16 ms·
Wasm has been here for years already. There's no flood of issues waiting for some cue to be released. It's no worse than any other part of the browser; probably
by modeless 7y ago
Wasm has been here for years already. There's no flood of issues waiting for some cue to be released. It's no worse than any other part of the browser; probably better than some. Besides, modern browsers don't rely solely on one sandbox anymore. There are many levels of protection now.
- pjmlp 7y agoCPUs were deemed unexploitable, until researchers had a better look into them. The only thing that makes WebAssembly safer than its predecessors, is that most security researchers haven't yet bothered with it.
- hjanssen 7y agoWhich is already true for any type of software. Bugs exist everywhere. Of course you finde some if you put in the effort. That is not something that marks the quality of the code.
- na85 7y agoNot all ideas were created equal. Parent's contention (one I agree with) seems to be that the contemporary browser-as-app-deployment-platform paradigm is a bad idea.
- modeless 7y agoI didn't say Wasm is unexploitable. You're attacking a straw man. Wasm vulnerabilities are worth real money. Bug bounties are tens of thousands of dollars to hundreds of thousands as part of exploit chains. If people aren't finding many, your explanation will have to be a little bit better than "they haven't yet bothered".
- pjmlp 7y agoCurrently there are better rivers for panning, but rest assured they will come. https://i.blackhat.com/us-18/Thu-August-9/us-18-Lukasiewicz-WebAssembly-A-New-World-of-Native_Exploits-On-The-Web-wp.pdf https://i.blackhat.com/us-18/Thu-August-9/us-18-Lukasiewicz-...