4 ms·

You both need to stop conflating bugs in a C program that become bugs in webasm with insecurity. Insecurity would be escaping the VM it runs in. In a native c

You both need to stop conflating bugs in a C program that become bugs in webasm with insecurity. Insecurity would be escaping the VM it runs in. In a native compiled binary you have infinite permissions and can make system calls. You can't do that in a webasm VM. Webasm is not insecure because a C program that crashes also crashes in webasm. You still haven't shown any evidence of escaping the VM or actual insecurity.

mort96 3y ago
Nobody is conflating bugs in a C program with bugs in WASM. Nobody is saying that there are sandbox escaping bugs. I give up.
- CyberDildonics 3y ago
  If you can't escape the VM, then where is the insecurity? If someone is dumping privileged data into a VM that's insecure no matter what, why would you blame webasm?
  - mort96 3y ago
    Web pages can have insecure JavaScript even if the sandbox isn't escaped. Sandbox escape isn't the only possible vulnerability in sandboxed applications. This is basic stuff that I know you already agree with so I don't understand why you keep pressing it. "Why would you blame WASM" is the right question. As I have said in LITERALLY every single comment so far, blaming WASM instead of the alleged hype people is where pjmlp is wrong. He's not wrong in the assertion that insecure programs may remain insecure when run in the WASM sandbox. But you refuse to listen. This conversation is like talking to a much less polite ChatGPT.
    - CyberDildonics 3y ago
      You're arguing against claims no one is making. No one thinks webasm magically fixes bugs. I never said that and no one else did either.
      - mort96 3y ago
        Fucking hell, please pay attention to the discussion you're in. pjmlp's claim is: marketing around WASM suggests that running C programs in WASM instead of natively magically makes those C programs safe.
        CyberDildonics 3y ago
        I doubt anyone is suggesting "magic" and obviously when people talk about 'safety' they mean preventing crashes and escaping the VM. What specific marketing are you talking about? Link what you're referring to.
        mort96 3y ago
        Read. My. Comments. I am not claiming that WASM has been misleadingly marketed. pjmlp is. Ask him to link to what he's referring to.
        CyberDildonics 3y ago
        After all this, now you're going to say you don't actually have any of these criticisms and you were just repeating someone else's claims? Ask him to link to what he's referring to. He posts this stuff in half the webasm threads I see. Like you he never has anything to back it up and you both get very upset at people asking.
        mort96 3y ago
        YES! I DISAGREE WITH PJMLK! ALL MY RESPONSES TO PJMLK HAVE BEEN ME DISAGREEING WITH HIM! ALL MY RESPONSES TO YOU HAVE BEEN ABOUT HOW YOU CAN ARGUE AGAINST HIM BETTER BY UNDERSTAND WHICH WRONG CLAIMS HE ACTUALLY MADE, SO THAT YOU'RE NOT ARGUING AGAINST STRAW MEN! PAY ATTENTION! This is my last response in this thread. You've displayed a profound inability to think. I can't be part of this anymore.
        3y ago
  - cygx 3y ago
    A reference was already provided. Here's a direct link to the demo of a cross-site scripting attack via webassembly: https://www.youtube.com/watch?v=glL__xjviro&t=450s https://www.youtube.com/watch?v=glL__xjviro&t=450s
    - CyberDildonics 3y ago
      That looks like you have to load up a local file with an exploit, use a png library not being used by major software that also doesn't check for issues with the png file (because they already need to deal with malicious files) and the end result is that it will run javascript if javascript is able to be run from webasm in that context. It is still worth looking at and is actual information, so I appreciate that.
      - cygx 3y ago
        Don't focus on the specific exploit, it's a general issue: In order to be useful, your wasm application will likely have to be able to make systems calls, or whatever its equivalent might be on your particular host environment. If you can corrupt internal state, you can control the arguments to these calls. The severity of the issue will depend on what your application is allowed to do: If all it has access to is a some virtual file system, the host will still be safe. But if that virtual file system contains sensitive data, results may nevertheless be catastrophic if, say, it can also request resources over http.

mort96 3y ago

Nobody is conflating bugs in a C program with bugs in WASM. Nobody is saying that there are sandbox escaping bugs. I give up.

CyberDildonics 3y ago
If you can't escape the VM, then where is the insecurity? If someone is dumping privileged data into a VM that's insecure no matter what, why would you blame webasm?
- mort96 3y ago
  Web pages can have insecure JavaScript even if the sandbox isn't escaped. Sandbox escape isn't the only possible vulnerability in sandboxed applications. This is basic stuff that I know you already agree with so I don't understand why you keep pressing it. "Why would you blame WASM" is the right question. As I have said in LITERALLY every single comment so far, blaming WASM instead of the alleged hype people is where pjmlp is wrong. He's not wrong in the assertion that insecure programs may remain insecure when run in the WASM sandbox. But you refuse to listen. This conversation is like talking to a much less polite ChatGPT.
  - CyberDildonics 3y ago
    You're arguing against claims no one is making. No one thinks webasm magically fixes bugs. I never said that and no one else did either.
    - mort96 3y ago
      Fucking hell, please pay attention to the discussion you're in. pjmlp's claim is: marketing around WASM suggests that running C programs in WASM instead of natively magically makes those C programs safe.
      - CyberDildonics 3y ago
        I doubt anyone is suggesting "magic" and obviously when people talk about 'safety' they mean preventing crashes and escaping the VM. What specific marketing are you talking about? Link what you're referring to.
        mort96 3y ago
        Read. My. Comments. I am not claiming that WASM has been misleadingly marketed. pjmlp is. Ask him to link to what he's referring to.
        CyberDildonics 3y ago
        After all this, now you're going to say you don't actually have any of these criticisms and you were just repeating someone else's claims? Ask him to link to what he's referring to. He posts this stuff in half the webasm threads I see. Like you he never has anything to back it up and you both get very upset at people asking.
        mort96 3y ago
        YES! I DISAGREE WITH PJMLK! ALL MY RESPONSES TO PJMLK HAVE BEEN ME DISAGREEING WITH HIM! ALL MY RESPONSES TO YOU HAVE BEEN ABOUT HOW YOU CAN ARGUE AGAINST HIM BETTER BY UNDERSTAND WHICH WRONG CLAIMS HE ACTUALLY MADE, SO THAT YOU'RE NOT ARGUING AGAINST STRAW MEN! PAY ATTENTION! This is my last response in this thread. You've displayed a profound inability to think. I can't be part of this anymore.
        3y ago
- cygx 3y ago
  A reference was already provided. Here's a direct link to the demo of a cross-site scripting attack via webassembly: https://www.youtube.com/watch?v=glL__xjviro&t=450s https://www.youtube.com/watch?v=glL__xjviro&t=450s
  - CyberDildonics 3y ago
    That looks like you have to load up a local file with an exploit, use a png library not being used by major software that also doesn't check for issues with the png file (because they already need to deal with malicious files) and the end result is that it will run javascript if javascript is able to be run from webasm in that context. It is still worth looking at and is actual information, so I appreciate that.
    - cygx 3y ago
      Don't focus on the specific exploit, it's a general issue: In order to be useful, your wasm application will likely have to be able to make systems calls, or whatever its equivalent might be on your particular host environment. If you can corrupt internal state, you can control the arguments to these calls. The severity of the issue will depend on what your application is allowed to do: If all it has access to is a some virtual file system, the host will still be safe. But if that virtual file system contains sensitive data, results may nevertheless be catastrophic if, say, it can also request resources over http.