16 ms·

Why am I excited about WebAssembly?

170 points by cptcobalt 4y ago

Starlevel001 4y ago
web devs re-invent webjars
- zamadatix 4y ago
  More re-invent JVM/Flash VM but yess extremely similar concepts. This was not done ignorantly though, WASM was much easier to build inside of existing browser engines and gave a bit more freedom in design.
- worik 4y ago
  Faster. Smaller. Better
projektfu 4y ago
What can wasm accomplish in that way that Java couldn't? I'm really confused about the hoopla.
- pjmlp 4y ago
  Some folks have need to create startups to fulfill a need we don't know we need to have solved.
  - bloppe 4y ago
    Well, unlike Java, Wasm is not the product of a for-profit company. It's a W3C standard that actually does solve many problems most people didn't realize they had. It essentially obsoletes virtualization (CTO of Docker famously said "If WASM+WASI existed in 2008, we wouldn't have needed to created [sic] Docker. That's how important it is"). It will allow the creation of a unified software ecosystem across languages (Wasm "components" are designed to allow you to e.g. import numpy into a JavaScript project. See https://hacks.mozilla.org/2019/08/webassembly-interface-types/ https://hacks.mozilla.org/2019/08/webassembly-interface-type...). The virtual machine is designed from the ground up to make many types of vulnerabilities, such a stack smashing, impossible. And, as an open standard, it's not beholden to the whims and lawyers of Oracle. I'm not 100% certain the W3C working group won't end up fumbling it, but if you're not excited about wasm then you probably just don't know much about it.
    - kaba0 4y ago
      Oracle was the company that completely open-sourced OpenJDK and even their own paid support JDK is just a minor modification of the former. Java and the JVM is also among the few languages/platforms with separate specifications, and multiple completely independent implementations. If anything, Java is a much much safer bet than the oligopoly of WebKit/Blink.
    - pjmlp 4y ago
      Yet there are enough for profit companies on its genesis and foundation. As for Docker, it is basically Java Application Servers full with YAML spaghetti to the point it makes me miss Websphere 5. Or even better, mainframe and microcomputers language environments like on IBM i, z/OS and Unisys ClearPath. Maybe its founders should have learned what preceded it.
      - EUROCARE 4y ago
        The founders know very clearly what preceded it as they're working with the authors of these previous attempts (JVM, CLR, etc) to integrate their stacks with Wasm.
        pjmlp 4y ago
        And yet they claim novelty while walking used trails...
      - colordrops 4y ago
        Most of the entire tech stack all the way down to transistors had for profit companies involved in their genisis and foundation.
        pjmlp 4y ago
        Except the " Wasm is not the product of a for-profit company." seems to be unaware of it.
- k__ 4y ago
  I think, the main point is that it isn't owned by Oracle. But also, that it's more for non-GC languages.
- diegocg 4y ago
  Nothing. People have been able to compile other languages into java bytecode for decades already. That didn't turn java into the one true runtime to rule them all, and webassembly will not be any different. I wish browser makers would focus into making the browser user and development experience actually work instead of going after the latest shiny feature.
  - PUSH_AX 4y ago
    > Nothing. How about not relying on the JRE? Mobile support? Partitioning between applet world and JS world?
    - kaba0 4y ago
      How are any of this relevant if we talk about a hypothetical future if Java was continued to be used in browsers? Browsers would include a JRE (which they actually did at a time as well, but that’s just a tiny technicality either way), there wasn’t even mobiles capable of browsing the net at the time, but there is nothing inherently unsolvable, it’s not like there is no partitioning between wasm and js world, but in this alternative reality there wouldn’t be js. Java could have access to the DOM.
  - simonw 4y ago
    Being able to compile languages to Java bytecode doesn't help if you still have to convince users to install a Java runtime environment. WebAssembly doesn't have this problem: almost every user is already running a browser that supports it.
    - hashmash 4y ago
      In the early days of Java, it was bundled with the browser. But because Sun didn't make their own (popular) browser, they couldn't dictate the terms for what features a browser was expected to include.
- vbezhenar 4y ago
  wasm runs in your browser. Java does not.
  - rjsw 4y ago
    Java could have been made to run well in a browser, giving applets good access to the DOM of their containing page wouldn't have been too difficult.
    - pjmlp 4y ago
      Not only it wasn't, it has always been possible to do so from Applets.
      - rjsw 4y ago
        When I wrote good access, I was really thinking that Java would have needed to provide an API at least as good as JQuery, not just a low-level way to walk nodes in a tree.
        pjmlp 4y ago
        The API was there nevertheless.
  - Jaxan 4y ago
    It used to, though.
  - orev 4y ago
    They are using the past tense of Java. In case you don’t know, the primary use of Java when it came out was to run “applets” inside the browser. And it was terrible. It was later when it became mostly a server-side thing (which at the time was dominated by languages like Perl, PHP, etc.)
    - hawkeyedan 4y ago
      To be precise, applets were an early application of Java. But Sun Microsystems actually developed it in the long-standing dream of the “universal binary.” The project began in 1991 targeting set-top boxes. [source](https://web.archive.org/web/20100210225651/http://www.java.com/en/javahistory/ https://web.archive.org/web/20100210225651/http://www.java.c...) WASM is another iteration of the same noble idea done with different technologies at a different moment. Java and the JVM have been incredibly successful. WASM has the potential to bring the dream of a universal binary even farther.
- nikki93 4y ago
  You can compile C, C++ and a bunch of other languages to Wasm, while you can't do that with Java as a target. A lot of existing C code compiles unchanged. And Wasm also actually runs in all browsers nowadays without the user noticing a difference (eg. iOS Safari too).
  - brian_herman 4y ago
    What we should be comparing it is to activeX and flash will it have the security that those two technologies didn't?
    - Georgelemental 4y ago
      WASM uses the browser sandbox, from what I understand it re-uses the same facilities that browsers use for JIT
      - ridiculous_fish 4y ago
        WASM's sandboxing as implemented in practice is different from JITs. It works by allocating a 4GB region of virtual memory and treating the base address as NULL. Pointers in WASM are 32 bit so they are unable to point outside the region. The big win is the runtime doesn't need to check pointers for validity. However there are some downsides relative to native code: 1. Can't address more than 4GB of memory 2. Can't be efficiently implemented on 32 bit systems 3. Can't share memory between WASM modules 4. NULL dereferences don't trap (I think) I would not be surprised if future CPUs had hardware support for this stuff, e.g. load/stores with a mask to confine the pointers.
        pjmlp 4y ago
        Just like Solaris SPARC has been doing like for 10 years.
        jb1991 4y ago
        Neat. I thought Web pages were limited to 2 GB memory. I guess tines have changed.
- dragonwriter 4y ago
  > What can wasm accomplish in that way that Java couldn't? I'm really confused about the hoopla. Provide relatively efficient support for languages other than JavaScript that is reliably available in major browsers without user action, an insecure plugin model, etc.
- stevemk14ebr 4y ago
  Java != JavaScript
- hajile 4y ago
  Wasm outright forbids things like GOTO and other potentially insecure features opting instead for structured programming. Java has been the subject of countless security vulnerabilities. Wasm also has the ability to stream bytecode and validate/compile as it streams (fast parsing was a major design goal) resulting in much faster startup times. Wasm is easier to integrate into the JIT/VM already shipping in browsers so they don't have to ship two massive engines. Wasm is a bit lower level which should result in faster execution than the JVM in the future. Wasm doesn't require garbage collection. Wasm has unsigned integers. Wasm isn't encumbered by Oracle.
