5 ms·

This is bad for frontend JavaScript being "open" for review, right? Companies will ask their developers to deliver WASM resources in the name of performance. A

This is bad for frontend JavaScript being "open" for review, right? Companies will ask their developers to deliver WASM resources in the name of performance. As a notable side-effect, it will become harder to review how websites work. Yes, I'm sure there will be reverse-compilation tools for WASM, but still.

nicoburns 7y ago
Complex websites are already delivering minified source. This isn't really meaningfully different. Luckily with so much open source code, it's less important to be able to inspect live websites these days.
williamdclt 7y ago
It's pretty rare companies ask their devs for a specific tech. The execs don't really have any idea what is the difference between JS and WASM, or what is WASM, or what is JS. And minified JS isn't particularly more reviewable I think
icey 7y ago
So much frontend JS has been packed and minified now that I’m not sure it will make that much difference. Reviewing Open Source code is still a far superior way to understand how code works, imo.
- sprash 7y ago
  Unminified javascript is far easier to understand than disassembled code which originated from compiled C++ or Rust. It is possible to disable half of the paywalls on the web just by looking at the JS code. I can see why certain parties would push really hard to introduce Webassembly. The performance argument is just a pretext because today's jit compilers for Javascript are really good.
  - arthurcolle 7y ago
    > It is possible to disable half of the paywalls on the web just by looking at the JS code. Shhh! Don't tell them!
Gaelan 7y ago
I mean, technically, browser support changes nothing here—if you wanted wasm-level obfuscation, you could compile wasm to js, or you could write a wasm interpreter in js. I guess this normalizes writing code like this, but that’s it.
AlexAltea 7y ago
JavaScript is often delivered minified without the corresponding original sources. If preventing reverse engineering is a goal, it could even be obfuscated, which certain sites already do. In practice, there's nothing that WebAssembly offers that could hinder analysis even further. If websites want to be transparent they could provide the sources (akin to providing unminified/unobfuscated JavaScript).
- strictnein 7y ago
  Reversing very heavily obfuscated Javascript is doable. If you want to fully reverse a 1000 line obfuscated file you're probably looking at a day or two of work, depending on how in depth you want to go.
chrshawkes 7y ago
Not a bad thing in my opinion. It will raise the price for developers who know their stuff. Open source needs to be re-evaluated in this day and age. We are churned and burned by company execs for their personal mission for riches. No regards to our health, families and retirements. Companies make billions off of our private data and hoard opportunities from the masses while promoting weekends worked towards open source initiatives so they can expand their for profit mission. In the end, we've made cancerous social networks which has given voice to some of the craziest people this world has ever seen. I hope developers start to wake up soon. We are being used like no other industry I know of. Working tirelessly to put ourselves out of a job. Bring on web assembly and let's make this beast called the web even more complicated. I've personally made quite a bit of money in this industry but I don't drink the same Koolaid consumed by the hipster masses in Silicon Valley.
eeZah7Ux 7y ago
The advertisement industry is huge and it's the driving force behind Google and many other companies. webassembly is encouraging websites to dump megabytes of binary code in browsers. Obfuscated, analysis-resistant code to ensure that people cannot disable ads and tracking. It's appalling that we are accepting this.
- jsjolen 7y ago
  I'm not sure that WASM actually is that analysis-resistant. It's more high-level in some aspects than the JVM bytecode for example. For example, it doesn't support arbitrary computed goto:s. Instead it supports block-based control flow, where the semantics can either create blocks or jump out of them to lower down blocks. This makes it possible to construct a CFG statically, which isn't possible if it did support arbitrary computed goto:s.
- linuxftw 7y ago
  And thanks to ubiquitous HTTPS, there's no way to analyze what information is leaving your device (especially on a mobile device).

nicoburns 7y ago

Complex websites are already delivering minified source. This isn't really meaningfully different. Luckily with so much open source code, it's less important to be able to inspect live websites these days.

williamdclt 7y ago

It's pretty rare companies ask their devs for a specific tech. The execs don't really have any idea what is the difference between JS and WASM, or what is WASM, or what is JS. And minified JS isn't particularly more reviewable I think

icey 7y ago

So much frontend JS has been packed and minified now that I’m not sure it will make that much difference. Reviewing Open Source code is still a far superior way to understand how code works, imo.

sprash 7y ago
Unminified javascript is far easier to understand than disassembled code which originated from compiled C++ or Rust. It is possible to disable half of the paywalls on the web just by looking at the JS code. I can see why certain parties would push really hard to introduce Webassembly. The performance argument is just a pretext because today's jit compilers for Javascript are really good.
- arthurcolle 7y ago
  > It is possible to disable half of the paywalls on the web just by looking at the JS code. Shhh! Don't tell them!

Gaelan 7y ago

I mean, technically, browser support changes nothing here—if you wanted wasm-level obfuscation, you could compile wasm to js, or you could write a wasm interpreter in js. I guess this normalizes writing code like this, but that’s it.

AlexAltea 7y ago

JavaScript is often delivered minified without the corresponding original sources. If preventing reverse engineering is a goal, it could even be obfuscated, which certain sites already do. In practice, there's nothing that WebAssembly offers that could hinder analysis even further. If websites want to be transparent they could provide the sources (akin to providing unminified/unobfuscated JavaScript).

strictnein 7y ago
Reversing very heavily obfuscated Javascript is doable. If you want to fully reverse a 1000 line obfuscated file you're probably looking at a day or two of work, depending on how in depth you want to go.

chrshawkes 7y ago

Not a bad thing in my opinion. It will raise the price for developers who know their stuff. Open source needs to be re-evaluated in this day and age. We are churned and burned by company execs for their personal mission for riches. No regards to our health, families and retirements. Companies make billions off of our private data and hoard opportunities from the masses while promoting weekends worked towards open source initiatives so they can expand their for profit mission. In the end, we've made cancerous social networks which has given voice to some of the craziest people this world has ever seen. I hope developers start to wake up soon. We are being used like no other industry I know of. Working tirelessly to put ourselves out of a job. Bring on web assembly and let's make this beast called the web even more complicated. I've personally made quite a bit of money in this industry but I don't drink the same Koolaid consumed by the hipster masses in Silicon Valley.

eeZah7Ux 7y ago

The advertisement industry is huge and it's the driving force behind Google and many other companies. webassembly is encouraging websites to dump megabytes of binary code in browsers. Obfuscated, analysis-resistant code to ensure that people cannot disable ads and tracking. It's appalling that we are accepting this.

jsjolen 7y ago
I'm not sure that WASM actually is that analysis-resistant. It's more high-level in some aspects than the JVM bytecode for example. For example, it doesn't support arbitrary computed goto:s. Instead it supports block-based control flow, where the semantics can either create blocks or jump out of them to lower down blocks. This makes it possible to construct a CFG statically, which isn't possible if it did support arbitrary computed goto:s.
linuxftw 7y ago
And thanks to ubiquitous HTTPS, there's no way to analyze what information is leaving your device (especially on a mobile device).