8 ms·

Update on NPAPI Deprecation

40 points by espadrine 12y ago

selectnull 12y ago
Interesting how they are deprecating one tech (NPAPI) in the name of open web, while at the same time they are pushing NaCl.
- gcp 12y ago
  I was very pleasantly surprised today to read that frameworks like Unity3D have already deprecated their NaCl and Flash support.
  - paulhodge 12y ago
    Yeah, that was interesting news. NaCl is officially removed in Unity 4.5 (which just came out). Flash will be removed in Unity 5 (if it's not already?). According to the Unity at least, asm.js + WebGL is the future. https://unity3d.com/unity/whats-new/unity-4.5#changes https://unity3d.com/unity/whats-new/unity-4.5#changes https://twitter.com/UnitZeroOne/status/471355979217793024 https://twitter.com/UnitZeroOne/status/471355979217793024
    - kristianp 12y ago
      What will that do for non-firefox users though? asm.js is Firefox only, so it's another non-open platform really.
      - skybrian 12y ago
        There's nothing Firefox-only about asm.js. It's a subset of JavaScript that runs in other browsers at reasonable speed since it's part of benchmarks that browser vendors are optimizing for. The pragma may be Firefox-only but nobody cares about that.
      - gcp 12y ago
        It won't do anything for non-Firefox users: things will just work, which is pretty much the entire point and a pretty huge difference from (P)NaCl and Flash. asm.js is nothing but a "hint" to the JS engine that some optimizations are possible. IIRC, Chrome hasn't implemented support for the pragma because they believe they can get the majority of the benefits by making V8 smarter.
- FooBarWidget 12y ago
  Isn't NaCl open source? What's the problem?
  - gcp 12y ago
    Something being open source doesn't really have much relation to a technology being open. In this case in particular, it's replacing one open-source API that is easily re-implementable, and has been reimplemented by many parties, by another one that is realistically only available by importing the majority of Chrome into your project.
    - pekk 12y ago
      That is not different from how most of Firefox's capabilities only work as part of Firefox.
      - zanny 12y ago
        The point is that NaCL is not browser portable at all. NPAPI is. Therefor, they are depreciating a cross browser plugin architecture for one that is Chrome-only. Which basically means no more plugins at all, unless Chrome captures a ridiculous 50%+ marketshare. Which is actually likely, because Google is doing some real seedy nonsense to get Chrome on every Windows preinstall and bundled with every other freeware program in the universe.
        justinschuh 12y ago
        It's a myth that NPAPI is browser portable (at least in the sense that portability is not a massive undertaking). NPAPI doesn't work on mobile platforms and it requires a huge effort to add or even maintain support for a multi-process browser and a modern graphics stack. Even then, the support is a hack that is a constant source of bugs, crashes, and security vulnerabilities. The only thing that's kept it working this long is constant vigilance on the part of browser makers.
      - pcwalton 12y ago
- magicalist 12y ago
  > Interesting how they are deprecating one tech (NPAPI) in the name of open web The only reference to the open web is > Most use cases that previously required NPAPI are now supported by JavaScript-based open web technologies while the reasoning given for deprecation is explicitly "security, speed, and stability", which is certainly true. NPAPI is bad, bad business, and wouldn't fly for a second today if it weren't grandfathered into browsers. It's a shame that there's still the NaCl fallback, but I would give good odds this will end up a positive for everyone as a forcing function, since the remaining plugins will look to JS-based solutions first since they'll continue working in all browsers. (now, unfortunately some of those will be turning to EME, but that's a different series of poor decisions)
  - selectnull 12y ago
    I'm all for deprecating NPAPI. At the same time, I don't think NaCl is the answer and it's definitely not "open web" (for any reasonable definition of that term) and shouldn't be advertised as such.
    - magicalist 12y ago
      > I don't think NaCl is the answer and it's definitely not "open web" (for any reasonable definition of that term) and shouldn't be advertised as such. Agreed, but as I said above, it's definitely not being called that in the blog post.
      - selectnull 12y ago
