4 ms·
Still, overall better than the situation of having to install a plugin that may or may not be available or working fully on your system. Plus security concerns
by bobajeff 4y ago
Still, overall better than the situation of having to install a plugin that may or may not be available or working fully on your system. Plus security concerns of running sometimes obscure binaries on your system to access web content.
- pjmlp 4y agoYou can compile heartbleed to WebAssembly, and there are ways to exploit memory corruption to change observable behaviour.
- bobajeff 4y agoI'm aware it's not impossible to exploit the current plug-in free browsers we have now. It's still objectively better than before. Not that I'm satisfied with the current state of browsers mind you. I just think not being forced to install someone's binary blob to look at web content is a net benefit.
- pjmlp 4y agoExcept you can't disable WebAssembly, and you can't control how a SPA is implemented, see Figma for example. Now you can enjoy Flash like ads using WebAssembly + WebGL, making it all a Phyrric victory.
- ranger_danger 4y agoWebAssembly can absolutely be disabled: Chromium-based: --js-flags=--noexpose_wasm Firefox-based: about:config javascript.options.wasm = false
- pjmlp 4y agoGreat now explain that to granny on her phone.
- tredre3 4y agoSeems like you're moving the goalposts... Webassembly is clearly an improvement over the old plugins. For one thing it's a full virtual machine and was designed with sandboxing in mind.
- pjmlp 4y agoNot at all, I say it can be disabled and stand by it. Those browser flags aren't something Joe and Jane users are capable to be aware of, can disappear at any time anyway, and are not a thing on mobile devices. A sandboxing that isn't bullet proof and can still be exploited by triggering memory corruption on the linear memory segment, thus changing decisions based on the data contents.
- ranger_danger 4y agoJoe and Jane also don't know or care what WebAssembly is.