3 ms·
>If there are N implementations, there are N times more chance for a security vulnerability. I don't even understand what this is supposed to mean. Do you mean
by colemickens 10y ago
>If there are N implementations, there are N times more chance for a security vulnerability.
I don't even understand what this is supposed to mean. Do you mean that a hole in the spec means that a sec vuln would occur in every implementation? Or that 5 implementations means 5 code bases to review?
Either way, it seems like a sentence that is meant to carry weight but is ultimately nearly completely meaningless. N different desktop apps on my computer have N chances for sec vulns. I don't see what that statement is supposed to mean regarding WebAssembly.
- fulafel 10y agoImplementation level bugs dominate, not spec bugs.
- espadrine 10y agoIn this instance, WASM shares JS' sandbox and security model down to the implementation, so the added risk is extremely limited. The only part that could be dangerous is the parser.
- fulafel 10y agoFrom WAVM's Github README: "This is a prototype of a simple standalone VM for WebAssembly" So it doesn't share code with a JS implementation in this case.
- espadrine 10y agoBrowsers have their security model. On the other hand, when you install an executable binary or a Node.js program, you don't expect to have the same security model. This project fits in the latter category. It does not claim that downloaded binaries are protected by a sandbox, and the only security claim it makes is the following weak one: “The generated code should be unable to access any memory outside of the addresses allocated to it”.