Native client is a horribly bad idea on so many levels. Wiz-bang demos aren't enough to distract from the danger.
Now trojans have one huge, lovely target. Just change browser settings and boom, easy attack. This in combination with hiding everything from users (status bar, url bar, etc.) is super dangerous. It's activex all over again.
Do it in webgl or otherwise, leave native code execution outside the browser.
Whenever I visit a WebGL demo inside Linux w/ NVidia drivers, if there are any complicated shaders, my system hard-freezes, forcing me to reboot.
Until the X developers fix Xorg's security model (like that will happen), and until NVidia fixes their Linux drivers (like that will happen), WebGL will always be one massive gaping security and stability problem for me as a Linux user.
Because we know, those days, to sandbox raw x86 code, and not let them access the system and the drivers... However, running shaders directly on the GPU exposes directly graphic drivers, that are not conceived to block unfriendly code.
Now trojans have one huge, lovely target. Just change browser settings and boom, easy attack. This in combination with hiding everything from users (status bar, url bar, etc.) is super dangerous. It's activex all over again.
Do it in webgl or otherwise, leave native code execution outside the browser.