Everything Old Is New Again: Binary Security of WebAssembly [pdf]

Re:Everything Old Is New Again: Binary Security of WebAssemb... by nynx on Friday April 30, 2021 @12:59PM (#26996052)

This paper always confuses people. The wasm sandbox is secure, and continues to be. This paper merely states that if you use an insecure language and mess up, then your program can be messed with.

[ Parent | on HN ]

Re:Everything Old Is New Again: Binary Security of WebAssemb... by modeless on Friday April 30, 2021 @01:09PM (#26996206)

The paper is also pointing out that wasm is missing some features that make it easier to exploit insecure languages than it is in native code.

[ Parent | on HN ]

Re:Everything Old Is New Again: Binary Security of WebAssemb... by emn13 on Friday April 30, 2021 @02:01PM (#26997008)

Well, easier... except that your hypothetical insecure WASM program has virtually no I/O, so pretty much every exploit is going to need some kind of extra indirection to even get into the WASM program - and once hacked, that WASM program again can barely interact with anything, meaning that again expoitability is going to be pretty situational. I suppose a native program might also have a sandbox that's as restrictive, but that's not exactly common.

[ Parent | on HN ]