News for hackers. Stuff that matters.

A comment on Shadow: New browser engine made almost entirely in JavaScript. Parent comment

Re:Shadow: New browser engine made almost entirely in JavaSc... by autoexec on Friday October 27, 2023 @07:16PM (#38045198)
Taking power away from the user seems to be a large part of the appeal of WASM. Wasn't it just a year or two ago that it was being reported that 75% of WASM modules are malicious? A a study from previous years had said 50% of all websites using it were malicious so the trend line isn't looking great.

I don't know how we got from "don't download and install random software from untrusted sources on your devices" to "let anyone with a website run code directly on your hardware. Sandboxes are impossible to breach!"

I get that it's cool tech and the promise of writing software to run on many different platforms is exciting, but from a real world/user perspective it's insane.

[ Parent | on HN ]
Re:Shadow: New browser engine made almost entirely in JavaSc... by armchairhacker on Friday October 27, 2023 @07:36PM (#38045343)
> I don't know how we got from "don't download and install random software from untrusted sources on your devices" to "let anyone with a website run code directly on your hardware. Sandboxes are impossible to breech!"

The whole point of WASM is that it's the alternative to downloading and installing random software.

[ Parent | on HN ]
Re:Shadow: New browser engine made almost entirely in JavaSc... by nehal3m on Friday October 27, 2023 @07:40PM (#38045372)
Wasn’t that your parents point though?
[ Parent | on HN ]
Re:Shadow: New browser engine made almost entirely in JavaSc... by autoexec on Friday October 27, 2023 @07:43PM (#38045395)
"Same malware, but with fewer steps" isn't exactly a win for WASM.
[ Parent | on HN ]
Re:Shadow: New browser engine made almost entirely in JavaSc... by minitech on Friday October 27, 2023 @10:24PM (#38046510)
It has exactly the same potential in the control and code-running respects as (minified) JavaScript. It’s overrepresented in malware because it’s faster, i.e. better for cryptominers. (Many sandbox breaches come from JavaScript’s complexity.)
[ Parent | on HN ]
Re:Shadow: New browser engine made almost entirely in JavaSc... by pests on Saturday October 28, 2023 @12:29AM (#38047145)
Right, did everyone forget about ASM.js? We already had conpile-to-js, it was just a horrible subset of more efficient JS. WASM is just the extension and further development of that.
[ Parent | on HN ]