3 ms·
That would assume you trust the server not to give you malicious machine code (which you of course cannot!). wasm is specified in such a way that it is still sa
by sjrd 9y ago
That would assume you trust the server not to give you malicious machine code (which you of course cannot!). wasm is specified in such a way that it is still sandboxed by the VM that compiles it. If you fetch arbitrary machine code, you cannot verify it and that leads to huge security holes!
- chrisseaton 9y ago> which you of course cannot! Didn't Google's NaCL implement verification of sandboxed machine code?
- sjrd 9y agoMaybe, but at what cost? I wouldn't be surprised if the cost of verifying the machine code was higher than the cost of compiling wasm to machine code.
- hateduser2 9y agoWhy can’t you just cache it with a hash?
- icebraining 9y agoHow would the client know the hash is valid?
- Zpalmtree 9y agoPerhaps he means you compile the code locally, hash it, and then next time you can fetch the compiled code from a server, and check the hash matches?
- icebraining 9y agoThat's possible; a kind of second-level cache. That assumes the compilation is reproducible, though.