5 ms·
> you cannot express anything malicious in Wasm This feels like a comment that will as age as badly as “you can’t get a virus just from looking at an email”
by peteretep 6y ago
> you cannot express anything malicious in Wasm
This feels like a comment that will as age as badly as “you can’t get a virus just from looking at an email”
- bagels 6y agoSounds like the promises made about the jvm.
- nih0 6y agocan u elaborate on these jvm promises?
- officialchicken 6y agoThe "sandbox" promise was/is still offered as the primary line of defense for Java. "The first version of Java was released by Sun Microsystems in 1995 [2]. One year later, researchers at Princeton University identified multiple flaws enabling an analyst to bypass the sandbox [3]. The authors identified weaknesses in the language, bytecode and object initialization, to name a few, some of them still present in Java at the time of writing."[0] [0] https://www.exploit-db.com/papers/45517 https://www.exploit-db.com/papers/45517 [2] http://www.oracle.com/technetwork/java/javase/overview http://www.oracle.com/technetwork/java/javase/overview [3] Drew Dean, Edward W. Felten, Dan S. Wallach. "Java security: From HotJava to Netscape and beyond." In Security & Privacy, IEEE, 1996
- marcosdumay 6y agoThe Java sandbox trusted any code signed with a SSL certificate by design, what didn't stop Sun from announcing it was secure and everything.
- jedisct1 6y agoYou can’t express anything malicious in JavaScript either, yet vulnerabilities are constantly found in web browsers, including WebAssembly JITs. You can express malicious things in Go, yet the number of RCEs in Go apps is pretty much zero.
- amelius 6y ago> You can’t express anything malicious in JavaScript either You have to be more specific because lots of fraud is possible by misleading the user through JavaScript tricks.
- CyberRabbi 6y agoFull device root from JavaScript https://github.com/synacktiv/PS4-webkit-exploit-6.XX https://github.com/synacktiv/PS4-webkit-exploit-6.XX
- alquemist 6y agoThat's a bit of apples and oranges. JS/WASM are runtimes executing hostile code, whereas Go apps are trusted code.
- etimberg 6y agoWhat about something like https://github.com/IAIK/rowhammerjs https://github.com/IAIK/rowhammerjs ?
- mhh__ 6y agoDepends - eBPF is statically verified pretty well, but spectre (and all its brothers) is a cruel mistress