back to article Google's Native Code browser tech goes cross-platform

At its annual I/O conference in San Francisco this week, Google unveiled a new version of its Native Client technology that allows developers to deploy binary code for web applications in an architecture-independent way. With the original version of Native Client (NaCl), developers could write modules in C or C++ and compile …

COMMENTS

This topic is closed for new posts.
  1. Pete Spicer
    Joke

    PNaCl: The 2010s answer to ActiveX.

    *waits for the inevitable Eadon rant*

    1. Anonymous Coward
      Anonymous Coward

      No need for the joke alert icon.

    2. JDX Gold badge

      It is a fair comparison, although I'm not sure other browsers were/are allowed to implement ActiveX even if they wanted to? PNaCl seems a dumb idea to me, you could just write a desktop app, so I can't seem other browsers wanting it really. It's technically very cool but I don't want every app to be inside the browser.

      1. El Andy

        They were allowed to implement ActiveX, it is after all just a bunch of COM interfaces and COM was an open standard. The real problem with other platforms supporting ActiveX (security concerns of native code aside) was that almost any native code worth writing ends up with dependencies on underlying OS functionality, because that aside your might just as well be using JITted JavaScript.

        This is the problem that doesn't really go away with PNaCl, although it's clear here that Google's strategy is to create a world of Chrome-only web applications, paving a way for Chrome OS only webapps and ultimately a closed web controlled by Google.

    3. DrXym

      PNaCl is different than ActiveX. First, programs are expressed in an intermediate format called LLVM bitcode so they either run in a VM, or they can be laced with memory & security checks as they are turned into native code. So the program would essentially have its own address space, heap, stack and file storage space separate from other apps or the OS. Second, the APIs that they can use are restricted and implemented by the browser host which can do additional security checks. Thirdly apps are only hosted through the Chrome Webstore which IMO limits the tech's usefulness but does allow them be tested for malicious behaviour and removed if necessary.

      An ActiveX component is just a native DLL or EXE. It can literally do anything it likes, OS security permitting. So if it was registered as as safe for scripting, and was exploitable, any malicious website could instantiate it, exploit it and own you.

      None of this means that PNaCl is going to be bug free but that's an implementation issue which can be fixed rather than a flaw in the concept itself.

      I wish other browsers would implement something similar but browser agnostic. Emscripten is a project that allows C to run in a browser by compiling it to LLVM bitcode and compiling that into JS which is what gets run. Performance is naturally horrible. Running the bitcode directly would be much faster, potentially near native.

      1. JDX Gold badge

        Well done for missing the point, nobody said NaCl and ActiveX are alike technically (I know exactly what an ActiveX or NPAPI plugin is since I've written one). Rather that they are both attempts by dominant browsers to force standards on the world.

        1. DrXym

          Since the point wasn't spelt out or even implied, I chose to address the technical aspect. Also, it's not like there was an open standard for plugins in other browsers. Netscape's NPAPI is as proprietary in its own way as ActiveX.

          And maybe Google are forcing it, which is why it's more important than ever that there be an open standard equivalent to it in terms of capability and performance.

          1. JDX Gold badge

            If NPAPI is proprietary how come it is supported in WebKit/Chrome and was even supported in older IE.

            Not being able to grasp the point under discussion and going off on a technical tangent is a typical nerd failing. Only nerds would find it ambiguous what was being discussed.

            And we do have a standard for running native code on different platforms - it's called an application. No reason to run it through the browser at all, unless of course you are trying to turn the browser into the OS and show that you don't need anything else... hardly a coincidence it's Google doing this.

            Having said that, plugins are a pig and NPAPI is pretty ancient, but browsers are moving away from plugins already.

      2. Ken Hagan Gold badge

        "An ActiveX component is just a native DLL or EXE. It can literally do anything it likes, OS security permitting"

        That's quite a big if, since one of the functions of any half-decent OS is precisely to sandbox user-level processes with "address space, heap, stack and file storage space separate from other apps or the OS" that you mention earlier on. ActiveX got its deservedly dismal reputation because Microsoft did not do this, so you ended up with arbitrary code from untrusted sources running with all the (usually administrative) privileges of the logged-on user.

        1. El Andy

          "ActiveX got its deservedly dismal reputation because Microsoft did not do this, so you ended up with arbitrary code from untrusted sources running with all the (usually administrative) privileges of the logged-on user"

          A common misconception. ActiveX actually had more support for security than NPAPI (the only real alternative). The difference was the Microsoft's tools made ActiveX control creation and consumption very, very easy. As a result lots of non-web applications were built from ActiveX controls without any consideration for what that meant in terms of the risk that they were inadvertently exposing to the web. If VB5 had marked ActiveX controls as unsafe for scripting by default and made it just a tad harder for web development, it would have never have developed the bad reputation in ultimately did.

    4. Mikel
      Boffin

      Really?

      Cross platform compiler tech is high art. That's why we revere Dennis Ritchie so: not only did he do it, he made it look easy. 40 years later we can't simplify his work because he reduced it to least principles before publishing. Every derivation of his art we try to advance the field leads to self-defeating complexity. He is the Einstein of code.

  2. Tom 7

    NaCl <> asm.js converter

    please!

    1. DrXym

      Re: NaCl <> asm.js converter

      The asm.js FAQ suggests it could reduce the 5x overhead of running code over JS down to 2x compared to native execution. Sounds like a worthy thing to do for the likes of emscripten. The bottleneck is still the need to convert to JS, even a subset.

