4 ms·
You bring this nonsense up in every webasm thread and every time it is explained to you that webasm does no IO and is contained in the same environment as javas
by BubRoss 7y ago
You bring this nonsense up in every webasm thread and every time it is explained to you that webasm does no IO and is contained in the same environment as javascript. Every time you either bring up details that have nothing to actually do with webasm or you say something vague about possible security problems in the future.
If you have real criticism based on real information, let's see it.
- pjmlp 7y agoYou mean the same JS engines that already have several entries on the CVE database? Yeah, really safe.
- jjoonathan 7y agoIt has a looooong way to go before it's as bad as flash.
- pjmlp 7y agoNot really, I already posted a couple of initial steps in a sibling comment.
- jjoonathan 7y agoIt would have to run a marathon to catch up. Initial steps are hardly an indication that it will.
- BubRoss 7y agoCan you link one that has to do with webasm? Are you saying that you think javascript is less secure than flash?
- pjmlp 7y agoIndeed, https://www.contextis.com/en/blog/webgl-a-new-dimension-for-browser-exploitation https://www.contextis.com/en/blog/webgl-a-new-dimension-for-... https://react-etc.net/entry/exploiting-speculative-execution-meltdown-spectre-via-javascript https://react-etc.net/entry/exploiting-speculative-execution... https://www.virusbulletin.com/virusbulletin/2018/10/dark-side-webassembly/ https://www.virusbulletin.com/virusbulletin/2018/10/dark-sid... https://www.cvedetails.com/vulnerability-list/vendor_id-20412/Webassembly.html https://www.cvedetails.com/vulnerability-list/vendor_id-2041... https://i.blackhat.com/us-18/Thu-August-9/us-18-Lukasiewicz-WebAssembly-A-New-World-of-Native_Exploits-On-The-Web-wp.pdf https://i.blackhat.com/us-18/Thu-August-9/us-18-Lukasiewicz-...
- BubRoss 7y agoAll of these are speculation about the future. Most have nothing to do with webasm at all. The first is about webgl (that has nothing to do with webasm) The second is about using javascript with intel speculative execution exploits. The third is grasping at straws, saying that call center scams would be more obsfuscated, even though javascript or asm.js can be just as obsfuscated, if not more. The fourth is about crashes in the webasm JIT The last is about -theoretically- executing arbitrary javascript. Heavens no. What is the real reason you have some crazy crusade against webasm? You go to great lengths to grasp at any straws you can. It isn't that big of a deal. It is a more direct way to JIT cpu intensive parts of a web page. Get over it. Incredibly, the alternative is to run actual native instructions by downloading a binary.
- pjmlp 7y agoSurvivor of the anti-PNaCL, Java and Flash crusade I guess.
- BubRoss 7y agoTo be clear, because you have seen other VMs, you are desperate to spread complete misinformation and lies about webasm? Funneling your own frustrations into lying and spreading false information on the internet is not something a reasonable, emotionally healthy person does. Think about all the other people that do that in other areas of discussion. Those are your peers when you do this.
- pjmlp 7y agoI am not desperate at all, it is no different than WebAssembly advocates spreading false information about its "safety" or novelty. In fact I rejoice that WebAssembly, despite all the attempts to be presented as safe and novel, is becoming the mechanism to bring back to life all the plugins that where killed in name of WebAssembly. I will give 5 years time for WebGL/WebGPU + WebAssembly to rule the majority of multimedia driven websites, with a new generation of Flash like tooling. Then you call tell the world how much safer and novel WebAssembly is.