3 ms·

There should not be a 'browser wasm' and a 'non browser' wasm. The wasm committee made many mistakes by treating it as an idea on paper, and not writing the ac

There should not be a 'browser wasm' and a 'non browser' wasm. The wasm committee made many mistakes by treating it as an idea on paper, and not writing the actual implimenting software. This has resulted in significant fragmenting of implimentation, each less trustworthy than the last. If any software is going to advertise safety, it must prove it. That's done through the feedback cycle and careful development. The only ones that have this are in browsers. Yet browsers have their own dubious implimentation, integrated with their JavaScript environment. Unless wasm decides on a set of standard runtimes that become trustworthy there will not be a wasm outside the browser. For example, when I search for python, I get python. There's still other pythons, but there's the python. This is true of all other software used. Wasm is failing to do that.

dgellow 7y ago
Try searching for C, C++, or even SQL or Javascript. You will quickly see that you don’t have “the official implementation”, because that’s not how things work in practice when considering well standardized and widely used software.
- devwastaken 7y ago
  You're mistaking written standard for implimentation standard. You only need a standard in practice. All of those things you've listed have only a few big players, with enough use and feedback cycle that there can be multiple different implimentations. Those different implimentations are very similar. There is not a different C to compilers, they have their own quirks, benefits, and target different systems. JavaScript is the least selective of any language, you will only find runtimes for it's modern versions in browsers Typically V8 or safari. V8 has become the effective standard. SQL has multiple big implimentations that deviate completely. This has a lot to do with marketing, and the fact data storage/retrieval is a significantly diverse section of computer science. In each of these known technologies there is a well known, well backed, named software project that people use it's name synonymous with it's supposed standard. Wasm doesn't have this, and that's because the implimentations took place in browser, which afaik did not impliment a unique engine to it. It just integrates wasm instructions to their js instructions. Which then led to there being dozens of different self called 'safe' implimentations. None of these have the users, time, and open source community necessary to know this. Which will inevitably lead to exploits. Given that situation, the only way wasm is going to live up to its goal of safety is backing a well made runtime. The problem of safety is what makes this very different from other software. Your own code with bugs is an annoyance, and maybe you can't do what you wanted. But code that is meant to be safe that instead allows for damage to you, your company - that deserves a much higher level of scrutiny.

dgellow 7y ago

Try searching for C, C++, or even SQL or Javascript. You will quickly see that you don’t have “the official implementation”, because that’s not how things work in practice when considering well standardized and widely used software.

devwastaken 7y ago
You're mistaking written standard for implimentation standard. You only need a standard in practice. All of those things you've listed have only a few big players, with enough use and feedback cycle that there can be multiple different implimentations. Those different implimentations are very similar. There is not a different C to compilers, they have their own quirks, benefits, and target different systems. JavaScript is the least selective of any language, you will only find runtimes for it's modern versions in browsers Typically V8 or safari. V8 has become the effective standard. SQL has multiple big implimentations that deviate completely. This has a lot to do with marketing, and the fact data storage/retrieval is a significantly diverse section of computer science. In each of these known technologies there is a well known, well backed, named software project that people use it's name synonymous with it's supposed standard. Wasm doesn't have this, and that's because the implimentations took place in browser, which afaik did not impliment a unique engine to it. It just integrates wasm instructions to their js instructions. Which then led to there being dozens of different self called 'safe' implimentations. None of these have the users, time, and open source community necessary to know this. Which will inevitably lead to exploits. Given that situation, the only way wasm is going to live up to its goal of safety is backing a well made runtime. The problem of safety is what makes this very different from other software. Your own code with bugs is an annoyance, and maybe you can't do what you wanted. But code that is meant to be safe that instead allows for damage to you, your company - that deserves a much higher level of scrutiny.