  - hashmash 4y ago
    Which Java vulnerabilities are you referring to which require breaking bytecode compatibility?
    - hajile 4y ago
      I misspoke (and updated my comment).
      - hashmash 4y ago
        Ok. I'm also curious about your comment regarding GOTO. How is it potentially insecure?
        worik 4y ago
        > Ok. I'm also curious about your comment regarding GOTO. How is it potentially insecure? Really? Is that a question? The trend over the years has been to structure our code. GOTO throws all of that away. Jump straight over the guards.
        hashmash 4y ago
        The Java language doesn't have a goto statement, and so all code is properly structured. A labeled break statement is almost a goto statement, but it still obeys structuring rules -- i.e., you cannot jump into the middle of a loop. At the bytecode level, all structured constructs get compiled into forms that rely on goto statements. Is this inherently insecure? Should the bytecode require structured programming too? How does this guard against malicious use any more than verified bytecode that relies on gotos?
- olalonde 4y ago
  Become a web standard.
- mikewarot 4y ago
  It provides a security model that actually works. WASM code can't access the outside world, except for channels you explicitly provide to it. Everything before it eventually let you have full access to the host file system, if you asked nicely, were given permission, or leveraged a bug in the system.
  - int_19h 4y ago
    wasm is only as secure as the runtime that you're using, and I would be extremely surprised if none of them have sandbox-breaking bugs in the long term.
    - Etherlord87 4y ago
      Can you elaborate? To my understanding you compile code into opcodes and it's as safe as the stack machine going through the opcodes. To my understanding the runtime is the part of the compiled code, and not the stack machine going through it.
  - pjmlp 4y ago
    Usenix Security '20-Everything Old Is New Again: Binary Security of WebAssembly" https://www.youtube.com/watch?v=glL__xjviro https://www.youtube.com/watch?v=glL__xjviro "The Security Risk of Lacking Compiler Protection in WebAssembly" https://arxiv.org/abs/2111.01421 https://arxiv.org/abs/2111.01421
- DonHopkins 4y ago
  WebAssembly isn't owned by Oracle. That's the most important reason to use WebAssembly instead of Java. It's also nice that it can do all kinds of things Java can't, but that's just icing on the cake.
  - bhaak 4y ago
    OP used "couldn't" and was referring IMHO to the days of Java applets.
- johannes1234321 4y ago
  On the browser side: What killed Java was to a large part loading times. First the Plugin had to load, then the bytecode had to be run. On many systems one immediately knew when Java was used by the browser getting slow and sleeping for a while. Flash loaded a lot faster (also systems were better, generally) however Flash apps completely messed with user experience. Nowadays JavaScript can do a lot of things better (say changing URL, history support, back button) which can be integrated with a wasm tool for having a way more seamless integration. As a user you simply don't notice if something is using JS or wasm. From there it imo carries over to the server side and other places. Java simply got a bad reputation as resource hog used for bad UI in Applets and many people looked elsewhere. And then wasm supports C and C++ (and more) with huge eco system of libraries, applications, ... (While of course these days a Java VM (incl. Android) is often used with non-Java languages as well)
stevebmark 4y ago
Fun fact: Wasm can be be significantly slower than vanilla Javascript https://betterprogramming.pub/how-fast-is-webassembly-versus-javascript-bc0eca058a54 https://betterprogramming.pub/how-fast-is-webassembly-versus...
- maxgraey 4y ago
  The article is relatively old. But I have the most complaints about the performance measurements. The WebAssembly should be tested in a way that eliminates the interop time, which is very expensive. That's why sorting and simple multiplication will always be slower if tested outside WebAssembly. Sorting in AssemblyScript is actually faster than in Rust or JavaScript: https://twitter.com/MaxGraey/status/1414867216676368384 https://twitter.com/MaxGraey/status/1414867216676368384
- enos_feedler 4y ago
  This might be a fact, but it certainly isn’t fun or interesting. Anybody who is framing WebAssembly into some sort of competition with javascript is completely missing the point of it’s existence. The major problem with WebAssembly right now is the major point of it’s existence is mirky. It will take time and effort from everyone using it for figure out it’s true calling, but I am hopeful and optimistic this gets discovered. In the meantime it doesn’t help to pit it against javascript.
  - smegsicle 4y ago
    what should it be compared against if not javascript?
    - zamadatix 4y ago
      Any general purpose VM is fine, including the VMs behind JavaScript, but just double check that's actually what's being compared instead of inter JavaScript and VM performance. How many times per second you can call 1-5 line functions from a webpage's execution context is comparing the latter and as the article notes at the end: > definitely don’t go converting all your websites’ JavaScript to WebAssembly! However, that’s not really the aim of WebAssembly. Its aim is to enable richer experiences on the web that require higher performance, for example machine learning, virtual reality, or gaming. WASM functions aren't meant to replace small JS functions on your standard website. It's meant to be a general purpose VM you can target large amounts of non-webpage code to.
amelius 4y ago
> If the device performs safety-critical functions, like actuating power, medical equipment, or a connected car, the firmware and software cannot be updated without rigorous testing. If the device requires certification, updating it may require recertification. But can we trust car manufacturers to do this testing and recertification before they push an update?
- jeffreygoesto 4y ago
  Generally yes. The delta tests for several classes of changes are baked in heavy processes and their execution is regularly audited. Maybe some startup cowboys see that differently, but then in their cars people are harmed while doing whatever...
  - amelius 4y ago
    Are you sure? I can't help but think of the VW emissions scandal. A "quick update" might seem a better choice to some managers than grounding the fleet.
    - jeffreygoesto 4y ago
      I am actually surprised that scandal did not get more people behind bars, because given the amount of processes, there must have been quite some number of bros knowing what's going on and covering each other.
sbf501 4y ago
I understand the excitement of the author, but I think they've simply added to the attack surface for very little ROI. IoT security is a HUGE risk, and securing boot and firmware updates is nontrivial. Even the supply-chain can be attacked, where the JTAG programmers are targets. The idea of being able to tune an ML model in the field is something that should be either built into the firmware with a dedicated HTTP port (like most devices do, by adding a lightweight LWIP server for config that is severely locked down), or a specialized App, which is what 99% of user-configurable IoT devices already do. TL;DR - Webassembly is completely unrelated to IoT provisioning and configuration.
- cptcobalt 4y ago
  I'm not completely sure your TLDR is a well-founded and fair distillation of your comment. And your comment itself reads as if it's a skim of the post itself. Yes, IoT security is obviously a huge risk, yet Wasm would dramatically reduce the possibility space of many (but not all) types of attacks.
  - sbf501 4y ago
    The article itself is very thin, as there is nothing practical it proposes.
fayten 4y ago
I have not been able to get excited about WASM due to the poor memory management situation. It’s been years since the MVP and we are still in limbo about freeing memory. A great issue documenting a lot of the pain points around this is here: https://github.com/WebAssembly/design/issues/1397 https://github.com/WebAssembly/design/issues/1397 Until this is solved WASM is dead in the water for a huge variety of applications. I am rooting for WASM, but it has been discouraging to watch this go unsolved over the years.
- capableweb 4y ago
