4 ms·

Flash had more issues than "politics."

pjmlp 7y ago
Yeah lets see how many security issues we get to see in WebAssembly sandboxes once researchers set their sights on them, given that they already found a couple on JS engines.
- modeless 7y ago
  Wasm has been here for years already. There's no flood of issues waiting for some cue to be released. It's no worse than any other part of the browser; probably better than some. Besides, modern browsers don't rely solely on one sandbox anymore. There are many levels of protection now.
  - pjmlp 7y ago
    CPUs were deemed unexploitable, until researchers had a better look into them. The only thing that makes WebAssembly safer than its predecessors, is that most security researchers haven't yet bothered with it.
    - hjanssen 7y ago
      Which is already true for any type of software. Bugs exist everywhere. Of course you finde some if you put in the effort. That is not something that marks the quality of the code.
      - na85 7y ago
        Not all ideas were created equal. Parent's contention (one I agree with) seems to be that the contemporary browser-as-app-deployment-platform paradigm is a bad idea.
    - modeless 7y ago
      I didn't say Wasm is unexploitable. You're attacking a straw man. Wasm vulnerabilities are worth real money. Bug bounties are tens of thousands of dollars to hundreds of thousands as part of exploit chains. If people aren't finding many, your explanation will have to be a little bit better than "they haven't yet bothered".
      - pjmlp 7y ago
        Currently there are better rivers for panning, but rest assured they will come. https://i.blackhat.com/us-18/Thu-August-9/us-18-Lukasiewicz-WebAssembly-A-New-World-of-Native_Exploits-On-The-Web-wp.pdf https://i.blackhat.com/us-18/Thu-August-9/us-18-Lukasiewicz-...
- BubRoss 7y ago
  You bring this nonsense up in every webasm thread and every time it is explained to you that webasm does no IO and is contained in the same environment as javascript. Every time you either bring up details that have nothing to actually do with webasm or you say something vague about possible security problems in the future. If you have real criticism based on real information, let's see it.
  - pjmlp 7y ago
    You mean the same JS engines that already have several entries on the CVE database? Yeah, really safe.
    - jjoonathan 7y ago
      It has a looooong way to go before it's as bad as flash.
      - pjmlp 7y ago
        Not really, I already posted a couple of initial steps in a sibling comment.
        jjoonathan 7y ago
        It would have to run a marathon to catch up. Initial steps are hardly an indication that it will.
    - BubRoss 7y ago
      Can you link one that has to do with webasm? Are you saying that you think javascript is less secure than flash?
      - pjmlp 7y ago
        Indeed, https://www.contextis.com/en/blog/webgl-a-new-dimension-for-browser-exploitation https://www.contextis.com/en/blog/webgl-a-new-dimension-for-... https://react-etc.net/entry/exploiting-speculative-execution-meltdown-spectre-via-javascript https://react-etc.net/entry/exploiting-speculative-execution... https://www.virusbulletin.com/virusbulletin/2018/10/dark-side-webassembly/ https://www.virusbulletin.com/virusbulletin/2018/10/dark-sid... https://www.cvedetails.com/vulnerability-list/vendor_id-20412/Webassembly.html https://www.cvedetails.com/vulnerability-list/vendor_id-2041... https://i.blackhat.com/us-18/Thu-August-9/us-18-Lukasiewicz-WebAssembly-A-New-World-of-Native_Exploits-On-The-Web-wp.pdf https://i.blackhat.com/us-18/Thu-August-9/us-18-Lukasiewicz-...

Yeah lets see how many security issues we get to see in WebAssembly sandboxes once researchers set their sights on them, given that they already found a couple on JS engines.

modeless 7y ago
Wasm has been here for years already. There's no flood of issues waiting for some cue to be released. It's no worse than any other part of the browser; probably better than some. Besides, modern browsers don't rely solely on one sandbox anymore. There are many levels of protection now.
- pjmlp 7y ago
  CPUs were deemed unexploitable, until researchers had a better look into them. The only thing that makes WebAssembly safer than its predecessors, is that most security researchers haven't yet bothered with it.
  - hjanssen 7y ago
    Which is already true for any type of software. Bugs exist everywhere. Of course you finde some if you put in the effort. That is not something that marks the quality of the code.
    - na85 7y ago
      Not all ideas were created equal. Parent's contention (one I agree with) seems to be that the contemporary browser-as-app-deployment-platform paradigm is a bad idea.
  - modeless 7y ago
    I didn't say Wasm is unexploitable. You're attacking a straw man. Wasm vulnerabilities are worth real money. Bug bounties are tens of thousands of dollars to hundreds of thousands as part of exploit chains. If people aren't finding many, your explanation will have to be a little bit better than "they haven't yet bothered".
    - pjmlp 7y ago
      Currently there are better rivers for panning, but rest assured they will come. https://i.blackhat.com/us-18/Thu-August-9/us-18-Lukasiewicz-WebAssembly-A-New-World-of-Native_Exploits-On-The-Web-wp.pdf https://i.blackhat.com/us-18/Thu-August-9/us-18-Lukasiewicz-...
BubRoss 7y ago
You bring this nonsense up in every webasm thread and every time it is explained to you that webasm does no IO and is contained in the same environment as javascript. Every time you either bring up details that have nothing to actually do with webasm or you say something vague about possible security problems in the future. If you have real criticism based on real information, let's see it.
- pjmlp 7y ago
  You mean the same JS engines that already have several entries on the CVE database? Yeah, really safe.
  - jjoonathan 7y ago
    It has a looooong way to go before it's as bad as flash.
    - pjmlp 7y ago
      Not really, I already posted a couple of initial steps in a sibling comment.
      - jjoonathan 7y ago
        It would have to run a marathon to catch up. Initial steps are hardly an indication that it will.
  - BubRoss 7y ago
    Can you link one that has to do with webasm? Are you saying that you think javascript is less secure than flash?
    - pjmlp 7y ago
      Indeed, https://www.contextis.com/en/blog/webgl-a-new-dimension-for-browser-exploitation https://www.contextis.com/en/blog/webgl-a-new-dimension-for-... https://react-etc.net/entry/exploiting-speculative-execution-meltdown-spectre-via-javascript https://react-etc.net/entry/exploiting-speculative-execution... https://www.virusbulletin.com/virusbulletin/2018/10/dark-side-webassembly/ https://www.virusbulletin.com/virusbulletin/2018/10/dark-sid... https://www.cvedetails.com/vulnerability-list/vendor_id-20412/Webassembly.html https://www.cvedetails.com/vulnerability-list/vendor_id-2041... https://i.blackhat.com/us-18/Thu-August-9/us-18-Lukasiewicz-WebAssembly-A-New-World-of-Native_Exploits-On-The-Web-wp.pdf https://i.blackhat.com/us-18/Thu-August-9/us-18-Lukasiewicz-...