The Next Browser Scripting Language Is — C?

mad.frog writes to tell us that in a recent talk by Adobe's Scott Petersen he demonstrated a new toolchain that he has been working on (and soon to be open-sourced) that allows C code to be run by the Tamarin virtual machine. "The toolchain includes lots of other details, such as a custom POSIX system call API and a C multimedia library that provides access to Flash. And there's some things that Petersen had to add to Tamarin, such as a native byte array that maps directly to RAM, thereby allowing the VM's "emulation" of memory to have only a minor overhead over the real thing. The end result is the ability to run a wide variety of existing C code in Flash at acceptable speeds. Petersen demonstrated a version of Quake running in a Flash app, as well as a C-based Nintendo emulator running Zelda; both were eminently playable, and included sound effects and music."

Comments

Browser-based OS

[rustalot42684]

Now we can finally get this "web operating system" thing I've heard so much about...

Re:Browser-based OS

[Hatta]

Well this just underscores how silly the whole web-application thing is. An application running on a browser is a silly idea for the same reason an OS running on a browser is. We already have operating systems to run programs on. Give us native programs, not some horrid mishmash of technologies.

Re:Browser-based OS

[Yold]

What the hell are you talking about? Web applications have some really good uses in the real-world (read business world). Instead of updating every computer in the office with a new version of some data management app, it is deployed once.

Native programs are optimized for speed, Web Applications are optimized for Rapid Application Development. Remember visual basic? Thats what web apps do nowadays, and trust me, its better.

As for "your horrid mishmash of technologies" statement, I agree that AJAX is overused, but believe me it is very nice to be able to do stuff on the server side (think form validation), and then not have to redo on the client-side in javascript.

Re:Browser-based OS

[Anonymous Coward]

You need an operating system to run programs? Bah! Real programmers aren't afraid of programming directly to the hardware.

This whole operating system fad won't last. Who wants to waste so many resources just to simplify development and portability? If we don't stop this operating system fad quickly, the next thing you'll see is people developing virtual machines so that girly programmers won't have to have to test their applications across various platforms. And then they'll start integrating these virtual machines into normal applications! What are they thinking? That memory and processor speeds are growing exponentially?

Re:Browser-based OS

[Whatanut]

If you run a browser based OS... and install a browser in it. And then use that to run a browser based OS, why... we could have infinite amounts of computing power! Or space time will tear itself apart. Either way, I'm making popcorn.

Re:Browser-based OS

[bestinshow]

Not really. I do agree that native applications are nicer than web applications, especially if you compare, e.g., Google Docs to Office, or even WordPad.

However what we have discovered is that (1) web applications are easier to write, and (2) it's nice having a consistent platform to develop to, even if that platform is mildly ridiculous (HTML + CSS + JavaScript + Browser-Workarounds + JavaScript canvas thing). Getting stuff to display and layout on this platform is easy, and simple to prettify, far easier than most native platforms have been in the past. There are also a dozen different ways to write the server side of things, and I think for many developers it is nice to be forced to split up the client interface from the meat of the system.

Of course, things are going too far. What should be happening is the simplification of native application programming, with a common platform, etc, without the overhead of having to run a Javascript or HTML rendering engine, and native full-speed canvases. I think that Apple is getting there, QT and KDE4 may be getting there but I haven't really looked into that platform. Java should have gotten there but early design mistakes (AWT, Swing) have killed that off, and SWT is a last-generation UI library. Maybe something like Fenggui on Java might help this platform, but I think Java's dead on the home desktop (and extremely alive and profitable on the server).

Re:Browser-based OS

[rustalot42684]

Instead of updating every computer in the office with a new version of some data management app, it is deployed once.

Or you could have a sensible package system which does updates (eg, one of the Linux package managers), or have the program itself do the updates (eg, Firefox). Your problem is solved.

A commonly mentioned benefit of web apps is portability, but this isn't really true either because of the variety (and inconsistency) of web browsers. What I think is a better approach is something like the solution we see with Qt, where you write your program once, then compile it for different platforms, and it looks native every time. You get the speed and the portability and the UI consistency and the tech support only needs to support one program.

I agree with you, however, that web apps are the new Visual Basic. They're slow, crappy, and often insecure.

Re:Browser-based OS

[Hatta]

Web applications have some really good uses in the real-world (read business world). Instead of updating every computer in the office with a new version of some data management app, it is deployed once.

