News for hackers. Stuff that matters.

A comment on How Shopify Uses WebAssembly Outside of the Browser. Parent comment

Re:How Shopify Uses WebAssembly Outside of the Browser by jedisct1 on Saturday December 19, 2020 @08:03AM (#25477160)
You can’t express anything malicious in JavaScript either, yet vulnerabilities are constantly found in web browsers, including WebAssembly JITs.

You can express malicious things in Go, yet the number of RCEs in Go apps is pretty much zero.

[ Parent | on HN ]
Re:How Shopify Uses WebAssembly Outside of the Browser by alquemist on Saturday December 19, 2020 @08:09AM (#25477186)
That's a bit of apples and oranges. JS/WASM are runtimes executing hostile code, whereas Go apps are trusted code.
[ Parent | on HN ]
Re:How Shopify Uses WebAssembly Outside of the Browser by amelius on Saturday December 19, 2020 @08:08AM (#25477184)
> You can’t express anything malicious in JavaScript either

You have to be more specific because lots of fraud is possible by misleading the user through JavaScript tricks.

[ Parent | on HN ]
Re:How Shopify Uses WebAssembly Outside of the Browser by CyberRabbi on Saturday December 19, 2020 @08:35AM (#25477296)
Full device root from JavaScript https://github.com/synacktiv/PS4-webkit-exploit-6.XX
[ Parent | on HN ]
Re:How Shopify Uses WebAssembly Outside of the Browser by etimberg on Saturday December 19, 2020 @09:28AM (#25477583)
What about something like https://github.com/IAIK/rowhammerjs ?
[ Parent | on HN ]