Towards native security defenses for the web ecosystem

Re:Towards native security defenses for the web ecosystem by The_rationalist on Thursday July 23, 2020 @04:25AM (#23925313)

Explaining why it was and why it would still be a disaster would bring actual intellectual value to your comment. The old plugin interface was not at all integrated with browser APIs nor interoperable with js like ts is. The security issues are nothing undoable, one just need to fully sandbox the VM, V8 has nothing special that couldn't be added to graalVM.

Meanwhile not having programming languages is a disaster as I explained in my parent comment but did your brain process the added value that such a change would bring to the world?

[ Parent | on HN ]

Re:Towards native security defenses for the web ecosystem by staticassertion on Thursday July 23, 2020 @11:28AM (#23928359)

I didn't think it needed to be stated why. It was horrible from a security perspective. The world has completely changed in terms of end user security since Java went from default-run to click-by-default to denied.

"One just needs to fully sandbox the VM" this is easier said than done. I explained in another post why Apparmor/Selinux are not nearly as effective as the Chrome sandbox. As for V8, sure, you could port over many mitigations it has to graalVM and get it running in a similar sandbox. Feel free, I'd certainly support you doing so.

Sure, my brain processes the benefit of other languages just fine. I'm excited to see wasm come to the browser.

[ Parent | on HN ]

Re:Towards native security defenses for the web ecosystem by The_rationalist on Thursday July 23, 2020 @12:36PM (#23929162)

I explained in another post why Apparmor/Selinux are not nearly as effective as the Chrome sandbox. Interesting, where can I find such post?

I'm excited to see wasm come to the browser. Yeh but it doesn't have native binding with the browser APIs nor does it have multilanguage interoperability, hence the added values of graalvm over wasm.

[ Parent | on HN ]