4 ms·
WebAssembly’s sandbox is quite a bit stronger than Flash’s was though.
by girvo 5y ago
WebAssembly’s sandbox is quite a bit stronger than Flash’s was though.
- pjmlp 5y agoNo need to escape the sandbox to abuse the users computer, or reach out to possible secrets, if they happen to go through exported functions.
- girvo 5y agoFor sure. But one of the bigger issues with flash was it’s runtime being a constant source of RCEs
- pjmlp 5y agoNow you get to enjoy them as JIT CVEs.
- girvo 5y agoThough from my understanding, there is far less of them, they're harder to do, and easier to solve. And even if it's the same amount, having a sandbox that's harder to escape, holding everything else equal, seems like a win for end-users. Flash's demise, while it caused me no end of grief back in the day as it was the bulk of my income, was a good thing in the end.
- pjmlp 5y agoFlash did not went away, thanks to the wonders of WebAssembly. https://leaningtech.com/cheerpx-for-flash/ https://leaningtech.com/cheerpx-for-flash/
- domakidis 5y agoMay I ask how have you been monetizing Flash up to that point? I remember reading examples from an e-book on how to build 3D scenes with Flex 3 when I was 17-18 years old. It was a short lived dream of mine to create online video games. Instead, I ended-up making add-ons for PHP-based forums. During that era Unity had its own web browser plugin and there was at least one Tennis-like game on the miniclip site itself.
- girvo 5y agoI owned and ran a web design agency, but because of my skills in Flash a lot of our "value add" was doing impressive experiences/interactive showcases for our various clients. A lot of it was doing kiosk deployment work, which I think is still done today with Flash sometimes.
- croes 5y agoCrypto miners don't need to escape a sandbox
- aaaaaaaaata 5y agoEasy solution, don't leave random webgames running when you're done with them, and if it doesn't noticeably impact performance...?
- pjmlp 5y agoYou don't need a game for that, any website will do, specially with background workers.
- aaaaaaaaata 5y agoExactly! Who's checking for this stuff on every blog page open, actually? I wish I was, but, usually am not.
- boutell 5y agoModern browsers will flag and slow down tabs that abuse the cpu. You could probably still mine but it’s a slow drip.