DOCSLIB.ORG

Webassembly As a Practical Path to Library Sandboxing

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Webassembly As a Practical Path to Library Sandboxing Gobi: WebAssembly as a Practical Path to Library Sandboxing Shravan Narayan Tal Garfinkel Sorin Lerner Hovav Shacham UC San Diego Stanford University UC San Diego UT Austin Deian Stefan UC San Diego Abstract 1 Introduction Software based fault isolation (SFI) is a powerful ap- proach to reducing the impact of security vulnerabilities Software-fault isolation (SFI), introduced in 1993 [29], is in large and critical C/C++ applications like Firefox and an effective technique for reducing trust in software com- Apache. Unfortunately, practical SFI tools have not been ponents in both userland and kernels [28]. But the dom- broadly available. inant mechanism for module isolation today is process- Developing an SFI toolchain is a significant engineer- based privilege separation and sandboxing [6,23], not SFI. ing challenge. Only in recent years have browser vendors Process-based isolation carries with it IPC overhead that invested in building production quality SFI tools NaCl/P- can be substantial for tightly coupled modules. In this NaCl to sandbox mobile code. Further, without committed paper, we argue that WebAssembly, developed for accel- support, these tools are not viable, e.g.,NaCl has recently erating Web content, is a viable basis for general-purpose been discontinued, orphaning projects that relied on it. SFI that is performant and maintainable. WebAssembly (Wasm) offers a promising solution—it Unlike process-based isolation, SFI does not enjoy can support high performance sandboxing—and has been instruction-set support on widely deployed processors. embraced by all major browser vendors—thus seems to Accordingly, SFI vendors need to develop and maintain have a viable future. However, Wasm presently only offers their own compiler backend (to rewrite modules to re- a solution for sandboxing mobile code. Providing SFI for strict memory accesses), their own linker and loader (to native application, such as C/C++ plugins or libraries install modules in the host address space), and their own requires additional steps. base library and ABI (to facilitate interaction between To reconcile the different worlds of Wasm on the the module and the outside world). This is a large un- browser and native platforms, we present Gobi. Gobi is a dertaking. Google’s Native Client (NaCl) SFI effort was system of compiler changes and runtime support that can largely rewritten in the port from 32-bit x86 [30] to 64- sandbox normal C/C++ libraries with Wasm—allowing bit x86 [26], and the most recent version of LLVM for them to be compiled and linked into native applications. which Google has supplied NaCl backend patches is 3.7.0, Gobi has been tested on libjpeg, libpng, and zlib. released in late 2015. Based on our experience developing Gobi we offer a WebAssembly (Wasm) [14] has supplanted NaCl for detailed analysis of how SFI developers can address the high-performance Web content sandboxing in browsers. difficult challenge of maintaining an SFI toolchain long It is a viable basis for general purpose SFI. Wasm al- term. We conclude with a call to arms to the Wasm com- ready provides the core SFI guarantee: isolated mod- munity and SFI research community to make Wasm based ules can access memory only within a single region. Un- module sandboxing a first class use case and describe how like NaCl, Wasm was designed for hosting isolated mod- this can significantly benefit both communities. ules in-process, rather than in a dedicated NaCl process. Addendum: This short paper was originally written in And Wasm’s popularity—it is implemented in all major January of 2019. Since then, the implementation and de- browsers [18]—means that it is supported by a robust and sign of Gobi evolved substantially and some of the issues growing toolchain ecosystem. raised in this paper have since been addressed by the We have built a prototype Wasm SFI system, called Wasm community. Some challenges still remain. We thus Gobi. Our experience highlights several shortcomings of left the paper largely intact and only provide a brief up- the current Wasm ecosystem for applications beyond Web date on the state of WebAssembly tooling as of November content acceleration. Some shortcomings are already be- 2019 in the last section. ing addressed by the community. For example, browsers 1 use their existing JIT infrastructure to compile Wasm Emscripten specific “embedding” runtime. This runtime bytecode to machine code. For host processes that don’t is providing support for C primitives and platform ABIs already include a JIT, a standalone machine code gen- such as stack and heap separation in the address space, erator is needed—and is currently being developed as primitives for setjmp and longjmp, threading primitives, Cranelift [8]. Others are not currently being addressed. floating point primitives and clock/time primitives. Em- For example, the