W3C recommends WebAssembly • Hacker News Board

Re: W3C recommends WebAssembly

#51

Post by bogwog » Fri, Dec 06, 2019, 4:01 PM UTC

dmvinson wrote: post #36

mbrock wrote: post #18

Earlier quoted context omitted.

Doesn’t that reasoning also imply that GNU and Linux are awfully opaque and not free nor open, since they are typically distributed as binaries?

The source for GNU and Linux is viewable by everyone, which negates the inability to view what is happening inside a binary. This is the problem Javascript source maps are meant to solve for the web, and I would welcome WASM more if part of the standard was a requirement for a source map when browser Dev Tools are open.

> This is the problem Javascript source maps are meant to solve for the web

That's not the problem source maps are meant to solve. They exist to debug transpiled code.

> The source for GNU and Linux is viewable by everyone, which negates the inability to view what is happening inside a binary.

That's not true. It is non-trivial to verify that the binary you received was built with the source code that's openly available. The point of FOSS is that you always have the option to build your own binaries so that you can be 100% certain of what is running on your machine. Most people aren't going to do that, so they need to place their trust on a third party (like whoever built their kernel). FOSS just makes that trust optional instead of mandatory (like it is with something like Windows)

Re: W3C recommends WebAssembly

#52

Post by mdszy » Fri, Dec 06, 2019, 4:01 PM UTC

duxup wrote: post #19

Does anyone have any good intro resources for WebAssembly for noobs? I've read articles here and there seen some in person demos, and honestly struggle to understand what it is / how it would / works relative to the current state of JavaScript frameworks. Often I'm approaching it from a JavaScript framework (React/Vue/Angular) approach as I'm a bit of a noob to the industry and that's generally my day job working on…

When was the last time you were able to unminify a javascript file that you wanted to investigate and were able to make sense out of it?

Re: W3C recommends WebAssembly

#53

Post by dmvinson » Fri, Dec 06, 2019, 4:02 PM UTC

dkersten wrote: post #20

dmvinson wrote: post #14

This feels like another step away from the free and open web many people are clamoring for. Distributing opaque binaries with websites instead of Javascript is a step past even the obfuscated minified javascript files meant to be confusing. At least those can still be debugged, stepped through, and explored freely by the end user if they want to learn or reverse engineer. Is there any tool or standard being worked on…

In my opinion it’s been a long time since direct access to Javascript has been useful. Yes you can unminify javascript but it’s still more work than most people will go through (especially if the code was generated by a compile to javascript language)so for most people things aren’t really changing that much

Yes, it is a ton of work to step through and understand minified and obfuscated code, but it is a skill that many people learn and do if there is motivation. On your second point, I think the key is that the people who do have a reason to detangle the logic of minified JS can be very impactful. I consider open viewing of Javascript as similar to noncompetes in California. It allows one to view competitors source code (if you have the motivation to work for it), which ultimately allows you to learn from and adapt their best practices. Yes, this can have negative effects, but it also may allow for a smaller company to leapfrog a larger incumbent who is too lazy to do some part of their processing server side. I could probably learn a lot about how to write (and block!) analytics tracking by reviewing the Google analytics javascript source code for example.

(Disclaimer: I've never looked at Google's analytics .js files and that may not be possible for some technical reason unknown to me)

Re: W3C recommends WebAssembly

#54

Post by [deleted] » Fri, Dec 06, 2019, 4:02 PM UTC

dmvinson wrote: post #14

This feels like another step away from the free and open web many people are clamoring for. Distributing opaque binaries with websites instead of Javascript is a step past even the obfuscated minified javascript files meant to be confusing. At least those can still be debugged, stepped through, and explored freely by the end user if they want to learn or reverse engineer. Is there any tool or standard being worked on…

[deleted]

Re: W3C recommends WebAssembly

#55

Post by ouid » Fri, Dec 06, 2019, 4:03 PM UTC

toolz wrote: post #26

dmvinson wrote: post #14

This feels like another step away from the free and open web many people are clamoring for. Distributing opaque binaries with websites instead of Javascript is a step past even the obfuscated minified javascript files meant to be confusing. At least those can still be debugged, stepped through, and explored freely by the end user if they want to learn or reverse engineer. Is there any tool or standard being worked on…

Who are these people clamoring for an open and free web? I've certainly never met them. The clamoring I hear is for a faster and more usable web. The vast majority of web users couldn't decipher JS even if it wasn't obfuscated.

The people clamoring for a faster and more usable web are precisely the people who do not operate an adblocker.

