Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Goodbye PNaCl, Hello WebAssembly

blog.chromium.org

Post reply on HN
Print view View original

141–150 of 352 posts

Re: Goodbye PNaCl, Hello WebAssembly

#141

Post by indolering »

withjive wrote: post #107
phonon wrote: post #100

Earlier quoted context omitted.

Uhhh, I think you missed this-- https://wiki.mozilla.org/Mortar_Project

Project Mortar is different in the fact that it is PDFium and Adobe Flash being allowed via Pepper API — basically it's for sandboxing those current native plugins. This would not be a public web use case. PNaCl vs WebAssembly was all about letting everybody run sandboxed native code in the browser without any extensions or prompts. Native Client (the portable version known as PNaCl) was an open source project by goo…

Yeah, AFAIK PDFium doesn't use PNaCI and Flash will only be around as long as absolutely necessary. The only reason they aren't using PDF.js is because the PDf spec is ~12K pages long and they don't want to throw engineer resources at it anymore.

Re: Goodbye PNaCl, Hello WebAssembly

#142

Post by indolering »

irrational wrote: post #140
spiderfarmer wrote: post #22

Earlier quoted context omitted.

The only way to move forward is to ignore them. Put up a message that advises to install Chrome or Firefox and get rid of all the cruft that supports browsers older than 5 years. Most probably already have a modern browser installed but use IE out of habit. I see it at large corporations all the time. I even heard "I wish it would remind me to just use Chrome"

Unfortunately that isn't an option for us. We are mandated to support everyone. And those people on IE are retail sales associates using our site on hardware that simply cannot be upgraded. It must be replaced to get a newer browser. But the replacement cycle is measured in decades.

> And those people on IE are retail sales associates using our site on hardware that simply cannot be upgraded.

I'm sooooo glad I'm not you. I've literally halted all personal projects using JS until they get modules implemented natively.

Re: Goodbye PNaCl, Hello WebAssembly

#143

Post by mintplant »

quickben wrote: post #126
eeZi wrote: post #21

This one I'm fine with since WebAssembly is a worthy replacement, but I'm still annoyed at Google discontinuing Chrome Apps. Some examples of specialized apps I use all the time that would require a native app otherwise: - Signal Desktop - TeamViewer - Postman - SSH client - Cleanflight drone configuration tool It was one of the best things that happened to Linux desktops in a long time and removing it hurts users an…

Add to that list: - unblockable advertising - stronger DRM - Bitcoin mining that regular user can't detect - etc.. It will be good and bad, but, more bad than good. We could choose not to run .exe .bat and the rest So far, webassbly doesn't look optional.

> - unblockable advertising

I don't see how this necessarily follows from WASM.

Re: Goodbye PNaCl, Hello WebAssembly

#144

Post by indolering »

marcosdumay wrote: post #45
lwlml wrote: post #2

At this point, I really loathe adopting any facet of web-browser technology: there are too many broken APIs in too many browsers to maintain on both sides of the system: the browser developers have an insane number of combinations of features that need to be useful, secured and made reliable and developers for browsers are always at some weird disadvantage where they can spend months or years maintaining an applicati…

Yeah. Wouldn't it be great if they just created a simple VM with well specified bytecode so that we could push the complexity into our tooling and just compile into the standard target?

Much harder than it sounds. Java, Adobe, and Google pumped a few hundred million dollars into previous attempts and they all failed. WASM learns from two decades of previous attempts and we are finally getting something sustainable[0].

0: https://brendaneich.com/2015/06/from-asm-js-to-webassembly/

Re: Goodbye PNaCl, Hello WebAssembly

#145

Post by puzzle »

candiodari wrote: post #137
eeZi wrote: post #80

Earlier quoted context omitted.

Hah, that's a funny thread. I've heard that Google is using Chromebooks for engineers with production access. Makes a lot of sense sense since Chrome OS is much easier to secure than a normal Linux distribution.

That sounds insane. Do you have any proof ? Google also has goobuntu, which I'm being is what's provided to engineers.

