News for hackers. Stuff that matters.

A comment on WAVM: standalone WebAssembly VM prototype. Parent comment

Re:WAVM: standalone WebAssembly VM prototype by espadrine on Monday June 06, 2016 @03:56AM (#11845265)
In this instance, WASM shares JS' sandbox and security model down to the implementation, so the added risk is extremely limited. The only part that could be dangerous is the parser.
[ Parent | on HN ]
Re:WAVM: standalone WebAssembly VM prototype by fulafel on Monday June 06, 2016 @04:58AM (#11845437)
From WAVM's Github README: "This is a prototype of a simple standalone VM for WebAssembly"

So it doesn't share code with a JS implementation in this case.

[ Parent | on HN ]
Re:WAVM: standalone WebAssembly VM prototype by espadrine on Monday June 06, 2016 @06:38AM (#11845726)
Browsers have their security model. On the other hand, when you install an executable binary or a Node.js program, you don't expect to have the same security model.

This project fits in the latter category. It does not claim that downloaded binaries are protected by a sandbox, and the only security claim it makes is the following weak one: “The generated code should be unable to access any memory outside of the addresses allocated to it”.

[ Parent | on HN ]