9 ms·

No installation required: how WebAssembly is changing scientific computing

109 points by kasperset 3y ago

Mortiffer 3y ago
Don't see this happening scientists are totally happy installing R or Matlab etc. Often a lab even sticks with windows b/c of some drivers for a sensor that only exists for windows
- exe34 3y ago
  One thing that I found mind blowing initially was that unbricking my pixel 5 involved simply going to Google's install page for it in Chrome with the usb connected and it reflashed successfully. Of course, there's nothing fundamentally new there, I'm sure Java applets could have done it on a serial port if somebody tried, but it was impressive given how gimped most os-level access is in a browser. So I would imagine you could write just enough webusb code to get new instruments to work that you wouldn't need local apps as a manufacturer.
  - jaflo 3y ago
    Flipper Zero firmware can also be flashed that way! Blew my mind in a similar way: https://github.com/flipperdevices/update.flipperzero.one https://github.com/flipperdevices/update.flipperzero.one
  - jclulow 3y ago
    > So I would imagine you could write just enough webusb code to get new instruments to work that you wouldn't need local apps as a manufacturer. Yes, delivering device control software in a browser with webusb from a cloud platform will usher in a whole new chapter of keeping people from truly owning the scientific research equipment they have procured!
    - exe34 3y ago
      Which means I'll never ever buy it with my own money! But it'll be cross platform for orgs that decide to invest in them.
  - pests 3y ago
    This is the process for the Stadia controller unlocking tool as well.
  - crote 3y ago
    The knife cuts both ways, though: webusb / webhid / webmidi allow raw access to physical devices which weren't designed for it, and therefore don't have any protections for it. You're just one nag screen away from having your devices be permanently hacked by some random website. It's quite worrying seeing the Chrome team have such blatant disrespect for basic security. Rather than using an allowlist for known-good devices or using some kind of handshake to validate the device is okay with a certain website talking to it, they use a blocklist to prevent a website from messing with things like keyboards/mice/u2f keys. It's a massive footgun waiting to go off. Firefox refuses to implement those APIs due to security concerns, and until they do a serious design overhaul it'd probably be better if Chrome hid it behind a default-off feature switch too.
    - egberts1 3y ago
      Not to mention how data can be leaked back to the hoster via steady stream of URLs.
    - exe34 3y ago
      I'm pretty sure I did have to give permission for this to work, and my default instinct for such requests is to say no or close the page immediately, unless it's something I actively want, like in this case. I take your point though, I'd prefer that there were a whole other page I had to go to and enable something like this. On the other hand, I've always hated how even something I've written for myself can be hobbled at the alter of security out of religious zeal. At one point you really couldn't access local files, although the orthodoxy has now shifted. I just wish it were easy to just point to a directory and say that's all you're getting, but do whatever you want in there.
- piva00 3y ago
  From what I see helping some friends not well versed with programming doing their PhDs, FORTRAN still has a lot of penetration with scientists. Lots of climate models are FORTRAN code. Also, through helping them I can see the dire state of scientific code, it's a mess, if departments had the budget to employ 1-2 professional programmers to help them mentor staff it could be extremely helpful for science code to be more easily shared and reasoned about, some of the code I've seen is basically throw away code after the contributors aren't around anymore...
  - konradha 3y ago
    There is project bringing Fortran to the browser, though (_using WebAssembly_) https://dev.lfortran.org/ https://dev.lfortran.org/
  - mike_hearn 3y ago
    A lot of scientific code is worse than a mess, it outright doesn't work and yields incorrect results, a problem which is then routinely covered up. I've seen this first hand :( The worst part is that universities don't realize how much they don't know. On the rare occasions outsiders notice what's going on they are faced with a wall of baffling excuses and justifications for why so much doesn't work, like "if it didn't crash it must be correct" or "scientists don't need unit tests, we just look at the results and know they are right because we're experts". Academics are happy to pronounce that professional coders can't judge the correctness of their work and do so loudly and publicly. As for money, well departments do have the budgets to hire developers. Science funding is in the high billions in most western countries. The problem is not departmental budgets, it's a social problem. Universities love the practice of spreading money amongst as many professors and tiny departments as possible in order to lay claim to every possible area of human knowledge/experience. Combine that with a culture of low standards and coverups and you've got a recipe for disasters (e.g. invariably critical bug fixes that corrupt data are described as not affecting the final results even when that clearly can't be true).
    - abyssin 3y ago