        Maybe not. But they are advertising the use of NaCl just after they spoke about "open web". One might call it hairsplitting. But we really don't need another ActiveX in the browser. We are still recuperating from that one. And I'm not even saying NaCl is bad as ActiveX, nor am saying that ActiveX is bad from technology point of view. What I am saying is that both are/were technologies that were pushed by single browser vendor and that is bad. EDIT: fixed typo
        12y ago
- deleted 12y ago
  [deleted]
gergles 12y ago
Yeah, NPAPI was too open for them to keep permitting the use of. Better to move everything to in-browser DRM (they almost gleefully recommend EME for video) and everything else to NaCl which only works in Chrome. sigh
- captainmuon 12y ago
  Too open in every sense. One, it was fairly simple. NaCl is a complete operating system API in the browser, and basically impossible for anyone but Google to implement (because it is proprietary, but also because of its sheer complexity). Then, native browser plugins were "omnipotent" and could do anything the user could do. Of course, this has security implications, which was why people wanted to get rid of them. But these are not unsolvable. Remember how insecure browsers were a few years ago, and look at how much work has went into securing them. Chrome uses sophisticated sandboxing of its individual parts. One could use this, or other modern techniques to contain plugins (containers, virtualization. Hell, you could just run plugins under a different user with restricted rights and it would help a lot). Security worries are not the reason. The real "problem" is that native code allows to much. - You can access the hardware and play back (potentially pirated) videos in any format at high speed. - You can access sockets and do any kind of communication (AFAIK this is not possible in pepper plugins, and in NaCl only with restrictions, and you are registered with your name with Google). You could write a file sharing client, a darknet, etc.. You could have a plugin that scrapes information from other sites. And you could do it all without having a domain, and without being legally accountable. - You can access the hardware, and peripherals - I guess there is a business opportunity for Google if manufacturers have to pay so their devices (printers, 3D headsets, ...) work with Chrome. If it is not for money, then for patents, or they use it for leverage against the other companies.
  - pekk 12y ago
    NaCl is not "proprietary," it's BSD-licensed
  - skybrian 12y ago
    "basically impossible for anyone but Google to implement". Sheer nonsense. I don't doubt it was hard to build, but with an open source reference implementation it shouldn't be hard to clone. I mean, we're not talking about WINE here. You could start with a fork.
gcp 12y ago
Is this going to be like H264 deprecation? i.e. if there's a "few" remaining use cases that they can't get people moved away from, they'll delay and eventually not do it, leaving everyone that went ahead and jumped into their "replacements" feeling like fools because they spent engineering effort for zero results except to promote a Google political move?
duskwuff 12y ago
Wait… what's the "Facebook" plugin in the last row?
- Zr40 12y ago
  It could refer to various Facebook apps/games that require a browser plugin to access native graphics capabilities or to escape from the browser and install files locally.
- natrius 12y ago
  https://www.facebook.com/videocalling https://www.facebook.com/videocalling
steeve 12y ago
So finally Netflix is going to have to move away from Silverlight.
- scott_karana 12y ago
  I was encouraged by that too, but I suspect Silverlight just got ported to NaCL... (or whatever else Chrome plugins are supposed to use)
  - dragonwriter 12y ago
    I suspect -- as it already does on Chromebooks -- Netflix will just use HTML5 video with DRM through EME on Chrome everywhere Netflix is supported once NPAPI support ends.
- jevinskie 12y ago
  I was wondering this as well. Does Netflix already support playback without Silverlight on Chrome using a <video> CDM? What is going to happen to Java applets? You must use a different browser?
  - girvo 12y ago
    I don't think Java applets are integrated using NPAPI?
    - gcp 12y ago
      They are.
  - gcp 12y ago
    What is going to happen to Java applets? You must use a different browser? Firefox is now blocking Java by default. Java on the web is dead, killed by Oracle and JavaScript.
- mcpherrinm 12y ago
  There's a reason Netflix's name is on the encrypted media extensions W3C document. As best I can tell, the whole DRM for HTML5 is basically centered around Netflix wanting to go HTML5 but not being able to ditch DRM.
