6 ms·
The toolchains for building WebAssembly from numerous languages, for one thing. The existence of an LLVM WebAssembly backend helps. (While eventually there were
by JoshTriplett 7y ago
The toolchains for building WebAssembly from numerous languages, for one thing. The existence of an LLVM WebAssembly backend helps. (While eventually there were other languages that targeted the JVM, for a long time if you wanted the JVM sandbox you had to write Java.)
WebAssembly also provides a fine-grained API surface area; you can run a WebAssembly sandbox with no external functions provided, or just a few.
WebAssembly's sandboxing isn't tied to the web; we're keeping all the same security properties when running code locally, and we're protecting modules from each other too.
Also, the WebAssembly bytecode format is designed from the beginning to support many different kinds of languages, including languages that directly store types in memory, rather than keeping everything as garbage-collected or reference-counted objects on the heap.
- beefhash 7y ago> The existence of an LLVM WebAssembly backend helps. So why aren't people just shipping straight up LLVM intermediate language VMs and instead go through wasm? Incidentally, would you consider wasm as a destination language for virtual machines for obfuscation? I.e. is it reasonable enough to implement it all in about a week? Plus I fear like the decompilation/disassembly tooling might be there too soon for it to be a real viable option, but maybe nobody's been working on that yet.
- est31 7y agoLLVM IR is an unstable format, changes a lot and only has one implementation.So it's not well suited for a standard. Google actually did use it for PNaCl but fortunately Mozilla prevailed when wasm was created. "Do what LLVM does" is not a valid strategy. On a related note, I'm glad that Firefox doesn't support the "Do what sqlite does" WebSQL api either, but Chrome (sadly) does.
- jandem 7y ago> So why aren't people just shipping straight up LLVM intermediate language VMs and instead go through wasm? This is answered in the WebAssembly FAQ: https://webassembly.org/docs/faq/#why-not-just-use-llvm-bitcode-as-a-binary-format https://webassembly.org/docs/faq/#why-not-just-use-llvm-bitc...
- pjmlp 7y agoJust like MSIL, Xerox PARC microcoded bytecode, IBM mainframes language environments and plenty of other examples.
- tasogare 7y agoYes the concept, as well as implementations, existed for decades. I think WASM is hype because it comes from the Web/JS community and they have good communication, but technically there is nothing new under the sun.
- afiori 7y agoI would say that being a success instead of a failure is something new. The JVM was successful but not for plugins, nor for embedded safety. Also the fact that many vendors have reached a consensus on both a MVP and an update process to future features looks like a win. If Sun, Microsoft, Apple, and Google had all been on board with the (supposedly free software) JVM the story would have been very different.
- pjmlp 7y agoIronically WebAssembly advocacy keeps being defensive against JVM, while cleverly forgetting the dozens of other formats that also offered similar capabilities, including executing C derived languages.
- biggestdecision 7y ago>WebAssembly also provides a fine-grained API surface area Are there concerns about compatibility when browsers are inevitably forced to reduce that surface area because of a security flaw? And how are we going to keep all browsers on the same page with regard to what functionality they provide? It will suck if wasm turns into a cross browser compatibility nightmare.
- gridlockd 7y agoWASM modules by themselves can do pretty much nothing besides allocating memory. If you want to use some API, you have to explicitly expose it, as a user.