2 ms·

Yes, WA has a defined security scope: it's right between the host and the WA program, and if you choose to sidestep it by eval-ing the output of a potentially m

Yes, WA has a defined security scope: it's right between the host and the WA program, and if you choose to sidestep it by eval-ing the output of a potentially malicious WA program, or simply handing it secrets, obviously you can get poor outcomes. No, WA has not solved the halting problem and fixed all bugs in sandboxed programs. Yes, it's important for people developing WA-based systems to acknowledge the above limitations. You've been brandying about this paper for the last year as if it means something that it doesn't [1-12]. Every time someone actually reads it they come to the same conclusion that this paper says nothing about the WA-host memory barrier -- and "everyone" includes the authors themselves [13]. And every time you respond by moving the goal posts with "but but WA isn't magic security pixie dust that solves all security problems". If I sound annoyed it's because I've been pushing back on your FUD with nary a direct response that acknowledges these limitations to your narrative and I am annoyed. Also, it's been a year now, where are all these papers that break WA that you keep promising? Are you privy to WA-host memory barrier breaking results that have yet to be published (and aren't just repackaged CPU vulnerabilities)? I'm open to evaluating the claim of such a break being found in the future, but there's no evidence for it yet. [1-12]: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=pjmlp%20Everything%20Old%20Is%20New%20Again%3A%20Binary%20Security%20of%20WebAssembly&sort=byPopularity&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... [13]: https://news.ycombinator.com/item?id=24223979 https://news.ycombinator.com/item?id=24223979

pjmlp 5y ago
I will keep pushing FUD as you call it, because the so called "security" improvements of WebAssembly aren't there. Just marketing, it doesn't matter that the host isn't directly exploited, when it can be affected by the behaviour of internal corrupted datastructurs inside the WASM module, just like an exploited OS process afects the surroundoing environment with its actions. A security sales pitch used to stagnate the state of RIA during the last 10 years. As for the papers not being there, I guess it is more fun to try to exploit other stuff than WebAssembly. Rest assured that you will be notified when they get announced.
- infogulch 5y ago
  An exploited WASM module can affect all the things it has access to, just like an exploited OS process can affect all the things it has access to. Agreed. Where we disagree is when you refuse to acknowledge that these two isolation systems can have vastly different access. The key thing to observe is that WASM's access is configurable; yes that means it could be up to the same level of access as a process if you're an idiot and give it that, but it could also be much more locked down than a process ever could be and in fact that's the point of using WASM. A process can attack the entire kernel via all syscalls, the entire filesystem, anything accessible over the network, any devices attached to the computer, etc, etc. If you write a game plugin architecture based on WASM and only give it access to affect entities in your game (and you're careful to treat its output as if it came from a potentially malicious remote server), there's nothing that the WASM plugin can do to break out, it can't attack arbitrary resources on your computer. Configured properly, at best you could compare WASM to a locked down SELinux process, but WASM is so much more portable that it's basically a new category of thing.
- infogulch 5y ago
  > As for the papers not being there, I guess it is more fun to try to exploit other stuff than WebAssembly. Yeah I guess a target with an attack surface that includes every web browser compiled in the last 5 years and ubiquitous cloud infrastructure that terminates half the web's TLS sessions is just too boring and low profile. Sure, that's why nobody's found a vulnerability yet. > Rest assured that you will be notified when they get announced. Certainly, I can read the HN front page just as well as anyone. But I suppose that means you don't have anything better either.

pjmlp 5y ago

I will keep pushing FUD as you call it, because the so called "security" improvements of WebAssembly aren't there. Just marketing, it doesn't matter that the host isn't directly exploited, when it can be affected by the behaviour of internal corrupted datastructurs inside the WASM module, just like an exploited OS process afects the surroundoing environment with its actions. A security sales pitch used to stagnate the state of RIA during the last 10 years. As for the papers not being there, I guess it is more fun to try to exploit other stuff than WebAssembly. Rest assured that you will be notified when they get announced.

infogulch 5y ago
An exploited WASM module can affect all the things it has access to, just like an exploited OS process can affect all the things it has access to. Agreed. Where we disagree is when you refuse to acknowledge that these two isolation systems can have vastly different access. The key thing to observe is that WASM's access is configurable; yes that means it could be up to the same level of access as a process if you're an idiot and give it that, but it could also be much more locked down than a process ever could be and in fact that's the point of using WASM. A process can attack the entire kernel via all syscalls, the entire filesystem, anything accessible over the network, any devices attached to the computer, etc, etc. If you write a game plugin architecture based on WASM and only give it access to affect entities in your game (and you're careful to treat its output as if it came from a potentially malicious remote server), there's nothing that the WASM plugin can do to break out, it can't attack arbitrary resources on your computer. Configured properly, at best you could compare WASM to a locked down SELinux process, but WASM is so much more portable that it's basically a new category of thing.
infogulch 5y ago
> As for the papers not being there, I guess it is more fun to try to exploit other stuff than WebAssembly. Yeah I guess a target with an attack surface that includes every web browser compiled in the last 5 years and ubiquitous cloud infrastructure that terminates half the web's TLS sessions is just too boring and low profile. Sure, that's why nobody's found a vulnerability yet. > Rest assured that you will be notified when they get announced. Certainly, I can read the HN front page just as well as anyone. But I suppose that means you don't have anything better either.