mikevm 12y ago
Browser plugins are basically dead anyway. Flash is the only major holdout. Mozilla's not going to bother replacing NPAPI as it's working on an asm.js replacement for Flash: http://mozilla.github.io/shumway/ http://mozilla.github.io/shumway/ similarly to what it did with its PDF viewer (now using pdf.js).
hosay123 12y ago
> We are actively helping still-popular NPAPI-based services migrate to open-web-based alternatives. Still using the term "open web", and in the very next paragraph discussing NaCl. Funny guys, real funny
- justinschuh 12y ago
  I think it's fairly clear that NaCl is suggested only as an alternative for applications with needs not yet supported by open web technologies: Most use cases that previously required NPAPI are now supported by JavaScript-based open web technologies. For the few applications that need low-level APIs, threads, and machine-optimized code, Native Client offers the ability to run sandboxed native code in Chrome. And accepting that, NaCl is free and open source that is publicly developed, so I don't see any of the implications of your argument working.
  - gcp 12y ago
    And accepting that, NaCl is free and open source that is publicly developed, so I don't see any of the implications of your argument working. Wake me up when anyone (can) realistically do an independent reimplementation. Claiming that NaCl is "open web" is a sure sign of excessive reality distortion fields.
    - justinschuh 12y ago
      Did you even read what you're responding to here? Because your comments throughout this thread imply that you have not. The only use of the term "open web" was specifically in reference to cross-browser technologies. You are the one inappropriately applying it where it was not originally used. So, I think you should take a step back and consider what your argument here really is. If you have some other objections to NaCl as a technology, then that's certainly your right. However, I don't see you substantiating your objections beyond vague FUD and ad hominem attacks. The reality is that NaCl is free and open source code with a permissive license. It's thoroughly documented and has an exhaustive test suite that would make an alternate implementation straightforward. In fact, independent teams have used exactly that documentation and those tests to reimplement entirely new validators for NaCl from scratch (e.g. the regex based validator). So, there really is no legitimate argument that NaCl couldn't realistically be reimplemented (even accepting that NaCl's license precludes such a need anyway).
vfclists 12y ago
Is there a difference between Chrome and Chromium that will enable Chromium to keep using NPAPI? Is Chrome actually a Chromium with Google customizations, in the sense that Chromium can keep NPAPI whilst Google removes it for its own distribution?
- gcp 12y ago
  I doubt that will turn out to be technically feasible in the long run. There's no bug team working on Chromium that isn't Google Chrome developers, AFAIK.
  - vfclists 12y ago
    It raises the question of how 'Open Source' Open Source can be if it is tightly controlled by companies who constantly make compatibility breaking 'improvements' and 'architectural changes' that funnel end users and developers through their hardware, app stores and onto their cloud storage. What browser should it be then? Rekonq, Konqueror? It appears that the Big Three would prefer desktop Linux to wither and die, or at least not go mainstream, or is just by imagination?
SoftwareMaven 12y ago
The removal of NPAPI is, ultimately, probably a good thing for users. However, it is frightening to watch a replay of IE4, when a browser developer created a much better product, then proceeded to drive all of innovation in the browser space. At the time, they were probably all good things (at least, in many people's minds; hindsight colors it differently now). At least, until Microsoft decided they won the Internet and stopped doing any innovation (hell, they even stopped trying to keep up with the Jones). Due to the stranglehold they had on market share, it was an intensely painful time for web development. Google is nearing the point of having won the Internet in the same way. Will we see something similar? Probably not to the same extent: Google's fortunes are too tightly tied to the Internet to drop out like Microsoft did (Microsoft failed to realize everybody's fortunes were tied to the Internet), but I still worry when a single company feels like it can make wide-sweeping, unilateral decisions about the web.