      I have the same experience in a psychology faculty. I helped a PhD student who was working on some MATLAB code. The amount of code I had to write for something similar as they were doing was orders of magnitude lower, and faster to write. But they spent months hurting their brains and therefor thought they were doing something really smart. There was a lot of micromanagement of clueless researchers, and the consequence is that everything had to be done the exact same way as the more experienced members of the lab did previously. This was the most wasteful work organization I've seen in my life, but there was little awareness of it, compared to other state-subsidized projects.
- Tarq0n 3y ago
  Enterprise companies have huge issues with installing, securing and maintaining open-source software though. Using browser based tools doesn't really resolve the underlying organizational and competence issues, but at least it lets people do their jobs.
firtoz 3y ago
> For instance, modern operating systems can handle 64-bit numbers. WebAssembly, however, is limited to 32 bits, and can access only 232 bytes (4 gigabytes) of memory. Furthermore, it cannot directly access a computer’s file system or its open network connections. And it’s not multithreaded; many algorithms depend on this form of parallelization, which allows different parts of a computation to be performed simultaneously. “A lot of older code won’t compile into WebAssembly, because it assumes that it can do things that can’t be done,” Stagg says. I am surprised by the memory and 32 bit limitations... Are there plans to overcome them? Edit: found it, https://github.com/WebAssembly/memory64 https://github.com/WebAssembly/memory64
- Extigy 3y ago
  Similarly for threads: https://github.com/webassembly/threads https://github.com/webassembly/threads
- flohofwoe 3y ago
  The quote is a bit misleading. Traditional WASM (wasm32) does have 64-bit numbers (both a 64-bit integer type, and 64-bit floats), but the address space is limited to 32-bits (and thus pointers are 32-bits too). AFAIK the downside of wasm64 is that it cannot use some virtual memory tricks to get rid of software range checks, so if memory access performance matters and a large address space isn't needed it probably still makes sense to stick with wasm32 even when wasm64 is available. PS: see discussion here: https://github.com/WebAssembly/memory64/issues/3 https://github.com/WebAssembly/memory64/issues/3
- mikewarot 3y ago
  >Furthermore, it cannot directly access a computer’s file system or its open network connections. Those are its two strongest features, not bugs. If you're not going to respect those, just use native code, and the broken ambient authority model of computing, which never works out in the long run. Edit: The article doesn't focus much on these limitations, but I think that putting up with the current limitations of WASM in terms of memory size or lack of threading might suck, but it's worth the ability to just try things out and run them without risking your whole computer. Younger folks who never had a PC with only write protectable floppy drives missed out on a wonderful care-free period when you could just TRY OUT any new software, and your other data was safe, no matter what.
mike_hearn 3y ago
> Some would use laptops, others would opt for tablets or mobile phones. Not all of them could even use the programming language that was the subject of the test: the statistical language R. “We had no control, really, over what devices those students were using,” says Stagg. Surely the problem here is much bigger than WebAssembly vs native code. What does it even mean to give students a test on using a software package if they aren't even willing to buy a computer? How are you supposed to do professional stats work after university on a mobile phone? They don't even expose a file system. Learning how to use a full workstation-class computer is a basic pre-requisite of doing science and many other types of professional work; these universities are just hopelessly lost if they're not making that clear to students up front and requiring or provisioning the equipment they need. Degrees awarded on the back of tests like these are worse than useless, they're outright deceptive to future employers. If someone claims they studied scientific computing and then turned out to not understand files, folders, packages, multiple windows and other basics then they'd be completely unable to do the job.
- fsflover 3y ago
  > How are you supposed to do professional stats work after university on a mobile phone? They don't even expose a file system. Mine does.
- tomgp 3y ago
  >How are you supposed to do professional stats work after university on a mobile phone? Generally your employer or institution will supply you with a computer (or access to one in the case of students)? The test described was devised during the lockdown because people didn't have had access to the university's facilities.
  - kiicia 3y ago
    Doom can run on anything...
  - duped 3y ago
    At my university we were able to use an RDP client to log into windows machines with all the engineering software installed on them. Performance sucked, which is why people only did it if they had too. But it was manageable. R was one of the software packages.
pjmlp 3y ago
Yet another advocacy article with absent of what came before.
icedchai 3y ago
We had code execution in the browser over 25+ years ago, with Java applets. Sure, they were bloated and sluggish back then. On today's hardware, you wouldn't even notice.

