Re:QuakeJS – A Quake Port to JavaScript with Emscripten
by modeless on Monday April 06, 2020 @04:48PM
(#22797694)
Wasm has been here for years already. There's no flood of issues waiting for some cue to be released. It's no worse than any other part of the browser; probably better than some. Besides, modern browsers don't rely solely on one sandbox anymore. There are many levels of protection now.
[ Parent
| on HN ]
Re:QuakeJS – A Quake Port to JavaScript with Emscripten
by pjmlp on Monday April 06, 2020 @04:52PM
(#22797732)
CPUs were deemed unexploitable, until researchers had a better look into them.
The only thing that makes WebAssembly safer than its predecessors, is that most security researchers haven't yet bothered with it.
Re:QuakeJS – A Quake Port to JavaScript with Emscripten
by hjanssen on Monday April 06, 2020 @05:09PM
(#22797908)
Which is already true for any type of software.
Bugs exist everywhere. Of course you finde some if you put in the effort. That is not something that marks the quality of the code.
Re:QuakeJS – A Quake Port to JavaScript with Emscripten
by na85 on Monday April 06, 2020 @07:24PM
(#22798922)
Not all ideas were created equal. Parent's contention (one I agree with) seems to be that the contemporary browser-as-app-deployment-platform paradigm is a bad idea.
Re:QuakeJS – A Quake Port to JavaScript with Emscripten
by modeless on Monday April 06, 2020 @07:20PM
(#22798890)
I didn't say Wasm is unexploitable. You're attacking a straw man.
Wasm vulnerabilities are worth real money. Bug bounties are tens of thousands of dollars to hundreds of thousands as part of exploit chains. If people aren't finding many, your explanation will have to be a little bit better than "they haven't yet bothered".
Re:QuakeJS – A Quake Port to JavaScript with Emscripten
by pjmlp on Tuesday April 07, 2020 @01:48AM
(#22800626)
Currently there are better rivers for panning, but rest assured they will come.
https://i.blackhat.com/us-18/Thu-August-9/us-18-Lukasiewicz-...