3 ms·

> doing so requires a JVM-like runtime such as wasmtime. Cosmopolitan proves that it's possible to just fix C instead This doesn't sound like a fair comparison

> doing so requires a JVM-like runtime such as wasmtime. Cosmopolitan proves that it's possible to just fix C instead This doesn't sound like a fair comparison. WASM isn't just providing portability, it's also providing security and runtime safety. Cosmopolitan doesn't, it presumably requires you to trust the codebase, and doesn't protect you from C's undefined behaviour. Of course, WASM also imposes a considerable performance penalty, I presume the Cosmopolitan approach easily outperforms WASM. > This is probably how Java would have been designed, if Intel's instruction set hadn't been encumbered by patents at the time. To mirror the comment by Someone, I sincerely doubt this. Java bytecode is a very high level stack-based IR, nothing like a CPU ISA. They could easily have made it resemble a CPU ISA if they'd wanted to. The lesser-known GNU Lightning JIT engine takes this approach, for instance.

rini17 6y ago
WASM only provides sandboxing. That is not the same as security nor it means runtime safety nor protection from undefined behavior.
- MaxBarraclough 6y ago
  > WASM only provides sandboxing. That is not the same as security The relevant Wikipedia article is named Sandbox (computer security). > nor it means runtime safety nor protection from undefined behavior It puts stronger constraints on what mischief undefined behaviour can lead to, and guarantees that various runtime errors are handled with traps. [0] This isn't the same as a hard guarantee that execution will terminate whenever undefined behaviour is invoked, but it's still a step up. [0] https://webassembly.org/docs/security/ https://webassembly.org/docs/security/
  - ssokolow 6y ago
    Speaking as someone who would love to see WebAssembly succeed as a cross-platform, cross-language way for me to write sandboxed plugins and CLI utilities, I do have to point out that, for out-of-browser use, WASM's MVP does regress various things: * https://00f.net/2018/11/25/webassembly-doesnt-make-unsafe-languages-safe/ https://00f.net/2018/11/25/webassembly-doesnt-make-unsafe-la... * https://www.usenix.org/system/files/sec20-lehmann.pdf https://www.usenix.org/system/files/sec20-lehmann.pdf (eg. Under WebAssembly's memory model, dereferencing NULL=0 won't lead to a segfault.)
    - MaxBarraclough 6y ago
      > Under WebAssembly's memory model, dereferencing NULL=0 won't lead to a segfault. Thanks that's a curious one. It won't always lead to a segfault with a conventional compiler either, undefined behaviour being what it is. [0][1] Fortunately GCC can be asked to add such checks at runtime, [2] this approach could also be taken with WebAssembly. [0] https://devblogs.microsoft.com/oldnewthing/20140627-00/?p=633 https://devblogs.microsoft.com/oldnewthing/20140627-00/?p=63... [1] https://blog.regehr.org/archives/213 https://blog.regehr.org/archives/213 [2] https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.h...
      - ssokolow 6y ago
        I was more referring to how it's standard practice on modern OSes to leave the zero page unmapped in a process's address space so that, if the compiler converts the NULL dereference into a dereference of address 0x0, it'll trigger a segfault.

rini17 6y ago

WASM only provides sandboxing. That is not the same as security nor it means runtime safety nor protection from undefined behavior.

MaxBarraclough 6y ago
> WASM only provides sandboxing. That is not the same as security The relevant Wikipedia article is named Sandbox (computer security). > nor it means runtime safety nor protection from undefined behavior It puts stronger constraints on what mischief undefined behaviour can lead to, and guarantees that various runtime errors are handled with traps. [0] This isn't the same as a hard guarantee that execution will terminate whenever undefined behaviour is invoked, but it's still a step up. [0] https://webassembly.org/docs/security/ https://webassembly.org/docs/security/
- ssokolow 6y ago
  Speaking as someone who would love to see WebAssembly succeed as a cross-platform, cross-language way for me to write sandboxed plugins and CLI utilities, I do have to point out that, for out-of-browser use, WASM's MVP does regress various things: * https://00f.net/2018/11/25/webassembly-doesnt-make-unsafe-languages-safe/ https://00f.net/2018/11/25/webassembly-doesnt-make-unsafe-la... * https://www.usenix.org/system/files/sec20-lehmann.pdf https://www.usenix.org/system/files/sec20-lehmann.pdf (eg. Under WebAssembly's memory model, dereferencing NULL=0 won't lead to a segfault.)
  - MaxBarraclough 6y ago
    > Under WebAssembly's memory model, dereferencing NULL=0 won't lead to a segfault. Thanks that's a curious one. It won't always lead to a segfault with a conventional compiler either, undefined behaviour being what it is. [0][1] Fortunately GCC can be asked to add such checks at runtime, [2] this approach could also be taken with WebAssembly. [0] https://devblogs.microsoft.com/oldnewthing/20140627-00/?p=633 https://devblogs.microsoft.com/oldnewthing/20140627-00/?p=63... [1] https://blog.regehr.org/archives/213 https://blog.regehr.org/archives/213 [2] https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.h...
    - ssokolow 6y ago
      I was more referring to how it's standard practice on modern OSes to leave the zero page unmapped in a process's address space so that, if the compiler converts the NULL dereference into a dereference of address 0x0, it'll trigger a segfault.