NaCl intentionally has the same sandbox, same security model, and same I/O capabilities as JS. In this case, NaCl would still be limited to XHR or WebSocket.

Ah, I didn't know that. How does naclssh do it, then? It seemed like it was going far more low-level than the standard sandboxed security.

From the snippet you posted above, it looks like it depends on a "websocket-to-socket proxy".

Aha, okay. Misunderstanding on my part, then!

This would undoubtedly be a bad idea. There is a reason it doesn't already exist.

I'm not saying open it up to just anything, but if this is for ChromeOS, they could certainly grant access to manually-installed extensions (not extension gallery extensions) and/or to OS components.

"Install this app* to get 10 free cows in FarmVille!"

* Note: App may include port scanner. Do not look directly into the operational end of the port scanner.

but a proxy can