location pointed This option ought to be use with care since this could leads to memory leakage
Table 4: PLUnG Pointer Qualifiers
In PLUnG pointer is can be declared by adding “::ptr” keyword to the scalar and “::addr” is used as the address referencing operator.
Table 5: Pointers syntaxes
Note that, if programmer does not defined any qualifier explicitly, PLUnG compiler will refer the default qualifiers mentioned in Table 4: PLUnG Pointer Qualifiers.
Type Checking System
PLUnG is Type Safe language. Both Static and Dynamic type checking mechanisms are available to PLUnG programmers. In essence, Static type checking which is carried out at compile time is mandatory while Dynamic type checking which is supposed to carry out in runtime is optional. For an instance, in an event of Down casting[9] Dynamic type check is preferred unless it has not addressed in source code level. Note that as explained in Numerical Data section, PCUnG the compiler of the PLUnG will try to coerce the numerical data to suitable type.
By default, dynamic type checking may enable with the installation of the compiler. Programmers may disable the runtime type checking which is not recommended, by using toggle the environment variable “PCUNG_RTC_FLAG” or by explicitly defining it in Shebang section of the main program.
Figure 12: Runtime Type Check disabling using environment variables
Figure 13: Runtime Type Check disabling in source code level
Exception Handling
Generally, exceptions can be defined as events which are supposed to introduce during the execution of a program if the execution flow of the program deviate from the expected path. (Shankar, 2002) PLUnG programmers can observe following information related to an exception,
Exception type
Stack trace of the exception (Where the exception occurs)
Error and State information of the exception
In order to provide robust compile time and runtime error handling mechanism PLUnG has introduce additional subclasses under their throwable main class.
Figure 14 Hierarchy of Exception Classes
In this text, it will be more focusing towards to the exceptions which are specific to eCommerce applications rather than ordinary exception.
According to Oracle definition, exceptions can be categorized in to three categories,
Checked Exception
Unchecked Exception
Error
Checked exceptions are supposed to check at compile-time prior to run time while unchecked exceptions are supposed to checked at run time. Despite that, errors are irrecoverable circumstances where more likely to out of the control from programmer’s perspective.
Runtime Exceptions in PLUnG categorize in to 2 sub classes. Common exception are basic runtime exceptions which are useful with general[10] programing. For an instance, if user trying to divide a number by zero (0), it will trigger an ArithmeticException.
Real Time Controlled Exception are useful for the situation where a program manipulates real time interaction. Further, these exceptions are associate with interaction objects which have discussed earlier in this text. For an instance, assume that a program has written to handle VoIP[11] interaction,
SocketException exception can be triggered by,
Underline port is unreachable (server or client side)
If it’s using a sock[12] file to communicate, permission issues, SELinux issues or even file unavailability could cause this
ChannelException exception can be triggered due to various issues on the communication channel. For an example,
Under line codec is not compatible
If the program is supposed to convert one codec[13] to another, codec conversion errors
If signaling of the channel is unreadable due to encryption
Every time when a programmer refers/imports an interaction library, their related exception classes may attach to exception class tree. And these exceptions may or may not be runtime/unchecked exception. Considering above same VoIP example, assume that programmer user Asterisk[14] interaction libraries. Set of exception which are related to Asterisk’s interaction will be added to exception class tree. In that case programmer may follow the manual from vendor, in this case “Asterisk Manual” to configure exceptions.
Following key words are to be used with exception handler,
Keyword
try
This keyword is associate with except key word. The coding block which specify under this keyword should contain exception code
except
Followed by try block, this is where exception is handled
fin
Purpose of the keyword fin is to execute its code segment without considering the execution of except segment
throw
Used to throw an exception
throws
This keyword is used to declare an exception
Table 6: Keywords with Exception Handler
Following code segment is used to alter the Time Stamp of calls. The program will catch DataExceptions where could be possibly triggers when it violates the allowed date time format. If an exception triggers, it will pass a waring log to syslog service and execute the fin block by logging interaction status with unchanged time stamp to syslog service.
If exception is never triggered, time stamp will be altered and by executing fin block, it will be logged an entry on syslog with altered time stamp and interaction status.
