4 ms·
I'm a fan of fast native code, but I worry that this promotes sneaky code in the background once it gets widely adopted. With javascript we basically have open
by toemetoch 14y ago
I'm a fan of fast native code, but I worry that this promotes sneaky code in the background once it gets widely adopted.
With javascript we basically have open-source web apps. I often skim through js source to learn new tricks - and obfuscation doesn't really stop me (apart from google's java-translated js) . With compiled NaCl I probably wouldn't be able to find out a lot.
I'm not talking about "stealing user data" when I say sneaky code. No, with compiled native code a whole new game is started: computational-intensive code. It wouldn't be that difficult to include code that gets a job to work on for a few minutes: breaking captchas, brute-forcing passwords, anything that shift computational effort from a server to a client.
- Drakim 14y agoI would assume the NaCl apps won't run by default. Maybe you get that "click to activate" thing that firefox is implementing for Flash and Java
- Arelius 14y agoYeah, that's not what happens, at least not today.
- toemetoch 14y agoIt doesn't run by default. But remember it's Google who's pushing this, and their browser has momentum. I'd guess it's just a matter of time before they run it by default. They already cashed out for security bounties for NaCl in the past[1] and seem to have increased resources recently[2] since it's quite a lucrative market for gaming. [1] https://developers.google.com/native-client/community/security-contest/faq https://developers.google.com/native-client/community/securi... [2] m.yahoo.com/w/legobpengine/news/google-bringing-high-end-gaming-chrome-via-native-054102268.html