So we get all these startups hyped into how WebAssembly is the silver bullet that will solve all security problems, which is kind of true until one reads all footnotes that come along with the contract.
Who, exactly, is overselling the wasm sandbox model? What startups are claiming wasm is a silver bullet that will solve all their problems? And I believe they're out there - but just because some wasm proponents are idiots doesn't make webassembly itself without value or without merit.
There's young idealistic "true believers" who latch on to any new technology trend. I've never been smart or lucky enough to stop them. People seem to make bad cults on top of all sorts of dubious technology ideas. And I've met plenty - nodejs devs who wanted to rewrite linux in javascript. React devs who thought functional programming was invented by react, and were convinced it was going to change the world. And oh, blockchain people. So many blockchain people.
But godspeed - maybe you'll have more luck in your anti-hucksterism crusade than I.
Webassembly and sandboxing in general isn’t a silver bullet that will solve every security problem we face. We still need our other languages and other tools, like static analysis and model checking.
I see it as a part of defence in depth. Wasm helps prevent RCE attacks and it helps control the blast radius of bad code. Rust and Go help prevent memory corruption bugs like heartbleed happening in the first place. No individual piece will be perfect - but ideally we want a world where no single bug on its own will give attackers the keys to the kingdom. At least, that’s the hope.