Re: W3C recommends WebAssembly

#56

Post by oefrha » Fri, Dec 06, 2019, 4:04 PM UTC

duxup wrote: post #19

Does anyone have any good intro resources for WebAssembly for noobs? I've read articles here and there seen some in person demos, and honestly struggle to understand what it is / how it would / works relative to the current state of JavaScript frameworks. Often I'm approaching it from a JavaScript framework (React/Vue/Angular) approach as I'm a bit of a noob to the industry and that's generally my day job working on…

Not sure about frontend frameworks, but I was able to successfully write some computational components or components without relevant JavaScript libraries in Rust with wasm-bindgen.

wasm-bindgen docs have some examples to get you started.

https://rustwasm.github.io/docs/wasm-bindgen/

Re: W3C recommends WebAssembly

#57

Post by hombre_fatal » Fri, Dec 06, 2019, 4:05 PM UTC

dkersten wrote: post #20

dmvinson wrote: post #14

This feels like another step away from the free and open web many people are clamoring for. Distributing opaque binaries with websites instead of Javascript is a step past even the obfuscated minified javascript files meant to be confusing. At least those can still be debugged, stepped through, and explored freely by the end user if they want to learn or reverse engineer. Is there any tool or standard being worked on…

In my opinion it’s been a long time since direct access to Javascript has been useful. Yes you can unminify javascript but it’s still more work than most people will go through (especially if the code was generated by a compile to javascript language)so for most people things aren’t really changing that much

I don't even think source code access is the most important part of the browser's dev console. Consider the network tab instead, being able to see exactly where your bandwidth is being spent and why.

This to me makes the browser vastly preferable to native apps. I didn't realize that the desktop app I use to easily translate languages[0] sends every keystroke to Google Analytics until I had to bother installing a proxy. Meanwhile this analysis is just an Opn-Cmd-I away in the browser.

[0]: https://apps.apple.com/us/app/translate-tab/id458887729

Re: W3C recommends WebAssembly

#58

Post by 6gvONxR4sf7o » Fri, Dec 06, 2019, 4:05 PM UTC

dmvinson wrote: post #14

This feels like another step away from the free and open web many people are clamoring for. Distributing opaque binaries with websites instead of Javascript is a step past even the obfuscated minified javascript files meant to be confusing. At least those can still be debugged, stepped through, and explored freely by the end user if they want to learn or reverse engineer. Is there any tool or standard being worked on…

Meanwhile here I am running around with js off by default. Most of the internet still works. More sites work better with js off than work worse. I hope webassembly doesn't change that into a world where the "js off" analogy is "running my OS without the ability to execute programs."

Re: W3C recommends WebAssembly

#59

Post by lukebitts » Fri, Dec 06, 2019, 4:05 PM UTC

maeln wrote: post #34

dmvinson wrote: post #14

This feels like another step away from the free and open web many people are clamoring for. Distributing opaque binaries with websites instead of Javascript is a step past even the obfuscated minified javascript files meant to be confusing. At least those can still be debugged, stepped through, and explored freely by the end user if they want to learn or reverse engineer. Is there any tool or standard being worked on…

Please, can we stop having this argument every time there is an article about webassembly ? WASM not any more obfuscated than any minified JS. Being a bytecode doesn't make you "unfree". You have access to the same tool to debug JS and WASM. And the WASM specification is open. There is literally no difference between running JS or running WASM.

Maybe I’m misunderstanding something but WASM is meant to be compiled from other languages and that source is lost, unlike minified javascript, isn’t it?

Re: W3C recommends WebAssembly

#60

Post by dmvinson » Fri, Dec 06, 2019, 4:06 PM UTC

bogwog wrote: post #38

dmvinson wrote: post #14

This feels like another step away from the free and open web many people are clamoring for. Distributing opaque binaries with websites instead of Javascript is a step past even the obfuscated minified javascript files meant to be confusing. At least those can still be debugged, stepped through, and explored freely by the end user if they want to learn or reverse engineer. Is there any tool or standard being worked on…

> Distributing opaque binaries with websites instead of Javascript is a step past even the obfuscated minified javascript files meant to be confusing. At least those can still be debugged, stepped through, and explored freely by the end user if they want to learn or reverse engineer. That's not true. There's nothing "free and open" about the tracking code embedded in every modern site, or the javascript blobs you get…

I respect your point and semi-agree, but as someone who ran a small business in high school that usually involved reverse engineering obfuscated Javascript, I think you're overstating how hard it is to follow the logic of Javascript blobs. Yes, whole program flows can be insanely difficult to follow, but narrowing in on the logic of key functions is often what one needs when trying to learn from other's code.