Live data from Hacker News

Clang runs in the browser and compiles C++ to WebAssembly

tbfleming.github.io

281–290 of 318 posts

Re: Clang runs in the browser and compiles C++ to WebAssembly

#281
post #126

Earlier quoted context omitted.

I’ve done webrtc “servers” (in C, not some nodejs bindings for the chromium implementation) and webrtc P2P. It really is “good enough” for a lot of things. But not game developers, who are used to dealing with a very forgiving environment that will let them do stupid things quickly. I have watched game developers in earnest busy wait a network thread “for speed reasons” but also derive approximate linear solutions to…

Congrats, you've just gone ahead and proved my point. Zero technical reasons other than an ad hoc attack on game development practices. Unless you have a client library that can be paired to that server which takes up less than 200kb of mem you won't see adoption. You're going to want to use one network stack across your products and a lot of the handheld and smaller platforms are really memory constrained.

> Zero technical reasons other than an ad hoc attack on game development practices.

These have been brought up ad nauseam so I didn't think it was useful to go over them.

The biggest reason UDPSocket doesn't just show up in browsers is that:

• Browser vendors don't want to accidentally make it easy to trivially D/DoS servers

• Browser vendors don't want to accidentally make it easy to trivially D/DoS clients

• It's not clear how to handle NAT traversal except when (interactively) trying to traverse NAT

But let's say we don't need anything more complicated than basic hole punching, P2P or cross-origin UDPSocket, and we can solve the trivial D/DoS issue with some kind of Allow-UDPSocket-From HTTP header, or OPTIONS or whatever. And maybe we have some kind of weird HTTP/2.0 transaction that does TURN/STUN automatically. Maybe.

Then we can have UDPSocket and you can implement netcode in JavaScript if you want!

However, WebRTC has already solved all those problems. Including the NAT one (that SDP/STUN/ICE stuff is there for a reason!). And obviously P2P, but also including some you probably haven't thought of, like issues around IP fragmentation (1200 byte packets!? DTLS fragments things itself for a reason!), and whether rolling custom crypto was a good idea.

> Unless you have a client library that can be paired to that server which takes up less than 200kb of mem you won't see adoption.

200k should be plenty: The dumb client can speak a slightly trimmed down WebRTC (e.g. limited to only a single codec) to keep the size down. My webserver which is just about as fast as they get, is only about 1kb of code on the hotpath.

But this doesn't answer my questions about a market: I don't sell to game developers, and I genuinely don't know if building a tiny+performant WebRTC client and server business is worth my time.

Is it?

How much will a game development studio pay to have this problem solved for them?

Re: Clang runs in the browser and compiles C++ to WebAssembly

#282

Earlier quoted context omitted.

As many as is needed. And as many processors as are needed. As someone who writes browser based 3D games, I need more power!

A web page should probably not be allowed to use unlimited amounts of computing power without asking for permission first.

I agree! Like 0xfeba pointed out, really annoying things like coinhive could eat all your CPU if no permission was required. Some sort of web API that tells the browser how many threads it can allocate for rendering and code execution. If the thread count exceeds a configured maximum the browser can ask the user for permission.

Re: Clang runs in the browser and compiles C++ to WebAssembly

#283
post #41

So the web browser is pretty much a mini operating system. Firefox and Chromium seriously feel like they have the longest compile time out of any package in Gentoo, except maybe Libreoffice. It has tons of embedded packages that it doesn't pull from the system/native (jpeg and png decoders and such). So with a lot of these neat things where we compile stuff or run a Linux kernel in the browser, we've pretty much come…

I have been thinking about why we have ended up here, and why not just native apps. The obvious answer is that it makes applications portable, which is great. The other key component I think is delivery. You don't ever install anything, it just exists when you ask for it. That is something native applications have never done, and not even something like JVM has done even though it addresses portability too. It is als…

The obvious answer is that web-based apps are effectively access restricted so the developer can charge any price they want including free, change prices at will, and enforce it effectively over the long term.

Native apps struggle with this.

Things that are easy to monetize tend to attract more effort than things that are possibly impossible to monetize, or have very limited monetization options.

Re: Clang runs in the browser and compiles C++ to WebAssembly

#284
post #266
post #263

Earlier quoted context omitted.

Aren't browsers basically the largest attack surface on most platforms now? Have they really succeeded in doing this?

Saying browsers are "the largest attack surface" is an indication of ubiquity, not an indictment of the design or implementation of browsers (which are still worth considering separately). And we only make such remarks about browsers (or other apps that execute untrusted code like spreadsheets or PDF readers) because the state of OS security is such that any program running directly can pretty much wreak havoc even w…

" because the state of OS security"

Those not designed for security were like that. Those designed for security had few of those problems. They just weren't popular with the big ecosystems and such since the demand side didn't care about security much. Very little security bolted onto something that was opposite at core. Common solutions were memory-safety for apps with validation on API calls, limiting of API's accessible, mandatory access control, and/or VM's isolating whole systems from apps needing protection.

OS's and browsers are not only becoming similar in functionality: they're similar in why people adopted them and why they're insecure.