  I'm not sure I fully understand the issue here, but reading through it, it seems to point towards that this issue only happens to people using 32bit browsers? Which, I assume (depending on the environment of course), is a very small section of users nowadays.
  - tyingq 4y ago
    Maybe not: https://github.com/WebAssembly/memory64/blob/main/proposals/memory64/Overview.md https://github.com/WebAssembly/memory64/blob/main/proposals/...
    - IshKebab 4y ago
      That's about 64 bit WASM not 64 bit browsers.
      - tyingq 4y ago
        It's about desktop WASM not having access to all the memory and so fine grained management of memory there could be important also.
- deleted 4y ago
  [deleted]
- rr808 4y ago
  Agreed on this, I assumed you'd be able to write for WASM with go, Java etc but no GC based languages are allowed.
pjmlp 4y ago
WebAssembly on the Edge, aka newer generations rediscover Propeller, BASIC Stamp, Java Embedded,....
- deleted 4y ago
  [deleted]
- deleted 4y ago
  [deleted]
cassepipe 4y ago
I am curious. I barely know any webdev and only program C and C++. Are there things that one still need JS for even though using webassembly ?
- gavinray 4y ago
  So, to clarify, "WEBassembly" was a terrible name in retrospect -- the majority of WASM use (that I have encountered) is serverside, not clientside. The super tl;dr of WASM is that it's a universal bytecode format, an idea sort of like the JVM or the CLR. There are a few major benefits to this: 1. Languages can pick WASM as a compile target, and then run anywhere that WASM is supported. This includes the browser, the server, embedded devices, wherever. 2. WASM acts as a "Lingua Franca" for interop between languages, sort of like a C ABI. Any language that supports importing WASM bundles immediately gains support for calling code from any language that supports compiling to WASM. It's trivial to write a program that calls functions from IE. Rust, Go, Zig, and C# in the span of 10 lines, because of WASM. On the clientside, you still need JS because WASM needs to interact with the browser's DOM API's. I'm not convinced of the benefits of WASM for writing web apps. (One exception is maybe Blazor for .NET, which is exceptionally well-done)
- klohto 4y ago
  Simply put, missing DOM manipulation. Here [0] is quite a good summary with plenty of links to currently open proposals/issues on WA's GitHub that would allow it to do that. [0]https://sudonull.com/post/62869-WebAssembly-and-DOM-manipulation https://sudonull.com/post/62869-WebAssembly-and-DOM-manipula...
  - torginus 4y ago
    Hmm, wouldn't it suffice just to export a createHandle() function to WASM, which could then use said handle to reference the underlying C++ object of the HTML element. V8's involvement isn't even necessary. The DOM element then would be collected, when there are no JS references to it, its handle is disposed of by the WASM code, or the WASM runtime itself is destroyed. Seems like a very similar problem to how game engines integrate scripting languages like Lua - with very similar solutions.
torginus 4y ago
I'm curious - what does WASM offer that emscripten + asm.js didn't?
- jsheard 4y ago
  From the creator of Emscripten: https://hacks.mozilla.org/2017/03/why-webassembly-is-faster-than-asm-js/ https://hacks.mozilla.org/2017/03/why-webassembly-is-faster-... Asmjs was a clever hack but still a hack, and starting over with a clean slate let them fix various limitations inherent to using Javascript as a compilation target
  - pjmlp 4y ago
    Only because they refused to adopt PNaCL.
- azakai 4y ago
  Wasm is smaller and faster than JavaScript and asm.js. It is both faster on average, it has far better predictability (far fewer performance cliffs or pitfalls), and it starts up faster (faster to decode + no need to warm up the JIT with types at runtime). You can test this pretty easily, since Emscripten still supports JavaScript output with a flag (for environments that lack wasm support for whatever reason). Comparing Emscripten's default wasm output to JS output for the same benchmark will show those benefits in most cases.
stefan_ 4y ago
> If the device performs safety-critical functions, like actuating power, medical equipment, or a connected car, the firmware and software cannot be updated without rigorous testing. If the device requires certification, updating it may require recertification. Updates are disruptive and need to be scheduled when the device is not performing its critical functions. Even just performing the update presents risks: if the update ends up bricking millions of devices and requires manual intervention, it could prove an existential risk to the business or the safety of individuals. WebAssembly does nothing to address any of this. The least important part about this is the language the code is written in. I think this person has thoroughly confused code running in a VM with code being secure, safe and performing to specification.
Rochus 4y ago
Nice that the author is enthusiastic; but everything he praises has been around for many years or has a rather hobbyist touch (e.g. what he writes in "The Edge" section). Webassembly has undoubted potential, but in the original use case (browser applications) it is still clearly too slow and inflexible; and interestingly, the adaptation seems to take place more in areas that are well occupied by Node, CLI or the Java VM. I just recently looked again at the current state and studied current literature with the intention of writing a WASM backend for Oberon+; but the technology probably needs a few more years to be worthwhile; at the very least, a built-in GC (or at least a means to scan the stack) should be available, otherwise the implementation would become incredibly inefficient.
- nikki93 4y ago
  GC implementations over Wasm definitely have perf issues. eg. Go compiled to Wasm has these with its GC. The main way when compiling to Wasm now is to not use a GC, which is reasonable depending on the application in question. It's quite reasonable for games or graphics applications. But yeah Wasm has definitely been used successfully with performance results in production, eg. in Figma: https://www.figma.com/blog/webassembly-cut-figmas-load-time-by-3x/ https://www.figma.com/blog/webassembly-cut-figmas-load-time-...
astlouis44 4y ago
What I'm most excited about is the potential for WebAssembly (along with WebGPU) to pave the way for a whole new era of browser games and provide an alternative to developers who don't want to fork over 30% to walled gardens. My team has built out WASM/WebGPU support for Unreal Engine 4 and is in progress for Unreal Engine 5 (and other engines) with a suite of optimization tools like asset streaming (so you don't have to download a whole game at once) and advanced texture compression (necessary for low powered devices like mobile/Chromebooks). More info on us in this Venturebeat article we were featured in: https://venturebeat.com/2022/05/12/wonder-interactives-the-immersive-web-will-play-unreal-4-games-on-the-web/ https://venturebeat.com/2022/05/12/wonder-interactives-the-i...
- Etherlord87 4y ago
  What is the minimum weight of an UE4 project compiled to WASM? The article says something about a menu being 10 MB, but is that a menu done in UE4 or just something else and somehow connected with an actual game? To my knowledge an unreal executable weight at minimum around 80 MB? That would compare poorly to Godot which is very light in comparison...
- slimsag 4y ago
  Was watching your update in the Khronos Group meetup a few days ago, very impressive work. I'm excited for what this will mean for the web overall, it might finally reach that tipping point where more than .io games become standard to play in the web. That's huge, and will drive demand for more powerful web APIs too. WebGPU in general is very nice. We're building a game engine[0] that uses Zig to build Dawn (Google Chrome WebGPU implementation) from source for running on desktop / Steamdeck, and working on browser support via WASM now. The future is bright here. [0] https://machengine.org https://machengine.org
- Animats 4y ago
  What do you do about WebAssembly's lack of real threads?
  - cylon13 4y ago
jokoon 4y ago
Since I've read that the key WASM person quit her job after a burnout, I'm quite pessimistic about WASM. Not surprised if it dies in future years. To be completely honest, WASM helps having cross platforms things, which is ALWAYS against the interests of companies who always divide their market territories to guarantees steady revenues. I'm also a bit curious how they managed to make WASM happen in the first place. I'm also still waiting for C++ toolchain to directly output WASM. I haven't touched bynaryen since, but it was not a great experience.