40 points by espadrine 12y ago

Interesting how they are deprecating one tech (NPAPI) in the name of open web, while at the same time they are pushing NaCl.

gcp 12y ago
I was very pleasantly surprised today to read that frameworks like Unity3D have already deprecated their NaCl and Flash support.
- paulhodge 12y ago
  Yeah, that was interesting news. NaCl is officially removed in Unity 4.5 (which just came out). Flash will be removed in Unity 5 (if it's not already?). According to the Unity at least, asm.js + WebGL is the future. https://unity3d.com/unity/whats-new/unity-4.5#changes https://unity3d.com/unity/whats-new/unity-4.5#changes https://twitter.com/UnitZeroOne/status/471355979217793024 https://twitter.com/UnitZeroOne/status/471355979217793024
  - kristianp 12y ago
    What will that do for non-firefox users though? asm.js is Firefox only, so it's another non-open platform really.
    - skybrian 12y ago
      There's nothing Firefox-only about asm.js. It's a subset of JavaScript that runs in other browsers at reasonable speed since it's part of benchmarks that browser vendors are optimizing for. The pragma may be Firefox-only but nobody cares about that.
    - gcp 12y ago
      It won't do anything for non-Firefox users: things will just work, which is pretty much the entire point and a pretty huge difference from (P)NaCl and Flash. asm.js is nothing but a "hint" to the JS engine that some optimizations are possible. IIRC, Chrome hasn't implemented support for the pragma because they believe they can get the majority of the benefits by making V8 smarter.
FooBarWidget 12y ago
Isn't NaCl open source? What's the problem?
- gcp 12y ago
  Something being open source doesn't really have much relation to a technology being open. In this case in particular, it's replacing one open-source API that is easily re-implementable, and has been reimplemented by many parties, by another one that is realistically only available by importing the majority of Chrome into your project.
  - pekk 12y ago
    That is not different from how most of Firefox's capabilities only work as part of Firefox.
    - zanny 12y ago
      The point is that NaCL is not browser portable at all. NPAPI is. Therefor, they are depreciating a cross browser plugin architecture for one that is Chrome-only. Which basically means no more plugins at all, unless Chrome captures a ridiculous 50%+ marketshare. Which is actually likely, because Google is doing some real seedy nonsense to get Chrome on every Windows preinstall and bundled with every other freeware program in the universe.
      - justinschuh 12y ago
        It's a myth that NPAPI is browser portable (at least in the sense that portability is not a massive undertaking). NPAPI doesn't work on mobile platforms and it requires a huge effort to add or even maintain support for a multi-process browser and a modern graphics stack. Even then, the support is a hack that is a constant source of bugs, crashes, and security vulnerabilities. The only thing that's kept it working this long is constant vigilance on the part of browser makers.
    - pcwalton 12y ago
magicalist 12y ago
> Interesting how they are deprecating one tech (NPAPI) in the name of open web The only reference to the open web is > Most use cases that previously required NPAPI are now supported by JavaScript-based open web technologies while the reasoning given for deprecation is explicitly "security, speed, and stability", which is certainly true. NPAPI is bad, bad business, and wouldn't fly for a second today if it weren't grandfathered into browsers. It's a shame that there's still the NaCl fallback, but I would give good odds this will end up a positive for everyone as a forcing function, since the remaining plugins will look to JS-based solutions first since they'll continue working in all browsers. (now, unfortunately some of those will be turning to EME, but that's a different series of poor decisions)
- selectnull 12y ago
  I'm all for deprecating NPAPI. At the same time, I don't think NaCl is the answer and it's definitely not "open web" (for any reasonable definition of that term) and shouldn't be advertised as such.
  - magicalist 12y ago
    > I don't think NaCl is the answer and it's definitely not "open web" (for any reasonable definition of that term) and shouldn't be advertised as such. Agreed, but as I said above, it's definitely not being called that in the blog post.
    - selectnull 12y ago
      Maybe not. But they are advertising the use of NaCl just after they spoke about "open web". One might call it hairsplitting. But we really don't need another ActiveX in the browser. We are still recuperating from that one. And I'm not even saying NaCl is bad as ActiveX, nor am saying that ActiveX is bad from technology point of view. What I am saying is that both are/were technologies that were pushed by single browser vendor and that is bad. EDIT: fixed typo
      - 12y ago
deleted 12y ago
[deleted]