"Saying browsers are "the largest attack surface" is an indication of ubiquity, not an indictment of the design or implementation of browsers"

It's actually saying both since browsers were mostly not designed for strong security or apply security engineering techniques of the time. That would be POLA, privilege separation, memory-safe languages, high-quality code in any components integrated, and so on. The first I saw attempt it was Chrome's Native Client imitating some benefits of OP Web Browser [that was designed for security] but weakening them for performance. Latter was Chrome's highest priority IIRC. There's Quantum moving memory-safe code into Firefox. However, browsers are mostly insecure architecture and code that just gets patched as problems are found. And they're ubiquitous. Music to malware authors' ears. :)

I'm including examples below of security-focused, browser architectures applying various methods of security at design and/or implementation stage so you have a mental point of comparison to current ones in terms of techniques employed. They were released as prototypes with nobody putting any effort in past that. So, high-assurance sector just isolated regular browsers in protection domains (eg VM's) on separation kernels or using MAC if browsers had to be there. Otherwise, native apps in memory-safe languages with regular old client-server architecture were much easier to make reliable and secure. Especially if using middleware designed to help with that. That's still true.

DarpaBrowser http://www.combex.com/papers/darpa-review/security-review.pd...

OP and OP2 Browsers https://pdfs.semanticscholar.org/832a/911f97b500cd2df4680186...

Microsoft Gazelle https://www.microsoft.com/en-us/research/publication/the-mul...

Illinois Browser Operating System https://www.usenix.org/legacy/event/osdi10/tech/full_papers/...

Quark Browser http://goto.ucsd.edu/quark/

Re: Clang runs in the browser and compiles C++ to WebAssembly

#285
post #53

So the web browser is pretty much a mini operating system. Firefox and Chromium seriously feel like they have the longest compile time out of any package in Gentoo, except maybe Libreoffice. It has tons of embedded packages that it doesn't pull from the system/native (jpeg and png decoders and such). So with a lot of these neat things where we compile stuff or run a Linux kernel in the browser, we've pretty much come…

Just need to be able to run Chrome/Firefox directly in a Docker instance, and we’d be there. But seriously, maybe that’s the next step in this crazy ride we’re all on.

Or firejail

Re: Clang runs in the browser and compiles C++ to WebAssembly

#286
post #56
post #51

Earlier quoted context omitted.

The other key component I think is delivery. You don't ever install anything, it just exists when you ask for it. That is precisely why I made the jump from Delphi to ASP.NET back in 2003, and now the jump to Angular2+.

Why Angular instead of React...or something else like Vue?

It's the first SPA framework I've learned and fell in love with it. I haven't gotten around to researching React or vue yet. I wonder if I'm missing out on anything by not using them.

Re: Clang runs in the browser and compiles C++ to WebAssembly

#287
post #165

Earlier quoted context omitted.

The answer is that browsers provide something that users desperately need and no operating system has ever provided: a sandbox strong enough to run completely untrusted code. The success of browsers is an indictment of the entire field of operating systems research. They have either failed to recognize the need or simply failed to deliver that kind of security. For one example take WebGL. For decades OpenGL had been…

Native apps had a head start: they don't load every asset from a potentially untrusted source. I would say that the browser most certainly has the biggest attack surface of any software in regular use. Your average browser is insanely complex. In fact, it is the only piece of software on my computer that scares me. Multiple JITs, font rendering, parsing, layouts, compression, image handling, sound and of course about…

> biggest attack surface

Sure, but in many modern browsers there's also a OS sandbox around it, so there's two layers of protection.

Re: Clang runs in the browser and compiles C++ to WebAssembly

#288

So the web browser is pretty much a mini operating system. Firefox and Chromium seriously feel like they have the longest compile time out of any package in Gentoo, except maybe Libreoffice. It has tons of embedded packages that it doesn't pull from the system/native (jpeg and png decoders and such). So with a lot of these neat things where we compile stuff or run a Linux kernel in the browser, we've pretty much come…

Not full circle until we can compile firefox or chrome to wasm :)

Re: Clang runs in the browser and compiles C++ to WebAssembly

#289

People might not like it but i really think native apps are going to die once everyone figures out how to optimize this crazy web stack.

Back in 2010 I considered native to be a fad and that we'd eventually go back to web (just like native desktop apps have gone to web.)

However, 8 years later, things really don't seem to be moving in that direction. Native is always going to be one step ahead in terms of speed and ability.

We would need to see native features start to stall so the web can catch up in ability, and websites need to do a lot of work to catch up in speed.

Re: Clang runs in the browser and compiles C++ to WebAssembly

#290
post #81

Earlier quoted context omitted.

Certainly not.

To the vast majority of users, anything in a browser is a web "site" and anything bundled with the OS or requiring an installer (including Electron apps) are "apps".

To the vast majority of users a virus is anything that's adversely affecting their system, should we use that definition too? The vast majority of people call the common cold the flu (around here anyway), should doctors change the definition of influenza to the layman one? All industries have their own terminology specialized terminology and they don't change it based on what naive end users think.
Post reply on HN