Grail (Guido van Rossum)

• Complete internet browser
• Currently at 0.2 release
• support downloadable applets
  • code not bytecode is downloaded to client
  • security is based on 'restricted python'
  • security currently is 'loose'
  • More complete security is planned for future release
    • little 'rooms' will be the default
    • there will be ways to have applets cooperate
    • sockets will be tough perhaps user authorization on a per-connet basis (as longs as not too many dialog boxes)
    • apps like the chat-room are nice and should be possible
    • in the next version there will be better controls of the module namespace (e.g. To modules named the same from different places currently are cached as the same module)
  • Mailing list for grail: grail@python.org
  • Grail is extensible in many dimentions
    • HTML tags
    • Protocols
    • GUI elements (menu's - more in the future)
• Full HTML 2.0, http, ftp, mailto
• Printing
• Bookmarks
• We hope to evolve grail into an environment much like emacs but much more platform independent
  • python better than elisp for configuration
  • not restricted to UNIX
  • eventually this could de-emphisize operating systems
• portability of grail is dependent on John Osterhout's (and Sun's) ability to deliver Tk ports to the Mac and Windows
• Grail is a bit slower than Netscape, mostly due to the HTML parser being written in python
• Inclusion of Dan Connolly's W3C reference HTML parser (faster because it is written in C) is possible in the future
• Can Grail interoperate with Java? No. No plans to incorporate
• Guido: 'I would prefer to keep the Python language pure, and throw away all that Java s(tuff)'

The Python SSLeay interface (Andrew Kuchling)

• Problem: Credit card numbers in clear are bad
• lot's of proposed solutions proposed today
• Current leader is SSL by netscape
• client/server negotiate an algorthm and session key
• optionally, clients and servers can authenticate each other
• provides easy security
• SSL relys on the X.509 framework - certification authorities Tree based (unlike PGP)
• SSLeay high level algorithm
  • Server only: generate and RSA key and keep it
  • Call SSLeay.fromfd() to create and SSLeay object attached to socket
  • Server only: set a public key and certificate with appropriate functions
  • call connect or accept
• SSLeay support was added to Grail in two hours (easy to use!)
• SSL makes it easy to gain security
• Python makes it easy to use SSLeay because of Polymorphism
• SSLeay is still in alpha state
• interfaces to other SSL implementation could be written
• because of RSA's RSAref toolkit, SSLeay can be used without patten infringment. Currently not a problem (especially abroad since patten law only applies in the US)

A Generic data collection system through WWW forms (Benny Shomer)

• Benny's employer manages one of the worlds largest biological databases
• Problem: an efficient way of collecting data - and validating it
• Benny has written some tools to attempt to validate the data on input using forms
• Classes
  • Generate HTML code - class: WWW - 75% complete to HTML 1.0
  • Data container - class: item - stores key value pairs
  • Form object - class: formobj - programatic presentation of form
  • Abstract class: session - tracks cronology, manages formobj , item , etc.
• Debugging
  • a simple class that overrides printing - very primative
  • using a file tracer - dump messages to a file
  • bypassing the web server - call a script that dumps the calling parameters instead of calling you script
• Future issues
  • Overcoming 23.5Kb limit in forms
  • HTML standard for menus and pop-up menues
  • ability to include files from the users system
  • easy interface to data encription in both directions
  • ability to include code libraries for data filtering and validation written by the server maintainer into the browser
  • ability to provide simple data checking and validation

Intelligent Interaction at Mitre

• Evolution of interfaces - multimodal
• Interaction on the web
  • menus, text input, cgi, moble code
• AIMI
  • completely interpreted interface
• IPP
  • Example - Intelligent Project Planner
• Now experimenting with Grail-izing some existing code
• Outstanding Issues
  • Screen real-estate
  • Security
    • sockets are a problem
    • keyboard and screen are trusted devices
    • other services are not
    • Java strategy of trusted code
    • standard for APIs for speech services are emerging
• Conclusion
  • web hosted multimodal solutions depend on other solutions
    • standard services (corba)
    • trusted services

Creating HTML documents in python (Joel Shprentz)

• Quick Review of HTML
  • Start with Text
  • Add tags
• Webs combine static and dynamic pages
• HTML document tree
  • Python code to generate HTML...

