3 ms·
I don't want to attack Rust or WASM, as I am pretty excited about this, but it's not that easy. That anything that runs into the browser is isolated sandboxed
by dullgiulio 9y ago
I don't want to attack Rust or WASM, as I am pretty excited about this, but it's not that easy.
That anything that runs into the browser is isolated sandboxed and whatnot is irrelevant. It's still arbitrary code running on often unwilling clients.
Don't believe me? Think about ad-blockers.
- steveklabnik 9y agoIt's no different than the existing JS here.
- dullgiulio 9y agoAbsolutely, not different at all. I am just saying that is naive to think that the web platform is safer than other platforms. Many "attacks" happen completely inside the sandbox.
- steveklabnik 9y agoOh yeah, it's not a panacea for sure.
- Rusky 9y agoThe web platform is not completely safe, but it is far safer than, say, an unsandboxed exe running on Windows.
- phkahler 9y agoMost JS is unwanted code running in the browser. Seriously, the web devs are the ones that want it, not the user.
- a_humean 9y agoThat's why I qualifed with "relatively safe". Arbitrary code from potentially malicious/incompetent sources is arbitrary code, but its a platform on which its relatively safe to run arbitrary code.