Niels Provos himself is a Chromebook user (not sure if he needs to access production these days...) and he talks about locking down privileged access to Chromebooks with security keys:

https://mikecborg.wordpress.com/2017/03/22/securing-clouds/ (search for all occurrences of 'chromebook')

https://youtu.be/O-JXFQezWOc?t=35m0s

Re: Goodbye PNaCl, Hello WebAssembly

#146

Post by jonknee »

skybrian wrote: post #92
BHSPitMonkey wrote: post #58

Earlier quoted context omitted.

That's a controlled environment, though; Samsung almost certainly creates a customized build of Chromium for its TVs and can simply keep NaCl enabled if it wishes. They aren't beholden to the same policies that apply to the consumer Chrome releases.

Yes, it's a gradual decay, not a forced upgrade. The problem is that you eventually end up stuck with an ancient version of Chromium without security fixes and incompatible with websites that use newer browser features.

> The problem is that you eventually end up stuck with an ancient version of Chromium without security fixes and incompatible with websites that use newer browser features.

Samsung can't even keep their flagship phones up to date, their TVs are not going to be kept updated regardless of what Google does with Chrome...

Re: Goodbye PNaCl, Hello WebAssembly

#147

Post by solomatov »

quickben wrote: post #126
eeZi wrote: post #21

This one I'm fine with since WebAssembly is a worthy replacement, but I'm still annoyed at Google discontinuing Chrome Apps. Some examples of specialized apps I use all the time that would require a native app otherwise: - Signal Desktop - TeamViewer - Postman - SSH client - Cleanflight drone configuration tool It was one of the best things that happened to Linux desktops in a long time and removing it hurts users an…

Add to that list: - unblockable advertising - stronger DRM - Bitcoin mining that regular user can't detect - etc.. It will be good and bad, but, more bad than good. We could choose not to run .exe .bat and the rest So far, webassbly doesn't look optional.

>- Bitcoin mining that regular user can't detect

It makes very little sense to mine on anything other than ASICs.

Re: Goodbye PNaCl, Hello WebAssembly

#148

Post by someSven »

mikekchar wrote: post #114
wcummings wrote: post #64

Earlier quoted context omitted.

I wouldn't call it a "Linux Desktop" if you can't run a standard SSH client. Chrome OS is it's own beast.

I've got this crazy idea. Since "Linux Desktops" are generally running GNU under the hood for providing user land services, why don't we call those systems... I don't know... "GNU/Linux"? That way we can distinguish them from systems that use the Linux kernel, but have a completely different user land infrastructure. I know, I know. It's crazy talk....

The chance of success would be higher if the term GLX would be used: Debian GLX, Ubuntu GLX, etc.

Re: Goodbye PNaCl, Hello WebAssembly

#149

Post by kps »

jlarocco wrote: post #131
eeZi wrote: post #104

Earlier quoted context omitted.

Signal Desktop and Cleanflight are open source. And sometimes, you have no choice - there's no FOSS alternative to TeamViewer, and thanks to it running inside Chrome, I no longer have to run a Windows VM. The web based SSH client is published by Google themselves and they use it internally. > The teams working on Debian, Ubuntu, Arch, etc. have much better security track records than some random web developers who've…

> The way things are, right now, Chrome is much better at protecting apps from each other than my Linux desktop is. I have a hard time believing that. With a ton of stuff all running inside of Chrome, it's much easier for them to access each other's data than if they were standalone apps. Further, since Chrome is such a huge attack surface, I would expect it to be less secure than a smaller, more specific application…

  > I have a hard time believing that. With a ton of stuff
  > all running inside of Chrome, it's much easier for them
  > to access each other's data than if they were standalone
  > apps.
Ah, the argument from incredulity.

If you're using X11, every command with access to the display server (which is usually everything you run) can read all keyboard and pointer input and screen output and inject arbitrary input.

Re: Goodbye PNaCl, Hello WebAssembly

#150

Post by winstonewert »

solomatov wrote: post #147
quickben wrote: post #126

Earlier quoted context omitted.

Add to that list: - unblockable advertising - stronger DRM - Bitcoin mining that regular user can't detect - etc.. It will be good and bad, but, more bad than good. We could choose not to run .exe .bat and the rest So far, webassbly doesn't look optional.

>- Bitcoin mining that regular user can't detect It makes very little sense to mine on anything other than ASICs.

Is that still true if someone else foots the power bill?
Post reply on HN