Will you try Google NativeClient?

Question

In case you didn't hear about it yet. Google Native Client is a way to run x86 native code in web applications, in a secure way.

The concept and idea is quite opposite to the others(Java, .NET and Flash), bytecode + Just-in-time.

Answer 1

If the rendering framerate of the applications is at least adequate, when run in the browser, this will live on with interest. Even for the purposes of an internet archive of x86 application, it is of use.

Microsoft, and ex Microsoft employees have done a number of things here and there over the years which is tangent to this effort; let's see if Google has more success.

Answer 2

I'm a bit skeptical - what's the great deal ? It's basically executable programs that you distribute through the web, sandboxed. It's unlikely that it will replace flash (because of its appeal to designers/animators), except maybe on niches like games. Then again, I don't quite see the point. Just package them and offer them as downloads, you won't be sandboxed.

Edit: Maybe one of the interests would be interaction with the webpage, through javascript.

Answer 3

It seems completely pointless to me.

The sandbox requires strict limitations on the program structure and instruction set/sequences for verification, which means you're unlikely to be able to port any of your existing native code without significant changes.

And we already have ways to take advantage of the full power of the CPU on the client side in the forms of Flash and Silverlight, whose runtimes already provide this sandbox functionality as well as allowing hardware acceleration. You also lose the benefits of a JIT-compiled and garbage collected environment meaning you won't have the most optimised instruction set running on the client, and it's potentially prone to memory leaks.

And frankly the security aspect worries me. Do I really trust that Google have identified every single possible instruction sequence and control flow that could do something like cause a buffer overrun etc.? Not given the number of security flaws in Chrome.

Maybe I'm missing something though...?

Answer 4

ActiveX?

Google reinventing the wheel again.

Answer 5

for me the main point is that if it manages to be popular, it will be easy to use better languages than currently offered on the browser. JavaScript is not enough, Java is unpopular and slow to start, and CLI is MS only.

If Adobe releases the full specs to AS bytecode, then maybe it would be worthwhile to create other compilers that target it. Alchemy is a great step, but compiling a VM for modern languages (i'd like to have Python and Lua) makes them too slow. (almost like JS until a few months ago).

but if google's sandbox is really secure, we could just compile any VM written in C and deploy them with the page. similar to how we currently deploy JS libraries (jQuery rocks!) to make it easier to program, we could simply include the VM and write in whatever language we like.

Answer 6

I agree with you, bytecode & JIT is a good way. But I feel happy that we will alternative choice. I don't mean they do better.

Sometime PROS will become CONS. GC is good, however it's unpredictability makes it hard to write Real Time Apps.

JIT is good. However, any one have seen usable H.264 encoder/decoder written in bytecode? (Please tell me if you have one). What I see is, we have to WAIT the JRE/CLR provide some modules in native and JNI/Interop (you will break the sandbox if you do it yourself).

Beside, there are millions of programmer who may never write Java/C#, but write C/C++.

Yes. I think they are reinventing the ActiveX. But thing changes these year. It is a interesting question: Do I really trust that VMware/Microsoft do it right on the VM? I do. But their release note/changes log said they have just fixed few security bug. If a OS can be sandbox, why not an application?

Again, I don't mean they do better. But good to have choice.

Answer 7

I'm having a real hard time finding a case when it would be advantageous for me. However, it does sound interesting. I might give it a try, but I don't really expect it to find widespread use.

Answer 8

No, for two reasons:

1. Security. Google is banking on being able to figure out every single possible set of C instructions that could be considered harmful. While Google has some smart people, I don't think they'll figure out every single one.
2. Portability. It only works on x86 systems. This rules out Smartphones, older Macs, video game systems with a web browser, etc...

Edit: To elaborate on the security part, this is what Google says on its security blog:

Our approach is built around a software containment system called the inner-sandbox that is designed to prevent unintended interactions between a native code module and the host system. The inner-sandbox uses static analysis to detect security defects in untrusted x86 code. Previously, such analysis has been challenging due to such practices as self-modifying code and overlapping instructions. In our work, we disallow such practices through a set of alignment and structural rules that, when observed, enable the native code module to be disassembled reliably and all reachable instructions to be identified during disassembly. With reliable disassembly as a tool, it's then feasible for the validator to determine whether the executable includes unsafe x86 instructions. For example, the validator can determine whether the executable includes instructions that directly invoke the operating system that could read or write files or subvert the containment system itself.

Answer 9

It basically means that you can write web-browser platform code (as in Flash/Silverlight/ActiveX/Java and now GoogleNC) in C++ instead of some new or adapted language.

If you like the idea of that, then this may be useful for you. I don't think that this will supplant Flash anytime soon, though.

Answer 10

I'm a bit suprised to not read about security of your "own" data. Google is a big trap for collecting any sort of data. What will happen to this data? It's probably similiar to the new stuff from Google again. You can call me paranoid, but I don not trust Google as much as many others. It's obvious to me that Google want to bind you to them in any thinkable way. They offer interesting things and then if people got those they got them .

So feel free to vote me down for that

Regards Friedrich

Answer 11

Yes, already installed NativeClient plugin on my computer. I would defenetly use it for browsing internet and for making own web-pages. Until now there was no simple way to deploy and share your C++ programs with others. NativeClient can change that. You could write Hello World code and immediately the whole world will have access to it. Making personal homepages will finally be about learning libraries, not about specializing in tens and hundreds of bug-prone problem-limited technologies, programming languages and even programming environments. Do you imagine how much clutter will be removed from our work?

Answer 12

Unity, a company which provides game development tools with a "build once, deploy anywhere" philosophy has just announced that they have ported their browser control to Native Client, allowing for a fully 3D game to be played for a user without having to prompt them to install the plug-in.