Slashdot Mirror
Google Demonstrates Chrome Native Client With Bastion
Multiple readers sent word that Bastion, an action RPG from indie developer Supergiant Games originally made for Xbox Live Arcade, has shown up in the Chrome Web Store. The purpose of the move is to showcase the browser's Native Client technology. From the article:
"Ian Ellison-Taylor, Google's director of product management for the open Web platform, said that Native Client, also called NaCl, can currently improve browser performance by 1 to 10 times. 'What would it be like if we could run native code inside the browser,' he asked the crowd, and he enumerated two goals for the Native Client project. He said Google wants to bring native applications to the Web for performance and security reasons, and it wants to enrich the Web ecosystem by bringing popular, long-in-use programming languages to the Web."
This is so revolutionary. Now we can run native applications on our computers! Just imagine the possibilities! Oh, wait. We already can. And they aren't inhibited by some horrid browser-based sandbox.
can currently improve browser performance by 1 to 10 times
- this reminds me of the quote from the historical documents:
-Good Lord! That's over 5000 atmospheres of pressure!
-How many atmospheres can the ship withstand?
-Well, it was built for space travel, so anywhere between zero and one.
You can't handle the truth.
How would that be more secure? I can only think of things that make it less secure. It is also Satan's anus poised over web standardization.
The Official Site of 1337 Pwnage
Like I really want anyone and their uncle to be running native code on my machine. We went to a sandbox model for a reason! If this is active now, how do we shut it off?
1. 2.
I tried Bastion this morning on my arguable beefy 8-core 8 GB machine. SLOW AS SNOT. So either it's slow or I need to change some configuration setting. Maybe I'm missing something, but wasn't doing this crap in the browser supposed to make it "just work" (tm)?
Mad Software: Rantings on Developing So
May I suggest one to ten pinches?
You can't handle the truth.
I am a little uneasy of making a web browser a proprietary platform. PcMag had an article about Chrome being the next IE 6 of the browser wars 2.0.
IE 6 was a great browser in 2001 regardless of its security shortcomings found years later. Everyone on slashdot back then admitted to using it but were scared and assumed the WWW would die soon because of it. Everyone seems to be oblivious that Google is another evil big corporation no different than Microsoft. Actually synergy is behind Google now, like it was with MS a decade ago.
Dart is chrome only, the javascript libraries are Chrome only or particulary run much better on Chrome (google ones like V8), this and many other proprietary HTML 5 code like that site with the band a few months ago that only work in Chrome. This game will use HTML 5 but has other proprietary hooks to make sure it wont run in any browser.
Google is making it clear they look at the browser as an operating system. At least Microsoft today is running away from ActiveX and trying to do good with IE 10 which will be the most open and standards compliant browser to date. Firefox is dying and is losing popularity. In a year or two from now it will be a IE vs Chrome world.
Anyone else bugged or am I just paranoid? I just want a great browser and not a simple fast one, but with the real goodies underneath it that are dependent on Chrome.
http://saveie6.com/
What would it be like if we could run native code inside the browser?
The massive swamp of security vulnerabilities that was ActiveX?
Hey... I have some great proprietary technology that can increase the performance of any program by at least 1 times. Please send $1 to Happy Dude, at 742 Evergreen Terrace...
Can someone describe the differences between NaCl (Salt?) and ActiveX? They both seem to be methods to run native code inside a browser sandbox. What are the ways Google's offering is superior? Is it better at all than the current implementation of ActiveX? I like Google, but this particular initiative seems kind of backwards thinking.
"I will trust Google to 'do no evil' until the founders no longer run it." Hello Alphabet.
Why do you insist that sandboxes are the only solution to security problems?
So how exactly do you propose to run native code securely without some kind of sandbox?
Why do you get so excited about a technique that's actually quite ancient?
Because we're making fun of mainstream PC operating system developers who can't figure out application sandboxing by themselves.
NaCl defines a subset of x86 instructions that are verifiably type-safe, just as .NET IL and JVM bytecode are verifiably type-safe. The browser verifies the binary before executing it.
For crying out loud, what is it with you wheel freaks? Why do you insist that wheels are the only solution to transportation problems? Why do you get so excited about a technique that's actually quite ancient?
