Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It's really hard to create vendor lock in on a feature nobody uses.

But even if they did go down that route, NaCl is licensed under BSD, so even Microsoft could add NaCL to IE if they wanted to. That's some pretty weak vendor lock-in.



Licensing is not the issue. Microsoft could not add NaCL to IE in the same sense that it could not add Firefox' DevTools to IE. It would require a major rewrite and cost tremendous heaps of money.


Even if that's true (and I share the sibling's skepticism), vendor A's incompetence and poor product quality is not meaningfully described as "lock-in" to vendor B - especially so when there's a readily available vendor C (Firefox) that doesn't share these ills.


Firefox doesn't support NacCl, Mozilla has show no intention of integrating it and they even criticized the technology.


Yeah but that's because Mozilla loves javascript and NaCl provides a working alternative.


How is NaCl not just "Google's version of ActiveX"



NaCl runs in a sandbox


it's secure and open source.


Nothing is "secure".


It's more secure than JavaScript, which is a start. Dropping the need for just-in-time compilation while gaining performance is nice.


When has JavaScript itself (and not the APIs, unless it's a JS-specific problem) last enabled an exploit in a major browser? I can't remember it.

Meanwhile, here's a NaCl sandbox escape exploit from March: https://www.exploit-db.com/exploits/36311/


I've gotta raise an eyebrow on that one. If it's a major rewrite to support a new plugin authoring language, your plugin architecture was a terrible mess to begin with.

Given that we're supposed to believe that New Internet Explorer was pretty much a from-the-ground-up rewrite, I can't imagine that their plugin architecture is a terrible mess.


NaCl isn't simply a plugin architecture. It is effectively the entire Chrome sandbox and large parts of Chrome architecture made available to binary plugins.

You aren't pulling it into your project without also pulling in half of Chrome.


According to this [0], NaCl is a Pepper plugin. [1] This would strongly imply that all you'd need to do to use NaCl is to implement PPAPI. Care to point out how I'm wrong about that?

[0] https://www.chromium.org/nativeclient/getting-started/gettin...

[1] Indeed, in a vaguely-recent Chrome, about:plugins has this to say about NaCl:

Native Client

Name: Native Client

Version:

Location: /opt/google/chrome/internal-nacl-plugin

Type: PPAPI (in-process)


the PPAPI is very closely tied to chrome's inner workings and is extremely complicated to implement as, compared to the old plugin api's, it doesn't allow native code any access to the local system. So it needs to provide plugins with all the possible hooks they will ever need.

Check https://developer.chrome.com/native-client/c-api for a list of currently supported features.

For other browsers to support PPAPI, they'd have to implement all of this, which, btw, also is a moving target that moves forward in lockstep with chrome releases.


> the PPAPI is very closely tied to chrome's inner workings and is extremely complicated to implement

I've looked at the API, and can't agree with your statement. The API is similar to a typical game engine API. There are classes for handling input devices, audio, OpenGL, hardware video decoding, filesystem access, and basic networking. The PPAPI does not even touch the DOM, so it's not tied to being in a web browser.


It's also not spec'd; there are many edge cases in the implementation that are undocumented and would have to be specified precisely in order to be implementable by others. Nobody has done that work so far.

Here's a random example bz pointed out from a few years ago: https://news.ycombinator.com/item?id=5452098


By "tied to chrome's inner workings" I meant the implementation itself which can't be lifted off of Chrome because of that. So PPAPI would need to be re-implemented by other browsers which is difficult as it's very much a moving target without an official standards process.

Basically what happens is that their flash plugin or some internal chrome app needs feature X at which point they extend PPAPI to have feature X. Trying to play catch-up with this kind of development is frustrating and difficult.

And aside of that, browser vendors don't like the fact that PPAPI is more or less re-implementing other existing web technologies. Here's a writeup by Robert O'Callahan from 2010 that goes into this reasoning: https://mail.mozilla.org/pipermail/plugin-futures/2010-April...


PPAPI is just providing an alternate, lower-level interface to the same web techniques accessible via JavaScript APIs. There's a bit more power (OpenGL ES 2.0, not the crippled WebGL standard based upon it) but nothing very significant. It's not browser-specific but it's also not going beyond what browsers provide.


I laughed real hard at the "just" in your sentence. thank you for that.


NPAPI (the old plugin architecture) is a terrible mess. It's 20 years old as of this year, and was cobbled together by Netscape back for version 2.0.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: