ChromeOS should be added to your list too. When Chromebooks get VPN...will be seriously tempting for a lot of businesses.
Also: this is a dumb thought, perhaps, but was just thinking about why browser sandboxing is so important.
Obviously (on a non-Chromebook at least) people can download and run any app locally, with the download itself often occurring through a web browser.
So why is sandboxing important?
I guess the issue is that you are downloading and running a full app with each page request, and often this download/execute cycle can occur on a script tag that is never explicitly approved by the user, so the frequency and invisibility of executing foreign code is much greater.
This is doubly true if you're talking about a Chromebook, whose administration and security features rest upon the fact that someone can't install stuff locally.
Also, the model of "trust every NaCl executable before you run it" breaks down in this environment...because Google depends on the fact that people must be able to trust clicking links they've never seen before [i.e. that they just searched for].
So it's really extremely important to their bottom line that they nail any security issues with NaCl. This may be different from MS's perception of ActiveX security as a priority.
Sandboxing is important on normal desktop browsers because downloading native apps off the internet and running them is incredibly unsafe for normal users. The more that can run in the browser's sandbox, the better for users.
As for comparisons to ActiveX, they are completely different. ActiveX was not designed to place any restrictions on the downloaded code at all. In contrast NaCL is designed to completely restrict the downloaded code.
Yes, there can be implementation bugs, just as there are implementation bugs in browsers. But it's a really important difference to say that full local privileges in NaCL is a _bug_ that will be fixed. Whereas full local privileges in ActiveX is a _feature_ that will not be fixed.
Also: this is a dumb thought, perhaps, but was just thinking about why browser sandboxing is so important.
Obviously (on a non-Chromebook at least) people can download and run any app locally, with the download itself often occurring through a web browser.
So why is sandboxing important?
I guess the issue is that you are downloading and running a full app with each page request, and often this download/execute cycle can occur on a script tag that is never explicitly approved by the user, so the frequency and invisibility of executing foreign code is much greater.
This is doubly true if you're talking about a Chromebook, whose administration and security features rest upon the fact that someone can't install stuff locally.
Also, the model of "trust every NaCl executable before you run it" breaks down in this environment...because Google depends on the fact that people must be able to trust clicking links they've never seen before [i.e. that they just searched for].
So it's really extremely important to their bottom line that they nail any security issues with NaCl. This may be different from MS's perception of ActiveX security as a priority.
Just some musings.