Figure 15: Exception Handling in PLUnG
Memory Management
Garbage Collection
Programmers are not required to explicitly clean the dirty memory location since PLUnG uses Virtual Machine’s (Parrot) garbage collection mechanisms. (Parrot Foundation, 2011)
As a default garbage collecting mechanism[15], Mark and Sweep (MS) is used by PCRUnG. In MS,
Stage 1: Garbage Collector traces all memory object and test the health[16] of these memory object. If a memory object is unhealthy it will be marked as dead.
Stage 2: Memory objects which are marked as dead will be Swept and reclaim.
Additionally, for programmers to allow more control over memory management, it is possible to explicitly defined the garbage collector mechanism in the program. Programmers may use the main program’s shebang line to defined the Garbage Collection mechanism. Note that, this is may affect to behavior of the running VM.
Figure 16: Explicitly define the Garbage Collector
Scope of the Variables
Visibility of the variable in PLUnG can be highly manipulatable. Basically, PLUnG programmers may declare their variable either private of global manner. Programmer are not required to explicitly required to declare private variable by default all the declarations are private. Special scenarios like use same name for private and global scoped variable, programmer may explicitly define the private variable.
Figure 17: Private and Global variable
Further, PLUnG as most of the modern programming languages support only Static/Lexical scoping.
Figure : PLUnG Static Scoping example
In above code segment, value which returns by function_01 is independent from its calling function (function_02) and function_01 is always refer the value of the global variable. Importantly, in these type of scenarios, same variable ($varX) is used in both global and private scopes. It is recommended to explicitly declare the scope in such cases. For an example, in order to alter the value of the global variable it may use our::$varX or $varX.
Data Abstraction
PLUnG supports Object Oriented Programming (OOP) by providing interface and abstract classes and related features to the programmer. The declaration of these classes may slightly different than other OOP languages.
Figure 19: PLUnG classes
Objects in PLUnG can be created as an Interaction Object or ordinary object. Even though syntaxes are different, there is no significant difference when it comes to actual object.
Figure 20: Polymorphism and Object creation
CHAPTER 03: DISCUSSION
Discussion
This section is dedicated discuss above mentioned features of the programming language in terms of eCommerce domain. In essence, previous chapter of the text describe the features of the programing language in technical aspect but in this section those concepts relate to eCommerce domain and try to evaluate those features against various matrices.
Evaluation against Readability metrices
Readability in Simplicity aspect
PLUnG itself is a loosely typed language and programmers do not need to explicitly define type of the variable. Even though this can be argued, since the exact primitive type is not explicitly defined in the source code the “it may cause some readability issue”, it is worth to mention that the ultimate goal is here to lift the burden from the programmers. For an instance, if a programmer defined a numerical variable, underline primitive type of the variable is to be cast in the compile time or during the runtime. Further, when programmers are required to deal with object, they may use the syntax which are native to interaction objects or ordinary object (refer: Figure 20: Polymorphism and Object creation). Further, with aliasing, it has been introduced an advance concept of qualifiers which is enhanced the distinct readability of the code.
Readability in Orthogonality aspect
Finest example here regards to Orthogonality in readability perspective is, PLUnG static scoping. According to Figure 18: PLUnG Static Scoping example, programmers are able to draw a fine line what variable should be accessible locally and how global variable are to be used.
Evaluation against Writability metrices
Writability in Simplicity aspect
As mentioned earlier sections, PLUnG provide adequate number of datatypes to the programmers. For an example, programmers do not need to defined primitive type of numerical scalars in PLUnG, it will be constructed by PLUnG itself.
On the other hand, PLUnG supports data abstraction, programmers may define their own types to use in the system. Despite that, regards to interaction objects, programmers can directly refer underline type and create Interaction Objects without having the burden of implementing it.
Further, rather than native repository, PLUnG support cross library support with PERL native repository which was introduced as CPAN, which provides programmers to wide range of support in terms of libraries.
As mention in Introduction sections, this whole PLUnG project ought to be adopt under open source community, due to that the syntax styles using in the PLUnG more likely to show a relativeness to LINUX and PERL style which opensource community may easily familiarize with.
Writability in Orthogonality aspect
In order to maintain the orthogonality matrices regards to working with libraries (native and CPAN), programmers are required to use different syntaxes. Which enhanced both writability and readability aspects (refer Figure 11: Interaction creation using PERL and PRUnG native libraries).
Another example is the usage of Interaction Object where programmers are able to separate ordinary object from Interaction Object.
