4 ms·

I wonder what the future holds for WebAssembly. If it doesn’t really catch on and just ends up being mostly (ab)used for nefarious purposes, I can imagine the

I wonder what the future holds for WebAssembly. If it doesn’t really catch on and just ends up being mostly (ab)used for nefarious purposes, I can imagine the major browsers dropping support in a few years. They did with technologies like Flash and Java applets before, and those had had much wider adoption previously. On the other hand, if someone comes up with a good programming language for modern Web-style applications that compiles down to Wasm for the client side and the ecosystem around it reaches escape velocity, that looks like an opportunity to disrupt a trillion dollar industry to me. Such things used to seem unrealistic, but there is so much money in web development, the current state of the art is so bad in numerous ways and almost everything is currently so short-lived (by wider programming industry standards) that I don’t think it’s completely out of the question to move the goalposts to an entirely different playing field any more.

neon_electro 4y ago
What does securing a WebAssembly runtime look like? Have browser developers made good strides on that front yet? Flash declined in part because of its poor security compared to the Web proper (HTML/CSS/JavaScript), so I'm curious where WebAssembly stands.
- afiori 4y ago
  Until threads are included in WASM its security model is essentially the browser sandbox and scope limitation (WASM modules cannot access the global object nor call arbitrary functions) Essentially WASM can be transpiled to Javascript (or ASM.js more likely) almost line by line and it would have almost the same security. Flash and Java applet were so dangerous because the plugins introduced a ton of new APIs that skipped the browser sandbox. Wasm introduces no new API. For non browser environments WASM mostly brings static validation, opaque external references, and bound checking on linear memory access.
  - neon_electro 4y ago
    Thank you!
theptip 4y ago
I’ve been thinking about this a lot in the last few years, and recently did a deep dive on Rust wasm. I think it’s unlikely to be a single new language that replaces the current JS hegemony. My bet is that wasm makes it possible for any backend language to embed frontend logic, and each language will have framework(s) to take advantage of this capability in idiomatic ways. I want to avoid specific language comparisons because they tend to veer into religious territory and shed more heat than light, but perhaps I can just note that Java, Rails, Elixir, Python and may others have great productive backend frameworks which could easily be extended to build and ship wasm to clients. (I think the model of the new JS framework Fresh is interesting to hold as a comparison for what sort of thing you can do with unified FE/BE stack; shipping client JS only when the specific page needs interactivity is one cool feature for example. But with wasm you’re free to pick any point along the MPA - SPA spectrum.)
muttled 4y ago
I wonder if the Ethereum merge (moving away from mining) will cause a drop in that misuse? I know a lot of the abuse are hidden crypto miners. There's going to be so much computing power shifting to the other coins (dropping the ROI) that there won't be much worth mining that can be done in the browser.
davnicwil 4y ago
> if someone comes up with a good programming language for modern Web-style applications I posit this has already happened and the language is Typescript. I don't see how a different language could meaningfully disrupt TS at this point. I don't actually even see what there is to disrupt, to be honest. TS is great and really productive, and scales to large teams well. What language has the potential to be 10x better than it?
- Chris_Newton 4y ago
  TypeScript is better than JavaScript in most situations. JavaScript is all that remained after the plugin-based alternatives were killed off. It’s not that TypeScript is a terrible language, but being a better language is a low bar to clear when you consider that we have 20+ years of extra experience since the early days of JS and a new language also wouldn’t inherit all the baggage. Things that IMHO have the potential to create a profoundly better language for developing web applications include: • A more expressive type and effect system • A more capable module system and better dependency management • A more comprehensive standard library • Integral support for building distributed systems and modelling communication within them Given those kinds of changes and avoiding a lot of the baggage, I think there is also room for a simpler, more systematic, more consistent syntax, which would be good for both human and computer readers. The latter is important because if it’s easily machine-readable then it’s easier to build tools, and building good tools around a programming language is a key factor in growing a large and sustainable ecosystem. I don’t know what being “10x better than TypeScript” would mean quantitatively, but I find it easy to believe that a language could arrive within say the next 5 years that required less than half the time to develop the same functionality, produced less than half the defects that would need fixing later, and ran several times faster under realistic conditions.
  - davnicwil 4y ago
    I agree that improvements are possible in the areas you've listed, my point was that I don't believe they'd be significant enough to get the 2x productivity you later mention. They're all, in my view, at or above the 80% good enough mark for the current paradigm of what a web app is or needs to do, and any further improvements would yield rapidly diminishing returns. I think the fact that JS has been used for 20+ years, and now TS for most of the last decade, is partly (not wholly) because of this. That's unless the paradigm of most web apps fundamentally shifts - ie your distributed systems point. Don't get me wrong, if such a 2x productivity increase over TS is possible I'd love to be wrong here and see that happen - not least just out of pure interest of how that language could be so much better, because clearly I'd be learning a lot there :-)
jcmontx 4y ago
> if someone comes up with a good programming language for modern Web-style applications that compiles down to Wasm That's exactly what Blazor is all about

