7 ms·

This is all a terrible idea and it will fragment the Internet as we know it. The internet is not a budget strip-mall of different low grade outlets; it's more a

by b0 14y ago

This is all a terrible idea and it will fragment the Internet as we know it. The internet is not a budget strip-mall of different low grade outlets; it's more an orchard full of fruit you can discover and pick at will from millions of trees. What people have invented is HTML applications, much as Microsoft promoted in the early 00's with some marketing and store ceremony around them. Also, let's look at NaCl while we're here: it's basically a modern version of ActiveX. Then we had silverlight, which was glorified Flash for LOB applications and could be out-of-browser. I wonder how long it'll be before Google invent that again. All those are dead, and for a good reason. Microsoft even sees that these approaches are just bad and has pushed away from them heavily recently apart from in the desktop and mobile space where they are 100% REQUIRED. As far as their integration goes now, you can pin sites to the taskbar and there is no massive ceremony or framework around it - it's just a glorified bookmark. Just because Google packages it up and throws it into the fad browser of the day, don't assume it's not the same golden turd that we've all hated in the past. George Santayana: "Those who cannot remember the past are condemned to repeat it."

mtgx 14y ago
You keep giving Microsoft's proprietary technologies as bad examples vs Google's open source ones, and keep saying it's the same. It's not. Other vendors weren't allowed to use ActiveX or Silverlight, nor could they help improve it, and fix their bugs.
- b0 14y ago
  Some little known facts which point to your assertions being wrong: 1. IE4 worked on UNIX (Solaris/HP-UX) and supported ActiveX. 2. MainSoft provided tools to port your ActiveX to UNIX (Usually a straight recompilation and little else required). 3. Other vendors are allowed to use Silverlight - look: http://www.mono-project.com/Moonlight http://www.mono-project.com/Moonlight 4. ActiveX,COM,MSRPC are all open specifications here: http://msdn.microsoft.com/en-us/library/dd208104(v=prot.10) http://msdn.microsoft.com/en-us/library/dd208104(v=prot.10) 1-2 died because there was lack of demand. 3 died because there was lack of demand and MS decided it was the wrong route. 4 is used by MANY open source projects from Samba to tsclient. As far as improving things goes, I've had many a thing fixed by Microsoft over the years. They ALWAYS solve a problem.
justinschuh 14y ago
You're very confused about these technologies. NaCl and ActiveX aren't even remotely comparable. ActiveX is a method for deploying arbitrary binaries via the Web, and history showed it to be extremely dangerous. NaCl is a method of running thoroughly sandboxed native code; because NaCl is machine specific, it's deployed only through Chrome extensions/apps, and there's no intention to expose it directly to the Web. PNaCl adds a portable bytecode layer on top of NaCl, and is intended as a general Web technology. Realistically, it's more comparable to Java or .NET, only lower-level, more performant, better security, and no one's going to get sued for using it.
- b0 14y ago
  Not quite, and I'm not confused. Both have sandboxes (ActiveX since Windows 6.0, IE7), both have restricted APIs, both run native code. PNaCl is equivalent of silverlight which is cut down CLR. More performance - I doubt it. CLR+JVM is pretty much up there. The moment you add any virtualization, trap code or translation layer to native code via NaCl which you will require for security, there is going to be overhead which will knock it inline with a VM architecture. Startup time might be less - that is it. Better security - that's a lie. Virtualization on any layer never gave anyone better security. It's throwing stones in glass houses. The only hard security boundary is at the MMU/page table. As NaCl grows, you will see it break. No-one getting sued? I'm sure the EU will have something to say when no other vendor implements it and Google uses it to leverage market share, much like Microsoft did in the late 90's and early 00's.
