News for hackers. Stuff that matters.

A comment on QuakeJS – A Quake Port to JavaScript with Emscripten. Parent comment

Re:QuakeJS – A Quake Port to JavaScript with Emscripten by pjmlp on Monday April 06, 2020 @04:34PM (#22797534)
Yeah lets see how many security issues we get to see in WebAssembly sandboxes once researchers set their sights on them, given that they already found a couple on JS engines.
[ Parent | on HN ]
Re:QuakeJS – A Quake Port to JavaScript with Emscripten by modeless on Monday April 06, 2020 @04:48PM (#22797694)
Wasm has been here for years already. There's no flood of issues waiting for some cue to be released. It's no worse than any other part of the browser; probably better than some. Besides, modern browsers don't rely solely on one sandbox anymore. There are many levels of protection now.
[ Parent | on HN ]
Re:QuakeJS – A Quake Port to JavaScript with Emscripten by pjmlp on Monday April 06, 2020 @04:52PM (#22797732)
CPUs were deemed unexploitable, until researchers had a better look into them.

The only thing that makes WebAssembly safer than its predecessors, is that most security researchers haven't yet bothered with it.

[ Parent | on HN ]
Re:QuakeJS – A Quake Port to JavaScript with Emscripten by hjanssen on Monday April 06, 2020 @05:09PM (#22797908)
Which is already true for any type of software.

Bugs exist everywhere. Of course you finde some if you put in the effort. That is not something that marks the quality of the code.

[ Parent | on HN ]
Re:QuakeJS – A Quake Port to JavaScript with Emscripten by na85 on Monday April 06, 2020 @07:24PM (#22798922)
Not all ideas were created equal. Parent's contention (one I agree with) seems to be that the contemporary browser-as-app-deployment-platform paradigm is a bad idea.
[ Parent | on HN ]
Re:QuakeJS – A Quake Port to JavaScript with Emscripten by modeless on Monday April 06, 2020 @07:20PM (#22798890)
I didn't say Wasm is unexploitable. You're attacking a straw man.

Wasm vulnerabilities are worth real money. Bug bounties are tens of thousands of dollars to hundreds of thousands as part of exploit chains. If people aren't finding many, your explanation will have to be a little bit better than "they haven't yet bothered".

[ Parent | on HN ]
Re:QuakeJS – A Quake Port to JavaScript with Emscripten by pjmlp on Tuesday April 07, 2020 @01:48AM (#22800626)
Currently there are better rivers for panning, but rest assured they will come.

https://i.blackhat.com/us-18/Thu-August-9/us-18-Lukasiewicz-...

[ Parent | on HN ]
Re:QuakeJS – A Quake Port to JavaScript with Emscripten by BubRoss on Monday April 06, 2020 @04:45PM (#22797671)
You bring this nonsense up in every webasm thread and every time it is explained to you that webasm does no IO and is contained in the same environment as javascript. Every time you either bring up details that have nothing to actually do with webasm or you say something vague about possible security problems in the future.

If you have real criticism based on real information, let's see it.

[ Parent | on HN ]
Re:QuakeJS – A Quake Port to JavaScript with Emscripten by pjmlp on Monday April 06, 2020 @04:49PM (#22797700)
You mean the same JS engines that already have several entries on the CVE database? Yeah, really safe.
[ Parent | on HN ]
Re:QuakeJS – A Quake Port to JavaScript with Emscripten by jjoonathan on Monday April 06, 2020 @05:11PM (#22797927)
It has a looooong way to go before it's as bad as flash.
[ Parent | on HN ]
Re:QuakeJS – A Quake Port to JavaScript with Emscripten by pjmlp on Tuesday April 07, 2020 @02:11AM (#22800741)
Not really, I already posted a couple of initial steps in a sibling comment.
[ Parent | on HN ]
Re:QuakeJS – A Quake Port to JavaScript with Emscripten by jjoonathan on Tuesday April 07, 2020 @02:22PM (#22805929)
It would have to run a marathon to catch up. Initial steps are hardly an indication that it will.
[ Parent | on HN ]
Re:QuakeJS – A Quake Port to JavaScript with Emscripten by BubRoss on Monday April 06, 2020 @05:46PM (#22798213)
Can you link one that has to do with webasm? Are you saying that you think javascript is less secure than flash?
[ Parent | on HN ]
Re:QuakeJS – A Quake Port to JavaScript with Emscripten by BubRoss on Tuesday April 07, 2020 @09:11AM (#22802854)
All of these are speculation about the future. Most have nothing to do with webasm at all.

The first is about webgl (that has nothing to do with webasm)

The second is about using javascript with intel speculative execution exploits.

The third is grasping at straws, saying that call center scams would be more obsfuscated, even though javascript or asm.js can be just as obsfuscated, if not more.

The fourth is about crashes in the webasm JIT

The last is about -theoretically- executing arbitrary javascript. Heavens no.

What is the real reason you have some crazy crusade against webasm? You go to great lengths to grasp at any straws you can. It isn't that big of a deal. It is a more direct way to JIT cpu intensive parts of a web page. Get over it. Incredibly, the alternative is to run actual native instructions by downloading a binary.

[ Parent | on HN ]
Re:QuakeJS – A Quake Port to JavaScript with Emscripten by pjmlp on Tuesday April 07, 2020 @09:36AM (#22803054)
Survivor of the anti-PNaCL, Java and Flash crusade I guess.
[ Parent | on HN ]
Re:QuakeJS – A Quake Port to JavaScript with Emscripten by BubRoss on Tuesday April 07, 2020 @12:19PM (#22804586)
To be clear, because you have seen other VMs, you are desperate to spread complete misinformation and lies about webasm?

Funneling your own frustrations into lying and spreading false information on the internet is not something a reasonable, emotionally healthy person does. Think about all the other people that do that in other areas of discussion. Those are your peers when you do this.

[ Parent | on HN ]
Re:QuakeJS – A Quake Port to JavaScript with Emscripten by pjmlp on Wednesday April 08, 2020 @02:27AM (#22810525)
I am not desperate at all, it is no different than WebAssembly advocates spreading false information about its "safety" or novelty.

In fact I rejoice that WebAssembly, despite all the attempts to be presented as safe and novel, is becoming the mechanism to bring back to life all the plugins that where killed in name of WebAssembly.

I will give 5 years time for WebGL/WebGPU + WebAssembly to rule the majority of multimedia driven websites, with a new generation of Flash like tooling.

Then you call tell the world how much safer and novel WebAssembly is.

[ Parent | on HN ]