5.3 - The HotJava Browser--A New Concept in Web Browsers
5.4 - The Essential Difference
5.5 - Dynamic Content
5.6 - Dynamic Types
5.7 - Dynamic Protocols
5.8 - Freedom to Innovate
5.9 - Implementation Details
5.10 - Security
5.11 - Summary
It's a jungle out there,
So drink your Java
T-shirt caption from Printer's Inc Cafe, Palo Alto, California
The HotJava browser is a new World-Wide Web browser built entirely in the Java programming language. The HotJava browser is the first major end-user application created using the Java language and run-time system as a base. The HotJava browser not only showcases the powerful features of the Java language environment, it also provides an ideal platform for distributing Java programs across the most complex, distributed, heterogeneous network in the world--the Internet.The HotJava browser and its already rapidly growing Web population of Java language programs called applets (mini-applications), are the most compelling demonstration of the dynamic capabilities of the Java language environment.
The HotJava browser includes many innovative features and capabilities above and beyond the first generation of static Web browsers. The HotJava browser is extensible--its foremost feature is its ability to download Java programs (applets) from anywhere, even across networks, and execute them on the user's machine. It builds on the network browsing techniques established by Mosaic and other Web browsers and expands them by adding dynamic behavior that transforms static documents into dynamic applications. The HotJava browser brings a much needed measure of interactivity to the concept of the Web browser, transforming the existing static data display of current generation Web browsers into a new dynamic, animation-oriented, interactive viewing system for hypertext. Content developers candistribute their applications across the Internet with the click of a button.
The Internet has evolved into an amorphous ocean of data stored in many formats on a multiplicity of network hosts. Over time, various data storage and transmission protocols have evolved to impose some order on this chaos. One of the fastest growing areas of the net--the one we're primarily interested in here--is the World-Wide Web (WWW), which uses a hypertext-based markup system to enable users to navigate their way across the oceans of data.
Web browsers combine the functions of fetching data with figuring out what the data is and displaying it if possible. One of the most prevalent file formats broswers deal with is HyperText Markup Language, or HTML-- a markup language that embeds simple text formatting commands within text to be formatted. The main key to the hypertext concept is HTML's use of links to other HTML pages either on the same host or elsewhere on the Internet.
A user in search of gold mining data, for instance, can follow links across the net from Mountain View, California, to the University of the Witwatersrand, South Africa, and arrive back at commercial data providers in Montreal, Canada, all within the context of tracing links in hypertext "pages."
What we could call the "first-generation" Web browsers--exemplified by NCSA Mosaic and Netscape Navigator--provide an illusion of being interactive. By using the (somewhat limited) language of HTML these browsers provide hypertext links on which you can click. The browser goes off across the network to fetch the data associated with that link, downloads the data, and displays it on your local screen. As we said, this is an illusion of interactivity.
This illustration depicts roughly the "interactive" flow of control in the first-generation Web browsers. As you see, it's not really interactive--it's just a fancy data fetching and display utility.
The HotJava browser brings a new twist to the concept of client-server computing. The general view of client-server computing is a big centralized server that clients connect to for a long time and from which they access data and applications. It is roughly a star with a big server in the middle and clients arrayed around it. The new model exemplified by the World-Wide Web is a wide-spread Web with shortxad -lived connections between clients and many servers. The controlling intelligence shifts from the server to the client and the answer to "who's in charge?" shifts from the server to the client.
The primary problem with the first-generation Web browsers is that they're built in a monolithic fashion with their awareness of every possible type of data, protocol, and behavior hard wired in order for them to navigate the Web. This means that every time a new data type, protocol, or behavior is invented, these browsers must be upgraded to be cognizant of the new situation. From the viewpoint of end users, this is an untenable position to be in. Users must continually be aware of what protocols exist, which browsers deal with those protocols, and which versions of which browsers are compatible with each other. Given the growth of the Internet, this situation is clearly out of control.
5.3 The HotJava Browser--A New Concept in Web Browsers
The HotJava browser solves the monolithic approach and moves the focus of interactivity away from the Web server and onto the Web client--that is, to the computer on which the user is browsing the Web. Because of its basis in the Java language system, a HotJava browser client can dynamically download segments of code that are executed right there on the client machine. Such Java-based "applets" (mini-applications) can provide full animation, play sound, and generally interact with the user in real time.