  - justinschuh 14y ago
    I'm sorry, but you are so grossly wrong in your statements that the only valid response is a bit of a fisking. Normally I'd prefer not to respond this way, but I've already engaged you, and I can't really let this much misinformation stand. > Both have sandboxes (ActiveX since Windows 6.0, IE7), both have restricted APIs, both run native code. ActiveX is a general purpose object API and has no sandbox at all. IE 7+ on Vista+ can instantiate ActiveX controls in a weak sandbox via low-integrity mode, but to imply it's comparable to the NaCl sandbox is just comically ignorant. NaCl validates the nexe's conformance and its subset of x86 instructions before it will run it (in that way being very similar to Java and .NET CLR). And NaCl runs entirely in an outer, system-level sandbox that denies all system and object access. In contrast, IE's low integrity mode lets you read anything the user can, exposes massive chunks of the system as attack surface, and provides various writeable locations. On top of that, all non-trivial ActiveX controls in IE implement brokers which run fully outside the sandbox--something that's not even possible with NaCl. > PNaCl is equivalent of silverlight which is cut down CLR. Nope. And making that claim begins to underscore just how little you know about this. > More performance - I doubt it. CLR+JVM is pretty much up there. The moment you add any virtualization, trap code or translation layer to native code via NaCl which you will require for security, there is going to be overhead which will knock it inline with a VM architecture. Startup time might be less - that is it. Virtualization or trap layer? That's not even close to how NaCl works. It's really sad that you couldn't be bothered to read a one-page explanation of before you launched into this completely wrong-headed diatribe. Please, start here next time, so your trolling can at least be superficially informed: https://developers.google.com/native-client/overview https://developers.google.com/native-client/overview > Better security - that's a lie. Virtualization on any layer never gave anyone better security. It's throwing stones in glass houses. The only hard security boundary is at the MMU/page table. As NaCl grows, you will see it break. Once again, premised on your total ignorance of the subject matter. Come back when you have at least a basic knowledge of the thing you're criticizing. > No-one getting sued? I'm sure the EU will have something to say when no other vendor implements it and Google uses it to leverage market share, much like Microsoft did in the late 90's and early 00's. I'm sure there was an attempt at making an argument in this last line, but mostly it just seems to be randomly scrambling for scary sounding words.
jmsduran 14y ago
> "The internet is not a budget strip-mall of different low grade outlets; it's more an orchard full of fruit you can discover and pick at will from millions of trees." Maybe it's just me, but I'm having a difficult time trying to comprehend how this statement relates to your argument. Some perspective please?
- b0 14y ago
  It's a commentary on how providing isolated islands (app stores) damages the distributed nature of the world wide web. Effectively every app technology is a landgrab by some entity who wants some exclusive chunk of the web with their own rules, usually for commercial gain. Basically the principle turns the world wide web into another WalMart or McDonald's rather than a vast library.