Evaluation against Reliability metrices
PLUnG provide both static and dynamic type checking. Further, dynamic type checking is optional but recommended while static type checking is mandatory.
Exception Handling in PLUnG has been optimized by introducing additional exception classes which are native to real time communication which ought to be more useful in the eCommerce domain. (refer: Exception Handling)
Last but not least, with aliasing, PLUnG has introduced a concept where programmers can use qualifiers to avoid memory leakages while optimizing their code.
Ideality on ECommerce domain
Sole purpose of this language to provide maximum support to the eCommerce domain. Following discussion based on the feature and their suitability as a programming language which dedicated to eCommerce domain. The discussion is divided to separate sub section to be more subjective.
Data Types
In order to provide more simplicity, PLUnG is introduced as a loosely typed language. There is a tradeoff between simplicity and reliability in this context but the reliability has been achieved through mapping variable to most suitable primitive type during both compile and execution time.
In this context, the main feature that PLUnG provide in terms of Data Types is Interaction Objects. Programmers are not required create a series of classes to handle interactions. Associate the related Interaction library and just use the Interaction Object in the program. (Refer: Interaction Object)
Exception Handling
One of the major hurdles in eCommerce domain regards to programming is handling Realtime data from various channels. As described in Exception Handling section, it has introduced additional exception classes to the language. The events related to these exceptions are considered as common in eCommerce applications. Further, programmer defined exception and exceptions from third party plugins can easily pluggable to throwable inheritance tree.
Compiler
In Compilers section it has been explained well enough why PLUnG uses a hybrid compiler which was introduced as PCUnG.
Since eCommerce solutions are frequently deal with Realtime interactions the speed of the execution was considered and also reusability or portability of the source code is considered. The other, concern was the security of the source code. Security indeed ought to be considered severely, it is assumed that there are many other factors ought to be taken in to account, rather than code interpretation to secure the source code. Either way, as mentioned in the text, the security feature can be considered as a bonus feature.
Further, today’s programming is not bounded to one single programming language or technology but they are stacked with other related technologies. In this case, the language here discussed also considered to be used similarly. That is one of the reasons where the selection of an existing Virtual Machine preferred over developing an entirely new one.
CHAPTER 04: ANNEXURES AND REFERENCES
REFERENCES
Ampomah , E. K., Ezekiel , M. M., & Abilimi , G. C. (2017). Qualitative Assessment of Compiled, Interpreted and Hybrid Programming Languages. New York: Foundation of Computer Science FCS, New York, USA.
Dev, P. T. (2001). introductions. Retrieved from docs.parrot.org: http://docs.parrot.org/parrot/latest/html/docs/book/draft/ch01_introduction.pod.html
Genesys. (2019, 09 06). Metadata. Retrieved from Genesys docs: https://docs.genesys.com/Documentation/GWC/latest/WidgetsAPI/WebChatMetadata
Hicks, M., Morrisett, G., Grossman, D., & Jim, T. (2004). Experience With Safe Manual Memory-Management in Cyclone. Vancouver: ACM. Retrieved from Cyclone.
Meyer, S. (2020). Evolving ECommerce: 14 Trends Driving Online Retail In 2020. Retrieved from bigcommerce: https://www.bigcommerce.com/blog/eCommerce-trends/#weighing-your-options-deciding-if-a-trend-makes-sense-for-your-business
In its simplest form cybersecurity is protecting data being compromised by a third party. This particular domain is expanding exponentially.
As per the publications of Telstra which is one of the leading telecommunication providers, cybersecurity is protecting anything across the network. Further, this may include, hardware, software and data in transit or rest. (“What is cybersecurity and why is it important?”, 2019)
Technically, cybersecurity categorizes into three major components,
Confidentiality: State that data should only available to read to authorized parties
Integrity: State that data should not be modified during the transit or at rest without proper authorization
Availability: Data should be available to all authorized parties
Cybersecurity and ERP
Enterprise Resource Planning (ERP), is a business or business processes integration approach which is has been widely deployed in all around the globe. Further, it was first initiated in 1990 and there has been massive expansion can be seen in today’s industry.
