Google Native Client grows out of research phase

Satisfied that its security underpinnings are solid, Google has promoted its open-source Native Client technology to accelerate Web applications out of its research phase and is taking steps to build it into the Chrome Web browser.

"Based on our experience to date, we believe that the basic architecture of our system is sound and the implementation is supportable. So now we are undertaking a number of tasks to transition Native Client from a research technology to a development platform," said Brad Chen, Google's Native Client engineering manager, in a mailing list announcement Wednesday.

Brad Chen, engineering manager of the Google Native Client

(Credit: Stephen Shankland/CNET)

Native Client, called NaCl for short, is a mechanism to run software downloaded over the Web directly on x86 processors such as Intel's Core line. The key motivation is to attain the speed of regular "native" software installed on a computer rather than the much slower JavaScript environment that sophisticated Web sites use today. It's one part of Google's broad effort to evolve the Web from a collection of relatively static sites into foundation for more powerful applications.

Executing native code from the Web is easy--until you start trying to worry about security risks. To this end, Native Client examines software before it runs to block software that takes a variety of prohibited actions, an idea called static analysis, and it runs the software in a protected sandbox.

"We recognized the underlying technology to be ambitious and risky, and felt strongly than a generous measure of public scrutiny was appropriate before we committed to any definite plans," Chen said. Satisfied that Native Client passed muster, Google will remove various security constraints such as the inability to execute Native Client software downloaded from the open Internet, he said.

Native Client was first introduced in December a browser plug-in, but Google doesn't like that approach.

"We recognize that there is well-justified resistance to installing browser plug-ins. For this reason we have a strong preference for delivering Native Client pre-installed or built into the browser, and we'll be focusing on that as our main strategy for delivering Native Client to users," Chen said.

And now we see one reason why Google is interested having a browser of its own available: "Careful readers may have already noticed evidence of integration into Chromium in the Native Client source," Chen said, referring to the open-source project that underlies the Chrome browser.

Google touted Native Client at its Google I/O conference in May, showing off a Web-based photo editor as an example of the processing power the technology offers. Google also is trying to pair Native Client with another company project, O3D, which lets browsers take advantage of hardware to accelerate 3D graphics.

[johnreg]

Sounds like what Microsoft has already done with Silverlight. The difference is that SIlverlight works on multiple browsers accross different platforms.

[JuggerNaut]

Silverlight really only works on Windows and sometimes Mac (Intel-only). Silverlight also is gaining no ground on Flash/Flex, so it's a moot point anyway!

[Simplicius]

What Google is doing is open source, hence fundamentally different from Silverblight.

[fernalima]

Silverlight is .NET and .NET is managed code. It is a intermediate language between source code and machine code, that is run inside a virtual machine, hindering performance a bit. Although, Google s approach is to run native (machine) code directly on bare hardware while trapping some instructions that aren t desired, those that can be used to malicious purposes.

[lee_zuckett]

Because it is open source does not make it "fundamentally" different, seriously.

[Shankland]

Well, Native Client runs on x86 machines only, but on Mac, Windows, and Linux. It doesn't run on non-x86 machines, though Google wants it to (let's not forget that Android phones use ARM and Qualcomm processors, and Google wants smartphones to run Web apps). The Native Client plug-in works with Firefox, Safari, Opera, and of course Chrome.

It definitely competes with Silverlight, though Silverlight isn't terribly widely used on Web sites. The best example I know of is Netflix's streaming video service. Silverlight tends to be more for standalone applications; Google envisions Native Client as more of a helper technology but not a complete programming environment or a platform where programmers can assume a bunch of libraries are built in to draw upon.

[mjconver]

Google Salt, I love it. Will only seasoned programmers use it?

[hmdz105]

Silver light, Flash, Java and .Net Framework all run application on native X86 platform. The overhead is that we need to install their run-time. I guess Google should introduce a new concept in this, like running JavaScript and HTML in Native Code directly. The concept of this, though, is not new. Who knows what Google really means by this exactly? And how does it differ from their current JavaScript engine used in Chrome browser?

[Shankland]

Native Client is for running code compiled (using a special version of GCC that's part of the project) directly for the processor--thus the term Native Code. It's not JavaScript, which is an interpreted or just-in-time compiled language.

