4 ms·

I skimmed through the pdf in less than 10 minutes, but from what it seems, it is pointing out how vulnerable binaries compiled to WebAssembly are still vulnerab

I skimmed through the pdf in less than 10 minutes, but from what it seems, it is pointing out how vulnerable binaries compiled to WebAssembly are still vulnerable to exploitation. Well, duh. What WebAssembly protects is the host machine, not the binary running inside the VM. None of these are attacks on the VM itself.

pjmlp 5y ago
Basically just nothing more than an OS process. It is not duh when WebAssembly advocates use the security sales pitch.
- Matheus28 5y ago
  The entire point is running completely untrusted code safely contained from the host. Not protect the code from itself (which was never the intention). It might bare some resemblance to OS processes in its sandbox capabilities, but it offers a lot more: - OS independent - CPU independent - Easy target for compilers - Easily embeddable - Code cannot modify itself in memory (which makes the point below easier) - Easy to prove safe from accessing the host (very limited instruction set, can only access a certain address range of memory). It is hard to make a mistake implementing a VM. It's not too complex, and you can make sure every memory load/write instruction emitted is written to target "(BASE_ADDRESS<<32) | x", with x being the pointer as seen from inside the wasm, and BASE_ADDRESS being the upper 32 bits of the 4 GiB aligned range you have of virtual memory for the module The fact that it is widely implemented by browsers helps prove all these points. I'm sure the next big fun project for some people is gonna be writing a microkernel that runs wasm binaries in ring 0. It's that safe (of course, spectre might add a bit of overhead to context switching still).
  - pjmlp 5y ago
    All valuable points when one ignores the history of bytecode distribution formats since the early 1960's, capabilities and containers security measures on OS processes. No need to modify the code when data can be corrupted and thus be misused to influence the decisions taken by the code. Yes, it will be probably a fun project replicating Burroughs architecture in 2021. By the way, had Chrome the same market share in 2010 that it enjoys today, everyone would be talking how great PNaCL is.
    - unrealhoang 5y ago
      Flash and Java had the market, but failed, so I wouldn’t be too excited about PNaCL. Isn’t the open-source, foundation-based standard the selling point of wasm?
      - pjmlp 5y ago
        They did not fail, politics killed them, the same politics that pushed for WebAssembly, but thanks to the WebAssembly pandora box, they were reborn just like Phoenix out of the ashes, https://leaningtech.com/cheerpj https://leaningtech.com/cheerpj https://leaningtech.com/cheerpx-for-flash https://leaningtech.com/cheerpx-for-flash Enjoy
        sitkack 5y ago
        I don't understand why you are so bitter about this. The fact that Wasm has a binary representation is orthogonal to the design. It has CFI and capabilities. CFI allows it to be compiled down to native code safely and run inside the same address space of the containing process. Capabilities control what gets in or out. You would be well served to ignore the whole bytecode aspect and just accept the Wast.

pjmlp 5y ago

Basically just nothing more than an OS process. It is not duh when WebAssembly advocates use the security sales pitch.

Matheus28 5y ago
The entire point is running completely untrusted code safely contained from the host. Not protect the code from itself (which was never the intention). It might bare some resemblance to OS processes in its sandbox capabilities, but it offers a lot more: - OS independent - CPU independent - Easy target for compilers - Easily embeddable - Code cannot modify itself in memory (which makes the point below easier) - Easy to prove safe from accessing the host (very limited instruction set, can only access a certain address range of memory). It is hard to make a mistake implementing a VM. It's not too complex, and you can make sure every memory load/write instruction emitted is written to target "(BASE_ADDRESS<<32) | x", with x being the pointer as seen from inside the wasm, and BASE_ADDRESS being the upper 32 bits of the 4 GiB aligned range you have of virtual memory for the module The fact that it is widely implemented by browsers helps prove all these points. I'm sure the next big fun project for some people is gonna be writing a microkernel that runs wasm binaries in ring 0. It's that safe (of course, spectre might add a bit of overhead to context switching still).
- pjmlp 5y ago
  All valuable points when one ignores the history of bytecode distribution formats since the early 1960's, capabilities and containers security measures on OS processes. No need to modify the code when data can be corrupted and thus be misused to influence the decisions taken by the code. Yes, it will be probably a fun project replicating Burroughs architecture in 2021. By the way, had Chrome the same market share in 2010 that it enjoys today, everyone would be talking how great PNaCL is.
  - unrealhoang 5y ago
    Flash and Java had the market, but failed, so I wouldn’t be too excited about PNaCL. Isn’t the open-source, foundation-based standard the selling point of wasm?
    - pjmlp 5y ago
      They did not fail, politics killed them, the same politics that pushed for WebAssembly, but thanks to the WebAssembly pandora box, they were reborn just like Phoenix out of the ashes, https://leaningtech.com/cheerpj https://leaningtech.com/cheerpj https://leaningtech.com/cheerpx-for-flash https://leaningtech.com/cheerpx-for-flash Enjoy
      - sitkack 5y ago
        I don't understand why you are so bitter about this. The fact that Wasm has a binary representation is orthogonal to the design. It has CFI and capabilities. CFI allows it to be compiled down to native code safely and run inside the same address space of the containing process. Capabilities control what gets in or out. You would be well served to ignore the whole bytecode aspect and just accept the Wast.