4 ms·
In this context the security guarantees are geared toward the attack threath the web faces: sandboxing untrusted code. You could say that this is the most web-
by afiori 6y ago
In this context the security guarantees are geared toward the attack threath the web faces: sandboxing untrusted code.
You could say that this is the most web-specific aspect of Web Assebly
- pjmlp 6y agoWhat matters is if WebAssembly actually holds the security guarantees used to sell it in detriment of PNaCL and CrossBridge. If not, then it was just smoke and mirrors to sell an agenda and delay progress 10 years. "Unreal Engine 3 Support for Adobe Flash Player - Epic Citadel" -> 2011 https://www.youtube.com/watch?v=xzyCTt5KLKU https://www.youtube.com/watch?v=xzyCTt5KLKU
- afiori 6y agoI know very little about PNaCl, I cannot say whether wasm is better or worse, I am just defending the existence of the specific role for webassembly: lightweight sandboxing with strong sandboxing guarantees. Personally I have high expectations in this strategy. Regarding the "Everything Old Is New Again: Binary Security of WebAssembly" they find that compiling something like photoshop to a single wasm module forfeits many security features available in x86, but this also point toward a future where application can be compiled in dozens or more small isolated modules. It remains to be seen if this will suceed or fail...
- pjmlp 6y agoI lost count how many bytecode formats and sandboxes I have used, or read about. WebAssembly is what the browsers now offer us, so I have to accept it, that doesn't mean I buy into the security story, specially when basic stuff like bounds checking inside the same linear memory segment is not considered as relevant. That paper is just the first of many yet to come.
- afiori 6y agoThat is fair, trust should be earned, not granted; I hope we will see a world where that will happen :)