Fuck, I first remember using wheels back in the 1970s on some Ford pintos, and it probably wasn't even a new technique then. All through the 1980s, 1990s and 2000s it became a pretty common feature of most land yachts. Hell, even Chrysler and GM have excellent wheel rotating support, and have had it for a long time. That's not even considering Hyundai, Kia, and the other existing and well-established platforms that have wheels! These days we've also got Saab, BMW and many other systems we can run on roads.
Look, wheel rotation is one transportation technique among many. If getting rid of wheels causes you that much of a problem, THEN YOU'RE DOING TRANSPORTATION REALLY FUCKING WRONG!
FTFY
Run native code WITHOUT the browser. Revolutionary idea, I know. You could pass on all the frameworks required to shoe-horn procedural programming onto a stateless protocol, give HTML and XML markup a miss, not write any javascript, and... just... write an application. And maybe it won't need 34MB to run in, and maybe it'll actually be instantly responsive. Maybe... just maybe... that's what you really need to do.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
Your Shitty Car Analogy is quite shitty, even for a Shitty Car Analogy. In fact, you actually proved the GP's point in your perverse attempt to ridicule it.
You're totally missing the fact that wheels are basically the only thing that'll allow most cars today to move. You take the wheels off, and your car isn't going anywhere. That's exactly the problem that the GP is describing with these sandboxing afficionados. They think of sandboxing as their only option, and thus it's the only option they employ. You take it away, and they're shit out of luck.
Sensible people, on the other hand, see sandboxing as just one more tool in the toolbox. It's not the only approach they use to ensure the security of their systems, so taking it away causes little to no harm. They have employed multiple other techniques to help ensure the security and the safety of their systems.
Yes, I'm curious if there'll be a complementary technology named Pepper.
Pepper is the plug-in API that NaCl modules use to communicate with browser-managed resource, JS, etc.
If I utilize both technologies, will my browser rap for me?
... rubbing salt in Adobe's wound.
Native Client is like a plugin that makes all other plugins obsolete.
-It can do everything you can do with Flash, Unity, Silverlight, etc.
-You can use any language to develop for it, C, C++, ObjC, Python, C#, you name it.
-Can access everything JS can (using the Pepper plugin API).
-It's from a trusted vendor (Google), so most people will not be afraid to install it.
-Will come pre-installed in the soon to be most popular web browser.
-It's open source
-It's much more secure than existing plugins due to sandboxing.
And, yes, I can understand HTML5 purists, but the truth is that:
1) Not everything can be made into a web application using HTML5+JS.
2) There's way too much code and applications written in other languages..
3) Cross-Platform web deployment is very attractive. Compile for x86 and ARM and 99.999% of the devices on the planet can be supported.
So, disable it if you don't want it, but this is a very attractive idea with a lot of potential for us developers, and even Adobe is trying somehting similar with Alchemy on Flash. It's a much more realistic way to bring actual real applications to the web than the dream that HTML5+JavaScript is.
In the meantime, use Firefox 3.6.
I was surprised to find that it still gets updates (3.6.x) and all the newest versions of my extensions still work with it. Your mileage may vary.
Maybe if netcraft reports that enough users are refusing to run their painted whore of a browser, the Firefox devs will see the light.
The reason it's still getting updates is because someone in mozilla still has enough sanity to understand that 4+ are failures that will never be adopted by corporate world, and that users want to have same browser at work and at home.
I would expect that 3.6 will continue to get upgrades for a very long time, or at least until they stop the insane release schedule they have now and default back to old one. Which will probably happen once they have enough head start on chrome to last them a year or so.
Ehm, microsoft did exactly this and called it 'ActiveX'. Unfortunately it had all kind of security flaws, and was restricted to one platform. Those were the main reasons it got burned down, not because of the name stamp per se.
Silverlight, although strictly speaking not native but close enough, was given all chances, but Redmond decided to screw it - i mean - stop the project themselves.
NaCl gets frowned upon a lot, too, but might be worth giving a chance as anything is better than flash. First see, only then burn, please.