neon_electro 4y ago

What does securing a WebAssembly runtime look like? Have browser developers made good strides on that front yet? Flash declined in part because of its poor security compared to the Web proper (HTML/CSS/JavaScript), so I'm curious where WebAssembly stands.

afiori 4y ago
Until threads are included in WASM its security model is essentially the browser sandbox and scope limitation (WASM modules cannot access the global object nor call arbitrary functions) Essentially WASM can be transpiled to Javascript (or ASM.js more likely) almost line by line and it would have almost the same security. Flash and Java applet were so dangerous because the plugins introduced a ton of new APIs that skipped the browser sandbox. Wasm introduces no new API. For non browser environments WASM mostly brings static validation, opaque external references, and bound checking on linear memory access.
- neon_electro 4y ago
  Thank you!

theptip 4y ago

I’ve been thinking about this a lot in the last few years, and recently did a deep dive on Rust wasm. I think it’s unlikely to be a single new language that replaces the current JS hegemony. My bet is that wasm makes it possible for any backend language to embed frontend logic, and each language will have framework(s) to take advantage of this capability in idiomatic ways. I want to avoid specific language comparisons because they tend to veer into religious territory and shed more heat than light, but perhaps I can just note that Java, Rails, Elixir, Python and may others have great productive backend frameworks which could easily be extended to build and ship wasm to clients. (I think the model of the new JS framework Fresh is interesting to hold as a comparison for what sort of thing you can do with unified FE/BE stack; shipping client JS only when the specific page needs interactivity is one cool feature for example. But with wasm you’re free to pick any point along the MPA - SPA spectrum.)

muttled 4y ago

I wonder if the Ethereum merge (moving away from mining) will cause a drop in that misuse? I know a lot of the abuse are hidden crypto miners. There's going to be so much computing power shifting to the other coins (dropping the ROI) that there won't be much worth mining that can be done in the browser.

davnicwil 4y ago

> if someone comes up with a good programming language for modern Web-style applications I posit this has already happened and the language is Typescript. I don't see how a different language could meaningfully disrupt TS at this point. I don't actually even see what there is to disrupt, to be honest. TS is great and really productive, and scales to large teams well. What language has the potential to be 10x better than it?

Chris_Newton 4y ago
TypeScript is better than JavaScript in most situations. JavaScript is all that remained after the plugin-based alternatives were killed off. It’s not that TypeScript is a terrible language, but being a better language is a low bar to clear when you consider that we have 20+ years of extra experience since the early days of JS and a new language also wouldn’t inherit all the baggage. Things that IMHO have the potential to create a profoundly better language for developing web applications include: • A more expressive type and effect system • A more capable module system and better dependency management • A more comprehensive standard library • Integral support for building distributed systems and modelling communication within them Given those kinds of changes and avoiding a lot of the baggage, I think there is also room for a simpler, more systematic, more consistent syntax, which would be good for both human and computer readers. The latter is important because if it’s easily machine-readable then it’s easier to build tools, and building good tools around a programming language is a key factor in growing a large and sustainable ecosystem. I don’t know what being “10x better than TypeScript” would mean quantitatively, but I find it easy to believe that a language could arrive within say the next 5 years that required less than half the time to develop the same functionality, produced less than half the defects that would need fixing later, and ran several times faster under realistic conditions.
- davnicwil 4y ago
  I agree that improvements are possible in the areas you've listed, my point was that I don't believe they'd be significant enough to get the 2x productivity you later mention. They're all, in my view, at or above the 80% good enough mark for the current paradigm of what a web app is or needs to do, and any further improvements would yield rapidly diminishing returns. I think the fact that JS has been used for 20+ years, and now TS for most of the last decade, is partly (not wholly) because of this. That's unless the paradigm of most web apps fundamentally shifts - ie your distributed systems point. Don't get me wrong, if such a 2x productivity increase over TS is possible I'd love to be wrong here and see that happen - not least just out of pure interest of how that language could be so much better, because clearly I'd be learning a lot there :-)

jcmontx 4y ago

> if someone comes up with a good programming language for modern Web-style applications that compiles down to Wasm That's exactly what Blazor is all about