4 ms·

Yes, and people are trying to run this outside browser too(like a jvm alternative). Not sure what's the craze about wasm outside browsers considering all the ri

by xfer 6y ago

Yes, and people are trying to run this outside browser too(like a jvm alternative). Not sure what's the craze about wasm outside browsers considering all the risks.

recursive 6y ago
You pretty much explained it yourself. It's a jvm alternative without the Oracle after-taste.
- pjmlp 6y ago
  And IBM, Red-Hat, Azul, Microsoft, SAP, Alibaba, Twitter, Amazon, PTC, Aicas, Gemalto,....
rubber_duck 6y ago
JVM is a different category of VM, it's memory model and bytecode don't fit languages such as C/C++/Rust at all ( AFAIK it doesn't even have unsigned integer operations).
- The_rationalist 6y ago
  Kotlin offer unsigned integers. Graalvm support c/c++ could in theory support rust too.
  - alex7o 6y ago
    There is a an example of rust using graalvm on their website. I have tried it and it works.
  - brabel 6y ago
    > Kotlin offer unsigned integers. As an experimental feature... I had to use it on one of the projects I work on because using signed bytes was driving me crazy, but I had to suppress warnings for experimental features (and will have to pay the price if they change the feature somehow, as they tend to do with experimental features).
  - rubber_duck 6y ago
    JVM is turing complete so it can run any language, the point is efficiency
  - pjmlp 6y ago
    They are faked via signed arithmetic, because the JVM does not support them anyway.
- pjmlp 6y ago
  CLR, mainframe language environments and now lost tech like some phone VM, do support C and C++ like languages.
  - rubber_duck 6y ago
    He was talking about JVM specifically, part of the benefit of WASM is portability, CLR is getting better in this regard with .net core but that's a recent development (I don't see how phone VMs compare) CLR also has an object model and a memory model that's not very friendly to unmanaged languages, hence C++/CLI, and the runtime is not very lightweight for embedding purposes
    - pjmlp 6y ago
      Symbian had a CLR port actually, and then there was PocketPC/Windows CE compact framework.
rvz 6y ago
Exactly. There's so much "WASM without the browser" hype for some time and this analysis puts the risks into perspective. It has been aggresively marketed as a JVM alternative (not equivalent), but with the same old native bugs and even makes XSS attacks possible. Stunning. Maybe that's why all the big media content companies went behind it. Out with Flash and Java and in with 'compile and run WASM programs in every browser' to support this 'open web™'. What they really mean is: 'We can't wait for WASM DRM!'
- deleted 6y ago
  [deleted]
- infogulch 6y ago
  The core WA principle of "protect the host from the program, but not the program from itself" still holds, based on the video this paper does not even attempt to break the WASM host memory barrier. That seems more like a success than anything else. Guess what: developers are still responsible for avoiding security bugs in their code. But at least when they mess up, it still won't damage more than what their dumb web app could have done already.
- hinkley 6y ago
  Chaos is a ladder. And we start the cycle over again around the time that young men and women no longer trust the opinions of people who lived through the last cycle. I used to call this 'fashion' as quite a few other people are fond of doing, but I don't think I'll be doing that anymore. Fashion has an element of frivolity that understates the consequences of all of the churn. I have been trying to figure out if there's a more structured way that I can gather my assumptions (about software in particular) and be able to audit them once in a while. Because we build so many decisions on these assumptions. And I suspect when they start to teeter is when we get the urge to try something very different, 'forget everything we think we know' and start over with a philosophy that we already tried and abandoned thirty years ago. But maybe I only need to forget six things I 'knew', instead of swinging back and forth on the pendulum with everyone else.

by xfer 6y ago

Yes, and people are trying to run this outside browser too(like a jvm alternative). Not sure what's the craze about wasm outside browsers considering all the risks.

recursive 6y ago

You pretty much explained it yourself. It's a jvm alternative without the Oracle after-taste.

pjmlp 6y ago
And IBM, Red-Hat, Azul, Microsoft, SAP, Alibaba, Twitter, Amazon, PTC, Aicas, Gemalto,....

rubber_duck 6y ago

JVM is a different category of VM, it's memory model and bytecode don't fit languages such as C/C++/Rust at all ( AFAIK it doesn't even have unsigned integer operations).

The_rationalist 6y ago
Kotlin offer unsigned integers. Graalvm support c/c++ could in theory support rust too.
- alex7o 6y ago
  There is a an example of rust using graalvm on their website. I have tried it and it works.
- brabel 6y ago
  > Kotlin offer unsigned integers. As an experimental feature... I had to use it on one of the projects I work on because using signed bytes was driving me crazy, but I had to suppress warnings for experimental features (and will have to pay the price if they change the feature somehow, as they tend to do with experimental features).
- rubber_duck 6y ago
  JVM is turing complete so it can run any language, the point is efficiency
- pjmlp 6y ago
  They are faked via signed arithmetic, because the JVM does not support them anyway.
pjmlp 6y ago
CLR, mainframe language environments and now lost tech like some phone VM, do support C and C++ like languages.
- rubber_duck 6y ago
  He was talking about JVM specifically, part of the benefit of WASM is portability, CLR is getting better in this regard with .net core but that's a recent development (I don't see how phone VMs compare) CLR also has an object model and a memory model that's not very friendly to unmanaged languages, hence C++/CLI, and the runtime is not very lightweight for embedding purposes
  - pjmlp 6y ago
    Symbian had a CLR port actually, and then there was PocketPC/Windows CE compact framework.

rvz 6y ago

Exactly. There's so much "WASM without the browser" hype for some time and this analysis puts the risks into perspective. It has been aggresively marketed as a JVM alternative (not equivalent), but with the same old native bugs and even makes XSS attacks possible. Stunning. Maybe that's why all the big media content companies went behind it. Out with Flash and Java and in with 'compile and run WASM programs in every browser' to support this 'open web™'. What they really mean is: 'We can't wait for WASM DRM!'

deleted 6y ago
[deleted]
infogulch 6y ago
The core WA principle of "protect the host from the program, but not the program from itself" still holds, based on the video this paper does not even attempt to break the WASM host memory barrier. That seems more like a success than anything else. Guess what: developers are still responsible for avoiding security bugs in their code. But at least when they mess up, it still won't damage more than what their dumb web app could have done already.
hinkley 6y ago
Chaos is a ladder. And we start the cycle over again around the time that young men and women no longer trust the opinions of people who lived through the last cycle. I used to call this 'fashion' as quite a few other people are fond of doing, but I don't think I'll be doing that anymore. Fashion has an element of frivolity that understates the consequences of all of the churn. I have been trying to figure out if there's a more structured way that I can gather my assumptions (about software in particular) and be able to audit them once in a while. Because we build so many decisions on these assumptions. And I suspect when they start to teeter is when we get the urge to try something very different, 'forget everything we think we know' and start over with a philosophy that we already tried and abandoned thirty years ago. But maybe I only need to forget six things I 'knew', instead of swinging back and forth on the pendulum with everyone else.