by b0 14y ago

mtgx 14y ago

You keep giving Microsoft's proprietary technologies as bad examples vs Google's open source ones, and keep saying it's the same. It's not. Other vendors weren't allowed to use ActiveX or Silverlight, nor could they help improve it, and fix their bugs.

b0 14y ago
Some little known facts which point to your assertions being wrong: 1. IE4 worked on UNIX (Solaris/HP-UX) and supported ActiveX. 2. MainSoft provided tools to port your ActiveX to UNIX (Usually a straight recompilation and little else required). 3. Other vendors are allowed to use Silverlight - look: http://www.mono-project.com/Moonlight http://www.mono-project.com/Moonlight 4. ActiveX,COM,MSRPC are all open specifications here: http://msdn.microsoft.com/en-us/library/dd208104(v=prot.10) http://msdn.microsoft.com/en-us/library/dd208104(v=prot.10) 1-2 died because there was lack of demand. 3 died because there was lack of demand and MS decided it was the wrong route. 4 is used by MANY open source projects from Samba to tsclient. As far as improving things goes, I've had many a thing fixed by Microsoft over the years. They ALWAYS solve a problem.

justinschuh 14y ago

You're very confused about these technologies. NaCl and ActiveX aren't even remotely comparable. ActiveX is a method for deploying arbitrary binaries via the Web, and history showed it to be extremely dangerous. NaCl is a method of running thoroughly sandboxed native code; because NaCl is machine specific, it's deployed only through Chrome extensions/apps, and there's no intention to expose it directly to the Web. PNaCl adds a portable bytecode layer on top of NaCl, and is intended as a general Web technology. Realistically, it's more comparable to Java or .NET, only lower-level, more performant, better security, and no one's going to get sued for using it.

b0 14y ago
Not quite, and I'm not confused. Both have sandboxes (ActiveX since Windows 6.0, IE7), both have restricted APIs, both run native code. PNaCl is equivalent of silverlight which is cut down CLR. More performance - I doubt it. CLR+JVM is pretty much up there. The moment you add any virtualization, trap code or translation layer to native code via NaCl which you will require for security, there is going to be overhead which will knock it inline with a VM architecture. Startup time might be less - that is it. Better security - that's a lie. Virtualization on any layer never gave anyone better security. It's throwing stones in glass houses. The only hard security boundary is at the MMU/page table. As NaCl grows, you will see it break. No-one getting sued? I'm sure the EU will have something to say when no other vendor implements it and Google uses it to leverage market share, much like Microsoft did in the late 90's and early 00's.
- justinschuh 14y ago
  I'm sorry, but you are so grossly wrong in your statements that the only valid response is a bit of a fisking. Normally I'd prefer not to respond this way, but I've already engaged you, and I can't really let this much misinformation stand. > Both have sandboxes (ActiveX since Windows 6.0, IE7), both have restricted APIs, both run native code. ActiveX is a general purpose object API and has no sandbox at all. IE 7+ on Vista+ can instantiate ActiveX controls in a weak sandbox via low-integrity mode, but to imply it's comparable to the NaCl sandbox is just comically ignorant. NaCl validates the nexe's conformance and its subset of x86 instructions before it will run it (in that way being very similar to Java and .NET CLR). And NaCl runs entirely in an outer, system-level sandbox that denies all system and object access. In contrast, IE's low integrity mode lets you read anything the user can, exposes massive chunks of the system as attack surface, and provides various writeable locations. On top of that, all non-trivial ActiveX controls in IE implement brokers which run fully outside the sandbox--something that's not even possible with NaCl. > PNaCl is equivalent of silverlight which is cut down CLR. Nope. And making that claim begins to underscore just how little you know about this. > More performance - I doubt it. CLR+JVM is pretty much up there. The moment you add any virtualization, trap code or translation layer to native code via NaCl which you will require for security, there is going to be overhead which will knock it inline with a VM architecture. Startup time might be less - that is it. Virtualization or trap layer? That's not even close to how NaCl works. It's really sad that you couldn't be bothered to read a one-page explanation of before you launched into this completely wrong-headed diatribe. Please, start here next time, so your trolling can at least be superficially informed: https://developers.google.com/native-client/overview https://developers.google.com/native-client/overview > Better security - that's a lie. Virtualization on any layer never gave anyone better security. It's throwing stones in glass houses. The only hard security boundary is at the MMU/page table. As NaCl grows, you will see it break. Once again, premised on your total ignorance of the subject matter. Come back when you have at least a basic knowledge of the thing you're criticizing. > No-one getting sued? I'm sure the EU will have something to say when no other vendor implements it and Google uses it to leverage market share, much like Microsoft did in the late 90's and early 00's. I'm sure there was an attempt at making an argument in this last line, but mostly it just seems to be randomly scrambling for scary sounding words.

jmsduran 14y ago

> "The internet is not a budget strip-mall of different low grade outlets; it's more an orchard full of fruit you can discover and pick at will from millions of trees." Maybe it's just me, but I'm having a difficult time trying to comprehend how this statement relates to your argument. Some perspective please?

b0 14y ago
It's a commentary on how providing isolated islands (app stores) damages the distributed nature of the world wide web. Effectively every app technology is a landgrab by some entity who wants some exclusive chunk of the web with their own rules, usually for commercial gain. Basically the principle turns the world wide web into another WalMart or McDonald's rather than a vast library.