4 ms·

This came across HN before. [1] My conclusion then: > Notably, they don't appear to even try to break the WA-host memory barrier, which I actually find to be a

This came across HN before. [1] My conclusion then: > Notably, they don't appear to even try to break the WA-host memory barrier, which I actually find to be a validation of the core design goal of WebAssembly: isolate the damage a vulnerable program can inflict to the memory space (and thus also output) of that program. Protect the host from the program, but not the program from itself. Also, maybe don't dump WA output you can't validate directly into DOM. [1]: https://news.ycombinator.com/item?id=24216764 https://news.ycombinator.com/item?id=24216764

pjmlp 6y ago
Regardless, WebAssembly just got one security group doing research against it, I expect plenty more to switch their attention into it, as WebAssemly slowly starts to gather more market share. > Protect the host from the program, but not the program from itself. All nice and dandy, except that the goal of WebAssembly is to extend the host, and have the host be dependant on the program behaviour. A host unaware that the program is compromised can be led to take decisions that it wouldn't otherwise do, like allow a basic user to acquire admin credentials, that were supposedly correctly validated by the program. I am really eager to see the amount of CVE's on WebAssembly to start poping up, then the whole WebAssembly advocates can tell the world why we had to ditch PNaCL and CrossBridge, 10 years of regress, and get the same outcome in the end.
- afiori 6y ago
  In this context the security guarantees are geared toward the attack threath the web faces: sandboxing untrusted code. You could say that this is the most web-specific aspect of Web Assebly
  - pjmlp 6y ago
    What matters is if WebAssembly actually holds the security guarantees used to sell it in detriment of PNaCL and CrossBridge. If not, then it was just smoke and mirrors to sell an agenda and delay progress 10 years. "Unreal Engine 3 Support for Adobe Flash Player - Epic Citadel" -> 2011 https://www.youtube.com/watch?v=xzyCTt5KLKU https://www.youtube.com/watch?v=xzyCTt5KLKU
    - afiori 6y ago
      I know very little about PNaCl, I cannot say whether wasm is better or worse, I am just defending the existence of the specific role for webassembly: lightweight sandboxing with strong sandboxing guarantees. Personally I have high expectations in this strategy. Regarding the "Everything Old Is New Again: Binary Security of WebAssembly" they find that compiling something like photoshop to a single wasm module forfeits many security features available in x86, but this also point toward a future where application can be compiled in dozens or more small isolated modules. It remains to be seen if this will suceed or fail...
      - pjmlp 6y ago
        I lost count how many bytecode formats and sandboxes I have used, or read about. WebAssembly is what the browsers now offer us, so I have to accept it, that doesn't mean I buy into the security story, specially when basic stuff like bounds checking inside the same linear memory segment is not considered as relevant. That paper is just the first of many yet to come.
        afiori 6y ago
        That is fair, trust should be earned, not granted; I hope we will see a world where that will happen :)

pjmlp 6y ago

Regardless, WebAssembly just got one security group doing research against it, I expect plenty more to switch their attention into it, as WebAssemly slowly starts to gather more market share. > Protect the host from the program, but not the program from itself. All nice and dandy, except that the goal of WebAssembly is to extend the host, and have the host be dependant on the program behaviour. A host unaware that the program is compromised can be led to take decisions that it wouldn't otherwise do, like allow a basic user to acquire admin credentials, that were supposedly correctly validated by the program. I am really eager to see the amount of CVE's on WebAssembly to start poping up, then the whole WebAssembly advocates can tell the world why we had to ditch PNaCL and CrossBridge, 10 years of regress, and get the same outcome in the end.

afiori 6y ago
In this context the security guarantees are geared toward the attack threath the web faces: sandboxing untrusted code. You could say that this is the most web-specific aspect of Web Assebly
- pjmlp 6y ago
  What matters is if WebAssembly actually holds the security guarantees used to sell it in detriment of PNaCL and CrossBridge. If not, then it was just smoke and mirrors to sell an agenda and delay progress 10 years. "Unreal Engine 3 Support for Adobe Flash Player - Epic Citadel" -> 2011 https://www.youtube.com/watch?v=xzyCTt5KLKU https://www.youtube.com/watch?v=xzyCTt5KLKU
  - afiori 6y ago
    I know very little about PNaCl, I cannot say whether wasm is better or worse, I am just defending the existence of the specific role for webassembly: lightweight sandboxing with strong sandboxing guarantees. Personally I have high expectations in this strategy. Regarding the "Everything Old Is New Again: Binary Security of WebAssembly" they find that compiling something like photoshop to a single wasm module forfeits many security features available in x86, but this also point toward a future where application can be compiled in dozens or more small isolated modules. It remains to be seen if this will suceed or fail...
    - pjmlp 6y ago
      I lost count how many bytecode formats and sandboxes I have used, or read about. WebAssembly is what the browsers now offer us, so I have to accept it, that doesn't mean I buy into the security story, specially when basic stuff like bounds checking inside the same linear memory segment is not considered as relevant. That paper is just the first of many yet to come.
      - afiori 6y ago
        That is fair, trust should be earned, not granted; I hope we will see a world where that will happen :)