Oh come on, it's not that hard to push an application onto every computer in the office. This is a cop out.

Native programs are optimized for speed, Web Applications are optimized for Rapid Application Development. Remember visual basic? Thats what web apps do nowadays, and trust me, its better.

Then use python with wxwidgets or something. Every bit as easy and portable, a lot faster and safer.

As for "your horrid mishmash of technologies" statement, I agree that AJAX is overused, but believe me it is very nice to be able to do stuff on the server side (think form validation), and then not have to redo on the client-side in javascript.

Frankly, you should be doing everything on the server side.

Re:Browser-based OS

[Yold]

#1, Yes, it is hard to push out an application to every University computer when you are at one w/ 50,000 students.

#2, see #1

#3, everything is done on the server-side, and prior to AJAX, it was redone in Javascript on the clientside for a more responsive user interface. Now, both the client and server use the server-side procedure.

Re:Browser-based OS

[sjames]

Sonny, back in the day we didn't need a machine to test our code. We ran it in our heads as we punched it into the cards. Sure, there were a few new guys who used pencil and paper to help them, but if they didn't shape up in a month or so, we ran them out of the industry.

Now get off my lawn!

Re:Browser-based OS

[Hairy Heron]

especially when the proprietary part is very large and complex (eg Java)

You're about 3 years out of date on calling Java proprietary, kiddo. In case you forgot, it's been GPLed for over a year now.

Re:Browser-based OS

[sconeu]

So it's browsers all the way down?

Re:Browser-based OS

[Anonymous Coward]

"Or you could have a sensible package system which does updates (eg, one of the Linux package managers), or have the program itself do the updates (eg, Firefox). Your problem is solved."

What if your office runs Windows, Mac OS X, Symbian OS, Debian, Plan 9, Red Hat, MS-DOS and OpenBSD?

I don't know about you, but I'd still rather just update a web application. There are many ways to solve the cross-platform issue, but the web's a particularly zippy one that's very easy to develop for, so why not?

Re:Browser-based OS

[grasshoppa]

Or you could have a sensible package system which does updates (eg, one of the Linux package managers), or have the program itself do the updates (eg, Firefox). Your problem is solved.

That certainly is a simplistic concept. Now, let's talk about largish environments. You know, where the user is running as a limited user, therefore the app can't update itself. Or where windows is required, so we can't use linux's update mechanisms.

Or how about the simple logic that updating one app once is more likely to go smoothly than updating one application 100 times. Or a thousand. No matter how automated, problems crop up.

Honestly, if you are going to argue the point, at least think about your arguments first.

Re:Browser-based OS

[jsebrech]

A commonly mentioned benefit of web apps is portability, but this isn't really true either because of the variety (and inconsistency) of web browsers. What I think is a better approach is something like the solution we see with Qt, where you write your program once, then compile it for different platforms, and it looks native every time.

That still doesn't solve the deployment problem. You need rights on the local system to install that software. Why do you need those rights? Because native apps can interact in too many ways, and they can't be trusted, so rights are not automatically granted.

The clever thing about the web platform, and what sets it apart from other platforms, is that the security model by default lets you run any app, even one you don't trust, on any system, without it causing major catastrophes.

The web platform is building on a new concept: ubiquitous internet. The idea is that your applications and data live in the cloud, and are available to you on any device, anywhere, any time. Off-line support is only necessary as a short-term stopgap until the cloud is visible again (like the offline support of google docs).

This is why the web makes sense: it just works. No installs, no administration, no lost data when your local machine fails, no shuttling different versions around on usb sticks. It's true that it's less powerful, but it doesn't matter because the ease of use gained from having the apps and the data "out there" will vastly outweigh the lack of capability for the majority of users.

Re:Browser-based OS

[Tablizer]

Well this just underscores how silly the whole web-application thing is. An application running on a browser is a silly idea for the same reason an OS running on a browser is. We already have operating systems to run programs on. Give us native programs, not some horrid mishmash of technologies.

Ideally, web apps should have 3 main advantages over native apps:

1. Easy deploy-ability - No "install" step

2. Vendor-neutral user-interface conventions - Developer only writes to "web standard" and not to Windows nor KDE nor Mac, etc. (X-windows tried to be this, but it is not HTTP-friendly.)

3. Sandbox Security - The web app would not be able to touch local resources, such as user's file system, without explicit permission.