You realize the JVM and a Java application are not the same thing, right? And I'm not saying the Register article is wrong, but I would take with a grain of salt anything Microsoft has to say about Java.
One plugin to rule them all, one plugin to find them,
One plugin to bring them all and in the "sandbox" hack them.
Democracy Now! - uncensored, anti-establishment news
It is quite surprising that, up until now, no one has thought of using a bytecode solution, that guarrantees portability and performance.
We have gone from the one extreme, i.e. an interpreted dynamic language, to the other extreme, i.e. native code. There is a sweet spot in between, that of bytecode, that offers portability and good performance on par with native code, and also better security than native code.
Sensible people, on the other hand, see sandboxing as just one more tool in the toolbox.
So please enlighten us. How do you run untrusted code on your machine without some kind of sandbox?
Unfortunately I get the message "requires an OpenGL card" on Windows XP SP3 with an NVidia GTX260, which definitely has working OpenGL. I've seen reports of this problem on MacOS too.
Hope Supergiant Games can fix this - since this is a web-delivered application, I'd hope they can grab hardware/OS details, with user permission, to help in resolving the issue.
Think of how most developers are using Javascript nowadays: it's a target language for their compilers.
Whether the source was Java (GWT compiler) or Javascript itself (YUI compressor, Google closure compiler) the fact remains that what browsers are given to run is not what the developers wrote. Which is standard practice in the software business (it's called compilation) and for good reasons.
Now, JS makes for a poor machine language. So we could either beat around the bush with an intermediate bytecode language (Java went there, and Python and all the others too, with varying results) or go for the real thing and come up with a good x86 sandboxing and code verification standard.
Remember, x86 is currently in use by 99% of desktop machines. When other architectures will gain momentum, websites will just offer two or more compiled versions of their code. In the mean time, they will just have to emulate or translate the x86 instruction set, a task for which a large open source code base has already been developed, and which would still be more efficient than parsing plain Javascript, by several orders of magnitude.
So what's the problem with that, again?
He said Google wants to bring native applications to the Web for performance and security reasons,
Perhaps it's just me and the security advantages of running native code instead of JS or anything on the JVM are immediately obvious to everyone else, but this sounds like Google is somewhat out of touch nowdays and lets marketing people "sell" the technology decisions to geeks...
"I love my job, but I hate talking to people like you" (Freddie Mercury)
Java tops for hackers, warns Microsoft:
Umm, yeah, like there's no bias there. Find me a reputable source for those statements.
Java Apps Have the Most Flaws, Cobol the Least:
Complete red herring. That article isn't about security flaws in the JVM, it's about programmer errors in apps written in Java. It's also a really, really poorly done study.
Some "Food 4 Thought" in regards to your statement requoted here next
Nope. Try again. But see if you can find something *real* this time (you can't).
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
I own Bastion already on Steam. It works perfectly fine. I thought I'd give the Chrome demo a shot. Nothing but a black screen in-game. Don't waste your time for now.
I do not think this word means what you think it means.
'What would it be like if we could run native code inside the browser..."
This sounds awesome. Maybe I will finally be able to run a browser inside my browser.
Truly, you have a dizzying intellect.
How perceptive of you! My good sir, I often make myself dizzy in mere contemplation of the vastness of it!
THUS, it wouldn't matter WHERE THE ERRORS COME FROM, they cause hassles for END USERS... period!
The subject of the discussion was whether or not sandboxes work. Programming errors in code running in the sandbox are irrelevant to that topic; what matters is whether or not malicious software can break out of the sandbox.
This is as "real" as it gets (though I prefer posting real-world practice findings as I did above & in my initial post you replied to) -> http://secunia.com/advisories/product/12878/ [secunia.com]
Wow a total of four vulnerabilities discovered in 2011. Thank you for making my point.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Sensible people, on the other hand, see sandboxing as just one more tool in the toolbox.
So please enlighten us. How do you run untrusted code on your machine without some kind of sandbox?
Root someone else's machine and run it there.
Like Tolkien wrote years ago: Ash NaCl durbatulûk, ash NaCl gimbatul, Ash NaCl thrakatulûk agh burzum-ishi krimpatulgoogle.
They are really strong technological strength,Envy ah!cheap ugg boots