BrowserPlus™
The Gory Details
The BrowserPlus Team
Nov 18th, 2008
Thursday, November 20, 2008 1

agenda
1. Architectural Overview
2. End Users
3. Web Developers
4. Service Authors
5. Security Model
BrowserPlus™
Thursday, November 20, 2008 2

Architectural Overview
50 pix 36 pix
16 pix
David Grigsby
Nov 18th, 2008
Thursday, November 20, 2008 3

big picture
user html/css/js
dist browserplus js
dist
servers
ActiveX NPAPI
daemon
service service service service service
BrowserPlus™
Thursday, November 20, 2008 4

browserplus.js
• Instantiates plugin object
• exposes core API
• 5k minified
BrowserPlus™
Thursday, November 20, 2008 5

plugins
user html/css/js
browserplus js
ActiveX NPAPI
JS JS
DnD DnD
Interop Interop
Plugin Common Lib
Session User File
Utils DnD
Mgmt Prompt Browse
Protocol Lib
daemon
service service service service service
Thursday, November 20, 2008 6

daemon
BrowserPlusCore
Platform Service Usage
Update Update Reporting
service service
logging
permissions
config
BrowserPlus™
Thursday, November 20, 2008 7

distribution servers
• platform (installers & updates)
• available services & descriptions
• permissions.smime
• stateless, BCP & redundant
• apache, REST
BrowserPlus™
Thursday, November 20, 2008 8

BrowserPlus for End Users
50 pix 36 pix
16 pix
Gordon Durand
Nov 18th, 2008
Thursday, November 20, 2008 9

installation
• one time install of platform
• less than 2mb
• no restart, no reload BrowserPlus™
Thursday, November 20, 2008 10

user prompting
• grant permissions
• install or update services
• tradeoff: transparency vs. usability
BrowserPlus™
Thursday, November 20, 2008 11

updates
• services and platform
• background download
• user-specific updates BrowserPlus™
Thursday, November 20, 2008 12

control panel
• see / remove site permissions
• see what sites are using what services
• remove services
• disable or uninstall platform
• report bugs
BrowserPlus™
Thursday, November 20, 2008 13

BrowserPlus for Web Developers
50 pix 36 pix
16 pix
Steve Spencer
Nov 18th, 2008
Thursday, November 20, 2008 14

getting started
• Include JavaScript
• Detect BrowserPlus
• Offer “upsell”
• Require services
• Use services
• The Toolbox
BrowserPlus™
Thursday, November 20, 2008 15

detection
<script type=\"text/javascript\"
src=\"http://bp.yahooapis.com/2.1.7/browserplus-min.js\"></script>
<script type=\"text/javascript\">
BrowserPlus.init(function(result) {
if (result.success) {
// require services
} else if (result.error == \"bp.notInstalled\") {
// render upsell link
} else if (result.error == \"bp.unsupportedClient\") {
// not supported on this client
} else {
// unexpected error
}
});
</script>
BrowserPlus™
Thursday, November 20, 2008 16

upsell
(1) redirect (3) in-page
(2) link
Install BrowserPlus
BrowserPlus™
Thursday, November 20, 2008 17

require
var tts = {
service: “TextToSpeech”,
version: “1”,
miniversion: “1.0.2”
};
BrowserPlus.require(
{ services: [tts] },
requireCB
);
BrowserPlus™
Thursday, November 20, 2008 18

service versioning
• major - api breaking change
• minor - add optional parameter
• micro - bug fix
• service - name of service
• version - (“1”, “1.2”, “1.2.3”)
• minversion - minimum allowable version
BrowserPlus™
Thursday, November 20, 2008 19

using services
• invocation
BrowserPlus.Service.method({args}, asyncCB);
• return object
{ success:true, value: “any object” }
OR
{ success:false, error: “errorCode”,
verboseError: “optional longer message” }
BrowserPlus™
Thursday, November 20, 2008 20

toolbox
(BrowserPlus in 1 line of code)
• desktop notifications (fallback to html)
BPTool.Notify.create().show(“My Title”, “My Message”);
• drop-in uploading widget
BPTool.Uploader.create(\"uploader\", {uploadUrl: \"up.php\"}).render();
• in-page installation experience
BPTool.Installer.createDialog({}, myInitFunc);
BrowserPlus™
Thursday, November 20, 2008 21

where’s the doc
http://browserplus.yahoo.com/developer/
BrowserPlus™
Thursday, November 20, 2008 22

BrowserPlus for Service Authors
50 pix 36 pix
16 pix
Lloyd Hilaiel
Nov 18th, 2008
Thursday, November 20, 2008 23

what is a service?
• Implementation
• A binary shared library (.so or .dll)
• OR a ruby script
• Metadata - JSON “manifest” file
• whatever else you want...
BrowserPlus™
Thursday, November 20, 2008 24

how services fit
BrowserPlusCore
Daemon
C Service API
C/C++ C/C++ C/C++
Service Service Service Ruby Interpreter
Ruby Ruby Ruby
Service Service Service
BrowserPlus™
Thursday, November 20, 2008 25

Service API
• API definition - structure
•
BrowserPlus™
Thursday, November 20, 2008 26

Service API - interactions
BrowserPlus to Service Service to BrowserPlus
BPPGetEntryPoints() BPCPostResults()
BPPInitialize() BPCPostError()
BPPShutdown(); BPCLog();
BPPAllocate(); BPCInvokeCallback();
BPPDestroy(); BPCPromptUser();
BPPInvoke();
(attach/detach)
BrowserPlus™
Thursday, November 20, 2008 27

Service API - types
• null • list
• boolean • callback
• integer • path
• double • any
• string
• map
BrowserPlus™
Thursday, November 20, 2008 28

what’s coming
• Service API - C & Ruby
• most of our services - open source
• “SDK”
• full documentation
BrowserPlus™
Thursday, November 20, 2008 29

build your own
• getting started
• getting help
• getting published
BrowserPlus™
Thursday, November 20, 2008 30

BrowserPlus for Bad Guys
50 pix 36 pix
16 pix
Lloyd Hilaiel
Nov 18th, 2008
Thursday, November 20, 2008 31

philosophy
• security through transparency (not
obscurity)
• leverage existing precedent
• meaningful prompting
• Explicit installation
BrowserPlus™
Thursday, November 20, 2008 32

security measures
• All sensitive content signed
• All components may be blacklisted
• Secure file handles
• Secure user prompting
• User controlled permissions
BrowserPlus™
Thursday, November 20, 2008 33

Secure file handles
• selected via interaction OR returned as
output
• Path removed, filename for display
purposes
• session scoped
BrowserPlus™
Thursday, November 20, 2008 34

help from our friends
• The “paranoids”
• Y! privacy group
• you.
BrowserPlus™
Thursday, November 20, 2008 35

contact us
• Questions, Support, Ideas:
http://developer.yahoo.net/forum/
• Partners:
browserplus-feedback@yahoo-inc.com
• Follow - twitter #browserplus & RSS
BrowserPlus™
Thursday, November 20, 2008 36

questions?
BrowserPlus™
Thursday, November 20, 2008 37