gergles 12y ago

Yeah, NPAPI was too open for them to keep permitting the use of. Better to move everything to in-browser DRM (they almost gleefully recommend EME for video) and everything else to NaCl which only works in Chrome. sigh

captainmuon 12y ago
Too open in every sense. One, it was fairly simple. NaCl is a complete operating system API in the browser, and basically impossible for anyone but Google to implement (because it is proprietary, but also because of its sheer complexity). Then, native browser plugins were "omnipotent" and could do anything the user could do. Of course, this has security implications, which was why people wanted to get rid of them. But these are not unsolvable. Remember how insecure browsers were a few years ago, and look at how much work has went into securing them. Chrome uses sophisticated sandboxing of its individual parts. One could use this, or other modern techniques to contain plugins (containers, virtualization. Hell, you could just run plugins under a different user with restricted rights and it would help a lot). Security worries are not the reason. The real "problem" is that native code allows to much. - You can access the hardware and play back (potentially pirated) videos in any format at high speed. - You can access sockets and do any kind of communication (AFAIK this is not possible in pepper plugins, and in NaCl only with restrictions, and you are registered with your name with Google). You could write a file sharing client, a darknet, etc.. You could have a plugin that scrapes information from other sites. And you could do it all without having a domain, and without being legally accountable. - You can access the hardware, and peripherals - I guess there is a business opportunity for Google if manufacturers have to pay so their devices (printers, 3D headsets, ...) work with Chrome. If it is not for money, then for patents, or they use it for leverage against the other companies.
- pekk 12y ago
  NaCl is not "proprietary," it's BSD-licensed
- skybrian 12y ago
  "basically impossible for anyone but Google to implement". Sheer nonsense. I don't doubt it was hard to build, but with an open source reference implementation it shouldn't be hard to clone. I mean, we're not talking about WINE here. You could start with a fork.

gcp 12y ago

Is this going to be like H264 deprecation? i.e. if there's a "few" remaining use cases that they can't get people moved away from, they'll delay and eventually not do it, leaving everyone that went ahead and jumped into their "replacements" feeling like fools because they spent engineering effort for zero results except to promote a Google political move?

duskwuff 12y ago

Wait… what's the "Facebook" plugin in the last row?

Zr40 12y ago
It could refer to various Facebook apps/games that require a browser plugin to access native graphics capabilities or to escape from the browser and install files locally.
natrius 12y ago
https://www.facebook.com/videocalling https://www.facebook.com/videocalling

steeve 12y ago

So finally Netflix is going to have to move away from Silverlight.

scott_karana 12y ago
I was encouraged by that too, but I suspect Silverlight just got ported to NaCL... (or whatever else Chrome plugins are supposed to use)
- dragonwriter 12y ago
  I suspect -- as it already does on Chromebooks -- Netflix will just use HTML5 video with DRM through EME on Chrome everywhere Netflix is supported once NPAPI support ends.
jevinskie 12y ago
I was wondering this as well. Does Netflix already support playback without Silverlight on Chrome using a <video> CDM? What is going to happen to Java applets? You must use a different browser?
- girvo 12y ago
  I don't think Java applets are integrated using NPAPI?
  - gcp 12y ago
    They are.
- gcp 12y ago
  What is going to happen to Java applets? You must use a different browser? Firefox is now blocking Java by default. Java on the web is dead, killed by Oracle and JavaScript.
mcpherrinm 12y ago
There's a reason Netflix's name is on the encrypted media extensions W3C document. As best I can tell, the whole DRM for HTML5 is basically centered around Netflix wanting to go HTML5 but not being able to ditch DRM.