In practice, it has not been quite that simple. For one, standard web interfaces have lack-luster and incomplete widget choices. And, different browsers support JS/DOM differently.
           

Re:Browser-based OS

[kundziad]

Or where windows is required, so we can't use linux's update mechanisms.

The truth is that Windows is a corporate OS too (or... in the first place), so it has perfectly working corporate software management mechanism. You just have to be maintain it well and have support from the application developers (who need to stick to good practice while coding their applications - that's usually the most difficult part).

Meet the new boss

[vivaoporto]

Same as the old boss.

And once we have C...

[Anonymous Coward]

We can write PHP! And then browser security will be top notch.

what?

[thermian]

You mean my preferred language has just become cool?

Ok, this is either great news or the world is about to end.

I think I'll go stand in a doorway for an hour or two, just to be on the safe side.

Re:what?

[eviloverlordx]

I heard that COBOL is next on the TODO list.

Re:what?

[dgatwood]

I'd use C for everything if its string handling weren't so utterly broken. It makes sense from a pure performance, near-the-hardware perspective to handle strings the way it does, but what is desperately needed is POSIX standardization of stracat/stracpy. That one change would make it trivial to eliminate 99% of all buffer overflows in typical apps (and, ideally, kernel code)....

char *stracpy(char *src) Returns a copy of a string in a newly allocated buffer large enough to hold the result. char *stracat(char *string1, char *string2 ...) Returns a newly allocated string that contains the concatenation of two or more strings.

Sure, I could write my own, and pretty much everybody on the planet has done it at least once in their lives, but it seems ridiculous that such obvious operations require hand holding. Outside of embedded platforms where malloc is expensive, dynamically allocating a new buffer for concatenations should be the norm. For situations where performance takes a big hit because you can't afford to copy the source string every time, you could also add this API:

strbuf_t strbufalloc(char *src [, size_t size_hint]) Returns a copy of a string in a newly allocated buffer large enough to hold the result. The optional second parameter size_hint allows you to specify a suggested size for the buffer. strbuf *strbufcat(strbuf_t string1, strbuf_t string2 ...) Returns a newly allocated string that contains the concatenation of two or more strings. The value of string1 must be a string buffer (strbuf_t). The value of string2 may be either a strbuf_t or char **.

Wherein strbuf is opaquely defined as:

struct strbuf_private {
char *content; // null-terminated string
size_t length;
void *private_history_data;
};

struct strbuf;
typedef struct strbuf *strbuf_t;

and the routines automatically realloc the internal char * buffer as needed to grow the size to hold incoming content and likely future content based on historical data about prior operations on the structure, the algorithm for which would be an implementation detail outside the scope of the standard. That said, for the rare cases where a simple copy hurts performance badly enough for most folks to care, chances are your application knows its own growth policy better than the OS could guess anyway, so you probably should just roll your own buffer management code. The important bits to add to the standard are those first two functions (stracpy and stracat).

Re:what?

[naasking]

See The Better String Library. Haven't used it myself, but it's supposedly very portable, high performance, and has good interoperability with normal null terminated C strings.

Internet-C reborn?

[dyfet]

There used to be a project, many years ago, which was I believe called itself something like "Internet-C". It used gcc with a pseudo-code backend to produce portable binaries which could then be ran from a plugin or through an emulator. Since gcc was tuned for register based archectures and 68k was already an existing backend, I think the pseudo-machine code he used was based at least loosely on the 68k one.

Re:Internet-C reborn?

[LWATCDR]

Could it be Juice?
http://web.archive.org/web/20010408174718/caesar.ics.uci.edu/juice/intro.html

Re:Internet-C reborn?

[naasking]

The DotGNU project compiles C to the CLR, so that fits the bill.

Re:Sound and Music?

[2nd Post!]

Nope. SFX is generally event driven (hit a key, hear the sword swing) where music is not (enter an area and music plays continuously in the background).

SFX requires timing, latency, and speed to be accurate. Music requires bandwidth and a minimum level of continuous CPU cycles.

Both have different needs so you can have one without the other (when you are talking emulation).

Where did they get the Zelda on PC?

[Anonymous Coward]

Is that a pirate copy? Just curious...

Re:Where did they get the Zelda on PC?

[Rob T Firefly]

It's a secret to everyone.

am I the only one bored with the software world?

[Anonymous Coward]

Everything's being constantly reinvented but no actual progress is being made. Oh look, the 100th toolkit to do exactly the same thing! Oh look, a new way of layering something old on something old on something old to give something new! Oh look, another silver bullet framework!