- musingsole 4y ago
  Please, I'd love to know what singular person has such influence that their burnout spells the end of WASM?
- stevemk14ebr 4y ago
  'The key wasm person' is nonsense. It's a spec, with multiple implementations of interpreters, jits, and other execution environments. Even outside of browsers there's other runtimes.
- capableweb 4y ago
  > Since I've read that the key WASM person quit her job after a burnout, I'm quite pessimistic about WASM. Not surprised if it dies in future years. WebAssembly is so big at this point it's too big to fail (famous last words maybe?). All major browsers support it (Firefox, Chrome, Safari and Edge), runtimes are available for non-browser usage, and a big amount of people are involved in moving it forward. If it was early days, then maybe losing one key person could have changed the fate of WebAssembly. But at this point, there are multiple key people both inside and outside the WebAssembly organization.
- jedisct1 4y ago
  Zig C++ directly compiles to WASM.
  - pjmlp 4y ago
    clang actually.
peanut_worm 4y ago
I am currently writing a typescript project with deno. I need to resize lots of very large images (20mb+) in a reasonable timeframe so I was considering using web assembly for it. Does that seem like a good fit? I have never used WASM before so I am wondering if its worth it.
- ywei3410 4y ago
  It sounds like quite a good fit. If you have a simple resizing algorithm I would consider using WebGPU/WebGL and a fragment shader to do it though.
nigrioid 4y ago
It's cool but they're going to use it to lock the web down and infest everything with DRM. You won't be able to scrape anything and we'll be in a worse position than when IE6 was #1.
- traverseda 4y ago
  I think that a combination of the Americans with Disabilities Act and the fact that websites need to be scrape-able to show up in search results should spare us the worst of this, hopefully...
muglug 4y ago
WASM has been a massive help to me. I'm building a static analysis CLI tool in Rust. It takes 30 seconds to build the WASM version, which I then upload to a website, providing a web-based version that other developers can use to demo the tool, and isolate bugs in its analysis. It feels sort of magic.
- pjmlp 4y ago
  Ah like Java Application Servers 20 years ago!
Animats 4y ago
No, I do not want my water heater to run WebAssembly. Or a Docker container. What could possibly go wrong?
- stavros 4y ago
  Nobody wants their water heater to run anything, except maybe water heater manufacturers, who can squeeze a penny out of you, and then you like that your water heater is cheaper. Don't get me started on TVs, mine worked fine until it was updated and started hanging and refusing to turn off. I had a TV that worked well and then they made it stop working. This is the future of devices.
  - worik 4y ago
    > Don't get me started on TVs, mine worked fine until it was updated.... Never ever connect a T.V. to the Internet! Use a Linux laptop sitting next to it. Internet connected T.V.s are the sort of thing that keeps me up at night, worrying
    - stavros 4y ago
      Yes but it's hard when your partner wants to watch Netflix on it and doesn't want to bother with a Linux laptop.
      - worik 4y ago
        Surely that is grounds for divorce?
        stavros 4y ago
        Haha, I will begin proceedings immediately.
Existenceblinks 4y ago
When I was learning Assembly in university there are lots of materials that teach building sophisticated apps by hand. WebAssembly (not itself but ecosystem) lacks of tutorials, books, toy projects. All of those materials are about how to compile from language X. So I'm not so excited, there's no relevant activities around.
labrador 4y ago
> While tremendously valuable, using WebAssembly in a web browser is not what excites me. The article should have been titled "Why Am I Excited About WebAssembly Outside The Browser?" The reasons the author gives don't seem that exciting. I'm excited about WebAssembly in the browser because, as other commenters have pointed out, this allows a new area of delivering executables to run in a sandboxed browser tab with just a click. Convenience, speed and safety. I think it fulfills the early promise of the internet before the malicious hackers got to it. Some might want to say here that this is still insecure, but it's a lot more secure than downloading and running a binary on the main OS.
- bastawhiz 4y ago
  There's literally nothing wrong with the title. The author doesn't have to qualify their excitement because it might not be for the same reasons as others.
  - labrador 4y ago
    You're right. It's my feeling that a few words could help clear up confusion people might have and save some time
jms55 4y ago
The author is missing another huge area: plugins/modding/scripting/etc. Think IDE plugins, Minecraft mods, or running user-provided untrusted scripts. The benefits WASM brings are: 1. Sandboxing - security 2. Isolation - if a plugin crashes, it won't bring down the whole program 3. Interoperability - write a plugin in lots of different languages, not just lua or js 4. Speed I'm hoping to write my thesis for my master's degree on this topic this year. I'm also in the process of writing a game like screeps, where users provide a WASM script to control units for an RTS-style game (without combat though) https://github.com/JMS55/botnet https://github.com/JMS55/botnet. It's amazing how simple it is to constrain memory usage, runtime duration, and secure exported functions to a WASM VM. Performance is also great - currently about ~6 microseconds per tick per unit, up to ~200 microseconds when doing expensive pathfinding. All that, while letting you program your units in Rust - the same language as the server is written in, while being able to share code with the server, and not having to use something more script-y like lua.
- westoncb 4y ago
  QuickJS compiled to WASM seems like a pretty nice way of getting a sandboxed js environment: https://github.com/justjake/quickjs-emscripten https://github.com/justjake/quickjs-emscripten. Curious if people have seen any other routes to doing it via WASM.
  - joeycodes 4y ago
    Figma plugins run in QuickJS in WASM https://www.figma.com/blog/an-update-on-plugin-security/ https://www.figma.com/blog/an-update-on-plugin-security/
jart 4y ago
WebAssembly is like Macromedia Flash for Generation Z, just like Flash was Java Applets for Generation Y. History repeats itself. However unlike Flash, you can't just uninstall wasm because there's no official way to disable it. https://developers.slashdot.org/story/22/07/16/0450218/ask-slashdot-does-webassembly-increase-your-web-browsers-attack-surface https://developers.slashdot.org/story/22/07/16/0450218/ask-s...
- slimsag 4y ago
  Also, you know, it's safe unlike both of those. And, you know, it's not deeply connected to representing a single language like both of those. And, I guess unlike those it's built by different companies following a standard rather than one company just pushing whatever they feel like that day of the week. But you're spot on otherwise. It's like they repeated the good parts of history and avoided repeating the bad parts. Weird.
  - kaba0 4y ago
    I don’t really get this - the jvm bytecode itself has zero access to anything outside of some memory given to it. It can’t even print to stdout in itself, it needs a method with a native implementation for everything. So there really is no “safer” here. Of course libraries can be written that expose more and more functionality, but I don’t see anything inherently unsafe in the JVM as opposed to WASM, which is the exact same way. If anything, the jvm can’t even crash itself, while wasm is free to do all the old memory errors, just this time constrained to its virtual memory space.
  - jart 4y ago
    The only thing I've ever seen webassembly used for online, was a hobby project where someone used it to get clang to run in the browser, which is cool, but kind of gimmicky, since no one wants to use a web page that needs to download hundreds of megs of dependencies. With Flash you could see the value like the Newgrounds animations it made possible, which would not have been possible otherwise. What has webassembly done for us besides turn the open web into opaque binary? Why is there no opt-out? It's the lack of consent that really gets to me. How many times do we have to say no?