C/C++ ABI implemented by Wasm com- scripten provides this runtime for Wasm as used on the pilers and browser hosts has not been standardized or even web, it does not provide this runtime for non-web embed- fully documented. We sound a call-to-action to the Wasm dings. We bridge this gap in Gobi. community to address these shortcomings. Syscalls. The libjpeg Wasm module needs to invoke Gobi is intentionally designed to minimize changes syscalls (e.g., for I/O or logging). However, Wasm only to the Wasm compiler, even at the cost of some perfor- supports a small number of memory related syscalls in mance. We are working to upstream our changes to the the Wasm runtime. Other syscalls are either unsupported Emscripten compiler. We describe the design decisions or unofficially supported in the Emscripten embedding we made to maximize the maintainability of Gobi within runtime. Gobi thus provide support for several syscalls, the Wasm ecosystem. ensuring compatibility while retaining memory isolation. Preliminary compatibility and performance evaluation Module sandboxing APIs. To safely use the sandboxed of Gobi supports the feasibility of Wasm as a base for libjpeg module the Gobi runtime also provides several general-purpose SFI. To date, Wasm performance has APIs to application code: been compared against JavaScript performance, not native code. Perhaps as a result, the bounds-checking techniques I Function Calls. The application calls into libjpeg to employed by current Wasm runtimes are well behind the parse the JPEG image. However, the application and SFI state of the art. We thus sound a call-to-action to the libjpeg Wasm module have ABI differences. We SFI researchers to adopt Wasm bytecode as an SFI in- provide an API that accounts for ABI differences (e.g., termediate representation and to bring high-performance function name mangling, struct parameters, etc.). sandboxing to Wasm. I Memory Allocation. The application and libjpeg must share data such as the parameters of function calls. To 2 Prototype allow controlled sharing, we provide an API that allo- cates memory in Wasm module memory. This memory Our positions in this paper stem from our experience build- is accessible to both the library and the application. ing Gobi. Therefore we briefly discuss the various require- I Pointer Swizzling. Pointers in the Wasm libjpeg mod- ments addressed by Gobi to leverage Wasm for module ule are to be represented in the format specified in sandboxing. Wasm standard—indexes into the Wasm memory. We By itself, Wasm provides an essential building block— thus provide APIs to convert or “swizzle” pointers to memory isolation, i.e. a module can only access its own the Wasm representation and its reverse. memory. However, we must safely use this memory iso- Callback Registration. The application may need the lated module in the application. In this section, we use I Wasm libjpeg module to invoke some application func- an example of an image decoder application that wishes tions. For example, libjpeg needs to invoke an error to use libjpeg (a JPEG decoding library) in a sandboxed handler application if it encounters a parsing error. We manner. To setup, we compile an unmodified libjpeg with thus provide an API to register callbacks. our custom Emscripten compiler to produce a Wasm mod- ule, which is in turn compiled with a Wasm compiler, such I Threading. To safely support multiple application as Cranelift, to produce an ELF library that is used with threads calling into libjpeg simultaneously, we must the Gobi runtime. create a new Wasm stack for each calling thread. We thus provide an API to create a new stack in the Wasm Runtime. To run Wasm modules like libjpeg, we should module which is called for each application thread. only require a simple standardized Wasm runtime for which multiple open source implementations exist [3, 16, Compiler modifications. For the application and Wasm 25]. This runtime provides basic functions for Wasm mod- libjpeg module to be compatible, they must have compati- ule setup—providing APIs to extend or free memory for ble machine models—identical sizes and alignments for the Wasm module, mechanisms to correctly handle traps, datatypes such as an int, long and the size of a pointer. implementation of data structures for indirect function In practice these are not the same: the application uses the call support (the Wasm specification requires all indirect default machine model of the target platform, however, the calls to go through the runtime to ensure memory safety). Wasm libjpeg module uses the machine model dictated In practice, the libjpeg Wasm module also requires the by the Wasm standard and toolchain. We resolve these 2 differences by modifying the machine model used by Em- and cannot be used for multi-threaded programs. We pro- scripten when compiling Wasm modules, taking care to pose an alternative approach that that minimizes compiler minimize the amount of changed cod (see Section 3.1). changes without giving up on performance.