ERP systems are configurable and could be integrated to a vast number of other information systems. The expansion of the ERP industry could automate almost all the key business processes. As per the aspect of data security, ERP deals with the most precious information which an organization has. Further, every node, every network, every data storage and even every user is vulnerable. The worst nightmare in the ERP industry is data breach in its system. If an organization lose their social media account or website is recoverable but breaching the ERP system is destroying the whole business.
ERP Security approaches
Generally, in ERP domain, security can be categorized by referring 3 deferent layers in the OSI model.
Network Layer
Presentation Layer
Application Layer
Networking Layer Security
In this category, it is mainly focused on data which is transfer through the network. For instance, a customer communicates with an ERP or an ERP system itself communicate with another third-party information system.
Traffic interception and modification
For instance these type vulnerabilities can be called as a man in the middle attacks. A third person or device intercepts the communication channel and listen to the media/data or sometimes override the media/data with fraudulent data.
Even data encryption and hashing algorithms mitigate that the data in the network will never be supposed to safe.
Vulnerabilities in protocols
If underlying protocols are vulnerable, ERP whole ERP system is vulnerable. In worst cases rather than data breaches, this can lead to denial of service (DoS) attacks. One of the famous examples for this is RFC protocol which SAP was using in their version 6.x and 7.x in TCP/IP layer was vulnerable to a denial of access for the legitimate users.
Presentation Layer Security
This is referring to the GUI or WEB access security. In many cases, these types of vulnerabilities are mitigated by using a solution like Citrix.
Further, the security of the Operating system is also a major factor.
OS Software vulnerabilities
Weak passwords
Insecure settings on OS
Can leads to these type of security vulnerabilities.
Application Layer Security
Apart from the other two major categories, application-layer security on purely on the hands of the ERP experts.
Policies and Administration:
Parallel to the implementation of the ERP system, a security policy should be introduced to administrators, mentioning a set of rules related to which subject is available to which object.
Authentication
In general terms, Authentication is referring to verify, if the object is the object it claims.
Authorization
Grants minimum access on a resource for a particular object. Further, authorization assures that particular resources are accessible for a particular user.
Separation of Duties
This is supposed to ensure that a particular task can be performed by certain users or roles.
Time Restriction
The systems access is granted only for a certain time. After the expire the current session user must re-authenticate to the system.
Logs
The entire system should keep separate logs. For instance, access logs, error logs and access logs
Security of the Database and other application components
It is vital to ensure that all the other related components to ERP is well secured. More importantly data base one of the key components in any ERP system, due to that it must be proactively to ensure that these major components remain secure.
Enhanced Security Implementation of ERP
Almost all the ERP implementation in the current industry is based on Role-Base Access Control (RBAC) model. RBAC model consists of following major components,
Role-Base Access Control (RBAC)
Figure Role-Based Access control structure
Permission: Permission can be defined as the availability of the object for a particular subject. But each domain has its own definition for permission.
Roles: Role can be a predefined set of responsibilities.
Users: A user is a person as it names and the user may be assigned to one or more role.
Constraints: In a hierarchical structure senior-level user can override the permission on their subordinate users
Drivers of ERP Security
The layout of the ERP implementations are still evolving, the arrival of new features leads to enormous challenges in security aspect. Further, customers requirements are always agile, even ERP could fully automate all the business processes, still, there will be a new feature to absorb. According to the research paper published by She and Thuraisingham, they have predicted the following key features in ERP (She & Thuraisingham, 2007),
On the hand, in most cases, the primary aspect of security implementation is access control and logging. Implementing and practising access control is the most tedious and resource-consuming procedure for any information systems. As an example, the present organization structure is agile than ever, employee turnovers cause a change of responsibilities on them while it led the privilege level of the system to keep changing. Due to that, the administration of the system become more resource consuming. But the worst case is, most of the higher the security measures lower the performance on the system, but even more downside of this is user’s feedback on these security measures.
Either way, it is vital for systems to maintain the balance between security cost and performance on the systems.
Security Policies related to ERP
According to Thuraisingham, ERP security widely focused on confidentiality (Thuraisingham, 2005), but it is a must to introduce other types of policies in order to mitigate security vulnerabilities.
