Clang runs in the browser and compiles C++ to WebAssembly • Hacker News Board

Re: Clang runs in the browser and compiles C++ to WebAssembly

#261

Post by bjoli » Tue, Jan 02, 2018, 5:15 PM UTC

pjc50 wrote: post #210

bjoli wrote: post #165

Earlier quoted context omitted.

Native apps had a head start: they don't load every asset from a potentially untrusted source. I would say that the browser most certainly has the biggest attack surface of any software in regular use. Your average browser is insanely complex. In fact, it is the only piece of software on my computer that scares me. Multiple JITs, font rendering, parsing, layouts, compression, image handling, sound and of course about…

> Native apps had a head start: they don't load every asset from a potentially untrusted source The whole native app is "untrusted" at the point of install. Even an app store offers a fairly thin guarantee about what apps are actually doing. It's far easier and less risky to open a web page and start doing something than install a native app.

Yes and no. Trust on first use is a thing. A web page is trust every time.

Sandboxing of native apps are getting easier by the minute , at least for Linux. Flatpack and snappy aren't there yet,though...

Re: Clang runs in the browser and compiles C++ to WebAssembly

#262

Post by z1mm32m4n » Tue, Jan 02, 2018, 5:26 PM UTC

AnIdiotOnTheNet wrote: post #202

nitemice wrote: post #73

Earlier quoted context omitted.

Every time something like this is posted, I always think of that video. As ridiculous and played-for-laughs as it is, it's looking more and more accurate (in one form or another) every day.

If we have learned anything in the past 2 years, it is that the difference between parody and reality is vanishingly small.

What happens when the stuff like the “exclusion zone” and the war from 2020–2025 come true...? ¯\_(ツ)_/¯

Re: Clang runs in the browser and compiles C++ to WebAssembly

#263

Post by jrs95 » Tue, Jan 02, 2018, 5:30 PM UTC

modeless wrote: post #83

ehnto wrote: post #41

Earlier quoted context omitted.

I have been thinking about why we have ended up here, and why not just native apps. The obvious answer is that it makes applications portable, which is great. The other key component I think is delivery. You don't ever install anything, it just exists when you ask for it. That is something native applications have never done, and not even something like JVM has done even though it addresses portability too. It is als…

The answer is that browsers provide something that users desperately need and no operating system has ever provided: a sandbox strong enough to run completely untrusted code. The success of browsers is an indictment of the entire field of operating systems research. They have either failed to recognize the need or simply failed to deliver that kind of security. For one example take WebGL. For decades OpenGL had been…

Aren't browsers basically the largest attack surface on most platforms now? Have they really succeeded in doing this?

Re: Clang runs in the browser and compiles C++ to WebAssembly

#264

Post by javajosh » Tue, Jan 02, 2018, 5:34 PM UTC

Someone wrote: post #121

qwerty456127 wrote: post #113

Earlier quoted context omitted.

Sounds reasonable. Why don't people use it then? Are there any frameworks already available so one won't have to invent a GUI toolkit from scratch?

One of the “few abstractions to work comfortably with the SVG DOM” that “you can easily write […] as you need them” would be a layout engine. You need one to adjust your UI to the user’s screen size. Another, I think, is that, to add scroll bars to a view, you have to write SVG scroll bars, make them respond to the mouse scroll wheel, be accessible, etc. Even if we will get them, eventually, it won’t be “easily”. I t…

>layout engine

Absolute positioning gets a bad rap! And yes, if you want widgets then you have a lot of work ahead of you. But it's a lot of fun to just work with the primitives - don't believe them when they tell you always need a GUI toolkit!

Re: Clang runs in the browser and compiles C++ to WebAssembly

#265

Post by narag » Tue, Jan 02, 2018, 5:45 PM UTC

ehnto wrote: post #41

djsumdog wrote: post #15

So the web browser is pretty much a mini operating system. Firefox and Chromium seriously feel like they have the longest compile time out of any package in Gentoo, except maybe Libreoffice. It has tons of embedded packages that it doesn't pull from the system/native (jpeg and png decoders and such). So with a lot of these neat things where we compile stuff or run a Linux kernel in the browser, we've pretty much come…

I have been thinking about why we have ended up here, and why not just native apps. The obvious answer is that it makes applications portable, which is great. The other key component I think is delivery. You don't ever install anything, it just exists when you ask for it. That is something native applications have never done, and not even something like JVM has done even though it addresses portability too. It is als…

The obvious answer is that it makes applications portable, which is great.

That's an understatement. Anybody trying to write a multiplatform complex desktop application around 2000 would have learnt that it was way much harder that it sounds today. Browsers were in a very reduced group of success cases.

Edit: also dont forget that there was a war about what tools and languages would become dominant. Unlike alternatives, most web tools were free.

