Google Is Grooming Chrome As a Game Platform

An anonymous reader writes with this snippet from Conceivably Tech: "On Friday I noticed that Google is heavily pushing New Game, a game developer conference that is focused on HTML5-based gaming content — and, of course, content that runs in web browsers. The fact that such an event already exists and that there is game content being developed in HTML5, is quite stunning by itself. However, Google also noted that a sandboxed native client (NaCl) with 3D (in addition to 2D) will be available in Chrome soon, which will allow the browser to connect to traditional C and C++ code via its integrated Pepper API."

The very stupidity of it all

[Anonymous Coward]

Google wants to introduce x86 native code to the web at the time when ARM platforms are attracting all the buzz. This is a step backwards, akin to Flash or ActiveX.

Does anyone

[phantomfive]

Does anyone else see this as a giant security hole? As in, various schemes like this have been tried since the days of ActiveX, and the only reason ActiveX has the worst reputation is because it's the only one that gained widespread use?

Proprietary

[Billly Gates]

How is using Pepper different than ActiveX with Internet Explorer?

If you use pure html 5 with WebGL or Canvas 3D (for IE 9 or IE 10) you can create 3D games using the hosts GPU. Chrome's 3D and hardware acceleration for html 5 does lag considerable behind Firefox and IE 9/10. I wonder if it is because they want you to use Pepper instead?

Either way their actions go agaisn't the spirit of HTML 5. You can do all of that properly in the latest versions of the browsers that is cross platform.

Re:Does anyone

[ninetyninebottles]

That's damn wrong. ActiveX's widespread usage is NOT the only reason. The most significant reason is that ActiveX had basically NO security - one wrong decision by the user and their whole system is compromised. There is no "sandbox filesystem actions" like in Java model for instance. The second glaring issue is that the user does not always gets to decide - lots of objects were marked "safe for scripting" - that is for use from JavaScript, when in fact their interfaces never meant to be secure.

I would add that being a closed source, single vendor project, there was no competition. If MS's implementation was insecure, well you're SOL. With an open standard implementation of NaCl with an open source reference implementation you have a different beast. If Google doesn't fix a problematic hole MS or Apple or Nokia or Canonical or Adobe can and will. Competition drives improvement, including security improvements.

Re:Cats shit in sandboxes all the time.

[ninetyninebottles]

They're [sandboxes] a theoretical concept that have never worked well in the real world. They've been tried time and time and time and time again. They aren't a new concept, but nobody ever seems able to implement them properly, even when some of the biggest names in the field are involved, and even when they have nearly unlimited resources and people to throw at the problem.

Well, except Apple with iOS, Google with Android, the NSA with their SELinux improvements, a crap-ton of people who worked on and use TrustedBSD, Bitfrost in the OLPC, and every security researcher for the last 20 years who has relied heavily on VMs. But yeah aside from those and probably a bunch more I don't know about, no one has successfully implemented sandboxes.

Maybe what you meant to say was that Microsoft hasn't been able to implement them properly.