Load more

Recommended publications
  • Effects and Opportunities of Native Code Extensions For
    Effects and Opportunities of Native Code Extensions for Computationally Demanding Web Applications DISSERTATION zur Erlangung des akademischen Grades Dr. Phil. im Fach Bibliotheks- und Informationswissenschaft eingereicht an der Philosophischen Fakultät I Humboldt-Universität zu Berlin von Dipl. Inform. Dennis Jarosch Präsident der Humboldt-Universität zu Berlin: Prof. Dr. Jan-Hendrik Olbertz Dekan der Philosophischen Fakultät I: Prof. Michael Seadle, Ph.D. Gutachter: 1. Prof. Dr. Robert Funk 2. Prof. Michael Seadle, Ph.D. eingereicht am: 28.10.2011 Tag der mündlichen Prüfung: 16.12.2011 Abstract The World Wide Web is amidst a transition from interactive websites to web applications. An increasing number of users perform their daily computing tasks entirely within the web browser — turning the Web into an important platform for application development. The Web as a platform, however, lacks the computational performance of native applications. This problem has motivated the inception of Microsoft Xax and Google Native Client (NaCl), two independent projects that fa- cilitate the development of native web applications. Native web applications allow the extension of conventional web applications with compiled native code, while maintaining operating system portability. This dissertation determines the bene- fits and drawbacks of native web applications. It also addresses the question how the performance of JavaScript web applications compares to that of native appli- cations and native web applications. Four application benchmarks are introduced that focus on different performance aspects: number crunching (serial and parallel), 3D graphics performance, and data processing. A performance analysis is under- taken in order to determine and compare the performance characteristics of native C applications, JavaScript web applications, and NaCl native web applications.
    [Show full text]
  • Lock-In-Pop: Securing Privileged Operating System Kernels By
    Lock-in-Pop: Securing Privileged Operating System Kernels by Keeping on the Beaten Path Yiwen Li, Brendan Dolan-Gavitt, Sam Weber, and Justin Cappos, New York University https://www.usenix.org/conference/atc17/technical-sessions/presentation/li-yiwen This paper is included in the Proceedings of the 2017 USENIX Annual Technical Conference (USENIX ATC ’17). July 12–14, 2017 • Santa Clara, CA, USA ISBN 978-1-931971-38-6 Open access to the Proceedings of the 2017 USENIX Annual Technical Conference is sponsored by USENIX. Lock-in-Pop: Securing Privileged Operating System Kernels by Keeping on the Beaten Path Yiwen Li Brendan Dolan-Gavitt Sam Weber Justin Cappos New York University Abstract code needed to run such a system increases the odds that Virtual machines (VMs) that try to isolate untrusted flaws will be present, and, in turn, that tens of millions code are widely used in practice. However, it is often of user machines could be at risk [25]. Furthermore, iso- possible to trigger zero-day flaws in the host Operating lation will not work if a malicious program can access System (OS) from inside of such virtualized systems. In even a small portion of the host OS’s kernel that contains this paper, we propose a new security metric showing a zero-day flaw [12]. Both of these drawbacks reveal the strong correlation between “popular paths” and kernel key underlying weakness in designing OSVM systems – vulnerabilities. We verify that the OS kernel paths ac- a lack of information as to which parts of the host kernel cessed by popular applications in everyday use contain can be safely exported to user programs.
