2 ms·
On one hand, yes, new attack surface is new attack surface. But WASM has been in browsers for almost a decade now.
by Retr0id 8mo ago
On one hand, yes, new attack surface is new attack surface. But WASM has been in browsers for almost a decade now.
- lich_king 8mo agoWithout the bindings this talks about, so it really couldn't do nearly as much.
- 0x457 8mo agoWASM has access to everything JS has via JS in the same sandbox that JS runs in. JS didn't magically become more "secure". Multiple things happened: - ActiveX and Flash got booted from browsers - Browsers got much better sandboxes Essentially limited what untrusted code can run and sandboxed that untrusted code. Before NaCl and PNaCl it was wild west in browsers. The same sandbox runs WASM. It even goes through the same runtime in every browser. It's no different from compiling language of your choice to subset of JavaScript (see asm.js).