8 ms·

This sounds great, but it's going to make it so, so much easier to spy on people and hide all kinds of nastiness in web applications. Worse is that tons of web

This sounds great, but it's going to make it so, so much easier to spy on people and hide all kinds of nastiness in web applications. Worse is that tons of web applications that get exploited won't be understood by the people who run them. Wordpress is a total minefield right now and it gets hacked all the time. What'll happen once they have a module that compiles up web assembly output for all the other modules running to speed things up? EDIT: wordpress the thing you install yourself, not wordpress the hosted app

moron4hire 11y ago
How is this at all different than now?
- msandford 11y ago
  Right now most javascript is readable-ish and if you see something totally unreadable, that's a good indication it's probably malware. Once you have machine code that's not terribly human readable it gets a lot easier to hide things.
  - moron4hire 11y ago
    I take it you don't know what a minifier is or how it can save upwards of 50% of your payload size.
    - Semiapies 11y ago
      There's no real size difference if you gzip it at the webserver.
      - moron4hire 11y ago
        That is incorrect. Theoretically, it should be true, but in practice it is not. You get the most savings by minifying and gzipping.
        Semiapies 11y ago
        In practice, the difference has been negligible, and I've seen it be entirely absent. Chasing small fractions of a percent of total CSS file size is a waste of time and effort.
    - msandford 11y ago
      I absolutely do, but thanks for being condescending nonetheless. Read C source. Then go read the machine code that C compiles into. I assure you that the C is far, far more readable even if you've HEAVILY obfuscated it. In order to better understand this, I present you with a StackOverflow answer: http://stackoverflow.com/a/331474 http://stackoverflow.com/a/331474 This: int get_int(int c); int main(void) { int a = 1, b = 2; return getCode(a) + b; } Might yield this: 00000000 <main>: int get_int(int c); int main(void) { /* here, the prologue creates the frame for main / 0: 8d 4c 24 04 lea 0x4(%esp),%ecx 4: 83 e4 f0 and $0xfffffff0,%esp 7: ff 71 fc pushl -0x4(%ecx) a: 55 push %ebp b: 89 e5 mov %esp,%ebp d: 51 push %ecx e: 83 ec 14 sub $0x14,%esp int a = 1, b = 2; /* setting up space for locals */ 11: c7 45 f4 01 00 00 00 movl $0x1,-0xc(%ebp) 18: c7 45 f8 02 00 00 00 movl $0x2,-0x8(%ebp) return getCode(a) + b; 1f: 8b 45 f4 mov -0xc(%ebp),%eax 22: 89 04 24 mov %eax,(%esp) 25: e8 fc ff ff ff call 26 <main+0x26> 2a: 03 45 f8 add -0x8(%ebp),%eax } / the epilogue runs, returning to the previous frame */ 2d: 83 c4 14 add $0x14,%esp 30: 59 pop %ecx 31: 5d pop %ebp 32: 8d 61 fc lea -0x4(%ecx),%esp 35: c3 ret I don't know why people find this notion that web assembly probably will make it easier to hide nefarious payloads so offensive. It's demonstrably true! People find out about open source projects "calling home" much, much faster than they do closed source projects. Go look at the spec. It's at a much lower level of abstraction than JavaScript is. https://github.com/WebAssembly/design/blob/master/AstSemantics.md https://github.com/WebAssembly/design/blob/master/AstSemanti...
  - untog 11y ago
    if you see something totally unreadable, that's a good indication it's probably malware. That's definitely not true. Minified JS is everywhere.
  - wtetzner 11y ago
    This is already true for plenty of "compile-to-javascript" languages. The textual format of wasm should be as easy to read as the output of those languages, if not easier.
robmcm 11y ago
By this logic, you could argue that because the code is compiled it will be hard to understand and find exploits. I don't think this is going to be an issue, or be any different than where we are now.
robmcm 11y ago
By this logic, you could argue that because the code is compiled it will be hard to understand and find exploits. I don't think this is going to be an issue, or be any different than where we are now.
spyder 11y ago
First: WebAssemly will have a readable text format for view-source functionality: https://github.com/WebAssembly/design/blob/master/TextFormat.md https://github.com/WebAssembly/design/blob/master/TextFormat... Second: "...so much easier to spy on people and hide all kinds of nastiness in web applications." What kind of spying and nastiness? WebAssembly will not have more access to your data than the JavaScript API. It will have access to the same API as JavaScript. For example if it wants your location it will call the same HTML5 location API and with the same restrictions, with the permission popup. Or setting cookies will also call the same API. And thanks to the built-in developer tools in browsers you can check the outgoing requests to see what is sent and to where.
- msandford 11y ago
  Readable text format at a much lower level of abstraction than javascript currently is at right now. Different is different. It's not so much about spying on your computer and gaining extra access, it's obvious (short of implementation bugs) that you won't gain any additional privileges that way. But what you will gain is a way to obfuscate extremely well "report such and such to some webserver" in a way that's difficult to detect. For example, you can hide the entropy inside of a fairly innocent looking URL and without a lot of digging you won't know what that entropy represents. It can look like just a plain jane resource request and the webserver can serve up the exact same resource no matter what the entropy is, but also record that entropy for a back-channel way of exfiltrating information from your browser. Finally, it opens up a whole new world of compiler attack. Right now the attacks against wordpress involve writing some information into a file and making it look "weird but I don't know what it does so I'd better not touch it". What happens when breaking into a wordpress install means that you can execute the equivalent of the untraceable compiler login exploit insertion attack? You can't perform this attack without 1) a compiler and 2) a low level target that's hard to understand. You don't even need to perform a stage 3 attack which is the most sophisticated, a stage 2 would do fine. https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...