    [Show full text]
  • Open Benchmark Alignment
    Benchmark Selection Guide, Vol. 1 Doing it Right Art Morgan Performance Engineer, Intel Corporation Spring 2015 Legal Disclaimers Software and workloads used in performance tests may have been optimized for performance only on Intel microprocessors. Performance tests, such as SYSmark* and MobileMark*, are measured using specific computer systems, components, software, operations and functions. Any change to any of those factors may cause the results to vary. You should consult other information and performance tests to assist you in fully evaluating your contemplated purchases, including the performance of that product when combined with other products. For more information go to http://www.intel.com/performance. Intel is a sponsor and member of the BenchmarkXPRT* Development Community, and was the major developer of the XPRT* family of benchmarks. Principled Technologies* is the publisher of the XPRT family of benchmarks. You should consult other information and performance tests to assist you in fully evaluating your contemplated purchases. © 2015 Intel Corporation. Intel, Intel Inside and other logos are trademarks or registered trademarks of Intel Corporation, or its subsidiaries in the United States and other countries. * Other names and brands may be claimed as the property of others. 2 About this Guide This guide uses benchmark comparison tables to help you select the right set of tools for Windows*, Android* and Chrome* platform evaluations. Benchmarks covered in this guide: . General Guidance on Platform Evaluations 3DMark* 1.2.0 ANDEBench* PRO AnTuTu* v5.6.1 . Benchmark Selection for Windows BaseMark* CL BatteryXPRT* 2014 CompuBench* CL 1.5 for OpenCL* . Benchmark Selection for Android CompuBench* RS 2.0 for RenderScript* CrXPRT* 2015 Geekbench* 3.3.1 .
    [Show full text]
  • Nacldroid: Native Code Isolation for Android Applications
    NaClDroid: Native Code Isolation for Android Applications Elias Athanasopoulos1, Vasileios P. Kemerlis2, Georgios Portokalidis3, and Angelos D. Keromytis4 1 Vrije Universiteit Amsterdam, The Netherlands [email protected] 2 Brown University, Providence, RI, USA [email protected] 3 Stevens Institute of Technology, Hoboken, NJ, USA [email protected] 4 Columbia University, New York, NY, USA [email protected] Abstract. Android apps frequently incorporate third-party libraries that contain native code; this not only facilitates rapid application develop- ment and distribution, but also provides new ways to generate revenue. As a matter of fact, one in two apps in Google Play are linked with a library providing ad network services. However, linking applications with third-party code can have severe security implications: malicious libraries written in native code can exfiltrate sensitive information from a running app, or completely modify the execution runtime, since all native code is mapped inside the same address space with the execution environment, namely the Dalvik/ART VM. We propose NaClDroid, a framework that addresses these problems, while still allowing apps to include third-party code. NaClDroid prevents malicious native-code libraries from hijacking Android applications using Software Fault Isolation. More specifically, we place all native code in a Native Client sandbox that prevents uncon- strained reads, or writes, inside the process address space. NaClDroid has little overhead; for native code running inside the NaCl sandbox the slowdown is less than 10% on average. Keywords: SFI, NaCl, Android 1 Introduction Android is undoubtedly the most rapidly growing platform for mobile devices, with estimates predicting one billion Android-based smartphones shipping in 2017 [12].