170 points by cptcobalt 4y ago

Starlevel001 4y ago

web devs re-invent webjars

zamadatix 4y ago
More re-invent JVM/Flash VM but yess extremely similar concepts. This was not done ignorantly though, WASM was much easier to build inside of existing browser engines and gave a bit more freedom in design.
worik 4y ago
Faster. Smaller. Better

projektfu 4y ago

What can wasm accomplish in that way that Java couldn't? I'm really confused about the hoopla.

pjmlp 4y ago
Some folks have need to create startups to fulfill a need we don't know we need to have solved.
- bloppe 4y ago
  Well, unlike Java, Wasm is not the product of a for-profit company. It's a W3C standard that actually does solve many problems most people didn't realize they had. It essentially obsoletes virtualization (CTO of Docker famously said "If WASM+WASI existed in 2008, we wouldn't have needed to created [sic] Docker. That's how important it is"). It will allow the creation of a unified software ecosystem across languages (Wasm "components" are designed to allow you to e.g. import numpy into a JavaScript project. See https://hacks.mozilla.org/2019/08/webassembly-interface-types/ https://hacks.mozilla.org/2019/08/webassembly-interface-type...). The virtual machine is designed from the ground up to make many types of vulnerabilities, such a stack smashing, impossible. And, as an open standard, it's not beholden to the whims and lawyers of Oracle. I'm not 100% certain the W3C working group won't end up fumbling it, but if you're not excited about wasm then you probably just don't know much about it.
  - kaba0 4y ago
    Oracle was the company that completely open-sourced OpenJDK and even their own paid support JDK is just a minor modification of the former. Java and the JVM is also among the few languages/platforms with separate specifications, and multiple completely independent implementations. If anything, Java is a much much safer bet than the oligopoly of WebKit/Blink.
  - pjmlp 4y ago
    Yet there are enough for profit companies on its genesis and foundation. As for Docker, it is basically Java Application Servers full with YAML spaghetti to the point it makes me miss Websphere 5. Or even better, mainframe and microcomputers language environments like on IBM i, z/OS and Unisys ClearPath. Maybe its founders should have learned what preceded it.
    - EUROCARE 4y ago
      The founders know very clearly what preceded it as they're working with the authors of these previous attempts (JVM, CLR, etc) to integrate their stacks with Wasm.
      - pjmlp 4y ago
        And yet they claim novelty while walking used trails...
    - colordrops 4y ago
      Most of the entire tech stack all the way down to transistors had for profit companies involved in their genisis and foundation.
      - pjmlp 4y ago
        Except the " Wasm is not the product of a for-profit company." seems to be unaware of it.
k__ 4y ago
I think, the main point is that it isn't owned by Oracle. But also, that it's more for non-GC languages.
diegocg 4y ago
Nothing. People have been able to compile other languages into java bytecode for decades already. That didn't turn java into the one true runtime to rule them all, and webassembly will not be any different. I wish browser makers would focus into making the browser user and development experience actually work instead of going after the latest shiny feature.
- PUSH_AX 4y ago
  > Nothing. How about not relying on the JRE? Mobile support? Partitioning between applet world and JS world?
  - kaba0 4y ago
    How are any of this relevant if we talk about a hypothetical future if Java was continued to be used in browsers? Browsers would include a JRE (which they actually did at a time as well, but that’s just a tiny technicality either way), there wasn’t even mobiles capable of browsing the net at the time, but there is nothing inherently unsolvable, it’s not like there is no partitioning between wasm and js world, but in this alternative reality there wouldn’t be js. Java could have access to the DOM.
- simonw 4y ago
  Being able to compile languages to Java bytecode doesn't help if you still have to convince users to install a Java runtime environment. WebAssembly doesn't have this problem: almost every user is already running a browser that supports it.
  - hashmash 4y ago
    In the early days of Java, it was bundled with the browser. But because Sun didn't make their own (popular) browser, they couldn't dictate the terms for what features a browser was expected to include.
vbezhenar 4y ago
wasm runs in your browser. Java does not.
- rjsw 4y ago
  Java could have been made to run well in a browser, giving applets good access to the DOM of their containing page wouldn't have been too difficult.
  - pjmlp 4y ago
    Not only it wasn't, it has always been possible to do so from Applets.
    - rjsw 4y ago
      When I wrote good access, I was really thinking that Java would have needed to provide an API at least as good as JQuery, not just a low-level way to walk nodes in a tree.
      - pjmlp 4y ago
        The API was there nevertheless.
- Jaxan 4y ago
  It used to, though.
- orev 4y ago
  They are using the past tense of Java. In case you don’t know, the primary use of Java when it came out was to run “applets” inside the browser. And it was terrible. It was later when it became mostly a server-side thing (which at the time was dominated by languages like Perl, PHP, etc.)
  - hawkeyedan 4y ago
    To be precise, applets were an early application of Java. But Sun Microsystems actually developed it in the long-standing dream of the “universal binary.” The project began in 1991 targeting set-top boxes. [source](https://web.archive.org/web/20100210225651/http://www.java.com/en/javahistory/ https://web.archive.org/web/20100210225651/http://www.java.c...) WASM is another iteration of the same noble idea done with different technologies at a different moment. Java and the JVM have been incredibly successful. WASM has the potential to bring the dream of a universal binary even farther.
nikki93 4y ago
You can compile C, C++ and a bunch of other languages to Wasm, while you can't do that with Java as a target. A lot of existing C code compiles unchanged. And Wasm also actually runs in all browsers nowadays without the user noticing a difference (eg. iOS Safari too).
- brian_herman 4y ago
  What we should be comparing it is to activeX and flash will it have the security that those two technologies didn't?
  - Georgelemental 4y ago
    WASM uses the browser sandbox, from what I understand it re-uses the same facilities that browsers use for JIT
    - ridiculous_fish 4y ago
      WASM's sandboxing as implemented in practice is different from JITs. It works by allocating a 4GB region of virtual memory and treating the base address as NULL. Pointers in WASM are 32 bit so they are unable to point outside the region. The big win is the runtime doesn't need to check pointers for validity. However there are some downsides relative to native code: 1. Can't address more than 4GB of memory 2. Can't be efficiently implemented on 32 bit systems 3. Can't share memory between WASM modules 4. NULL dereferences don't trap (I think) I would not be surprised if future CPUs had hardware support for this stuff, e.g. load/stores with a mask to confine the pointers.
      - pjmlp 4y ago
        Just like Solaris SPARC has been doing like for 10 years.
      - jb1991 4y ago
        Neat. I thought Web pages were limited to 2 GB memory. I guess tines have changed.
dragonwriter 4y ago
> What can wasm accomplish in that way that Java couldn't? I'm really confused about the hoopla. Provide relatively efficient support for languages other than JavaScript that is reliably available in major browsers without user action, an insecure plugin model, etc.
stevemk14ebr 4y ago
Java != JavaScript
hajile 4y ago
Wasm outright forbids things like GOTO and other potentially insecure features opting instead for structured programming. Java has been the subject of countless security vulnerabilities. Wasm also has the ability to stream bytecode and validate/compile as it streams (fast parsing was a major design goal) resulting in much faster startup times. Wasm is easier to integrate into the JIT/VM already shipping in browsers so they don't have to ship two massive engines. Wasm is a bit lower level which should result in faster execution than the JVM in the future. Wasm doesn't require garbage collection. Wasm has unsigned integers. Wasm isn't encumbered by Oracle.
- hashmash 4y ago
  Which Java vulnerabilities are you referring to which require breaking bytecode compatibility?
  - hajile 4y ago
    I misspoke (and updated my comment).
    - hashmash 4y ago
      Ok. I'm also curious about your comment regarding GOTO. How is it potentially insecure?
      - worik 4y ago
        > Ok. I'm also curious about your comment regarding GOTO. How is it potentially insecure? Really? Is that a question? The trend over the years has been to structure our code. GOTO throws all of that away. Jump straight over the guards.
        hashmash 4y ago
        The Java language doesn't have a goto statement, and so all code is properly structured. A labeled break statement is almost a goto statement, but it still obeys structuring rules -- i.e., you cannot jump into the middle of a loop. At the bytecode level, all structured constructs get compiled into forms that rely on goto statements. Is this inherently insecure? Should the bytecode require structured programming too? How does this guard against malicious use any more than verified bytecode that relies on gotos?
olalonde 4y ago
Become a web standard.
mikewarot 4y ago
It provides a security model that actually works. WASM code can't access the outside world, except for channels you explicitly provide to it. Everything before it eventually let you have full access to the host file system, if you asked nicely, were given permission, or leveraged a bug in the system.
- int_19h 4y ago
  wasm is only as secure as the runtime that you're using, and I would be extremely surprised if none of them have sandbox-breaking bugs in the long term.
  - Etherlord87 4y ago
    Can you elaborate? To my understanding you compile code into opcodes and it's as safe as the stack machine going through the opcodes. To my understanding the runtime is the part of the compiled code, and not the stack machine going through it.
- pjmlp 4y ago
  Usenix Security '20-Everything Old Is New Again: Binary Security of WebAssembly" https://www.youtube.com/watch?v=glL__xjviro https://www.youtube.com/watch?v=glL__xjviro "The Security Risk of Lacking Compiler Protection in WebAssembly" https://arxiv.org/abs/2111.01421 https://arxiv.org/abs/2111.01421
DonHopkins 4y ago
WebAssembly isn't owned by Oracle. That's the most important reason to use WebAssembly instead of Java. It's also nice that it can do all kinds of things Java can't, but that's just icing on the cake.
- bhaak 4y ago
  OP used "couldn't" and was referring IMHO to the days of Java applets.
johannes1234321 4y ago
On the browser side: What killed Java was to a large part loading times. First the Plugin had to load, then the bytecode had to be run. On many systems one immediately knew when Java was used by the browser getting slow and sleeping for a while. Flash loaded a lot faster (also systems were better, generally) however Flash apps completely messed with user experience. Nowadays JavaScript can do a lot of things better (say changing URL, history support, back button) which can be integrated with a wasm tool for having a way more seamless integration. As a user you simply don't notice if something is using JS or wasm. From there it imo carries over to the server side and other places. Java simply got a bad reputation as resource hog used for bad UI in Applets and many people looked elsewhere. And then wasm supports C and C++ (and more) with huge eco system of libraries, applications, ... (While of course these days a Java VM (incl. Android) is often used with non-Java languages as well)