Integrity Policies: Ensure that data is only could change/modified by authorized users of the systems
Data quality and provenance policies: Control the validity of the data flows and data accuracy
Trust Policies: Data only be available to the parties which organization trust
Need-to-Know Policies: These policies define that particular information should be acknowledged by the intended parties
Need-to-Share Policies: Same as Need-to-Know policies, these define that particular information should be shared with the intended parties
Security of Shared content
Shared information through ERPs is one of the security aspects that resent ERP systems are lacking. In order to cater to this security aspect, a secured framework with encryption is necessary. But as discussed earlier in this text, there is a considerable amount of resource needed to be allocated. Further, practising this with lesser performance impact is vital.
Security-related ERP web components
ERP systems in present, more likely to have web features. Generally, almost all components implemented on standalone architecture now is available in web-based infrastructure as well.
When it comes to the security-related web components, the data travel through XML format has major concerns. In fact, XML framework has integrated with encryption and digital signatures, it still to be boosted up.
Well-known issues and resolutions in ES Domain
Lack of Employee Training and Upkeep
The weakest link in any software system is humans. Untrained and uninformed employees that use the ERP system and handle important data are one of the biggest security liabilities. Having an ongoing training schedule should not be overlooked! It’s important to train all your employees about the new system initially, but what’s really going to make a difference is the continuous learning approach. Employees should be briefed about the ERP regularly in the case there are any changes or upgrades made to the system. Rather than investing time and money on cybersecurity measures, invest some in educating your staff.
Overlooking Software Updates
Speaking of changes and upgrades to the system, failing to keep up with any and all updates to your ERP is another security problem you’ll definitely want to avoid. Because most software updates take time, companies see this as a waste of precious resources and will often delay making regular updates to their ERP system. Software vendors release updates to address known security vulnerabilities and to fix weak spots in order to help keep their customer’s systems more secure, so delaying or failing to keep up with system updates is only hurting you more in the long run.
Inadequate Access and Authentication
Like all software systems, single authentication is the standard way to access the data within them. Passwords may seem great; however, they may not be enough anymore. Cracking a password is one of the most common forms of hacking, so having your businesses most important and confidential data accessible through the use of a single password (which can be easily stolen or guessed by cybercriminals) doesn’t make much sense anymore. Switching to a two-factor authentication method is a good way to make sure your passwords aren’t hacked or stolen.
Who can access and edit data within your ERP system is another security concern that stems from authentication. Full access rights are usually a default when it comes to software, but it’s important to manage who has access to what data. Access rights and/or permissions depend on the needs and requirements of your business, so definitely keep this in mind when giving your employees important information on how to access data within the ERP – maybe maintain audit logs to track any changes or add authorizations to keep track of who is looking at what.
Enterprise cloud services are not enterprise or security threats ready
This problem arises while selecting the ideal ERP vendor. An organization often choose the ERP vendors without evaluating the security aspect of their product which are not ready for security standpoint.
Nowadays, most cloud services depend upon APIs which are third-party developers to manage and interact with their services and it controls from authentication and access to encryption and activity monitoring.
Data breaches or Failure to comply
Breaches involving health information, trade secrets and intellectual property are typically the most devastating. For this, cybercriminals are responsible. They get attracted to the huge amount of data stored in cloud servers.
To protect the data in the cloud enterprise should be able to comply with the General Data Protection Regulation (GDPR).
Full access rights (Confidentiality violation): lack of encryption
Whilst some public cloud providers are starting to provide customers with more control over their data, information stored in the cloud is often not within an organization’s control. Many enterprises make the mistake of failing to encrypt sensitive data.
The Cloud Security Alliances (CSA) recommends organizations to use a VPN tunnel to protect their data. It protects sensitive enterprise data from being in hands of unknown third-party applications.
Use of unauthorized systems (lack of due diligence)
There are plenty of vendors providing enterprise systems. An unauthorized system is risky for the business it may not come up with the best practice of cloud security control.
To avoid this, enterprises should review the standards and accreditations gained by cloud provider’s such as: ISO 9001, DCS, PCI and HIPAA and this process is called due diligence.
DDoS Attack
Distributed Denial of Services (DDoS) is nothing but it stretches the time of processing in a system it attacks it. For example, botnet; it attacks the targeted system with flooded traffic.
We can avoid this using DDoS mitigation which is a set of techniques or tools for resisting or mitigating the impact of DDoS attacks on networks attached to the internet by protecting the target and relay networks.
