Unfortunately, NaCl seems to have all the same protocol and same-origin restrictions as JS, so you can't even open a frickin' socket.

You can, however, open a WebSocket. You won't be able to connect directly to an SSH server listening with TCP, but you can connect to a server speaking SSH over the WebSocket Protocol. Of course, you can do that today with JavaScript. Ten year old network protocols do not require native code for performance.

Didn't Google pay for a student to the naclssh port as part of the code of summer project?

Something tells me such limitations will be temporary...

"This allowed us to remove the expiration date and localhost security restrictions we had adopted in previous research-focused releases.

We are excited to see Native Client progressively evolve into a developer-ready technology. In the coming months we will be adding APIs for 3D graphics, local file storage, WebSockets, peer-to-peer networking, and more."

AFAIK the security limits are intentional and when they add new NaCl APIs they will have the same restrictions as the equivalent JS version of the API. NaClets that run within an "app" instead of a "page" may be able to bypass some restrictions, though.

Well you can open a WebSocket.

Same-origin prevents your corporate intranet from getting scraped because a user visited a malicious website.