[hmdz105]

@Shankland:
Is not JIT (Just In Time) run in native x86 ? I guess some websites claim that JIT code is as fast as its native equivalent ( C# v.s C++), specially in math intensive applications. What I want to know is that why Google is trying to add to the burden of web programmer to learn another language. Why not make their V8 engine as fast as possible instead of this?

[meh100]

JIT is not run in native code. The code is compiled into a platform-independent byte code. Then, it is fed into a virtual machine that processes the byte code and gives instructions to the processor. It isn't much of a slowdown compared to native languages, especially not compared to the 50+ times slowdown you can get with interpreted languages. The biggest advantage JIT and interpreted languages have is that they are completely machine independent- you won't need different code for each OS and architecture.

[jjww2009]

how is this different from active x? i believe silverlight is much safer to use.

[Shankland]

ActiveX is different from Silverlight and from Native Code. ActiveX runs code natively (on Windows only) after the computer user agrees that the certificate used to sign the code is from a trusted source. Many people (not just Google) find this security mechanism weak. Silverlight, like Flash, runs software in a protected environment supplied by a plug-in. Native Client code modules are called from within the Web page and requires a runtime to execute the code; the runtime checks to see if the code complies with the security policy before executing it.

[MatthewFabb]

Interesting approach, in bundling the native client with chrome. The question is where that leaves users who are not using Chrome? Installing a plugin is still a lot easier for users rather than switching browsers.

Also I wonder if this approach has anything to do with the fact that Adobe now has a tool called Achelemy that allows C++/C code to be converted in byte code and run in the Flash Player. Because when given the choice of using C++ code in the browser using the well known Flash Player or going with new plugin from Google, I imagine most would use Flash.

[twitter_1963]

FAT CLIENTS ARE BACK - in disguise. FAT CLIENTS from secure signed vendors pushed to dekstops on demand. Worked for years. Great performance. The browser is dead, next we'll be running native as a preference.

Look at Iphone, most apps run native - NOT in the browser - it just WORKS.

[Shankland]

It just works on the iPhone. But Google's Gmail Web application, written once, works on iPhone, Android, and Palm Pre. Don't count the browser out yet.

[hawkeyeaz1]

NaCl gives benefits of speed, for data processing like encryption and photo editing. Flash doesn't do it, or it doesn't do it well. Also, from here, it isn't that much work to get old classic DOS games like Duke Nukem to run in NaCl.

[Shankland]

Google demonstrated Quake running in NaCl. For real graphics, though, they have to get O3D working in conjunction with NaCl.

[jemiller0]

Does anyone know what language Google Native Client uses? I can't believe it would be C/C++. If it is, that is just insanity.

[meh100]

If it's native code, then it will work with any language that is directly compiled to machine code. This would include C, C++, Objective-C, Fortran, and Cobol. It doesn't include more modern languages such as Java, Python, Perl, or C# because programs in those languages aren't directly compiled to machine code.

[BIGELLOW]

Someone mentioned that "the browser is dead" because "fat clients" are taking over. The part that is missing is this... Chrome, a browser, is very simplistic for a reason. It is the "shell" for the "fat client" to sit inside of. Google hinted at this when they talked about the tabbing system of Google Chrome. They mentioned that an individual tab needn't necessarily be a website. To me, this says that an individual tab could end up being an application running through NaCl. Given this, people have been talking for years as to whether or not Google would release an operating system to compete with Windows. Well, Chrome/NaCl is it.

Native Client does not replace Silverlight, Flush, Jave, Video codecs etc. It provides a ways for such software to be SAFELY downloaded and used. So may allow more browsers plug-in to be used without problems. It will limit (not remove) the risk when a browser plug has a security whole in it.

Think of Native Client as a safer version of ActiveX?.

It may take of, provided it is easy to convert an ActiveX control into a Native Client.

A little bit of history, some old IBM machines protected memory access by checking the binary of a programme before letting it install, rather then having hardware memory protection. Native Client is a more extensive version of this.

[idfubar]

Static analysis hasn't advanced in the last 10 years?