Vendor Security
A vendor is also known as a supplier, is an individual or company that sells goods or services to someone else in the economic production chain. Vendors are a part of the supply chain i.e. the network of all the individuals, organizations, resources, activities and technology involved in the creation and sale of a product, from the delivery of source materials from the supplier to the manufacturer, through to its eventual delivery to the end-user. Parts manufacturers are vendors of parts to other manufacturers that assemble the parts into something sold to wholesalers or retailers. Retailers are vendors of products to consumers. In information technology as well as in other industries, the term is commonly applied to suppliers of goods and services to other companies.
Vendor risk management or security (VRM) is a process that deals with the management and planning of third-party products and services. This ensures that the use of third-party products, IT suppliers and service providers does not result in a potential business disruption or in any negative impact on business performance. This process is meant to assist organizations in managing and monitoring the risk exposure resulting from third-party suppliers of IT products and services. Vendor risk management (VRM) involves a comprehensive plan for the identification and mitigation of potential business uncertainties as well as legal liabilities regard to hiring third-party vendors of IT products and services.
VRM has become even more important because of the prevalence of outsourcing. Because some organizations entrust some of their workflows to third parties, they lose control of those workflows and have to trust the third party to do their job well. But disruptive events like natural disasters, cyber-attacks and data breaches and are often out of the organizations control.
A good VRM strategy may include the following points:
First and foremost, there must be a contract that outlines the business relationships between the organization and the third-party.
There should be clear guidelines pertaining to access and control of sensitive information as per vendor agreement.
There should be consistent monitoring of the vendor’s performance to ensure that each line of the contract is executed properly.
The organization must ensure that vendors meet all regulatory compliance within the industry and should create a method to constantly monitor this compliance.
Conclusion
Enterprise systems are widely used in various industries and these systems its self is being rapidly developed. Security concerns related to enterprise systems were there at the beginning and now with the development of the technologies, these security concerns have also been changed and have introduced new varieties. Initially, enterprise systems were only available to organization premises but now systems are available to anywhere if the internet is there hence, security concerns are exponentially growing.
Researches should focus on following key areas to enhance the security aspect of enterprise systems,
Policies
Secured file sharing
Knowledge sharing
Secured authentication and authorization methods.
As a vendor or client point of view following the practical security aspect should be analyzed.
Updates
Since ERP implementations are practice out of the box concepts, most of the implementations are identical to each others. Usually, it can be seen, plenty of variation from their original core modules. These sorts of implementation are vulnerable to malfunctioning after the updates since the underline initial changes might not compatible with new updates. Vendor updates and patches are mandatory and more importantly when selecting a vendor, it is vital to consider whether security patches and updates are applicable on fly.
Training
One of the key factors is facilitating proper training to the end-users. Training should cover functional areas and security and ethics. To up to date the end-users’ regular training are mandatory.
Compliance
It is vital to an organization to comply with industry standards. As an example,
Proper security policies are mandatory for any type of organization. And these policies are to be updated and actively practice in the organization. Some of the common policies in the industry,
System integration in ERP can’t avoid since this whole concept is an Integration. When connecting third-party modules it is recommended to use an escrow or any other trusted intermediate service.
Reference
DDoS mitigation. (2019). Retrieved from https://en.wikipedia.org/wiki/DDoS_mitigation
Yeo, S., Kim, S., & Cho, D. (2014). Dynamic Access Control Model for Security Client Services in Smart Grid. Daejeon, South Korea: International Journal of Distributed Sensor Networks.
SIP standards for Session Initiation Protocol and It’s Purely IP based.
BRI/PRI
PRI stands for Primary Rate Interface and It contains One 64Kbps T1 or E1 Chanel for Signaling AKA Channel D and 23 T1 or 30 E1 Channels as Bearing Chanel aka Channel B.
BRI standards for Basic Rate Interface and Contain Two Barer channel and One Signaling Chnnel AKA 2B+D.
Further Both Both PRI and BRI are ISDN services and also data rate of PRI is 2.048Mbps while 128-144Kbps.
ISDN : Integrated Service Digital Network / It’s Some Dumb Network
SIP vs BRI/PRI
SIP does Best effort Delivery as same as IP traffic do, while BRI/PRI Provide QoS. If someone requires to attain QoS through SIP something like MPLS will do with a considerable amount cost.
SIP is more flexible than BRI/PRI because it can be accommodated by company existing data network while BRI/PRI reuires to have a dedicated link for it self.