    [Show full text]
  • 2018 Webist Lnbip (20)
    Client-Side Cornucopia: Comparing the Built-In Application Architecture Models in the Web Browser Antero Taivalsaari1, Tommi Mikkonen2, Cesare Pautasso3, and Kari Syst¨a4, 1Nokia Bell Labs, Tampere, Finland 2University of Helsinki, Helsinki, Finland 3University of Lugano, Lugano, Swizerland 4Tampere University, Tampere, Finland [email protected], [email protected], [email protected], [email protected] Abstract. The programming capabilities of the Web can be viewed as an afterthought, designed originally by non-programmers for relatively simple scripting tasks. This has resulted in cornucopia of partially over- lapping options for building applications. Depending on one's viewpoint, a generic standards-compatible web browser supports three, four or five built-in application rendering and programming models. In this paper, we give an overview and comparison of these built-in client-side web ap- plication architectures in light of the established software engineering principles. We also reflect on our earlier work in this area, and provide an expanded discussion of the current situation. In conclusion, while the dominance of the base HTML/CSS/JS technologies cannot be ignored, we expect Web Components and WebGL to gain more popularity as the world moves towards increasingly complex web applications, including systems supporting virtual and augmented reality. Keywords|Web programming, single page web applications, web com- ponents, web application architectures, rendering engines, web rendering, web browser 1 Introduction The World Wide Web has become such an integral part of our lives that it is often forgotten that the Web has existed only about thirty years. The original design sketches related to the World Wide Web date back to the late 1980s.
    [Show full text]
  • Sound Loop Superoptimization for Google Native Client
    Sound Loop Superoptimization for Google Native Client Berkeley Churchill Rahul Sharma ∗ JF Bastien Stanford University Microsoft Research India Stanford University [email protected] [email protected] [email protected] Alex Aiken Stanford University [email protected] Abstract rules. Specifically, the rules restrict the addresses of memory Software fault isolation (SFI) is an important technique for accesses and indirect jump targets at runtime. the construction of secure operating systems, web browsers, However, performance is a “significant handicap” for and other extensible software. We demonstrate that super- SFI [38]. Currently, there is a performance penalty that all optimization can dramatically improve the performance of users of NaCl and other SFI implementations pay for the se- Google Native Client, a SFI system that ships inside the curity guarantees. Building an optimizing compiler for SFI Google Chrome Browser. Key to our results are new tech- systems is difficult because of a pronounced phase ordering niques for superoptimization of loops: we propose a new ar- problem: Either a compiler can generate well-formed SFI chitecture for superoptimization tools that incorporates both code and then optimize it for performance, or it can generate a fully sound verification technique to ensure correctness and optimized code and adjust it to obey the SFI rules. Both of a bounded verification technique to guide the search to op- these approaches lead to sub-optimal performance. More- timized code. In our evaluation we optimize 13 libc string over, without verification, the optimizations have no formal functions, formally verify the correctness of the optimiza- guarantees of correctness [26, 30]. tions and report a median and average speedup of 25% over In contrast, search-based program optimization tech- the libraries shipped by Google.
    [Show full text]
  • Mitigating Javascript's Overhead with Webassembly
    Samuli Ylenius Mitigating JavaScript’s overhead with WebAssembly Faculty of Information Technology and Communication Sciences M. Sc. thesis March 2020 ABSTRACT Samuli Ylenius: Mitigating JavaScript’s overhead with WebAssembly M. Sc. thesis Tampere University Master’s Degree Programme in Software Development March 2020 The web and web development have evolved considerably during its short history. As a result, complex applications aren’t limited to desktop applications anymore, but many of them have found themselves in the web. While JavaScript can meet the requirements of most web applications, its performance has been deemed to be inconsistent in applications that require top performance. There have been multiple attempts to bring native speed to the web, and the most recent promising one has been the open standard, WebAssembly. In this thesis, the target was to examine WebAssembly, its design, features, background, relationship with JavaScript, and evaluate the current status of Web- Assembly, and its future. Furthermore, to evaluate the overhead differences between JavaScript and WebAssembly, a Game of Life sample application was implemented in three splits, fully in JavaScript, mix of JavaScript and WebAssembly, and fully in WebAssembly. This allowed to not only compare the performance differences between JavaScript and WebAssembly but also evaluate the performance differences between different implementation splits. Based on the results, WebAssembly came ahead of JavaScript especially in terms of pure execution times, although, similar benefits were gained from asm.js, a predecessor to WebAssembly. However, WebAssembly outperformed asm.js in size and load times. In addition, there was minimal additional benefit from doing a WebAssembly-only implementation, as just porting bottleneck functions from JavaScript to WebAssembly had similar performance benefits.
