Clang runs in the browser and compiles C++ to WebAssembly

Re:Clang runs in the browser and compiles C++ to WebAssembly by jeremyjh on Tuesday January 02, 2018 @06:48AM (#16051344)

I've been using the web for over twenty years and it has never harmed my computer or invaded my system in any way. I do think I've seen adware and scumware that may have originated on the web on friends computers but I'm pretty sure they did something like allow a toolbar to be installed. Can you give an example of an exploit that did not require user permission,did not use a plugin, and that allowed arbitrary code execution from the internet ?

[ Parent | on HN ]

Re:Clang runs in the browser and compiles C++ to WebAssembly by will4274 on Tuesday January 02, 2018 @02:35PM (#16054748)

> I've been using the web for over twenty years and it has never harmed my computer or invaded my system in any way

How do you know? Basically every browser has a RCE vulnerability a month and has for 20 years. From ancient JPEG vulnerabilities to modern video codecs and DOM manipulation vulnerabilities.

[ Parent | on HN ]

Re:Clang runs in the browser and compiles C++ to WebAssembly by dpwm on Tuesday January 02, 2018 @07:20AM (#16051456)

Anecdotally, I've never experienced remote code execution through a browser either. However, the most widely used browser for many years did have plenty of remote execution vulnerabilities that did not rely on plugins or toolbars [0].

[0] https://www.cvedetails.com/vulnerability-list.php?vendor_id=...

[ Parent | on HN ]

Re:Clang runs in the browser and compiles C++ to WebAssembly by netheril96 on Tuesday January 02, 2018 @10:06AM (#16052201)

Exploiting remote execution vulnerabilities is doable, but why do that when one has the easy route of exploiting gullible users instead?

[ Parent | on HN ]

Re:Clang runs in the browser and compiles C++ to WebAssembly by blub on Thursday January 04, 2018 @06:20AM (#16069482)

Would the recent Spectre vulnerability be an acceptable example for you?

There are a gazillion others, but this one is nice and sweet and exposes the whole web app strategy as completely bankrupt from a security perspective.

[ Parent | on HN ]

Re:Clang runs in the browser and compiles C++ to WebAssembly by TomMarius on Tuesday January 02, 2018 @07:19AM (#16051451)

Yes. The web itself is harmless; it's the stuff you download and run that harms you.

[ Parent | on HN ]

Re:Clang runs in the browser and compiles C++ to WebAssembly by stult on Tuesday January 02, 2018 @09:43AM (#16052060)

Guns aren't dangerous! It's the bullets that will get you!

[ Parent | on HN ]

Re:Clang runs in the browser and compiles C++ to WebAssembly by netheril96 on Tuesday January 02, 2018 @10:10AM (#16052222)

This is not an appropriate analogy. Guns and bullets are designed to kill, but browsers and the download capability are not designed to infect your computer. Rather, they are designed with an opposite goal.

[ Parent | on HN ]

Re:Clang runs in the browser and compiles C++ to WebAssembly by alpos on Tuesday January 02, 2018 @11:16AM (#16052730)

An "infection" in this case would be the execution of some other person's code on my computer. Browsers have been designed specifically to do this since Javascript was invented.

The only difference between malware and "regular-ware" is whether the code meets certain user expectations about what it will and will not do.

[ Parent | on HN ]

Re:Clang runs in the browser and compiles C++ to WebAssembly by TomMarius on Tuesday January 02, 2018 @01:54PM (#16054290)

Yes, exactly. What's your point though?

[ Parent | on HN ]