    	def createHtml (partyList):
    	print "
    Hello World
    "
          

  • Problems
    • Bad HTML is not trapped right away
    • Knowledge is not reusable
    • Document is generated in a strict sequence
    • Hard to change document style among many documents
  • A better way: use HTML documents structure as a paradigm for code (as a tree)
• Object Model
  • Each tag is modeled as an object
  • Object attributes
    • Tag: string, Attributes: dictionary
  • Object methods
    • append, prepend, setAttribute, writeHTML
• Some simple python code...

     	body = HtmlElement("BODY")
     	head = HtmlElement("H1")
     	image = HtmlElement("IMG")
     	body.writeStdout()
     

• Improvement: Use a tag factory to create all tag object
  • tag factory knows correct HTML syntax
  • tag factory sets the most used attibutes
• Python code with tag factory...

  	image = Tag.IMG("flag.gif")
      	head = Tag.H1 ([image, " Politics"])
    	body = Tag.BODY(head)
  	body.writeStdout()
     

• Code can be nested
• HTML forms
  • implemented as tags
  • a single field may have many tags
  • forms are HtmlElement tag objects
  • fields are special subclasses of HtmlElement
  • fields can set their values from a CGI response dictionary
• HTML documents need consistent style
• Abstract class HtmlDocument
  • contents, append, prepend, writeHtml
• Python library
  • htmlDoc
  • 628 lines of python, 16 classes
  • available from www.python.org
• Work In Progress
  • HTML Upgrades, currently 2.0
  • HTML Parsing - parse HTML into a tree of objects
  • SGML Support - could be extended to support (maybe code to generate a tag factory from a DTD)
• Future Directions
  • Choose best way to store HTML text - pickles?
  • Provide a better forms model
    • Present form (possibly with preset responses)
    • validate input
    • process request
    • display results
  • paring down large lists into multiple selections
• Conclusions
  • Python is excellent
  • HTML tag classes guarantee correct tags
  • Object tree matches tag structure
  • HTML document classes consolidate style decisions in one place
  • New HTML applications are small and easy to build
• Q: (Scott Hassan) What about preserving asyncronous loading of pages? Doesn't buffering the entire page up till the end break that?
• A: Most of the delay is in network delays, not in processing the python
• Q: (Scott) What about if your python does an SQL query?
• A: Often I need to know how many hits I got to decide how to display the page
• Q: (Scott) User needs to see *something* happening
• A: Yes that would be nice too

SYLU 1.0 - ILU runtime reimplemented in/for Python (Scott Hassan)

• What is ILU
  • Invented at Xerox PARC
  • Distributed Objects
  • ISL (Interface Specification Language) - language independent object specifier
  • Every parameter is strongly typed
  • Corba ORB (Object Request Broker)
  • language independent
  • transport independent (UDP, TCP, email)
• SYLU
  • Scott's Yet another Language Unification
  • Just the Python/ILU runtime reimlemented
  • Under 4000 lines of code
  • doesn't implement entire ILU 1.X - no courier protocol, no singleton types, no garbage collection, no UDP
  • Future
    • ILU 2.0 support
    • thread support for big time server programs
    • support encryption that ILU supports (SSL, others)
  • Grail applications that use SYLU
    • Chat room
    • Drawing room - everyone draws on the same page
    • Four player Roulette game
    • http://www-db.standford.edu/~hassan/grailApps
  • Performance - ILU will be faster than raw HTTP because the connection stays open (adds 25% overhead to raw TCP)

Security == Authentication == Encryption (Aaron Watters - Bell Labs)

• Sun is right - the network *is* the computer
  • Machine boundries are the most irritating
• Sun is wrong - Java style security isn't enough
  • too complicated
  • requires bug free interpreter
  • java specific
  • one level of security
• Netscape is right
  • Encryption protocols provide trustworthy security (e.g. SSL)
  • Simple
  • If the application has bugs it won't work *but* the priviledged access will be maintained
  • not specific to one language, os, hardware, chip, etc.
  • Fully and easily configurable
• Goal - define a protocol which provides...
  • configurable authorization
  • configurable security
• Constraints
  • don't want to know where the code is running
• Proposal: encryption protected pseudo secure cell OS
• Q: Are we talking about two security issues 1) privacy 2) trojan horse?
• Secure Key distribution is still a major problem