Re: Clang runs in the browser and compiles C++ to WebAssembly

#266

Post by kibwen » Tue, Jan 02, 2018, 5:46 PM UTC

jrs95 wrote: post #263

modeless wrote: post #83

Earlier quoted context omitted.

The answer is that browsers provide something that users desperately need and no operating system has ever provided: a sandbox strong enough to run completely untrusted code. The success of browsers is an indictment of the entire field of operating systems research. They have either failed to recognize the need or simply failed to deliver that kind of security. For one example take WebGL. For decades OpenGL had been…

Aren't browsers basically the largest attack surface on most platforms now? Have they really succeeded in doing this?

Saying browsers are "the largest attack surface" is an indication of ubiquity, not an indictment of the design or implementation of browsers (which are still worth considering separately). And we only make such remarks about browsers (or other apps that execute untrusted code like spreadsheets or PDF readers) because the state of OS security is such that any program running directly can pretty much wreak havoc even without explicit superuser privileges. Even on locked-down mobile OSes, the amount of havoc your Facebook app gets up to is incredible compared to what happens when you merely visit facebook.com on your mobile browser.

Re: Clang runs in the browser and compiles C++ to WebAssembly

#267

Post by ryandrake » Tue, Jan 02, 2018, 5:50 PM UTC

ehnto wrote: post #41

djsumdog wrote: post #15

So the web browser is pretty much a mini operating system. Firefox and Chromium seriously feel like they have the longest compile time out of any package in Gentoo, except maybe Libreoffice. It has tons of embedded packages that it doesn't pull from the system/native (jpeg and png decoders and such). So with a lot of these neat things where we compile stuff or run a Linux kernel in the browser, we've pretty much come…

I have been thinking about why we have ended up here, and why not just native apps. The obvious answer is that it makes applications portable, which is great. The other key component I think is delivery. You don't ever install anything, it just exists when you ask for it. That is something native applications have never done, and not even something like JVM has done even though it addresses portability too. It is als…

> You don't ever install anything, it just exists when you ask for it. That is something native applications have never done

Actually, this used to be common, and still is for things like game consoles. You used to stick the floppy disk in, and run the program directly from there. No concept of installing anything. Indeed your computer may not have even had writable storage to "install" anything onto. At worst, if you did have a hard drive, you were free to copy the (single) executable onto your drive so you didn't need to rummage through your stack of floppies to find the program every time you wanted to run it. That was the extent of installing something.

The situation where your program consists of multiple files, each of which had to be copied into some special location on your hard drive by an "installer"--is a relatively new (since the 90s?) concept.

It's actually refreshing nowadays when I stumble upon one of those rare applications where everything comes in a single executable file and it can be run from anywhere. Dying breed.

Re: Clang runs in the browser and compiles C++ to WebAssembly

#268

Post by sp332 » Tue, Jan 02, 2018, 6:03 PM UTC

blub wrote: post #136

shalabhc wrote: post #120

Next we'll get to a webassembly-only VM that will replace the OS. All 'apps' will run on this VM instead of being native, and most will be cross platform. They'll talk to each other via messaging (using Javascript semantics) instead of bytes-over-pipes as they do today. An integrated globally available, namespaced data store API might replace the filesystem. Each app+version will be accessible by a distinct URL. 'My…

Add metrics and advertising obsessed companies into the mix and the only result could be a complete clusterfuck. The major issue with web apps is that the customer (or depending on the company bag of meat that watches the ads) has no control over the app or the data. They will be abused by the company in all sorts of creative ways. And yes, those VMs could be local-only, but why would Google, MS or Mozilla want that?…

The alternative is advertising built into the OS like Ubuntu did and MS and Amazon still do, tracking built into the OS like Google and MS do, etc. Having the trackers run in a sandbox is not great but it's a little better than letting them all run natively.

Re: Clang runs in the browser and compiles C++ to WebAssembly

#269

Post by marcosdumay » Tue, Jan 02, 2018, 6:04 PM UTC

solarkraft wrote: post #67

BatFastard wrote: post #32

Earlier quoted context omitted.

As many as is needed. And as many processors as are needed. As someone who writes browser based 3D games, I need more power!

A web page should probably not be allowed to use unlimited amounts of computing power without asking for permission first.

I don't see why the foreground web page shouldn't have as much access to my desktop's CPU as any native program.

Re: Clang runs in the browser and compiles C++ to WebAssembly

#270

Post by marcosdumay » Tue, Jan 02, 2018, 6:06 PM UTC

solarkraft wrote: post #69

knowThySelfx wrote: post #16

Earlier quoted context omitted.

The browser is gonna become like a front for a distributed OS.

Yep. We already have threads. What I find most painful about this development is that this new platform requires Javascript and wrapping everything inside an HTML document.

WebAssebly is here to let one replace Javascript. Not to depend on it.

(It's the other way around, if you want to keep using Javascript, the expectation is that you'll start to depend on WebAssemby in the future.)