3 ms·

Taking power away from the user seems to be a large part of the appeal of WASM. Wasn't it just a year or two ago that it was being reported that 75% of WASM mod

Taking power away from the user seems to be a large part of the appeal of WASM. Wasn't it just a year or two ago that it was being reported that 75% of WASM modules are malicious? A study from a previous year had said 50% of all websites using it were malicious so the trend line isn't looking great. I don't know how we got from "don't download and install random software from untrusted sources on your devices" to "let anyone with a website run code directly on your hardware. Sandboxes are impossible to breach!" I get that it's cool tech and the promise of writing software to run on many different platforms is exciting, but from a real world/user perspective it's insane.

armchairhacker 3y ago
> I don't know how we got from "don't download and install random software from untrusted sources on your devices" to "let anyone with a website run code directly on your hardware. Sandboxes are impossible to breech!" The whole point of WASM is that it's the alternative to downloading and installing random software.
- nehal3m 3y ago
  Wasn’t that your parents point though?
- autoexec 3y ago
  "Same malware, but with fewer steps" isn't exactly a win for WASM.
minitech 3y ago
It has exactly the same potential in the control and code-running respects as (minified) JavaScript. It’s overrepresented in malware because it’s faster, i.e. better for cryptominers. (Many sandbox breaches come from JavaScript’s complexity.)
- pests 3y ago
  Right, did everyone forget about ASM.js? We already had conpile-to-js, it was just a horrible subset of more efficient JS. WASM is just the extension and further development of that.