From Asm.js to WebAssembly

Re:From Asm.js to WebAssembly by JoshTriplett on Wednesday June 17, 2015 @03:12PM (#9734522)

> a bunch of those are forbidden for security reasons (like raw file access and raw TCP and UDP sockets), so you wouldn't want pages to just have access to them in the manner that a PNaCl-using Chrome extension does anyway.

Sure I do, with explicit permission granted. For instance, consider a web-based VNC client, without needing a server-side WebSocket proxy.

And there are far more where those came from.

Also, the advantage of making low-level web APIs is that any new high-level APIs built on top of them run inside the sandbox, so their implementation is not part of the attack surface.

[ Parent | on HN ]

Re:From Asm.js to WebAssembly by the8472 on Wednesday June 17, 2015 @03:29PM (#9734643)

Considering that people already are installing apps on their smartphones and nod away all the checkboxes

   [x] share all my contacts
   [x] rummage through my images
   [x] tap into microphone and camera at any time
   [x] set my house on fire

such a list of allow/deny simply needs to come to browsers too.

Ideally they should be designed in a way that those feature unlocks get delayed randomly, so that they always "break" any code relying on those APIs by default. I.e. stuff should still work if the user doesn't give you the key to the city.

[ Parent | on HN ]

Re:From Asm.js to WebAssembly by smitherfield on Friday June 19, 2015 @02:23PM (#9746666)

We had this, it was called "Java applets" (also, DirectX), and it sucked.

[ Parent | on HN ]