4 ms·

> It seems like you're claiming, in a really roundabout way, that WASM will never have DOM access I am not going to say never. It does not now and will not fo

> It seems like you're claiming, in a really roundabout way, that WASM will never have DOM access I am not going to say never. It does not now and will not for the foreseeable future though. I know DOM interop is a popular request, but nobody has started working on it and it isn't a priority. Part of the problem in implementing DOM access to a unrestricted bytecode format is security. Nobody wants to relax security so that people who are JavaScript challenged can feel less insecure.

wootness 9y ago
It's not about being "javascript challenged", it's about wanting to use a non-crappy language riddled with problems.
tptacek 9y ago
Which of the security concerns browser Javascript deals with do you think are intrinsic to the language, as opposed to the bindings the browser provides the language? If the security issues are in the bindings (ie: when and how I'll allow you to originate a request with credentials in it), those concerns are "portable" between languages.
- austincheney 9y ago
  It isn't due to the language but to context of known APIs provided to the language that can only be executed a certain way by the language. How would a browser know to restrict a web server compiled into bytecode specifically to violate same origin? The browser only knowns to restrict this from JavaScript because such capabilities are allowed only from APIs the browser provides to JavaScript.
  - tptacek 9y ago
    I really don't understand your example. Are you proposing a web server running inside the browser as a WebAssembly program, and the browser attempting to enforce same origin policy against that server? That doesn't make much sense.
    - austincheney 9y ago
      Yep, it doesn't make sense and that is the problem. There is no reason why you couldn't write a web server in WASM that runs in an island inside the browser to bypass the browser's security model.
      - tptacek 9y ago
        This does not make any sense, sorry.
- tedunangst 9y ago
  Not sure if this is directly relevant, but there have been all sorts of type confusion bugs when resizing arrays, etc. Stuff in the base language. They exist independent of API, but merely because the language is exposed.
steveklabnik 9y ago
> I know DOM interop is a popular request, but nobody has started working on it and it isn't a priority. I linked to the latest proposal downthread; people are absolutely working on this.

wootness 9y ago

It's not about being "javascript challenged", it's about wanting to use a non-crappy language riddled with problems.

tptacek 9y ago

Which of the security concerns browser Javascript deals with do you think are intrinsic to the language, as opposed to the bindings the browser provides the language? If the security issues are in the bindings (ie: when and how I'll allow you to originate a request with credentials in it), those concerns are "portable" between languages.

austincheney 9y ago
It isn't due to the language but to context of known APIs provided to the language that can only be executed a certain way by the language. How would a browser know to restrict a web server compiled into bytecode specifically to violate same origin? The browser only knowns to restrict this from JavaScript because such capabilities are allowed only from APIs the browser provides to JavaScript.
- tptacek 9y ago
  I really don't understand your example. Are you proposing a web server running inside the browser as a WebAssembly program, and the browser attempting to enforce same origin policy against that server? That doesn't make much sense.
  - austincheney 9y ago
    Yep, it doesn't make sense and that is the problem. There is no reason why you couldn't write a web server in WASM that runs in an island inside the browser to bypass the browser's security model.
    - tptacek 9y ago
      This does not make any sense, sorry.
tedunangst 9y ago
Not sure if this is directly relevant, but there have been all sorts of type confusion bugs when resizing arrays, etc. Stuff in the base language. They exist independent of API, but merely because the language is exposed.

steveklabnik 9y ago

> I know DOM interop is a popular request, but nobody has started working on it and it isn't a priority. I linked to the latest proposal downthread; people are absolutely working on this.