109 points by kasperset 3y ago

Don't see this happening scientists are totally happy installing R or Matlab etc. Often a lab even sticks with windows b/c of some drivers for a sensor that only exists for windows

exe34 3y ago
One thing that I found mind blowing initially was that unbricking my pixel 5 involved simply going to Google's install page for it in Chrome with the usb connected and it reflashed successfully. Of course, there's nothing fundamentally new there, I'm sure Java applets could have done it on a serial port if somebody tried, but it was impressive given how gimped most os-level access is in a browser. So I would imagine you could write just enough webusb code to get new instruments to work that you wouldn't need local apps as a manufacturer.
- jaflo 3y ago
  Flipper Zero firmware can also be flashed that way! Blew my mind in a similar way: https://github.com/flipperdevices/update.flipperzero.one https://github.com/flipperdevices/update.flipperzero.one
- jclulow 3y ago
  > So I would imagine you could write just enough webusb code to get new instruments to work that you wouldn't need local apps as a manufacturer. Yes, delivering device control software in a browser with webusb from a cloud platform will usher in a whole new chapter of keeping people from truly owning the scientific research equipment they have procured!
  - exe34 3y ago
    Which means I'll never ever buy it with my own money! But it'll be cross platform for orgs that decide to invest in them.
- pests 3y ago
  This is the process for the Stadia controller unlocking tool as well.
- crote 3y ago
  The knife cuts both ways, though: webusb / webhid / webmidi allow raw access to physical devices which weren't designed for it, and therefore don't have any protections for it. You're just one nag screen away from having your devices be permanently hacked by some random website. It's quite worrying seeing the Chrome team have such blatant disrespect for basic security. Rather than using an allowlist for known-good devices or using some kind of handshake to validate the device is okay with a certain website talking to it, they use a blocklist to prevent a website from messing with things like keyboards/mice/u2f keys. It's a massive footgun waiting to go off. Firefox refuses to implement those APIs due to security concerns, and until they do a serious design overhaul it'd probably be better if Chrome hid it behind a default-off feature switch too.
  - egberts1 3y ago
    Not to mention how data can be leaked back to the hoster via steady stream of URLs.
  - exe34 3y ago
    I'm pretty sure I did have to give permission for this to work, and my default instinct for such requests is to say no or close the page immediately, unless it's something I actively want, like in this case. I take your point though, I'd prefer that there were a whole other page I had to go to and enable something like this. On the other hand, I've always hated how even something I've written for myself can be hobbled at the alter of security out of religious zeal. At one point you really couldn't access local files, although the orthodoxy has now shifted. I just wish it were easy to just point to a directory and say that's all you're getting, but do whatever you want in there.
piva00 3y ago
From what I see helping some friends not well versed with programming doing their PhDs, FORTRAN still has a lot of penetration with scientists. Lots of climate models are FORTRAN code. Also, through helping them I can see the dire state of scientific code, it's a mess, if departments had the budget to employ 1-2 professional programmers to help them mentor staff it could be extremely helpful for science code to be more easily shared and reasoned about, some of the code I've seen is basically throw away code after the contributors aren't around anymore...
- konradha 3y ago
  There is project bringing Fortran to the browser, though (_using WebAssembly_) https://dev.lfortran.org/ https://dev.lfortran.org/
- mike_hearn 3y ago
  A lot of scientific code is worse than a mess, it outright doesn't work and yields incorrect results, a problem which is then routinely covered up. I've seen this first hand :( The worst part is that universities don't realize how much they don't know. On the rare occasions outsiders notice what's going on they are faced with a wall of baffling excuses and justifications for why so much doesn't work, like "if it didn't crash it must be correct" or "scientists don't need unit tests, we just look at the results and know they are right because we're experts". Academics are happy to pronounce that professional coders can't judge the correctness of their work and do so loudly and publicly. As for money, well departments do have the budgets to hire developers. Science funding is in the high billions in most western countries. The problem is not departmental budgets, it's a social problem. Universities love the practice of spreading money amongst as many professors and tiny departments as possible in order to lay claim to every possible area of human knowledge/experience. Combine that with a culture of low standards and coverups and you've got a recipe for disasters (e.g. invariably critical bug fixes that corrupt data are described as not affecting the final results even when that clearly can't be true).
  - abyssin 3y ago
    I have the same experience in a psychology faculty. I helped a PhD student who was working on some MATLAB code. The amount of code I had to write for something similar as they were doing was orders of magnitude lower, and faster to write. But they spent months hurting their brains and therefor thought they were doing something really smart. There was a lot of micromanagement of clueless researchers, and the consequence is that everything had to be done the exact same way as the more experienced members of the lab did previously. This was the most wasteful work organization I've seen in my life, but there was little awareness of it, compared to other state-subsidized projects.
Tarq0n 3y ago
Enterprise companies have huge issues with installing, securing and maintaining open-source software though. Using browser based tools doesn't really resolve the underlying organizational and competence issues, but at least it lets people do their jobs.