The HotJava browser removes the static limitations of the Mosaic generation of Web browsers with its ability to add arbitrary behavior to the browser. Using the HotJava browser you can add applications that range from interactive science experiments in educational material, to games and specialized shopping applications. You can implement interactive advertising, customized newspapers, and a host of application areas that haven't even been thought of yet. The capabilities of a Web browser whose behavior can be dynamically updated are open-ended.
Furthermore, the HotJava browser provides the means for users to access these applications in a new way. Software migrates transparently across the network as it's needed. You don't have to "install" software--it comes across the network as you need it--perhaps after asking you to pay for it... Content developers for the World-Wide Web don't have to worry about whether or not some special piece of software is installed in a user's system--it just gets there automatically. This transparent acquiring of applications frees content developers from the boundaries of the fixed media types such as images and text and lets them do whatever they'd like.
The central difference between the HotJava browser and other browsers is that while these other browsers have knowledge of the Internet protocols hard-wired into them, the HotJava browser understands essentially none of them. What it does understand is to how find out about things it doesn't understand. The result of this lack of understanding is great flexibility and the ability to add new capabilities very easily.
One of the most visible uses of the HotJava browser's ability to dynamically add to its capabilities is something we call dynamic content. For example, someone could write a Java language program following the HotJava API that implemented an interactive chemistry simulation. People browsing the net with the HotJava browser could easily get this simulation and interact with it, rather than just having a static picture with some text. They can do this and be assured that the code that brings their chemistry experiment to life doesn't also contain malicious code that damages the system. Code that attempts to be malicious or which has bugs essentially can't breach the walls placed around it by the security and robustness features of the Java language.
For example, the following is a snapshot of the HotJava browser in use. Each diagram in the document represents a different sort algorithm. Each algorithm sorts an array of integers. Each horizontal line represents an integer: the length of the line corresponds to the value of the integer and the position of the line in the diagram corresponds to the position of the integer in the array.
In a book or HTML document, the author has to be content with these static illustrations. With the HotJava browser the author can enable the reader to click on the illustrations and see the algorithms animate:
Using these dynamic facilities, content providers can define new types of data and behavior that meet the needs of their specific audiences, rather than being bound by a fixed set of objects.
The HotJava browser's dynamic behavior is also used for understanding different types of objects. For example, most Web browsers can understand a small set of image formats (typically GIF, X11 pixmap, and X11 bitmap). If they see some other type, they have no way to deal with it directly. The HotJava browser, on the other hand, can dynamically link the code from the host that has the image allowing it to display the new format. So, if someone invents a new compression algorithm, the inventor just has to make sure that a copy of the Java language code is installed on the server that contains the images they want to publish; they don't have to upgrade all the browsers in the world. The HotJava browser essentially upgrades itself on the fly when it sees this new type.
The following is an illustration of how HotJava negotiates with a server when it encounters an object of an unknown type:
The protocols that Internet hosts use to communicate among themselves are key components of the net. For the World-Wide Web (WWW), HTTP is the most important of these communication protocols. In documents on the WWW a reference to a document is called a URL. The URL contains the name of the protocol, HTTP, that is used to find that document. Current Web browsers have the knowledge of HTTP built-in. Rather than having built-in protocol handlers, HotJava uses the protocol name to link in the appropriate handler. This allows new protocols to be incorporated dynamically.
The dynamic incorporation of protocols has special significance to how business is done on the Internet. Many vendors are providing new Web browsers and servers with added capabilities, such as billing and security. These capabilities most often take the form of new protocols. So each vendor comes up with their unique style of security (for example) and sells a server and browser that speak this new protocol. If a user wants to access data on multiple servers on which each has proprietary new protocols, the user needs multiple browsers. This is incredibly clumsy and defeats the synergistic cooperation that makes the World-Wide Web work.
With the HotJava browser as a base, vendors can produce and sell exactly the piece that is their added value, and integrate smoothly with other vendors, creating a final result that is seamless and very convenient for the end user.
Protocol handlers get installed in a sequence similar to how content handlers get installed: The HotJava Browser is given a reference to an object (a URL). If the handler for that protocol is already loaded, it will be used. If not, the HotJava Browser will search first the local system and then the system that is the target of the URL.
