Google Addressing Web App Security With 'Native Client'

Google is exploring a way to run code fast and natively in a Web browser without worrying about security issues. To that end, the search giant unveiled its new Native Client open source project on Monday.

Native Client, abbreviated by Google as "NaCl," is currently available for testing as research release version 0.1. The solution promises to reduce data transfers between Web servers and the browser client to better run Web applications in x86-based machines.

"With the ability to seamlessly run native code on the user's machine, you could instead perform…actual image processing on the desktop CPU, resulting in a much more responsive application by minimizing data transfer and latency," according to Brad Chen, a member of the Google Native Client team, writing on the Google Code Blog.

Chen pointed out that these tasks can be performed today using "a combination of JavaScript and server side processing." However, that approach is "painfully slow" because of the data chunks that must be transferred.

On the other hand, local CPU processing of data using Web applications poses security issues, which is the main question that Google is trying to address with the release of Native Client.

"To help protect users from malware and maintain portability, we have defined strict rules for valid modules," Chen wrote. "Our approach is built around a software containment system called the inner-sandbox [that] uses static analysis to detect security defects in untrusted x86 code."

These security measures specify a set of structural criteria for all modules. For instance, "modules may not contain certain instruction sequences," according to Chen. The goal is to help developers to create "safer and more dynamic applications that can run on any OS and any browser," Chen wrote. 

The initial release of Native Client is a hefty download that includes compilation tools and runtime. It also has a software development kit to write portable code modules that will work in Firefox, Safari, Opera and Google Chrome.

Currently, Native Client is not supported in Internet Explorer. While Microsoft's ActiveX technology allows code to run natively, a Google white paper (PDF) explains that it requires the "manual establishment of trust relationships through pop-up dialog boxes…[that] have been inadequate to prevent execution of malicious native code."

The white paper asserts that in contrast to ActiveX, "NaCl is designed to prevent such exploitation, even for flawed NaCl modules."

Some readers of the Google Code Blog have compared the Native Client technology with an Adobe solution code-named "Alchemy." The Alchemy solution lets developers run C and C++ code via the Adobe Flash platform.

Native Client will run on any Windows, Mac or Linux system with an x86 processor. Chen explained that Google is "working on supporting other CPU architectures (such as ARM and PCC) to make this technology work on the many types of devices that connect to the Web today."

The test software can be downloaded at the Google Native Client Web page here.

About the Author

Jim Barthold is a freelance writer based in Delanco, N.J. covering a variety of technology subjects.

comments powered by Disqus


  • What's New in TypeScript 5.5, Now Generally Available

    Microsoft shipped the latest iteration of its type-infused superset of JavaScript, TypeScript 5.5, introducing inferred type predicates, control flow narrowing, JSDoc @import and other enhancements.

  • GitHub Copilot for Azure Gets Preview Glitches

    This reporter, recently accepted to preview GitHub Copilot for Azure, has thus far found the tool to be, well, glitchy.

  • New .NET 9 Templates for Blazor Hybrid, .NET MAUI

    Microsoft's fifth preview of .NET 9 nods at AI development while also introducing new templates for some of the more popular project types, including Blazor Hybrid and .NET MAUI.

  • What's Next for ASP.NET Core and Blazor

    Since its inception as an intriguing experiment in leveraging WebAssembly to enable dynamic web development with C#, Blazor has evolved into a mature, fully featured framework. Integral to the ASP.NET Core ecosystem, Blazor offers developers a unique combination of server-side rendering and rich client-side interactivity.

  • Nearest Centroid Classification for Numeric Data Using C#

    Here's a complete end-to-end demo of what Dr. James McCaffrey of Microsoft Research says is arguably the simplest possible classification technique.

Subscribe on YouTube