4 ms·

"uses WebAssembly" - forgive me but what? How do I know my PDF isn't going to Russia? or China? I mean, I could wireshark it but I'd like to know more about wha

"uses WebAssembly" - forgive me but what? How do I know my PDF isn't going to Russia? or China? I mean, I could wireshark it but I'd like to know more about what's in the webassembly. PDF's are sensitive to some organizations. As already stated, some orgs even block online pdf tools for obvious reasons. I'm interested in this but I would be even more so if there was source so I can audit. Since it's running locally in my browser anyway.

remram 3y ago
Is WebAssembly less trustworthy than minified/obfuscated JavaScript? WebAssembly has no implicit access to browser APIs so I wouldn't think so.
- croes 3y ago
  Less experience in reading and de-obfuscating it.
artursapek 3y ago
Very odd reason to pick on WebAssembly
jchw 3y ago
You can check the network tab. WebAssembly doesn't have magic powers like ActiveX or something like that.
- reactordev 3y ago
  yeah, I checked the asm. using golang, imports some libs and is granted access to disk (sandbox). cool.
4RealFreedom 3y ago
It's interesting that they don't just supply the source code. Are they hoping if there's enough interest then they can turn this into a service? This type of functionality is great but I don't like the black box approach. Edit: After some consideration, maybe they're worried that someone else would create a service using their work.
Vt71fcAqt7 3y ago
You can disable network requests using tools like ublock and violentmonkey.
taminka 3y ago
> going to Russia? or China? always ironic when ppl say this on websites hosted in the us, a country with the most documented cases of governmental organisation backdooring/spying :/
- jkestner 3y ago
  True, though that's because the US has a fairly free press and the Freedom of Information Act.
  - artursapek 3y ago
    HA
  - croes 3y ago
    And the CloudAct and gagging orders
- csdreamer7 3y ago
  > always ironic when ppl say this on websites hosted in the us, a country with the most documented cases of governmental organisation backdooring/spying :/ That is because other countries do not let you document/publish this information. :-) https://www.nytimes.com/2022/03/04/world/europe/russia-censorship-media-crackdown.html https://www.nytimes.com/2022/03/04/world/europe/russia-censo... https://www.eff.org/deeplinks/2022/08/uks-online-safety-bill-attacks-free-speech-and-encryption https://www.eff.org/deeplinks/2022/08/uks-online-safety-bill... At least not as much as American courts will allow. The US has it's own censorship laws, but American resistance/choosing to ignore, is quite strong.
  - taminka 3y ago
    backdooring and censorship are two very different things
    - csdreamer7 3y ago
      > backdooring and censorship are two very different things Parent poster talked about backdooring being documented in the US, not comparing the two in general. I posted links about non-US governments making it illegal to document the backdooring or other things the government may worry about an unpopular reaction to. The practice of the 1st amendment in the US offers very strong, but not absolute, protections against this.
Larrikin 3y ago
Isn't this true of basically every single program, in browser or not? If you're worried turn off network access
raincole 3y ago
What does it even mean lol. I really like how you implied that it's a problem of WebAssembly. How is checking a web page's network connection, WebAssembly or not, harder than reading ALL the source code (if you don't read them all you can't be sure!) of a non-trivial app?
- gabereiser 3y ago
  I was expecting something along the lines of pdf.js or something. WebAssembly was a shock, but I looked at the asm, saw golang, decompiled back to go and looked. all good. still... all it takes is an errant http.client call.
  - deleted 3y ago
    [deleted]
akmittal 3y ago
Open website > disable internet/wifi > perform your task and close tab
- h4x0rr 3y ago
  If the website is truly malicious it could store the data in localStorage and transfer it to their servers the next time you open the site
askvictor 3y ago
Do you inspect the source of every webpage you visit, and every application you run?

remram 3y ago

Is WebAssembly less trustworthy than minified/obfuscated JavaScript? WebAssembly has no implicit access to browser APIs so I wouldn't think so.

croes 3y ago
Less experience in reading and de-obfuscating it.

artursapek 3y ago

Very odd reason to pick on WebAssembly

jchw 3y ago

You can check the network tab. WebAssembly doesn't have magic powers like ActiveX or something like that.

reactordev 3y ago
yeah, I checked the asm. using golang, imports some libs and is granted access to disk (sandbox). cool.

4RealFreedom 3y ago

It's interesting that they don't just supply the source code. Are they hoping if there's enough interest then they can turn this into a service? This type of functionality is great but I don't like the black box approach. Edit: After some consideration, maybe they're worried that someone else would create a service using their work.

Vt71fcAqt7 3y ago

You can disable network requests using tools like ublock and violentmonkey.

taminka 3y ago

> going to Russia? or China? always ironic when ppl say this on websites hosted in the us, a country with the most documented cases of governmental organisation backdooring/spying :/

jkestner 3y ago
True, though that's because the US has a fairly free press and the Freedom of Information Act.
- artursapek 3y ago
  HA
- croes 3y ago
  And the CloudAct and gagging orders
csdreamer7 3y ago
> always ironic when ppl say this on websites hosted in the us, a country with the most documented cases of governmental organisation backdooring/spying :/ That is because other countries do not let you document/publish this information. :-) https://www.nytimes.com/2022/03/04/world/europe/russia-censorship-media-crackdown.html https://www.nytimes.com/2022/03/04/world/europe/russia-censo... https://www.eff.org/deeplinks/2022/08/uks-online-safety-bill-attacks-free-speech-and-encryption https://www.eff.org/deeplinks/2022/08/uks-online-safety-bill... At least not as much as American courts will allow. The US has it's own censorship laws, but American resistance/choosing to ignore, is quite strong.
- taminka 3y ago
  backdooring and censorship are two very different things
  - csdreamer7 3y ago
    > backdooring and censorship are two very different things Parent poster talked about backdooring being documented in the US, not comparing the two in general. I posted links about non-US governments making it illegal to document the backdooring or other things the government may worry about an unpopular reaction to. The practice of the 1st amendment in the US offers very strong, but not absolute, protections against this.

Larrikin 3y ago

Isn't this true of basically every single program, in browser or not? If you're worried turn off network access

raincole 3y ago

What does it even mean lol. I really like how you implied that it's a problem of WebAssembly. How is checking a web page's network connection, WebAssembly or not, harder than reading ALL the source code (if you don't read them all you can't be sure!) of a non-trivial app?

gabereiser 3y ago
I was expecting something along the lines of pdf.js or something. WebAssembly was a shock, but I looked at the asm, saw golang, decompiled back to go and looked. all good. still... all it takes is an errant http.client call.
- deleted 3y ago
  [deleted]

akmittal 3y ago

Open website > disable internet/wifi > perform your task and close tab

h4x0rr 3y ago
If the website is truly malicious it could store the data in localStorage and transfer it to their servers the next time you open the site

askvictor 3y ago

Do you inspect the source of every webpage you visit, and every application you run?