Innovation on the Internet follows a pattern: initially: someone develops a technology. They're free to try all kinds of things since no one else is using the technology and there are no compatibility issues. Slowly, people start using it, and as they do, compatibility and interoperability concerns slow the pace of innovation. The Internet is now in a state where even simple changes that everyone agrees will have significant merit are very hard to make.
Within a community that uses the HotJava browser, individuals can experiment with new facilities while at the same time preserving compatibility and interoperability. Data can be published in new formats and distributed using new protocols and the implementations of these will be automatically and safely installed. There is no upgrade problem.
One need not be inventing new things to need these facilities. Almost all organizations need to be able to adapt to changing requirements. the HotJava browser's flexibility can greatly aid that. As new protocols and data types become important, they can be transparently incorporated.
The basic structure of the HotJava browser is instructive. It is easiest understood from the operation of Mosaic:
Mosaic starts with a URL and fetches the object using the specified protocol. The host and localinfo fields are passed to the protocol handler. The result of this is a bag of bytes that contains the object that has been fetched. These bytes are inspected to determine the type of the data (for example, HTML document or JPEG image). From this type information, code to manipulate and view this data is invoked.
That's all there is to Mosaic. It's essentially very simple. But despite this, it is actually huge since it contains handlers for all of these data types. It's bundled together into one big monolithic lump.
In contrast, the HotJava browser is very small, since all of the protocol and data handlers are brought in from the outside. For example, when it calls the protocol handler, instead of having a table that has a fixed list of protocols that it understands, the HotJava browser instead uses this type string to derive a class name. The protocol handler for this type is dynamically linked in if it is missing. They can be linked in from the local system, or they can be linked in from definitions stored on the host where the URL was found, or anywhere else on the net that the browser suspects might be a good place to look. Similarly, the code to handle different types of data objects and different ways of viewing them.
What makes this federation of pieces and dynamic addition of capabilities possible is the Java language, the underlying programming language described in the earlier parts of this document, and the environment on which HotJava is built.
Network security is of primary importance to Internet users, especially with the burgeoning growth of Internet commerce. Network-based applications must be able to defend themselves against a veritable gallimaufry of network viruses, worms, Trojan horses, and other forms of intruders. This section discusses the layers of defense provided by the Java language, run-time system, and the higher-level protocols of the HotJava browser itself.
One of the most important technical challenges in building a system like the HotJava browser is making it secure. Installing and running imported code fragments from across the network is an open invitation to all sorts of problems. On the one hand, such a facility provides great power that can be used to achieve very valuable ends, but on the other hand it can be subverted to become a breeding ground for computer viruses. The topic of safety is a very broad one and doesn't have a single answer. The HotJava browser has a series of facilities that layer and interlock to provide a fairly high degree of safety.
The First Layer--The Java Language Interpreter
The first layer of security in Java applications come from the ground rules of the Java language itself. These features have been described in detail in previous chapters in this paper.
When a code fragment is imported into HotJava it doesn't actually know whether or not the code fragment follows the Java language rules for safety, since it may not have been produced by the local Java language compiler. As described earlier, imported code fragments are subjected to a series of checks, starting with straightforward tests that the format of the code is correct and ending with a series of consistency checks by the Verifier.
The Next Layer--The Higher Level Protocols
Given this base set of guarantees that interfaces cannot be violated, higher level parts of the system implement their own protection mechanisms. For example, the file access primitives implement an access control list that controls read and write access to files by imported code (or code invoked by imported code). The defaults for these access control lists are very restrictive. If an attempt is made by a piece of imported code to access a file to which access has not been granted, a dialog box pops up to allow the user to decide whether or not to allow that specific access.
These access restrictions err on the conservative side, which makes constructing some very useful extensions impossible or awkward. We have a mechanism whereby public keys can be securely attached to code fragments that allows code with trusted public keys to have fewer restrictions. This mechanism isn't in the public release for legal reasons.
The HotJava Web browser--based upon the foundations of the Java language environment--brings a hitherto unrealized dynamic and interactive capability to the World-Wide Web. Dynamic content, dynamic data types, and dynamic protocols provide content creators with an entirely new tool that facilitates the burgeoning growth of electronic commerce and education. The advent of the dynamic and interactive capabilities provided by the HotJava Web browser brings the World-Wide Web to life, turning the Web into a new and powerful business and communication tool for all users.
