Widgets used to create mashups tend not to be interoperable and also to be potential security risks, in that third-party widgets could be malicious, Ferraiolo said. Widget developers usually have to build different versions of their widgets to work with different containers. And on the security front, there is no comprehensive, standards-based approach to widget isolation.

So the OpenAjax Alliance is working to relieve this situation with its OpenAjax Hub technology and OpenAjax Metadata for Widgets specification. The OpenAjax Hub 1.1 provides a framework for loading and isolating widgets and secure message management, Ferraiolo said. Then OpenAjax Metadata for Widgets defines an industry-standard widget wrapper format. Then open-source transcoders convert popular existing proprietary gadget formats into OpenAjax Metadata, and the OpenAjax Alliance open-source mini-mashup application shows how to use all of these technologies.

The OpenAjax Hub is a small bit of standard JavaScript that enables multiple AJAX run-times to work together, and Version 1.1 provides for widget security. There is a draft OpenAjax Hub 1.1 specification that should be finalized by the end of 2008, Ferraiolo said.

OpenAjax Metadata for Widgets addresses the two core shortcomings of widgets for mashup use. In terms of widget interoperability, OpenAjax Metadata for Widgets defines industry-standard XML for mashup widgets and is "very close to Google Gadgets," Ferraiolo said. OpenAjax Metadata for Widgets is designed to work with OpenAjax Hub 1.1, which provides a secure mashup run-time.

"Google Gadgets is the gorilla of the Web widget space, and we want to match Google Gadgets wherever possible," Ferraiolo said.