  3. oolor

    The first thought that occurred to me was, hmm doesn't run on Java. I know I am missing some steps, but I get the feeling that Oracle is the next company to get its lunch eaten by Google.

    More to the point, I wonder how much this has to do with delivering video without JavaScript as much as code porting.

    1. Mikel
      Pint

      Oracle

      Google already ate Oracle's lunch. Oracle sued and Google won. Have you been asleep for a decade?

      1. oolor
        Pirate

        Re: Oracle's lunch

        > Have you been asleep for a decade?

        Sometimes it seems that way.

        I'd say that case was about stolen recess cookies since it was really an acquired property from Sun (and judge Alsup found that the cookies had been dropped anyhow - guy's middle name is a programming language, how ironic and to boot, he learned Java for the trial). I was surprised when Google didn't pony up the 6 bil for that sale, guess we know why.

        I am referring to the rest of Oracle's current business, they still pull in around 2.5 billion in profit on 9 billion revenue a quarter. With this accelerated code delivery to the browser, my thinking is that they are going towards making it more like a thin client system, though through a full blown PC, tablet or whatnot. This together with the news that Mozilla is working on a JavaScript based video/content delivery which can similarly be used as a conduit for a workstation networked to servers elsewhere leads me to believe that the next thing will be selling large organizations a Google operated replacement for Oracle hardware and software (I'd put Amazon in this business too).

        < I'll see your beer and raise you a shipload of rum (some pirate's lunch :), stolen, naturally), cheers mate

    2. James Anderson

      oracle is safe.

      Until Google can make make a reliable high performance db which you can run on your own hardware l think Larry can keep counting his income in billions.

      Yes Google has big table, but it only runs in Googles data centre and is not acid.

      If you own a mobile phone you probably update an Oracle database about 500 times a day. Everytime you change base stations you will update at least three databases and probably as many as ten. Most telcos use Oracle for this because its fast and doesn't lose data.

      1. oolor

        Re: oracle is safe.

        That is an excellent point James, about the own hardware. I also have this preference personally, but I see many businesses going the other route. Thanks for the example about telecom providers, it gave me a few ideas for how to investigate my initial thesis further as I still think that even a small fraction of businesses migrating away can hurt profitability.

        About the no-ACID, it actually has that now with Datastore (though I haven't looked into it in depth):

        http://www.theregister.co.uk/2013/05/16/google_datastore/

        With all this in mind, it would likely be companies which utilize their data primarily internally rather than for customer facing instant data needs that are the prime target for such a switch.

  4. Frankee Llonnygog

    Dear Customer

    When logging into our online bank, we recommend you don't use Google Chrome ...

  5. Christian Berger

    Where's the advantage?

    I still don't see where the advantage is. JS-interpreters are so amazingly fast these days, you will have problems getting any advantage from having some byte code.

    However the disadvantages are obvious. Byte code is much harder to check for malware, and it's much harder to edit it when you have found some.

    1. P. Lee

      Re: Where's the advantage?

      > JS-interpreters are so amazingly fast these days,

      My experience of google docs spreadsheets would disagree with that and JS is relatively hard to code for if you've grown up with C.

      A lot of the benefit is in application delivery. The idea is to devalue microsoft on the desktop by making apps cross-platform and delivered via http, which cuts out the wintel support team and reduces the cost of trials and roll-outs. It replaces the windows interface libraries with a browser one, which is an easier direction to take than to do java on the desktop or find some other reason to drop win32 interfaces.

      I like the idea.

      1. K

        Re: Where's the advantage?

        In theory its an excellent idea.

        But in practice it will be a niche product at best, too many applications require use of OS-specific APIs, so even if the delivery method is cross-platform, the vast majority of apps will not be.

        1. Destroy All Monsters Silver badge
          Trollface

          Re: Where's the advantage?

          > too many applications require use of OS-specific APIs, so even if the delivery method is cross-platform...

          Well, this may change pretty fast in a way not well-becoming to the "too many applications".

  6. Ropewash
    Trollface

    PNaCl...

    ...doesn't Sodium Chloro-phosphate sound both unstable and toxic?

    1. MrT

      I first read it as...

      ...pinochle - Sundar Pichai is the jack of diamonds and he knows the secret identity of the queen of spades...

  7. Anonymous Coward
    Anonymous Coward

    And this differs from Java in the browser how?

    And we all know how well Sun and Oracle have done with that don't we?

  8. James 47

    Oh God

    Javascript scripters will suddenly start firing out native plugins as though they were experienced develoeprs. What could possibly go wrong

    1. P. Lee

      Re: Oh God

      I'm hoping this is not just a plugin replacement.. After all, the point of plugins was that they are OS-specific and managed by a third party.

      I'd like it to be an aid for people who currently do cross-platform to make their lives better. For example, network management tools - currently in windows executables could go x86/Chromium to cover off windows, linux and osx. Perhaps an accounting package for small business, where OSX compatibility might be handy. Chat clients would also be good. Even a google-docs type spreadsheet, but with lower latency and local execution.

      How good would it be to give people a clean OS and point them to http://apps.corp.com/ ? There are you base apps, talk to your manager if you need something more. It will be interesting to see if the performance turns out to be adequate.

  9. John Smith 19 Gold badge
    Unhappy

    So it's a VM/dynamic linking loader running a semi-compiled intermediate language

    from one tool chain and hosted by one browser.

    Can you say "Cross platform proprietary lock in?"

    Technically a formidable logistical exercise.

    Cutting edge stuff in the 1970's and 80's.

    Otherwise...

This topic is closed for new posts.

Other stories you might like