News for hackers. Stuff that matters.

A comment on Web Assembly Working Group Charter Approved. Parent comment

Re:Web Assembly Working Group Charter Approved by Houshalter on Friday August 04, 2017 @10:24AM (#14928865)
Native apps are not compatible across platform. But more importantly they can't be safely installed by the user. I don't want to install your websites app because I have no way of knowing it won't give me a virus or drain my battery. How does that let "software publishers control my usage even more"? It takes a significant amount of their control away by putting them in a limited sandbox.

Wasm is the first time we will get cross platform and fully sandboxed native speed code.

None of what you speak of has anything to do with wasm. You can do all that just fine with JavaScript. We've had that world ever since browsers allowed disabling right clicking. Even before js, you could always distribute your webpage as an image if you wanted that. Wasm just let's you run code faster. It doesn't change anything.

[ Parent | on HN ]
Re:Web Assembly Working Group Charter Approved by baybal2 on Saturday August 05, 2017 @04:00AM (#14934689)
You are unaware of issues with sandbox.

Here they are:

1. A sandbox can have bugs, and they do have them

2. Sandboxed environments have to give huge reach of system api's anyways, and you can do a lot with them

3. There are classes of vulnurabilities that sandboxes can't do anything about: instruction level exploits, hardware bugs, "gpu frying webgl shaders"

4. Human factor (see comments about "run anyways" above)

[ Parent | on HN ]
Re:Web Assembly Working Group Charter Approved by Houshalter on Saturday August 05, 2017 @06:40AM (#14935112)
All of that applies to JavaScript again. Wasm is just lower level and simpler. If anything it should be significantly easier to sandbox because of its simplicity. It doesn't provide any more access to Apis or anything than JavaScript does.
[ Parent | on HN ]
Re:Web Assembly Working Group Charter Approved by lozenge on Saturday August 05, 2017 @12:25PM (#14936465)
Some sandbox is better than no sandbox. When's the last time somebody delivered ransomware through the browser without a user explicitly opening a downloaded file?
[ Parent | on HN ]