A walk through the implementation of BrowserPlus.

1. BrowserPlus™
The Gory Details
The BrowserPlus Team
Nov 18th, 2008
Thursday, November 20, 2008 1

2. agenda
1. Architectural Overview
2. End Users
3. Web Developers
4. Service Authors
5. Security Model
BrowserPlus™
Thursday, November 20, 2008 2

3. Architectural Overview
50 pix 36 pix
16 pix
David Grigsby
Nov 18th, 2008
Thursday, November 20, 2008 3

4. big picture
user html/css/js
dist browserplus js
dist
servers
ActiveX NPAPI
daemon
service service service service service
BrowserPlus™
Thursday, November 20, 2008 4

5. browserplus.js
• Instantiates plugin object
• exposes core API
• 5k minified
BrowserPlus™
Thursday, November 20, 2008 5

6. plugins
user html/css/js
browserplus js
ActiveX NPAPI
JS JS
DnD DnD
Interop Interop
Plugin Common Lib
Session User File
Utils DnD
Mgmt Prompt Browse
Protocol Lib
daemon
service service service service service
Thursday, November 20, 2008 6

7. daemon
BrowserPlusCore
Platform Service Usage
Update Update Reporting
service service
logging
permissions
config
BrowserPlus™
Thursday, November 20, 2008 7

8. distribution servers
• platform (installers & updates)
• available services & descriptions
• permissions.smime
• stateless, BCP & redundant
• apache, REST
BrowserPlus™
Thursday, November 20, 2008 8

9. BrowserPlus for End Users
50 pix 36 pix
16 pix
Gordon Durand
Nov 18th, 2008
Thursday, November 20, 2008 9

10. installation
• one time install of platform
• less than 2mb
• no restart, no reload BrowserPlus™
Thursday, November 20, 2008 10

11. user prompting
• grant permissions
• install or update services
• tradeoff: transparency vs. usability
BrowserPlus™
Thursday, November 20, 2008 11

12. updates
• services and platform
• background download
• user-specific updates BrowserPlus™
Thursday, November 20, 2008 12

13. control panel
• see / remove site permissions
• see what sites are using what services
• remove services
• disable or uninstall platform
• report bugs
BrowserPlus™
Thursday, November 20, 2008 13

14. BrowserPlus for Web Developers
50 pix 36 pix
16 pix
Steve Spencer
Nov 18th, 2008
Thursday, November 20, 2008 14

15. getting started
• Include JavaScript
• Detect BrowserPlus
• Offer “upsell”
• Require services
• Use services
• The Toolbox
BrowserPlus™
Thursday, November 20, 2008 15

16. detection
<script type=quot;text/javascriptquot;
src=quot;http://bp.yahooapis.com/2.1.7/browserplus-min.jsquot;></script>
<script type=quot;text/javascriptquot;>
BrowserPlus.init(function(result) {
if (result.success) {
// require services
} else if (result.error == quot;bp.notInstalledquot;) {
// render upsell link
} else if (result.error == quot;bp.unsupportedClientquot;) {
// not supported on this client
} else {
// unexpected error
}
});
</script>
BrowserPlus™
Thursday, November 20, 2008 16

17. upsell
(1) redirect (3) in-page
(2) link
Install BrowserPlus
BrowserPlus™
Thursday, November 20, 2008 17

18. require
var tts = {
service: “TextToSpeech”,
version: “1”,
miniversion: “1.0.2”
};
BrowserPlus.require(
{ services: [tts] },
requireCB
);
BrowserPlus™
Thursday, November 20, 2008 18

19. service versioning
• major - api breaking change
• minor - add optional parameter
• micro - bug fix
• service - name of service
• version - (“1”, “1.2”, “1.2.3”)
• minversion - minimum allowable version
BrowserPlus™
Thursday, November 20, 2008 19

20. using services
• invocation
BrowserPlus.Service.method({args}, asyncCB);
• return object
{ success:true, value: “any object” }
OR
{ success:false, error: “errorCode”,
verboseError: “optional longer message” }
BrowserPlus™
Thursday, November 20, 2008 20

21. toolbox
(BrowserPlus in 1 line of code)
• desktop notifications (fallback to html)
BPTool.Notify.create().show(“My Title”, “My Message”);
• drop-in uploading widget
BPTool.Uploader.create(quot;uploaderquot;, {uploadUrl: quot;up.phpquot;}).render();
• in-page installation experience
BPTool.Installer.createDialog({}, myInitFunc);
BrowserPlus™
Thursday, November 20, 2008 21

22. where’s the doc
http://browserplus.yahoo.com/developer/
BrowserPlus™
Thursday, November 20, 2008 22

23. BrowserPlus for Service Authors
50 pix 36 pix
16 pix
Lloyd Hilaiel
Nov 18th, 2008
Thursday, November 20, 2008 23

24. what is a service?
• Implementation
• A binary shared library (.so or .dll)
• OR a ruby script
• Metadata - JSON “manifest” file
• whatever else you want...
BrowserPlus™
Thursday, November 20, 2008 24

25. how services fit
BrowserPlusCore
Daemon
C Service API
C/C++ C/C++ C/C++
Service Service Service Ruby Interpreter
Ruby Ruby Ruby
Service Service Service
BrowserPlus™
Thursday, November 20, 2008 25

26. Service API
• API definition - structure
•
BrowserPlus™
Thursday, November 20, 2008 26

27. Service API - interactions
BrowserPlus to Service Service to BrowserPlus
BPPGetEntryPoints() BPCPostResults()
BPPInitialize() BPCPostError()
BPPShutdown(); BPCLog();
BPPAllocate(); BPCInvokeCallback();
BPPDestroy(); BPCPromptUser();
BPPInvoke();
(attach/detach)
BrowserPlus™
Thursday, November 20, 2008 27

28. Service API - types
• null • list
• boolean • callback
• integer • path
• double • any
• string
• map
BrowserPlus™
Thursday, November 20, 2008 28

29. what’s coming
• Service API - C & Ruby
• most of our services - open source
• “SDK”
• full documentation
BrowserPlus™
Thursday, November 20, 2008 29

30. build your own
• getting started
• getting help
• getting published
BrowserPlus™
Thursday, November 20, 2008 30

31. BrowserPlus for Bad Guys
50 pix 36 pix
16 pix
Lloyd Hilaiel
Nov 18th, 2008
Thursday, November 20, 2008 31

32. philosophy
• security through transparency (not
obscurity)
• leverage existing precedent
• meaningful prompting
• Explicit installation
BrowserPlus™
Thursday, November 20, 2008 32

33. security measures
• All sensitive content signed
• All components may be blacklisted
• Secure file handles
• Secure user prompting
• User controlled permissions
BrowserPlus™
Thursday, November 20, 2008 33

34. Secure file handles
• selected via interaction OR returned as
output
• Path removed, filename for display
purposes
• session scoped
BrowserPlus™
Thursday, November 20, 2008 34

35. help from our friends
• The “paranoids”
• Y! privacy group
• you.
BrowserPlus™
Thursday, November 20, 2008 35

36. contact us
• Questions, Support, Ideas:
http://developer.yahoo.net/forum/
• Partners:
browserplus-feedback@yahoo-inc.com
• Follow - twitter #browserplus & RSS
BrowserPlus™
Thursday, November 20, 2008 36

37. questions?
BrowserPlus™
Thursday, November 20, 2008 37