Google Addressing Web App Security With 'Native Client'

Google is exploring a way to run code fast and natively in a Web browser without worrying about security issues. To that end, the search giant unveiled its new Native Client open source project on Monday.

Native Client, abbreviated by Google as "NaCl," is currently available for testing as research release version 0.1. The solution promises to reduce data transfers between Web servers and the browser client to better run Web applications in x86-based machines.

"With the ability to seamlessly run native code on the user's machine, you could instead perform…actual image processing on the desktop CPU, resulting in a much more responsive application by minimizing data transfer and latency," according to Brad Chen, a member of the Google Native Client team, writing on the Google Code Blog.

Chen pointed out that these tasks can be performed today using "a combination of JavaScript and server side processing." However, that approach is "painfully slow" because of the data chunks that must be transferred.

On the other hand, local CPU processing of data using Web applications poses security issues, which is the main question that Google is trying to address with the release of Native Client.

"To help protect users from malware and maintain portability, we have defined strict rules for valid modules," Chen wrote. "Our approach is built around a software containment system called the inner-sandbox [that] uses static analysis to detect security defects in untrusted x86 code."

These security measures specify a set of structural criteria for all modules. For instance, "modules may not contain certain instruction sequences," according to Chen. The goal is to help developers to create "safer and more dynamic applications that can run on any OS and any browser," Chen wrote. 

The initial release of Native Client is a hefty download that includes compilation tools and runtime. It also has a software development kit to write portable code modules that will work in Firefox, Safari, Opera and Google Chrome.

Currently, Native Client is not supported in Internet Explorer. While Microsoft's ActiveX technology allows code to run natively, a Google white paper (PDF) explains that it requires the "manual establishment of trust relationships through pop-up dialog boxes…[that] have been inadequate to prevent execution of malicious native code."

The white paper asserts that in contrast to ActiveX, "NaCl is designed to prevent such exploitation, even for flawed NaCl modules."

Some readers of the Google Code Blog have compared the Native Client technology with an Adobe solution code-named "Alchemy." The Alchemy solution lets developers run C and C++ code via the Adobe Flash platform.

Native Client will run on any Windows, Mac or Linux system with an x86 processor. Chen explained that Google is "working on supporting other CPU architectures (such as ARM and PCC) to make this technology work on the many types of devices that connect to the Web today."

The test software can be downloaded at the Google Native Client Web page here.

About the Author

Jim Barthold is a freelance writer based in Delanco, N.J. covering a variety of technology subjects.


  • Microsoft Endpoint Manager Improvements Highlighted at Ignite

    Improvements in the Microsoft Endpoint Manager (MEM) management solution were part of Tuesday's Microsoft Ignite online event.

  • Green City Illustration

    Microsoft Ignite 2020 Reaction, Part 1: A New Normal for Tech Conferences

    Something about Satya Nadella's opening keynote makes Brien wonder if Microsoft thinks we'd all be better off doing everything -- including conferences like Ignite -- remotely, even after the pandemic is over.

  • Microsoft Ignite: Azure Advances Across Five Frontiers

    To kick off the Microsoft Ignite virtual conference, CEO Satya Nadella made a bold claim about the public cloud with the second-largest market share behind Amazon.

  • Microsoft Buying Games Maker ZeniMax Media for $7.5 Billion

    Microsoft is buying ZeniMax Media, parent company of Bethesda Softworks and other game-maker affiliates, for $7.5 billion in cash.

comments powered by Disqus