Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Unix in the Browser Tab

browsix.org

Post reply on HN
Print view View original

51–60 of 79 posts

Re: Unix in the Browser Tab

#51

Post by rezonant »

PaulDavisThe1st wrote: post #36
btbuildem wrote: post #10

Why not "stream" an image of an actual OS (say, linux) to the browser? Has anyone pulled that off yet? (Kind of like rendering services for example, the client is just for user interaction, everything else is streamed from server where all the computation happens)

gaikai was doing this in the early 2010s for zero-day game release demos. java in the browser, streaming video and audio from servers, relaying back game input events.

Before Gaikai was OnLive[1] which was a full platform with a game store and libraries and the ability to seamlessly and instantly spectate others' games. It worked fairly well if you had a great Internet connection. Of course nowadays Stadia does the same thing at presumably much lower latencies and higher quality.

[1] https://en.wikipedia.org/wiki/OnLive

EDIT: Technically Gaikai was founded a year before OnLive, but at the time OnLive was more accessible as Gaikai remained in a limited release up until Sony bought them to use for Playstation Now

Re: Unix in the Browser Tab

#52

Post by MisterTea »

arturventura wrote: post #32
MisterTea wrote: post #31

Earlier quoted context omitted.

Have you looked at running Inferno in the browser? Granted the OS is heavily bit rotted though there are still people poking at it. Join a plan 9 community. Tons of resources and people doing what you want to do. Check my profile for links and channels.

I will take a look for sure. I didn't knew they actually got inferno running on a browser. Probably some of you can help me understand better on how to implement certain parts of the OS.

##9fans on discord, matrix and irc on oftc is a great start. Though due to a recent set of trolls the discord is invite only. I think there's a link on postnix.pw

Re: Unix in the Browser Tab

#53

Post by rezonant »

vgb2k18 wrote: post #50
nteon wrote: post #44

I'm one of the authors - its so exciting to see continued interest here! The biggest problem with Browsix today stems from Spectre mitigations: Shared Array Buffers aren't enabled by default in browsers, and static hosting sites like GitHub Pages don't let you set the right COOP/COEP ( https://web.dev/coop-coep/ ) headers to get them enabled AFAICT. Additionally, Browsix hasn't been updated in a while, although I sti…

If I'm reading this right, it means Shared Array Buffers can get enabled by sites that are not GitHub Pages, eg, by spinning up one's preferred cloud hosting instance (DO AWS Azure etc). If yes, then this appears in my mind as not a huge problem.

Also at least for Chrome the limitations are delayed until Chrome 103 if I read this right. See update at the top of https://developer.chrome.com/blog/enabling-shared-array-buff...

Chrome stable is at 97 currently.

Re: Unix in the Browser Tab

#54

Post by rezonant »

yjftsjthsd-h wrote: post #42
benatkin wrote: post #33

I'd like to see Node.js running on it. I know StackBlitz has "WebContainers" but I'm looking for something open source.

Er, why? You want to run a JS implementation on top of a JS implementation? (I'm not super familiar with this ecosystem so I'm probably missing something obvious like libraries or something)

The ability to run code targetted to Node.js along with its own standard library within the browser, at least in a mostly accurate way. Writing Javascript on the web is fairly different than writing Javascript for Node.js, mainly (1) the APIs that are available to you and (2) the capabilities that are available to you. It's useful for developer tooling (Stackblitz does just this).

So it's not about running a JS implementation on top of a JS implementation per se, but being able to run JS code that uses things like CommonJS require(), Node builtin modules, etc

Re: Unix in the Browser Tab

#55

Post by rezonant »

throwawayHN378 wrote: post #22

Hmmm cool but cd is not implemented? Still awesome especially for an undergrad proj

Yeah the shell leaves something to be desired (see the backspace bug mentioned in /README). Makes me want to waste a weekend writing a proper shell for it :-D but I have too many side projects

Re: Unix in the Browser Tab

#56

Post by rank0 »

rezonant wrote: post #49
rank0 wrote: post #40

This is amazing. I’m imagining all the ways I could use this for offensive security tools. If I had a way to import a js library that enabled running web servers, invoking OS commands, or running a reverse http proxy I’d be able to do so much damage to any target client.

It doesn't let you escape the browser sandbox. > Sockets include support for TCP socket servers and clients, making it possible to run applications like databases and HTTP servers *together with their clients in the browser*. Emphasis is mine. You need to run the server and the client within Browsix. Furthermore the "OS commands" are commands within the Browsix environment.

Ah thanks for pointing that out.

But nonetheless, this is useful technology for a malicious actor.

For example, a functioning http server would enable an http proxy that could intercept/modify requests made from the client no?

Now I can add headers to requests made by an html form submit. This might allow for more potent csrf attacks, or circumvention of controls like the HttpOnly cookie flag.

Can I use a victims browser as a c2 server now? I bet with some brainstorming we could come up with some creative offensive capabilities using this technology.

Re: Unix in the Browser Tab

#57

Post by rezonant »

mattowen_uk wrote: post #3

Based on how we see so many 'OS in the Browser' links here on HN, am I right to be underwhelmed by this one?

It's about building the UNIX abstractions using web primitives, like WebWorkers and transportable WHATWG Streams. Very cool stuff. I've seen a lot of these here and this one is not underwhelming to me at least- if anything it is inspiring for how one might architect an advanced resource intensive client-side web app.

Re: Unix in the Browser Tab

#58

Post by rezonant »

spicybright wrote: post #9
usr1106 wrote: post #7

2 questions: * why? * security?

Security? As secure as any javascript programmed site is. Why? Why not? (Just don't put it in production lol)

I think the parent poster thinks this is somehow breaking out of the JS sandbox (which it's not).

> (Just don't put it in production lol)

Why not? If you were to use multiple "processes" using Browsix in your app, it actually may be _more_ secure as Web Workers do not share state with each other and the main thread. (EDIT: Although for me I would at best take inspiration from this rather than use it for a real app)

Re: Unix in the Browser Tab

#60

Post by rezonant »

rank0 wrote: post #56
rezonant wrote: post #49

Earlier quoted context omitted.

It doesn't let you escape the browser sandbox. > Sockets include support for TCP socket servers and clients, making it possible to run applications like databases and HTTP servers *together with their clients in the browser*. Emphasis is mine. You need to run the server and the client within Browsix. Furthermore the "OS commands" are commands within the Browsix environment.

Ah thanks for pointing that out. But nonetheless, this is useful technology for a malicious actor. For example, a functioning http server would enable an http proxy that could intercept/modify requests made from the client no? Now I can add headers to requests made by an html form submit. This might allow for more potent csrf attacks, or circumvention of controls like the HttpOnly cookie flag. Can I use a victims bro…

No, you can't start a web server within Browsix that can accept connections from outside Browsix.

Just like you can't do that in regular JavaScript in the browser.

Post reply on HN