stevebmark 4y ago

Fun fact: Wasm can be be significantly slower than vanilla Javascript https://betterprogramming.pub/how-fast-is-webassembly-versus-javascript-bc0eca058a54 https://betterprogramming.pub/how-fast-is-webassembly-versus...

maxgraey 4y ago
The article is relatively old. But I have the most complaints about the performance measurements. The WebAssembly should be tested in a way that eliminates the interop time, which is very expensive. That's why sorting and simple multiplication will always be slower if tested outside WebAssembly. Sorting in AssemblyScript is actually faster than in Rust or JavaScript: https://twitter.com/MaxGraey/status/1414867216676368384 https://twitter.com/MaxGraey/status/1414867216676368384
enos_feedler 4y ago
This might be a fact, but it certainly isn’t fun or interesting. Anybody who is framing WebAssembly into some sort of competition with javascript is completely missing the point of it’s existence. The major problem with WebAssembly right now is the major point of it’s existence is mirky. It will take time and effort from everyone using it for figure out it’s true calling, but I am hopeful and optimistic this gets discovered. In the meantime it doesn’t help to pit it against javascript.
- smegsicle 4y ago
  what should it be compared against if not javascript?
  - zamadatix 4y ago
    Any general purpose VM is fine, including the VMs behind JavaScript, but just double check that's actually what's being compared instead of inter JavaScript and VM performance. How many times per second you can call 1-5 line functions from a webpage's execution context is comparing the latter and as the article notes at the end: > definitely don’t go converting all your websites’ JavaScript to WebAssembly! However, that’s not really the aim of WebAssembly. Its aim is to enable richer experiences on the web that require higher performance, for example machine learning, virtual reality, or gaming. WASM functions aren't meant to replace small JS functions on your standard website. It's meant to be a general purpose VM you can target large amounts of non-webpage code to.

amelius 4y ago

jeffreygoesto 4y ago
Generally yes. The delta tests for several classes of changes are baked in heavy processes and their execution is regularly audited. Maybe some startup cowboys see that differently, but then in their cars people are harmed while doing whatever...
- amelius 4y ago
  Are you sure? I can't help but think of the VW emissions scandal. A "quick update" might seem a better choice to some managers than grounding the fleet.
  - jeffreygoesto 4y ago
    I am actually surprised that scandal did not get more people behind bars, because given the amount of processes, there must have been quite some number of bros knowing what's going on and covering each other.

sbf501 4y ago

I understand the excitement of the author, but I think they've simply added to the attack surface for very little ROI. IoT security is a HUGE risk, and securing boot and firmware updates is nontrivial. Even the supply-chain can be attacked, where the JTAG programmers are targets. The idea of being able to tune an ML model in the field is something that should be either built into the firmware with a dedicated HTTP port (like most devices do, by adding a lightweight LWIP server for config that is severely locked down), or a specialized App, which is what 99% of user-configurable IoT devices already do. TL;DR - Webassembly is completely unrelated to IoT provisioning and configuration.

cptcobalt 4y ago
I'm not completely sure your TLDR is a well-founded and fair distillation of your comment. And your comment itself reads as if it's a skim of the post itself. Yes, IoT security is obviously a huge risk, yet Wasm would dramatically reduce the possibility space of many (but not all) types of attacks.
- sbf501 4y ago
  The article itself is very thin, as there is nothing practical it proposes.

fayten 4y ago

I have not been able to get excited about WASM due to the poor memory management situation. It’s been years since the MVP and we are still in limbo about freeing memory. A great issue documenting a lot of the pain points around this is here: https://github.com/WebAssembly/design/issues/1397 https://github.com/WebAssembly/design/issues/1397 Until this is solved WASM is dead in the water for a huge variety of applications. I am rooting for WASM, but it has been discouraging to watch this go unsolved over the years.