moron4hire 11y ago

How is this at all different than now?

msandford 11y ago
Right now most javascript is readable-ish and if you see something totally unreadable, that's a good indication it's probably malware. Once you have machine code that's not terribly human readable it gets a lot easier to hide things.
- moron4hire 11y ago
  I take it you don't know what a minifier is or how it can save upwards of 50% of your payload size.
  - Semiapies 11y ago
    There's no real size difference if you gzip it at the webserver.
    - moron4hire 11y ago
      That is incorrect. Theoretically, it should be true, but in practice it is not. You get the most savings by minifying and gzipping.
      - Semiapies 11y ago
        In practice, the difference has been negligible, and I've seen it be entirely absent. Chasing small fractions of a percent of total CSS file size is a waste of time and effort.
  - msandford 11y ago
    I absolutely do, but thanks for being condescending nonetheless. Read C source. Then go read the machine code that C compiles into. I assure you that the C is far, far more readable even if you've HEAVILY obfuscated it. In order to better understand this, I present you with a StackOverflow answer: http://stackoverflow.com/a/331474 http://stackoverflow.com/a/331474 This: int get_int(int c); int main(void) { int a = 1, b = 2; return getCode(a) + b; } Might yield this: 00000000 <main>: int get_int(int c); int main(void) { /* here, the prologue creates the frame for main / 0: 8d 4c 24 04 lea 0x4(%esp),%ecx 4: 83 e4 f0 and $0xfffffff0,%esp 7: ff 71 fc pushl -0x4(%ecx) a: 55 push %ebp b: 89 e5 mov %esp,%ebp d: 51 push %ecx e: 83 ec 14 sub $0x14,%esp int a = 1, b = 2; /* setting up space for locals */ 11: c7 45 f4 01 00 00 00 movl $0x1,-0xc(%ebp) 18: c7 45 f8 02 00 00 00 movl $0x2,-0x8(%ebp) return getCode(a) + b; 1f: 8b 45 f4 mov -0xc(%ebp),%eax 22: 89 04 24 mov %eax,(%esp) 25: e8 fc ff ff ff call 26 <main+0x26> 2a: 03 45 f8 add -0x8(%ebp),%eax } / the epilogue runs, returning to the previous frame */ 2d: 83 c4 14 add $0x14,%esp 30: 59 pop %ecx 31: 5d pop %ebp 32: 8d 61 fc lea -0x4(%ecx),%esp 35: c3 ret I don't know why people find this notion that web assembly probably will make it easier to hide nefarious payloads so offensive. It's demonstrably true! People find out about open source projects "calling home" much, much faster than they do closed source projects. Go look at the spec. It's at a much lower level of abstraction than JavaScript is. https://github.com/WebAssembly/design/blob/master/AstSemantics.md https://github.com/WebAssembly/design/blob/master/AstSemanti...
- untog 11y ago
  if you see something totally unreadable, that's a good indication it's probably malware. That's definitely not true. Minified JS is everywhere.
- wtetzner 11y ago
  This is already true for plenty of "compile-to-javascript" languages. The textual format of wasm should be as easy to read as the output of those languages, if not easier.

robmcm 11y ago

By this logic, you could argue that because the code is compiled it will be hard to understand and find exploits. I don't think this is going to be an issue, or be any different than where we are now.

robmcm 11y ago

spyder 11y ago

First: WebAssemly will have a readable text format for view-source functionality: https://github.com/WebAssembly/design/blob/master/TextFormat.md https://github.com/WebAssembly/design/blob/master/TextFormat... Second: "...so much easier to spy on people and hide all kinds of nastiness in web applications." What kind of spying and nastiness? WebAssembly will not have more access to your data than the JavaScript API. It will have access to the same API as JavaScript. For example if it wants your location it will call the same HTML5 location API and with the same restrictions, with the permission popup. Or setting cookies will also call the same API. And thanks to the built-in developer tools in browsers you can check the outgoing requests to see what is sent and to where.

msandford 11y ago
Readable text format at a much lower level of abstraction than javascript currently is at right now. Different is different. It's not so much about spying on your computer and gaining extra access, it's obvious (short of implementation bugs) that you won't gain any additional privileges that way. But what you will gain is a way to obfuscate extremely well "report such and such to some webserver" in a way that's difficult to detect. For example, you can hide the entropy inside of a fairly innocent looking URL and without a lot of digging you won't know what that entropy represents. It can look like just a plain jane resource request and the webserver can serve up the exact same resource no matter what the entropy is, but also record that entropy for a back-channel way of exfiltrating information from your browser. Finally, it opens up a whole new world of compiler attack. Right now the attacks against wordpress involve writing some information into a file and making it look "weird but I don't know what it does so I'd better not touch it". What happens when breaking into a wordpress install means that you can execute the equivalent of the untraceable compiler login exploit insertion attack? You can't perform this attack without 1) a compiler and 2) a low level target that's hard to understand. You don't even need to perform a stage 3 attack which is the most sophisticated, a stage 2 would do fine. https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...