mikevm 12y ago

Browser plugins are basically dead anyway. Flash is the only major holdout. Mozilla's not going to bother replacing NPAPI as it's working on an asm.js replacement for Flash: http://mozilla.github.io/shumway/ http://mozilla.github.io/shumway/ similarly to what it did with its PDF viewer (now using pdf.js).

hosay123 12y ago

> We are actively helping still-popular NPAPI-based services migrate to open-web-based alternatives. Still using the term "open web", and in the very next paragraph discussing NaCl. Funny guys, real funny

justinschuh 12y ago
I think it's fairly clear that NaCl is suggested only as an alternative for applications with needs not yet supported by open web technologies: Most use cases that previously required NPAPI are now supported by JavaScript-based open web technologies. For the few applications that need low-level APIs, threads, and machine-optimized code, Native Client offers the ability to run sandboxed native code in Chrome. And accepting that, NaCl is free and open source that is publicly developed, so I don't see any of the implications of your argument working.
- gcp 12y ago
  And accepting that, NaCl is free and open source that is publicly developed, so I don't see any of the implications of your argument working. Wake me up when anyone (can) realistically do an independent reimplementation. Claiming that NaCl is "open web" is a sure sign of excessive reality distortion fields.
  - justinschuh 12y ago
    Did you even read what you're responding to here? Because your comments throughout this thread imply that you have not. The only use of the term "open web" was specifically in reference to cross-browser technologies. You are the one inappropriately applying it where it was not originally used. So, I think you should take a step back and consider what your argument here really is. If you have some other objections to NaCl as a technology, then that's certainly your right. However, I don't see you substantiating your objections beyond vague FUD and ad hominem attacks. The reality is that NaCl is free and open source code with a permissive license. It's thoroughly documented and has an exhaustive test suite that would make an alternate implementation straightforward. In fact, independent teams have used exactly that documentation and those tests to reimplement entirely new validators for NaCl from scratch (e.g. the regex based validator). So, there really is no legitimate argument that NaCl couldn't realistically be reimplemented (even accepting that NaCl's license precludes such a need anyway).

vfclists 12y ago

Is there a difference between Chrome and Chromium that will enable Chromium to keep using NPAPI? Is Chrome actually a Chromium with Google customizations, in the sense that Chromium can keep NPAPI whilst Google removes it for its own distribution?

gcp 12y ago
I doubt that will turn out to be technically feasible in the long run. There's no bug team working on Chromium that isn't Google Chrome developers, AFAIK.
- vfclists 12y ago
  It raises the question of how 'Open Source' Open Source can be if it is tightly controlled by companies who constantly make compatibility breaking 'improvements' and 'architectural changes' that funnel end users and developers through their hardware, app stores and onto their cloud storage. What browser should it be then? Rekonq, Konqueror? It appears that the Big Three would prefer desktop Linux to wither and die, or at least not go mainstream, or is just by imagination?

SoftwareMaven 12y ago

The removal of NPAPI is, ultimately, probably a good thing for users. However, it is frightening to watch a replay of IE4, when a browser developer created a much better product, then proceeded to drive all of innovation in the browser space. At the time, they were probably all good things (at least, in many people's minds; hindsight colors it differently now). At least, until Microsoft decided they won the Internet and stopped doing any innovation (hell, they even stopped trying to keep up with the Jones). Due to the stranglehold they had on market share, it was an intensely painful time for web development. Google is nearing the point of having won the Internet in the same way. Will we see something similar? Probably not to the same extent: Google's fortunes are too tightly tied to the Internet to drop out like Microsoft did (Microsoft failed to realize everybody's fortunes were tied to the Internet), but I still worry when a single company feels like it can make wide-sweeping, unilateral decisions about the web.