4 ms·
As your current sibling comment points out, most vulnerabilities are in the JIT. It’s certainly possible to exploit the browser itself with unsafe code it may b
by eyelidlessness 4y ago
As your current sibling comment points out, most vulnerabilities are in the JIT. It’s certainly possible to exploit the browser itself with unsafe code it may be running, but a lot more probable that exploits take advantage of the runtime compiler(s) hosted by it. Rewriting even all of WebKit in Rust might benefit at the JIT level but it very well may not, because ultimately it’s still a hosted compiler for an arbitrary dynamic language.
- nneonneo 4y agoBreaking the JIT is just the first step for most browser exploits. The JIT lives in the renderer process, which is heavily sandboxed in modern browsers. To do anything useful, an exploit usually has to compromise the browser process with a second bug (“sandbox escape”). Rewriting the browser part in e.g. Rust would be a great step towards closing off that avenue of attack.
- kitsunesoba 4y agoI wouldn’t be surprised if significant chunks of WebKit start getting rewritten in Swift once it gains C++ interop. Not that use of Rust is impossible but so far Apple’s interest in Rust has been as far as I know entirely in server usage.