    [Show full text]
  • Visualization of Prague Castle
    Master’s Thesis Czech Technical University in Prague Faculty of Electrical Engineering F3 Department of Computer Graphics and Interaction Visualization of Prague Castle Bc. Antonín Smrček Study Programme: Open Informatics Field of Study: Computer Graphics and Interaction January 2016 Supervisor: prof. Ing. Jiří Žára, CSc. Acknowledgement / Declaration I would like to thank prof. Ing. Jiří I hereby declare that I have completed Žára, CSc., for supervision of my the- this thesis independently and that I have sis. He provided me with invaluable in- listed all the literature and publications sights, feedback on work in progress and used. his guidance was especially important I have no objection to usage of this in finishing stages of the project. My work in compliance with the act §60 thanks are also due to all friends who Zákon č. 121/2000Sb. (copyright law), helped me with the user testing. Finally, and with the rights connected with the I want to particularly thank my mother copyright act including the changes in for her support throughout my studies. the act. In Prague on January 11, 2016 ........................................ v Abstrakt / Abstract Tato diplomová práce se zabývá vý- This thesis describes a development vojem webové aplikace která vizualizuje of the web-based 3D virtual walk ap- prostředí Pražského hradu a umožňuje plication which visualizes the Prague 3D virtuální procházku v rámci jeho Castle and provides the users with an prostor. Důraz je kladen na grafic- information about interesting objects kou kvalitu a výkon aplikace. Obdobné in the area, with focus on graphical systémy pro vizualizaci měst jsou podro- quality and performance of the ap- beny analýze a jsou diskutovány možné plication.
    [Show full text]
  • CIS 4360 Secure Computer Systems Sandboxing: Google Native Client
    CIS 4360 Secure Computer Systems Sandboxing: Google Native Client Professor Qiang Zeng Spring 2017 Some slides are stolen from Intel docs Previous Class • SGX ensures confidentiality and integrity of data and code in an enclave • Only the Intel processors and the enclave need be trusted • Secrets are provisioned (through e.g. SSL) to enclaves only after they have been attested CIS 4360 – Secure Computer Systems 2 When you want to run trusted code to process security-sensi8ve data, what can you rely on? Intel SGX CIS 4360 – Secure Computer Systems 3 When you want to run untrusted code, what should you use? Sandboxing is a good op8on Google’s Nave Client is an example of Sandboxing technique CIS 4360 – Secure Computer Systems 4 What is Native Client? • Native Client is a sandboxing technique for running compiled C and C++ code in the browser efficiently and securely, independent of the user’s operating system CIS 4360 – Secure Computer Systems 5 • CIS 4360 – Secure Computer Systems 6 We already have JavaScript, which is safe and portable; why do we s8ll want Nave Client? Performance (code is executed navely rather than interpreted) Numerous legacy C/C++ code can be migrated to Web CIS 4360 – Secure Computer Systems 7 • CIS 4360 – Secure Computer Systems 8 CIS 4360 – Secure Computer Systems 9 Wait! Downloading nave code from Internet and running it in my browser? Are you insane? Your concern is valid. That is exactly why we need a sandbox for running nave code in the browser CIS 4360 – Secure Computer Systems 10 Benefits of Native Client •
    [Show full text]
  • Sandboxing Native Client Presented by : Hamza Omar
    SANDBOXING NATIVE CLIENT PRESENTED BY : HAMZA OMAR 1 OUTLINE 1. What is a Sandbox ? 2. Google Native Client 3. Demo for Native Client 4. Symbolic Execution 5. Demo for Symbolic Execution 2 WHAT IS A SANDBOX? In computer security, a sandbox is a security mechanism for separating running programs. It is often used to execute untested code, or untrusted programs from unverified third parties, suppliers, untrusted users and untrusted websites. A sandbox typically provides a tightly controlled set of resources for guest programs to run in, such as scratch space on disk and memory Sandboxing is frequently used to test unverified programs that may contain a virus or other malicious code, without allowing the software to harm the host device. 3 NATIVE CLIENT Google Native Client (NaCl) is a sandboxing technology for running a subset of Intel x86/x86- 64, ARM or MIPS native code in a sandbox. It allows safely running native code from a web browser, independent of the user operating system, allowing web-based applications to run at near-native speeds. Real world system deployed by GOOGLE in their CHROME browser. It uses arbitrary native code with the help of isolation, sandboxing technique also called software fault isolation. Software Fault Isolation does not rely on the operating system to sandbox instead it looks at the binaries through a different approach to check whether it is safe to use the code or not. 4 WHY NATIVE CODE ? Web browsers already support JavaScript, flash or many others of kind. Why do we need native code then ? PERFORMANCE - The native code is unsafe from some perspectives but is really fast.
