Firefox's low-latency WebAssembly compiler

Re:Firefox's low-latency WebAssembly compiler by pjmlp on Friday March 27, 2020 @04:03AM (#22701117)

Which I doubt, given that it depends on what is being compiled into WebAssembly anyway.

It is really nothing new here, just the politics to have a bytecode execution platform that everyone agrees on.

For example, if I can replicate a Flash security flaw with CheerpX, should I blame Flash, CheerpX for being a good implementation, or WebAssembly for allowing Leaning Technologies to faithfully re-implement Flash?

[ Parent | on HN ]

Re:Firefox's low-latency WebAssembly compiler by afiori on Friday March 27, 2020 @04:40AM (#22701252)

Memory tagging or inner bound checks have no effect on sandboxing. The wasm guarantee is that a module cannot escape it's sandbox, not that it is logically correct.

the security model of the web site based on executing arbitrary code, so you would need to assume that the wasm you receive tagged it's memory in the most malicious way possible anyway.

the way I see it real hardware needs this kind of checks more because they have worse sandboxing

[ Parent | on HN ]

Re:Firefox's low-latency WebAssembly compiler by afiori on Friday March 27, 2020 @04:42AM (#22701260)

Also, Flash vulnerabilities were about escaping the execution sandbox of the web, so you should blame bad the implementation/specification of wasm in your case.

[ Parent | on HN ]

Re:Firefox's low-latency WebAssembly compiler by jankiel on Friday March 27, 2020 @04:41AM (#22701256)

AFAIK WebAssembly can't do more harm than JS since it lives in the same sandbox, so that's not a concern? You're basically running Flash in a small VM.

[ Parent | on HN ]