Original URL: http://www.theregister.co.uk/2008/09/04/chrome_review/

Chrome: A new force for web applications?

Promise through the froth

By Tim Anderson

Posted in Software, 4th September 2008 14:17 GMT

Review Google's new web browser has provoked an orgy of comment almost rivalling that for a new trinket from Apple. There's plenty of froth, but for once the interest is justified.

This is not just a browser: it is a vehicle for delivering web applications, and it significantly changes the balance of power between those trying to build modern client platforms. It is time to abandon the term Rich Internet Applications, or RIAs, as if this were a distinct category that is not quite mainstream.

This is a battle over how most of the web and a large slice of business applications will be built in future.

In some ways the goals of Google Chrome parallel those of Adobe Systems with AIR. Both companies are bringing web applications to the desktop. Adobe's approach was to create a new runtime which wraps Flash, the WebKit HTML rendering engine, and the Sqlite database engine to allow web applications to run outside the browser.

Google also took WebKit and Sqlite (part of its Gears extension library), but its approach to desktop integration is beautiful in its simplicity. Chrome lets you create desktop shortcuts to web pages. In addition, when you open a web page from one of these shortcuts, it opens without any browser furniture.

This really is a significant feature, because a well-designed and responsive web application will be indistinguishable from any other desktop application. The name Chrome is in part a reference to it - in software development, the term describes the surrounding user interface of an application.

At the press conference announcing Chrome, Google's vice president of product management Sundar Pichai said: "We used to call it content, not Chrome - that's what we should focus on." The name Chrome is an ironic one, that means as little chrome as possible.

Saviour of the universe?

What about the Flash element? Web developers turn to Flash, or some alternative such as Microsoft's Silverlight browser plug-in, for several reasons, including rich graphical effects, video and multimedia, and a fast just-in-time compiled virtual machine. Google cannot provide all this in Chrome, yet this seems to be headed in that direction. Chrome ticks the box for a fast virtual machine, with the V8 JavaScript engine. Google VA technical lead Lars Bak described three key features of V8.

The first is a native code compiler. Although JavaScript is a dynamic language, which is more challenging for a compiler, Bak explained how V8 "monitors the program as you run it and creates common structures of objects inside the virtual machine," enabling optimisation.

Next, Bak talked about inline caching. Inlining is a way of flattening program structure to speed up function calls.

The third feature is memory management. According to Bak, V8 is designed to scale, so that Javascript web applications can grow much bigger while still performing well. As an aside, it is worth noting Mozilla's claims that its own forthcoming Javascript virtual machine, TraceMonkey, is better than V8 on some tests.

This will be part of a future Firefox release. Microsoft, on the other hand, seems to have little interest in JIT-compiled Javascript. JScript is faster in IE8, but not close to V8 or TraceMonkey. Real-world performance is about interaction with the browser's document object model (DOM) as well as pure code.

Another interesting feature in relation to Flash is the Canvas element. This was invented by Apple for Safari, which also uses WebKit, and is part of HTML 5. Canvas lets browser applications paint arbitrary graphics, just as you can in Flash or in native code applications. A note to the official specification adds that "a future version of this specification will probably define a 3d context (probably based on the OpenGL ES API)". Speculative - but clearly Canvas has the potential to reduce the need for plug-ins like Flash or Silverlight.

Firefox also supports Canvas, but what about Internet Explorer? You guessed: it is missing, though there are clever wrappers which use IE's VML graphics library to emulate Canvas.

A side-effect of Chrome is that despite its large market share Microsoft risks finding IE marginalised for the lack of features such as compiled Javascript and the Canvas element.

Google has made Chrome quick to install, with no restart needed, and we may see websites that treat it almost like a plug-in: "Install Chrome to view this site."

The other big feature for application developers is Gears, which can enable offline functionality through a local store and web server, as well as Sqlite and the desktop integration mentioned above.

Google has made much ballyhoo over security and robustness in Chrome, thanks to its process isolation for tabs and running processes with restricted permissions. There are echoes of Microsoft's protected mode for IE7, and its tab isolation in IE8.

Reading the white paper on Chrome security, it is interesting to note how security in Chrome's current implementation is closely tied to Windows features, which is probably a good thing since Windows poses unique security challenges thanks to its poor history of users running with local administrator rights.

While this is good progress, Gears security strikes me as a concern. Gears lets web applications write to the user's hard drive, though only in areas that are part of the user's profile, and isolated by site origin. The idea is that only trusted sites are allowed to use Gears.

Chrome built in Visual Studio 2005

Chromium, the open source Chrome project, ready for Visual Studio 2005

However, with popular applications like WordPress starting to use Gears as an option for enhancing performance by caching data, there is the possibility of all sorts of sites inviting the user to enable Gears. What if a hijacked site used the desktop API to install malicious desktop shortcuts, or worse? Although Gears enables new possibilities for developers, I suspect the security aspect needs more examination.

Another snag with Chrome is that currently it does not support any extension API. Google said it will do in future, though bearing in mind that one popular extension might be an ad blocker, perhaps it will not hasten in this.

Finally, one significant Chrome advantage for developers is that all the code can easily be downloaded. Configuring a machine to build some open source projects successfully can be a challenge. But Chromium is delivered as a Visual Studio 2005 solution, and its main dependency is the Windows SDK. This gives developers the ability to debug and profile code at the deepest level.

Chrome, then, is a significant new force in web application development. ®