Can anyone here remember the web of 10 years ago, for example? Content = text for reading + graphics for illustration. No bullcrap, just Google/Wikipedia style web sites to give me a simple navbar + content.

But is it secure?

[Animats]

If the "byte array mapped to RAM" installed in Tamarin allows the code to store anywhere in the interpreter's space, that's a huge security hole. It can do anything the user process can do. If you're going to allow that, you may as well just load executable machine code directly, as with Active-X.

Anyway, the article is a blog post that rehashes an interview from last year. The info in that article is better.

Re:But is it secure?

[ergo98]

If the "byte array mapped to RAM" installed in Tamarin allows the code to store anywhere in the interpreter's space, that's a huge security hole. It can do anything the user process can do. If you're going to allow that, you may as well just load executable machine code directly, as with Active-X.

You should email them and tell them about this! Surely they haven't though of such a thing!

Sarcasm aside (sorry, I couldn't help myself), I suspect the VM needs to actually hand you a block of memory, and on accesses it validates that it is within the VM allocated range. Anything less would be silly, however such a thing would provide a huge win (I've tried to do image editing in pure managed code, and then found a massive performance win switching it over to P/Invoke native code).

Re:Right...

[Nyall]

primary? ummm... I thought the primary point of layers is so that you can do a lot with only a few simple function calls

Purpose?

[roman_mir]

This is an interesting hack but it does not do anything for improving either computational theory or improving web application development. Combine C arrays that can be coded within a page like Javascript with a web-browser's security model and you get yourself what exactly? Is this going to improve the speed of development, the security of a thin client, the stability of a browser, the ease of memory usage, the consistency of interfaces or reusability of code? Certainly there will be more features available to a browser client but will there be enough abstraction between the machine and the code to avoid having major security/consistency problems?

It is just not clear to me right now whethere there is a purpose to this beyond satisfaction of an interesting hack.

Ah, the Memories...

[Tickenest]

Petersen demonstrated a version of Quake running in a Flash app, as well as a C-based Nintendo emulator running Zelda; both were eminently playable, and included sound effects and music.

So Flash can simulating computing as it was back in 1998? Super....

This confirms it C is Death!

[SmallFurryCreature]

The more you run away from it, the closer you get to it. So now things are as inevitable as Death, Taxes and C.

A frightful three-some indeed.

Re:Right...

[Chris Mattern]

The circle is now complete. When C left Unix it was but the back-end. Now, it is the API.

Adobe Systems != Open Source

[mpapet]

The last time I checked, Adobe Systems is about as hostile to open source as possible. They are the seldom acknowledged masters of the "first hit on the crack pipe is free" scheme.

http://labs.adobe.com/technologies/eula/air.html

Multiple helper libraries licensed under the MPL doesn't change the fact they are promoting another information silo.

Re:Right...

[twiddlingbits]

And you realize all the overhead this created? It's why we needed dual core 3GHz 64 bit processors. C code, properly written is very tight and fast. Too many layers complicates the issue and introduces more chances of error. If you are looking inside Unix you'll find out the OS is written in C (and some assembler). You can have a GUI/Windows and still have C code..it's called X/MOTIF and has been around a long time, works well and is very fast. I'm pretty sure the current Linux GUIs owe a lot to to Motif.

Re:Right...

[camperdave]

How so? That's like saying sushi bars are there to try to get away from fishing.

Well, it must work because I've never had to catch a fish to eat sushi.

Re:Sounds fantastic

[UnknowingFool]

I feel a great disturbance in the force as if a million admins suddenly screamed in terror . . .

Perl is Interpreted C

[Doc Ruby]

There's very little if any C code that can't be written basically the same for Perl to interpret it basically the same way. The exception is direct memory access, but there are ways. And besides, I'd rather access memory through an API that really manages it, like making it hard to unexpectedly overflow buffers or grant access to unauthorized other users.

I'd love a Perl interpreter embedded in my browser. I'd love to have a Perl API directly to the browser app and the browser documents' DOM. I'd love to have a "Perl commandline" that returns text like usual, or that works on remote data by URL, or that returns icons or other data displayable in the browser.

Javascript is a pain in the ass. I'd rather have a Perl engine, and all the Perl modules and scripts, to run against my browser the way I usually run against my terminal window.

