Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Bytecode Alliance: Building a secure, composable future for WebAssembly

hacks.mozilla.org

Post reply on HN
Print view View original

201–210 of 265 posts

Re: The Bytecode Alliance: Building a secure, composable future for WebAssembly

#201

Post by pjmlp »

lambda wrote: post #157
tschneidereit wrote: post #153

Earlier quoted context omitted.

Indeed: that and many other things are prior art in this space. And there is a lot of prior art for what we're working on—this is not meant as an academic research project! :)

Yes, one of the answers I want to give any time someone asks "why will WASM succeed when the JVM didn't" is that there is 25 years more experience and research to draw upon.

And yet bounds checking access validation was left out of the design, something that most of previous research projects took care to taint as unsafe packages when present.

Re: The Bytecode Alliance: Building a secure, composable future for WebAssembly

#202

Post by pjmlp »

jdance wrote: post #92
nabla9 wrote: post #71

JVM was supposed to be this. Gosling said publicly that JVM is more important than Java. . Many things went wrong. Microsoft was actively sabotaging JVM. They implemented very fast JVM for Explorer and their operating system that intentionally broke the JVM 1.1 standard. See Sun vs Microsoft 1997. Microsoft lost and paid damages. .NET was created to do more damage.

I like the JVM and have done lots of code for it, but the java download&install / setting up PATH / non native gui-look / no exe-files / should i get se/ee/jre/sdk etc etc must be a big contributing factor to its lack of being more popular (client side). A lot of the experience has been clumsy, ugly and unintuitive from the start

WebAssembly developer experience is also not the most friendly one, with its mix of toolchains, specially if one is on Windows.

Oh, and debugging is still at printf level style and reading raw bytecodes.

Re: The Bytecode Alliance: Building a secure, composable future for WebAssembly

#203

Post by pjmlp »

mantap wrote: post #166
shmolyneaux wrote: post #74

Earlier quoted context omitted.

Thanks for the reference. Just so it's clear, the definition of "malware" used here is in-browser crypto mining and obfuscation. Only 1 in 600 of the top 1 million sites use WebAssembly. WebAssembly doesn't actually provide a new vector for malware.

WebAssembly is still very immature. It unsurprising that it has such a low adoption right now. I think the real problem with webassembly would be if it becomes too popular and starts to become a JS competitor rather than a complement to JS.

WebAssembly is the revenge of Flash/Java/ActiveX, but this time everything will turn out perfect, as per WebAssembly advocacy.

Re: The Bytecode Alliance: Building a secure, composable future for WebAssembly

#204

Post by dgellow »

devwastaken wrote: post #200

There should not be a 'browser wasm' and a 'non browser' wasm. The wasm committee made many mistakes by treating it as an idea on paper, and not writing the actual implimenting software. This has resulted in significant fragmenting of implimentation, each less trustworthy than the last. If any software is going to advertise safety, it must prove it. That's done through the feedback cycle and careful development. The…

Try searching for C, C++, or even SQL or Javascript. You will quickly see that you don’t have “the official implementation”, because that’s not how things work in practice when considering well standardized and widely used software.

Re: The Bytecode Alliance: Building a secure, composable future for WebAssembly

#205

Post by kasperni »

int_19h wrote: post #172
nabla9 wrote: post #71

JVM was supposed to be this. Gosling said publicly that JVM is more important than Java. . Many things went wrong. Microsoft was actively sabotaging JVM. They implemented very fast JVM for Explorer and their operating system that intentionally broke the JVM 1.1 standard. See Sun vs Microsoft 1997. Microsoft lost and paid damages. .NET was created to do more damage.

JVM bytecode semantics were all about Java - it forces the Java object model on you, for example. It was never designed to allow a diverse ecosystem of languages.

Yet, we still a lot more new languages on the Java platform. Then say .NET which was designed to be polyglot.

Re: The Bytecode Alliance: Building a secure, composable future for WebAssembly

#206

Post by kasperni »

jdance wrote: post #92
nabla9 wrote: post #71

JVM was supposed to be this. Gosling said publicly that JVM is more important than Java. . Many things went wrong. Microsoft was actively sabotaging JVM. They implemented very fast JVM for Explorer and their operating system that intentionally broke the JVM 1.1 standard. See Sun vs Microsoft 1997. Microsoft lost and paid damages. .NET was created to do more damage.

I like the JVM and have done lots of code for it, but the java download&install / setting up PATH / non native gui-look / no exe-files / should i get se/ee/jre/sdk etc etc must be a big contributing factor to its lack of being more popular (client side). A lot of the experience has been clumsy, ugly and unintuitive from the start

Which, is also why that method for delivering applications has been deprecated for a couple of years.

Now, the prefered way to ship a Java application is to bundle the runtime and the application into a single installer similar to, for example, Electron apps.

Re: The Bytecode Alliance: Building a secure, composable future for WebAssembly

#207

Post by vanderZwan »

devwastaken wrote: post #198
JoshTriplett wrote: post #2

I'm one of the folks working with the Alliance, and I'm incredibly excited about WebAssembly outside the browser. Happy to answer questions. Imagine extensions for applications or databases, written in any language you want, with no ability to exfiltrate data. Imagine supporting a safe plugin API that isn't just for C and languages that FFI to C, but works natively with safe datatypes. Today, if you want to be extens…

This isn't entirely accurate. Exploitations in whatever code is converted to wasm instructions still work inside the wasm memory space. As in, if you write your program in c, python, whatever, and put it in wasm, then have a wasm extension system of some sort - if that c or python is exploitable, then whatever external access that wasm instance has is now useable. And whatever memory is in the memory space can be mod…

Does WASM let you run memory as code?

Re: The Bytecode Alliance: Building a secure, composable future for WebAssembly

#208

Post by DonHopkins »

nabla9 wrote: post #71

JVM was supposed to be this. Gosling said publicly that JVM is more important than Java. . Many things went wrong. Microsoft was actively sabotaging JVM. They implemented very fast JVM for Explorer and their operating system that intentionally broke the JVM 1.1 standard. See Sun vs Microsoft 1997. Microsoft lost and paid damages. .NET was created to do more damage.

Yeah, Microsoft actively sabotaged JVM by developing CLR. Those monsters!

Re: The Bytecode Alliance: Building a secure, composable future for WebAssembly

#209

Post by DonHopkins »

bestouff wrote: post #12

Don't take it bad, but it looks like the java launch a (long) while ago. What makes wasm better than java ?

Being built into the browser. Look how many years and versions of Java made then failed at that promise.

Re: The Bytecode Alliance: Building a secure, composable future for WebAssembly

#210

Post by DonHopkins »

pjmlp wrote: post #203
mantap wrote: post #166

Earlier quoted context omitted.

WebAssembly is still very immature. It unsurprising that it has such a low adoption right now. I think the real problem with webassembly would be if it becomes too popular and starts to become a JS competitor rather than a complement to JS.

WebAssembly is the revenge of Flash/Java/ActiveX, but this time everything will turn out perfect, as per WebAssembly advocacy.

Hey don't forget Shockwave. That was the thing that totally took over the web that everybody hated before Flash.
Post reply on HN