capableweb 4y ago
I'm not sure I fully understand the issue here, but reading through it, it seems to point towards that this issue only happens to people using 32bit browsers? Which, I assume (depending on the environment of course), is a very small section of users nowadays.
- tyingq 4y ago
  Maybe not: https://github.com/WebAssembly/memory64/blob/main/proposals/memory64/Overview.md https://github.com/WebAssembly/memory64/blob/main/proposals/...
  - IshKebab 4y ago
    That's about 64 bit WASM not 64 bit browsers.
    - tyingq 4y ago
      It's about desktop WASM not having access to all the memory and so fine grained management of memory there could be important also.
deleted 4y ago
[deleted]
rr808 4y ago
Agreed on this, I assumed you'd be able to write for WASM with go, Java etc but no GC based languages are allowed.

pjmlp 4y ago

WebAssembly on the Edge, aka newer generations rediscover Propeller, BASIC Stamp, Java Embedded,....

deleted 4y ago
[deleted]
deleted 4y ago
[deleted]

cassepipe 4y ago

I am curious. I barely know any webdev and only program C and C++. Are there things that one still need JS for even though using webassembly ?

gavinray 4y ago
So, to clarify, "WEBassembly" was a terrible name in retrospect -- the majority of WASM use (that I have encountered) is serverside, not clientside. The super tl;dr of WASM is that it's a universal bytecode format, an idea sort of like the JVM or the CLR. There are a few major benefits to this: 1. Languages can pick WASM as a compile target, and then run anywhere that WASM is supported. This includes the browser, the server, embedded devices, wherever. 2. WASM acts as a "Lingua Franca" for interop between languages, sort of like a C ABI. Any language that supports importing WASM bundles immediately gains support for calling code from any language that supports compiling to WASM. It's trivial to write a program that calls functions from IE. Rust, Go, Zig, and C# in the span of 10 lines, because of WASM. On the clientside, you still need JS because WASM needs to interact with the browser's DOM API's. I'm not convinced of the benefits of WASM for writing web apps. (One exception is maybe Blazor for .NET, which is exceptionally well-done)
klohto 4y ago
Simply put, missing DOM manipulation. Here [0] is quite a good summary with plenty of links to currently open proposals/issues on WA's GitHub that would allow it to do that. [0]https://sudonull.com/post/62869-WebAssembly-and-DOM-manipulation https://sudonull.com/post/62869-WebAssembly-and-DOM-manipula...
- torginus 4y ago
  Hmm, wouldn't it suffice just to export a createHandle() function to WASM, which could then use said handle to reference the underlying C++ object of the HTML element. V8's involvement isn't even necessary. The DOM element then would be collected, when there are no JS references to it, its handle is disposed of by the WASM code, or the WASM runtime itself is destroyed. Seems like a very similar problem to how game engines integrate scripting languages like Lua - with very similar solutions.

torginus 4y ago

I'm curious - what does WASM offer that emscripten + asm.js didn't?

jsheard 4y ago
From the creator of Emscripten: https://hacks.mozilla.org/2017/03/why-webassembly-is-faster-than-asm-js/ https://hacks.mozilla.org/2017/03/why-webassembly-is-faster-... Asmjs was a clever hack but still a hack, and starting over with a clean slate let them fix various limitations inherent to using Javascript as a compilation target
- pjmlp 4y ago
  Only because they refused to adopt PNaCL.
azakai 4y ago
Wasm is smaller and faster than JavaScript and asm.js. It is both faster on average, it has far better predictability (far fewer performance cliffs or pitfalls), and it starts up faster (faster to decode + no need to warm up the JIT with types at runtime). You can test this pretty easily, since Emscripten still supports JavaScript output with a flag (for environments that lack wasm support for whatever reason). Comparing Emscripten's default wasm output to JS output for the same benchmark will show those benefits in most cases.

stefan_ 4y ago

> If the device performs safety-critical functions, like actuating power, medical equipment, or a connected car, the firmware and software cannot be updated without rigorous testing. If the device requires certification, updating it may require recertification. Updates are disruptive and need to be scheduled when the device is not performing its critical functions. Even just performing the update presents risks: if the update ends up bricking millions of devices and requires manual intervention, it could prove an existential risk to the business or the safety of individuals. WebAssembly does nothing to address any of this. The least important part about this is the language the code is written in. I think this person has thoroughly confused code running in a VM with code being secure, safe and performing to specification.

Rochus 4y ago

Nice that the author is enthusiastic; but everything he praises has been around for many years or has a rather hobbyist touch (e.g. what he writes in "The Edge" section). Webassembly has undoubted potential, but in the original use case (browser applications) it is still clearly too slow and inflexible; and interestingly, the adaptation seems to take place more in areas that are well occupied by Node, CLI or the Java VM. I just recently looked again at the current state and studied current literature with the intention of writing a WASM backend for Oberon+; but the technology probably needs a few more years to be worthwhile; at the very least, a built-in GC (or at least a means to scan the stack) should be available, otherwise the implementation would become incredibly inefficient.

nikki93 4y ago
GC implementations over Wasm definitely have perf issues. eg. Go compiled to Wasm has these with its GC. The main way when compiling to Wasm now is to not use a GC, which is reasonable depending on the application in question. It's quite reasonable for games or graphics applications. But yeah Wasm has definitely been used successfully with performance results in production, eg. in Figma: https://www.figma.com/blog/webassembly-cut-figmas-load-time-by-3x/ https://www.figma.com/blog/webassembly-cut-figmas-load-time-...

astlouis44 4y ago

What I'm most excited about is the potential for WebAssembly (along with WebGPU) to pave the way for a whole new era of browser games and provide an alternative to developers who don't want to fork over 30% to walled gardens. My team has built out WASM/WebGPU support for Unreal Engine 4 and is in progress for Unreal Engine 5 (and other engines) with a suite of optimization tools like asset streaming (so you don't have to download a whole game at once) and advanced texture compression (necessary for low powered devices like mobile/Chromebooks). More info on us in this Venturebeat article we were featured in: https://venturebeat.com/2022/05/12/wonder-interactives-the-immersive-web-will-play-unreal-4-games-on-the-web/ https://venturebeat.com/2022/05/12/wonder-interactives-the-i...

Etherlord87 4y ago
What is the minimum weight of an UE4 project compiled to WASM? The article says something about a menu being 10 MB, but is that a menu done in UE4 or just something else and somehow connected with an actual game? To my knowledge an unreal executable weight at minimum around 80 MB? That would compare poorly to Godot which is very light in comparison...
slimsag 4y ago
Was watching your update in the Khronos Group meetup a few days ago, very impressive work. I'm excited for what this will mean for the web overall, it might finally reach that tipping point where more than .io games become standard to play in the web. That's huge, and will drive demand for more powerful web APIs too. WebGPU in general is very nice. We're building a game engine[0] that uses Zig to build Dawn (Google Chrome WebGPU implementation) from source for running on desktop / Steamdeck, and working on browser support via WASM now. The future is bright here. [0] https://machengine.org https://machengine.org
Animats 4y ago
What do you do about WebAssembly's lack of real threads?
- cylon13 4y ago

jokoon 4y ago

Since I've read that the key WASM person quit her job after a burnout, I'm quite pessimistic about WASM. Not surprised if it dies in future years. To be completely honest, WASM helps having cross platforms things, which is ALWAYS against the interests of companies who always divide their market territories to guarantees steady revenues. I'm also a bit curious how they managed to make WASM happen in the first place. I'm also still waiting for C++ toolchain to directly output WASM. I haven't touched bynaryen since, but it was not a great experience.

