47 ms·
That feels a little unfair. WebAssembly has been shipping in the majority of production browsers for over three years now. That's one of the most security-sens
by azakai 6y ago
That feels a little unfair.
WebAssembly has been shipping in the majority of production browsers for over three years now. That's one of the most security-sensitive attack targets that exists. Those browsers would not have done so if it weren't reasonably safe.
Of course there are vulnerabilities that are discovered, just like in every part of the web platform. Nothing is perfect. But a huge amount of attention has been put on wasm's security and the major implementations are very robust.
It's true that wasm is reaching into other areas besides the web, which does raise new questions (like in that recent USENIX 2020 paper). Perhaps it's fair to say wasm is immature as a replacement for a native executable, or other new ideas that are coming out. But it's very mature as a sandboxing solution for pure computational code, and it's used successfully on the web all the time.
- pjmlp 6y agoIt not unfair when plenty of WebAssembly supporters try to sell it as the ultimate bytecode, without any flaws from all the ones that came into existence since the 60's. Also it is still catching up to features that those bytecodes already have during the last 20 years. Those browsers are only shipping MVP 1.0, unless you want to equate Web with Chrome. Only now are hackers and security researchers actually caring about WebAssembly security, hence the first wave of security papers on USENIX 2020. I expect those that drove WebAssembly in detriment of what we already had to be eventually surprised. For what I care, I will just take advantage of it to get back my plugins.