Guitar Hero and Lumines

[tepples]

Nope. SFX is generally event driven (hit a key, hear the sword swing) where music is not (enter an area and music plays continuously in the background).

SFX requires timing, latency, and speed to be accurate. Music requires bandwidth and a minimum level of continuous CPU cycles.

Both have different needs so you can have one without the other (when you are talking emulation).

In Parappa the Rapper, Beatmania, Guitar Freaks, Drummania, Keyboard Mania, Frequency, Amplitude, Taiko Drum Master, Donkey Konga, Guitar Hero, Rock Band, and even scenes in the Mario Party and WarioWare series, the player triggers sound effects at specific times, and these sound effects represent music that the player is performing. If the background music becomes desynchronized from the sound effects that represent music, the emulated environment becomes unusable. Even games that aren't directly about performing music, such as Rez, Lumines, and some scenes in Super Mario RPG, indicate the timing of various game world events using the music.

bizarre

[speedtux]

Trying to retrofit C into Tamarin seems bizarre. Why not use an on-the-fly sandboxing native C compiler? Tiny C (tcc) would seem like a good start.

http://bellard.org/tcc/

Startup latency

[IamTheRealMike]

Being able to run Python or Quake inside a Flash VM sounds useful at first blush, but it seems you'd lose most of what makes webapps nice for both developers and users. In particular, C based apps are not designed to be streamed, whereas Flash or AJAX apps usually are (to some extent). Nobody wants to browse to a "web app" and then spend 5 minutes twiddling their thumbs whilst 20 megabyte of Python runtime or Quake is pulled down over the wire. Web apps just have a different DNA to desktop apps.

I can see this being used to accelerate computation-heavy subelements of a regular Flash app though. I wonder how much of this is being driven by a desire to run a Photoshop subset inside Flash?

Re:Sounds fantastic

[dedazo]

Those who don't remember ActiveX are doomed to reinvent it. Poorly.

Yes, but...

[vimm]

... can it run Linux?

Crazy thoughts.....

[jmorris42]

> You realise that all the OS layers, networking layers, web browsers,
> scripting languages are primarily to try to get away from C?

So? You are missing the bigger point. All of those layers and scripting languages you speak of are written in C. So C working in Flash means all of that other stuff can be brought over. Perl + Flash? Python + Flash? Ruby? The mind boggles at the possibilities.

Of course since nobody will want to stuff all of Perl + half of CPAN down the pipe every time an applet loads we will end up with predownloaded versions cached for use. Let the package war begin, will flash binary packages be maintained with .deb or .rpm... I can see Windows users fighting Package Kit or Synaptic to manage the cruft needed so that "web apps" can work. We could end up with an entire GNU/Flash[1] distribution lurking on every Windows PC.

[1] I object to the GNU/Linux misnaming abomination but this time it really will be a "GNU" distribution since Linux won't be involved. At least until we get a formal 'distribution' being shipped by Adobe.

A mighty hack, but of dubious use.

[Peganthyrus]

Hooray! Now C programmers can join the fun of writing sluggish applications that eat up huge amounts of CPU even when they're doing nothing!

Deceptive headline, too, as this is just about compiling C to the bytecode that the Flash player interprets. Or even worse, now that I RTFA: "The LLVM instructions are converted into opcodes for a custom Virtual Machine that runs in ActionScript, a variant of ECMAScript and sibling of JavaScript." So your C is compiled to bytecode, that is interpreted by an interpreter that is, itself, a stream of the Flash player's bytecode.

Moore's Law notwithstanding, this is a pretty insane use of processor cycles, guaranteed to make your program run a couple orders of magnitude slower than it would if you actually compiled it, or rewrote it in Actionscript!

Re:Right...

[Achoi77]

only an API of evil, Darth!

Easier way...

[Anonymous Coward]

chrome://browser/content/browser.xul

Firefox inside Firefox inside Firefox...

I wonder if it supports C completely

[RWerp]

For example, does it support buffer overruns? Double free's?

Re:Sounds fantastic

[DoofusOfDeath]

Those who don't remember ActiveX are doomed to reinvent it. Poorly.

A poorly re-invented ActiveX? I feel like I've just stared into the abyss, and seen Bill staring back at me.

Re:Right...

[msuarezalvarez]

I'm pretty sure the current Linux GUIs owe a lot to to Motif.

Indeed. The violent urge to get rid of Motif has been a driving force in most of the modern GUI development.