3 ms·
Though I'm certain the security concerns were integral to the design of WASM, the ability to pass a pointer from JavaScript downstream into WASM terrifies the h
by shakna 7y ago
Though I'm certain the security concerns were integral to the design of WASM, the ability to pass a pointer from JavaScript downstream into WASM terrifies the hell out of me.
I know that theoretically every WASM module is supposed to have a fully isolated memory block, but I can't help but wonder about the day where a bug allows WASM to deliver malware payloads to read other web browser tabs. Let's hope that WASM doesn't become everyday in advert networks.
- maxmcd 7y agoIt is a wasm pointer, not an OS pointer. You wouldn't actually get an address of OS memory, just to the addressable memory within the wasm VM. Getting isolation between tabs does seem to be an ongoing concern, but that's happening regardless of the presence of wasm: https://v8.dev/blog/spectre#site-isolation https://v8.dev/blog/spectre#site-isolation