Re:WAVM: standalone WebAssembly VM prototype
by fulafel on Monday June 06, 2016 @12:53AM
(#11844737)
Implementation level bugs dominate, not spec bugs.
Re:WAVM: standalone WebAssembly VM prototype
by espadrine on Monday June 06, 2016 @03:56AM
(#11845265)
In this instance, WASM shares JS' sandbox and security model down to the implementation, so the added risk is extremely limited. The only part that could be dangerous is the parser.
Re:WAVM: standalone WebAssembly VM prototype
by fulafel on Monday June 06, 2016 @04:58AM
(#11845437)
From WAVM's Github README: "This is a prototype of a simple standalone VM for WebAssembly"
So it doesn't share code with a JS implementation in this case.
Re:WAVM: standalone WebAssembly VM prototype
by espadrine on Monday June 06, 2016 @06:38AM
(#11845726)
Browsers have their security model. On the other hand, when you install an executable binary or a Node.js program, you don't expect to have the same security model.
This project fits in the latter category. It does not claim that downloaded binaries are protected by a sandbox, and the only security claim it makes is the following weak one: “The generated code should be unable to access any memory outside of the addresses allocated to it”.
I don't even understand what this is supposed to mean. Do you mean that a hole in the spec means that a sec vuln would occur in every implementation? Or that 5 implementations means 5 code bases to review?
Either way, it seems like a sentence that is meant to carry weight but is ultimately nearly completely meaningless. N different desktop apps on my computer have N chances for sec vulns. I don't see what that statement is supposed to mean regarding WebAssembly.