    [Show full text]
  • Webgl Based 3D Game Engine
    WebGL based 3D Game Engine Master thesis Morten Nobel-Jørgensen [email protected] Supervisors Mark Jason Nelson / Daniel Povlsen ITU – Games Marts 2012 WebGL based 3D Game Engine 1 Abstract With the introduction of WebGL Web browsers became capable of using hardware accelerated 3D graphics, which opened up the possibility of creating a wide range of applications including 3D games. In this thesis I will investigate how a 3D game engine can be implemented in a browser using WebGL and JavaScript. First I will take a look at the characteristics of JavaScript and JavaScript engines, by investigating some techniques and software patterns for writing high performance JavaScript, and then examine some of the challenges there are when comes to creating 3D games. To get hands-on experience I have implemented KickJS – a WebGL based 3D game engine. KickJS is a shader-based engine with a range of built-in shaders. Using the KickJS engine I have also created a shader editor, a scene editor and several small 3D demos. Finally I have benchmarked the raw performance of JavaScript and WebGL. I have approached this problem from two sides: First comparing JavaScript performance with C++ performance and then seeing how the rendering performance of KickJS compares with the Unity game engine. In general I found that the JavaScript CPU performance is around 2-4 times slower than C++ based applications. Since much of the calculations are pushed to the GPU, this may not be an issue for small and medium sized games. The availability of WebGL makes the WebGL browsers a very attractive platform.
    [Show full text]
  • Native Client: a Sandbox Technology
    IJETST - Vol.||03||Issue||03||Pages 3709-3714||March||ISSN 2348-9480 2016 International Journal of Emerging Trends in Science and Technology Impact Factor: 2.838 DOI: http://dx.doi.org/10.18535/ijetst/v3i03.13 Native Client: A Sandbox Technology Authors Geetika Kapil, Lata Bagle, Gohila Khatun, Mrs Ruchi Tawani Abstract Native Client is a sandbox technology, which run C and C++ compiled code in the browser in an efficient and secure manner. To make this technology go independent of any architecture, portable native client let developers to compile their code with Ahead Of time (AOT) translation. It brings the native code to the web without the loss of the security and portability of the web. INTRODUCTION Why use Native Client? Native Client is an open source technology that It helps to run the compiled code in the browser at expands web programming beyond Java Script, near native speeds. It helps to harness the client’s enabling us to enhance application without the loss computational resources for 3D, CAD modeling, of security .The developers can work in their client-side data analytics. preferred language. This paper digs in the It gives the compiled code the same level of advantages of this technology, common use cases, portability and safety as the JavaScript. how to use it for porting Perl modules etc. The Google has implemented the open source Native Benefits of Native Client Client project in the chrome Browser for Mac, Below are the advantages of the native client Windows and Linux. 1. Graphics, audio:-We can easily play 2D and 3D games.
    [Show full text]