4 ms·

Do you mean people bringing their own compilers with web pages?

by zzzcpan 8y ago

pjmlp 8y ago
Yep, unless browser vendors change course, the revenge of plugins is near. Prepare for Flash 2.0.
- smacktoward 8y ago
  But if they all just compile down to WASM, why should anyone care? It's not like you'll need to install a new plugin for each new language you run across. You have a WASM interpreter already, you don't have to know or care about the process by which the site you're visiting turns source code into WASM bytecode.
  - kbenson 8y ago
    > But if they all just compile down to WASM, why should anyone care? Because some sites/people will implement a new deployment scheme that implements a new layout engine in a canvas, and use that to "prevent plagiarism" or protect data. Think an online retailer preventing price scraping, or some site that gets visions of grandeur about a more multimedia rich experience (like every photographer's website 15 years ago), or wanting to prevent ad-blockers or use dark patterns that browsers finally actively prevent. There are business incentives for all these, in some cases if not necessarily for the end user, then for a company to trick end-users into thinking they need ("click here and for $10/mo more we'll add our patented anti-scraping/copying technology to your site!").
    - terandle 8y ago
      Seems like your issue is with the canvas tag and not necessarily with wasm as you could just do that in JS as well.
      - kbenson 8y ago
        No matter how minified, JS is much more easily reversed and dealt with, and won't have the level of same performance that WASM does, so it's a harder sell. It's sort of like saying that shipping an interpreted language file is just as hard to reverse engineer as a compiled binary. Sure, you can make the interpreted language harder to read by obfuscating it, but it's hard to compare with straight up machine code or byte code. In addition, all the obfuscation techniques feed into each other. WASM through a canvas to protect content isn't all that useful if the content is built from JSON which is easily visible. But if that JSON is itself encrypted/obfuscated, that's harder. But determining the obfuscation method from JS code (minified or not) is much easier than determining it from machine/byte code. In both cases enough skill will bypass any mechanism since it's locally running code, but all you have to do is raise the bar high enough to dissuade most. An occassional switch of some underlying obfuscation methodology to make those bypassing have to continuously work at it, and you've got a system that does most of what's needed. In the end, it's just like door locks. There's lots of technology that can be used, all of it is defeatable in some fashion, but there's things you can do to make it not worthwhile for all but the most determined. In the case of canvas content rendering, I think WASM might be the tipping point that makes this really feasible. I guess we'll see, it's not like there's really any way to stop it (nor is it clear we should try).
    - tokyodude 8y ago
      Isn't that the Kindle Cloud Reader? https://read.amazon.com/ https://read.amazon.com/
- shams93 8y ago
  Well Wasm can interact with Dom and js while flash could not flash was totally isolated from the Dom.

Do you mean people bringing their own compilers with web pages?

pjmlp 8y ago

Yep, unless browser vendors change course, the revenge of plugins is near. Prepare for Flash 2.0.

smacktoward 8y ago
But if they all just compile down to WASM, why should anyone care? It's not like you'll need to install a new plugin for each new language you run across. You have a WASM interpreter already, you don't have to know or care about the process by which the site you're visiting turns source code into WASM bytecode.
- kbenson 8y ago
  > But if they all just compile down to WASM, why should anyone care? Because some sites/people will implement a new deployment scheme that implements a new layout engine in a canvas, and use that to "prevent plagiarism" or protect data. Think an online retailer preventing price scraping, or some site that gets visions of grandeur about a more multimedia rich experience (like every photographer's website 15 years ago), or wanting to prevent ad-blockers or use dark patterns that browsers finally actively prevent. There are business incentives for all these, in some cases if not necessarily for the end user, then for a company to trick end-users into thinking they need ("click here and for $10/mo more we'll add our patented anti-scraping/copying technology to your site!").
  - terandle 8y ago
    Seems like your issue is with the canvas tag and not necessarily with wasm as you could just do that in JS as well.
    - kbenson 8y ago
      No matter how minified, JS is much more easily reversed and dealt with, and won't have the level of same performance that WASM does, so it's a harder sell. It's sort of like saying that shipping an interpreted language file is just as hard to reverse engineer as a compiled binary. Sure, you can make the interpreted language harder to read by obfuscating it, but it's hard to compare with straight up machine code or byte code. In addition, all the obfuscation techniques feed into each other. WASM through a canvas to protect content isn't all that useful if the content is built from JSON which is easily visible. But if that JSON is itself encrypted/obfuscated, that's harder. But determining the obfuscation method from JS code (minified or not) is much easier than determining it from machine/byte code. In both cases enough skill will bypass any mechanism since it's locally running code, but all you have to do is raise the bar high enough to dissuade most. An occassional switch of some underlying obfuscation methodology to make those bypassing have to continuously work at it, and you've got a system that does most of what's needed. In the end, it's just like door locks. There's lots of technology that can be used, all of it is defeatable in some fashion, but there's things you can do to make it not worthwhile for all but the most determined. In the case of canvas content rendering, I think WASM might be the tipping point that makes this really feasible. I guess we'll see, it's not like there's really any way to stop it (nor is it clear we should try).
  - tokyodude 8y ago
    Isn't that the Kindle Cloud Reader? https://read.amazon.com/ https://read.amazon.com/
shams93 8y ago
Well Wasm can interact with Dom and js while flash could not flash was totally isolated from the Dom.