firtoz 3y ago

> For instance, modern operating systems can handle 64-bit numbers. WebAssembly, however, is limited to 32 bits, and can access only 232 bytes (4 gigabytes) of memory. Furthermore, it cannot directly access a computer’s file system or its open network connections. And it’s not multithreaded; many algorithms depend on this form of parallelization, which allows different parts of a computation to be performed simultaneously. “A lot of older code won’t compile into WebAssembly, because it assumes that it can do things that can’t be done,” Stagg says. I am surprised by the memory and 32 bit limitations... Are there plans to overcome them? Edit: found it, https://github.com/WebAssembly/memory64 https://github.com/WebAssembly/memory64

Extigy 3y ago
Similarly for threads: https://github.com/webassembly/threads https://github.com/webassembly/threads
flohofwoe 3y ago
The quote is a bit misleading. Traditional WASM (wasm32) does have 64-bit numbers (both a 64-bit integer type, and 64-bit floats), but the address space is limited to 32-bits (and thus pointers are 32-bits too). AFAIK the downside of wasm64 is that it cannot use some virtual memory tricks to get rid of software range checks, so if memory access performance matters and a large address space isn't needed it probably still makes sense to stick with wasm32 even when wasm64 is available. PS: see discussion here: https://github.com/WebAssembly/memory64/issues/3 https://github.com/WebAssembly/memory64/issues/3
mikewarot 3y ago
>Furthermore, it cannot directly access a computer’s file system or its open network connections. Those are its two strongest features, not bugs. If you're not going to respect those, just use native code, and the broken ambient authority model of computing, which never works out in the long run. Edit: The article doesn't focus much on these limitations, but I think that putting up with the current limitations of WASM in terms of memory size or lack of threading might suck, but it's worth the ability to just try things out and run them without risking your whole computer. Younger folks who never had a PC with only write protectable floppy drives missed out on a wonderful care-free period when you could just TRY OUT any new software, and your other data was safe, no matter what.

mike_hearn 3y ago

> Some would use laptops, others would opt for tablets or mobile phones. Not all of them could even use the programming language that was the subject of the test: the statistical language R. “We had no control, really, over what devices those students were using,” says Stagg. Surely the problem here is much bigger than WebAssembly vs native code. What does it even mean to give students a test on using a software package if they aren't even willing to buy a computer? How are you supposed to do professional stats work after university on a mobile phone? They don't even expose a file system. Learning how to use a full workstation-class computer is a basic pre-requisite of doing science and many other types of professional work; these universities are just hopelessly lost if they're not making that clear to students up front and requiring or provisioning the equipment they need. Degrees awarded on the back of tests like these are worse than useless, they're outright deceptive to future employers. If someone claims they studied scientific computing and then turned out to not understand files, folders, packages, multiple windows and other basics then they'd be completely unable to do the job.

fsflover 3y ago
> How are you supposed to do professional stats work after university on a mobile phone? They don't even expose a file system. Mine does.
tomgp 3y ago
>How are you supposed to do professional stats work after university on a mobile phone? Generally your employer or institution will supply you with a computer (or access to one in the case of students)? The test described was devised during the lockdown because people didn't have had access to the university's facilities.
- kiicia 3y ago
  Doom can run on anything...
- duped 3y ago
  At my university we were able to use an RDP client to log into windows machines with all the engineering software installed on them. Performance sucked, which is why people only did it if they had too. But it was manageable. R was one of the software packages.

pjmlp 3y ago

Yet another advocacy article with absent of what came before.

icedchai 3y ago

We had code execution in the browser over 25+ years ago, with Java applets. Sure, they were bloated and sluggish back then. On today's hardware, you wouldn't even notice.