musingsole 4y ago
Please, I'd love to know what singular person has such influence that their burnout spells the end of WASM?
stevemk14ebr 4y ago
'The key wasm person' is nonsense. It's a spec, with multiple implementations of interpreters, jits, and other execution environments. Even outside of browsers there's other runtimes.
capableweb 4y ago
> Since I've read that the key WASM person quit her job after a burnout, I'm quite pessimistic about WASM. Not surprised if it dies in future years. WebAssembly is so big at this point it's too big to fail (famous last words maybe?). All major browsers support it (Firefox, Chrome, Safari and Edge), runtimes are available for non-browser usage, and a big amount of people are involved in moving it forward. If it was early days, then maybe losing one key person could have changed the fate of WebAssembly. But at this point, there are multiple key people both inside and outside the WebAssembly organization.
jedisct1 4y ago
Zig C++ directly compiles to WASM.
- pjmlp 4y ago
  clang actually.

peanut_worm 4y ago

I am currently writing a typescript project with deno. I need to resize lots of very large images (20mb+) in a reasonable timeframe so I was considering using web assembly for it. Does that seem like a good fit? I have never used WASM before so I am wondering if its worth it.

ywei3410 4y ago
It sounds like quite a good fit. If you have a simple resizing algorithm I would consider using WebGPU/WebGL and a fragment shader to do it though.

nigrioid 4y ago

It's cool but they're going to use it to lock the web down and infest everything with DRM. You won't be able to scrape anything and we'll be in a worse position than when IE6 was #1.

traverseda 4y ago
I think that a combination of the Americans with Disabilities Act and the fact that websites need to be scrape-able to show up in search results should spare us the worst of this, hopefully...

muglug 4y ago

WASM has been a massive help to me. I'm building a static analysis CLI tool in Rust. It takes 30 seconds to build the WASM version, which I then upload to a website, providing a web-based version that other developers can use to demo the tool, and isolate bugs in its analysis. It feels sort of magic.

pjmlp 4y ago
Ah like Java Application Servers 20 years ago!

Animats 4y ago

No, I do not want my water heater to run WebAssembly. Or a Docker container. What could possibly go wrong?

stavros 4y ago
Nobody wants their water heater to run anything, except maybe water heater manufacturers, who can squeeze a penny out of you, and then you like that your water heater is cheaper. Don't get me started on TVs, mine worked fine until it was updated and started hanging and refusing to turn off. I had a TV that worked well and then they made it stop working. This is the future of devices.
- worik 4y ago
  > Don't get me started on TVs, mine worked fine until it was updated.... Never ever connect a T.V. to the Internet! Use a Linux laptop sitting next to it. Internet connected T.V.s are the sort of thing that keeps me up at night, worrying
  - stavros 4y ago
    Yes but it's hard when your partner wants to watch Netflix on it and doesn't want to bother with a Linux laptop.
    - worik 4y ago
      Surely that is grounds for divorce?
      - stavros 4y ago
        Haha, I will begin proceedings immediately.

Existenceblinks 4y ago

When I was learning Assembly in university there are lots of materials that teach building sophisticated apps by hand. WebAssembly (not itself but ecosystem) lacks of tutorials, books, toy projects. All of those materials are about how to compile from language X. So I'm not so excited, there's no relevant activities around.

labrador 4y ago

> While tremendously valuable, using WebAssembly in a web browser is not what excites me. The article should have been titled "Why Am I Excited About WebAssembly Outside The Browser?" The reasons the author gives don't seem that exciting. I'm excited about WebAssembly in the browser because, as other commenters have pointed out, this allows a new area of delivering executables to run in a sandboxed browser tab with just a click. Convenience, speed and safety. I think it fulfills the early promise of the internet before the malicious hackers got to it. Some might want to say here that this is still insecure, but it's a lot more secure than downloading and running a binary on the main OS.

bastawhiz 4y ago
There's literally nothing wrong with the title. The author doesn't have to qualify their excitement because it might not be for the same reasons as others.
- labrador 4y ago
  You're right. It's my feeling that a few words could help clear up confusion people might have and save some time

jms55 4y ago

The author is missing another huge area: plugins/modding/scripting/etc. Think IDE plugins, Minecraft mods, or running user-provided untrusted scripts. The benefits WASM brings are: 1. Sandboxing - security 2. Isolation - if a plugin crashes, it won't bring down the whole program 3. Interoperability - write a plugin in lots of different languages, not just lua or js 4. Speed I'm hoping to write my thesis for my master's degree on this topic this year. I'm also in the process of writing a game like screeps, where users provide a WASM script to control units for an RTS-style game (without combat though) https://github.com/JMS55/botnet https://github.com/JMS55/botnet. It's amazing how simple it is to constrain memory usage, runtime duration, and secure exported functions to a WASM VM. Performance is also great - currently about ~6 microseconds per tick per unit, up to ~200 microseconds when doing expensive pathfinding. All that, while letting you program your units in Rust - the same language as the server is written in, while being able to share code with the server, and not having to use something more script-y like lua.

westoncb 4y ago
QuickJS compiled to WASM seems like a pretty nice way of getting a sandboxed js environment: https://github.com/justjake/quickjs-emscripten https://github.com/justjake/quickjs-emscripten. Curious if people have seen any other routes to doing it via WASM.
- joeycodes 4y ago
  Figma plugins run in QuickJS in WASM https://www.figma.com/blog/an-update-on-plugin-security/ https://www.figma.com/blog/an-update-on-plugin-security/

jart 4y ago

WebAssembly is like Macromedia Flash for Generation Z, just like Flash was Java Applets for Generation Y. History repeats itself. However unlike Flash, you can't just uninstall wasm because there's no official way to disable it. https://developers.slashdot.org/story/22/07/16/0450218/ask-slashdot-does-webassembly-increase-your-web-browsers-attack-surface https://developers.slashdot.org/story/22/07/16/0450218/ask-s...

slimsag 4y ago
Also, you know, it's safe unlike both of those. And, you know, it's not deeply connected to representing a single language like both of those. And, I guess unlike those it's built by different companies following a standard rather than one company just pushing whatever they feel like that day of the week. But you're spot on otherwise. It's like they repeated the good parts of history and avoided repeating the bad parts. Weird.
- kaba0 4y ago
  I don’t really get this - the jvm bytecode itself has zero access to anything outside of some memory given to it. It can’t even print to stdout in itself, it needs a method with a native implementation for everything. So there really is no “safer” here. Of course libraries can be written that expose more and more functionality, but I don’t see anything inherently unsafe in the JVM as opposed to WASM, which is the exact same way. If anything, the jvm can’t even crash itself, while wasm is free to do all the old memory errors, just this time constrained to its virtual memory space.
- jart 4y ago
  The only thing I've ever seen webassembly used for online, was a hobby project where someone used it to get clang to run in the browser, which is cool, but kind of gimmicky, since no one wants to use a web page that needs to download hundreds of megs of dependencies. With Flash you could see the value like the Newgrounds animations it made possible, which would not have been possible otherwise. What has webassembly done for us besides turn the open web into opaque binary? Why is there no opt-out? It's the lack of consent that really gets to me. How many times do we have to say no?