61–70 of 172 posts
Earlier quoted context omitted.
Web assembly is extra code and complexity in a web browser compared to one without, so there are more potential vulnerabilities
I don't buy it because you can apply same reasoning to every new / changed line of code, yet it ain't always true The question is, is WASM's security model / sandbox "safer" / "easier to actually execute" than JS'?
Earlier quoted context omitted.
That's fair I'm not really one for jargon and whatnot (I think it can actually become less useful if the goal is just to communicate something to a person), but the first line in wiki says: > a homoglyph is one of two or more graphemes, characters, or glyphs with shapes that appear identical or very similar. "Very similar" and "two or more" being the key words. As for homograph I found homoglyph by reading the wiki a…
> (Insert obligatory "wiki it's not always accurate etc etc"). Overall I'd take either one and personally don't care. Just trying to match what you're saying with what I'm reading and make sense of where the truth is. Diving in (even if the parent doesn't care :) ): The last sentence is the real challenge: Meanings depend 100% on writer and reader understandings. If two agree that 'homograph' means 'chicken poop', as…
Been looking in that article to find how they concluded it's from North Korea, but I can't find it. Can anyone point it out for me?
Earlier quoted context omitted.
I don't buy it because you can apply same reasoning to every new / changed line of code, yet it ain't always true The question is, is WASM's security model / sandbox "safer" / "easier to actually execute" than JS'?
It does not matter because JS is not going anywhere. Whether it’s more secure or not, it’s still additional attack surface.
Of course JS ain't gonna go anywhere now, but if popular JS frameworks started emitting WebAssembly behind the scenes, so devs could still write their JS(and C++/C#/etc) code, but it'd use WASM under the hood then that'd start process of the deprecation of JS.
Which would mean that after all popular JS frameworks managed to migrate and popular sites adopted to this, then in ideal world you'd be able to turn off javascript and still use those sites/apps via WASM, not by default for everyone, but at least users that care would have an option to do so while still being able to use the web.
You gotta start somewhere
I'm wrong somewhere? or out of the touch with reality?
Earlier quoted context omitted.
How will WebAssembly save us?
I'm asking
Edit: from another comment in a sibling thread, you indicate thinking that WASM has a "security model / sandbox". That would have been (part of) the answer to the grandparent comment I suppose.
Earlier quoted context omitted.
That's fair I'm not really one for jargon and whatnot (I think it can actually become less useful if the goal is just to communicate something to a person), but the first line in wiki says: > a homoglyph is one of two or more graphemes, characters, or glyphs with shapes that appear identical or very similar. "Very similar" and "two or more" being the key words. As for homograph I found homoglyph by reading the wiki a…
> (Insert obligatory "wiki it's not always accurate etc etc"). Overall I'd take either one and personally don't care. Just trying to match what you're saying with what I'm reading and make sense of where the truth is. Diving in (even if the parent doesn't care :) ): The last sentence is the real challenge: Meanings depend 100% on writer and reader understandings. If two agree that 'homograph' means 'chicken poop', as…
To be clear: reporting what has been understood still influences meaning. Choice of inclusion moderates spread; definitions are inherently lossy and cannot capture the whole range of nuance; the compiler's understanding can be inaccurate. Lexicography is not a neutral art, no matter your choice of biases. And OED no less "represents the understandings of a few editors of unknown knowledge" than Wikipedia does. With different goals, and to different standards, to be sure, but Gell-Mann amnesia goes hard until you get into the weeds.
Earlier quoted context omitted.
I'm asking
But why ask? Why not ask why we can't use forests or jquery to prevent these attacks? What is the logic here, how do you think it might work, even just vaguely if you don't have a worked-out solution? Edit: from another comment in a sibling thread, you indicate thinking that WASM has a "security model / sandbox". That would have been (part of) the answer to the grandparent comment I suppose.
"WebAssembly describes a memory-safe, sandboxed execution environment that may even be implemented inside existing JavaScript virtual machines. When embedded in the web, WebAssembly will enforce the same-origin and permissions security policies of the browser."
Basically I felt like it was designed with security in mind and I do wonder whether it'd prevent attacks like this
Earlier quoted context omitted.
It does not matter because JS is not going anywhere. Whether it’s more secure or not, it’s still additional attack surface.
I believe it does Of course JS ain't gonna go anywhere now, but if popular JS frameworks started emitting WebAssembly behind the scenes, so devs could still write their JS(and C++/C#/etc) code, but it'd use WASM under the hood then that'd start process of the deprecation of JS. Which would mean that after all popular JS frameworks managed to migrate and popular sites adopted to this, then in ideal world you'd be able…
https://developer.mozilla.org/en-US/docs/WebAssembly
As for vulnerabilities, here are nccgroup's slides about WASM explots:
https://i.blackhat.com/us-18/Thu-August-9/us-18-Lukasiewicz-...
Here's an example vulnerability in WASM parsing leading to RCE:
https://labs.f-secure.com/assets/BlogFiles/apple-safari-wasm...
Earlier quoted context omitted.
I'm actually surprised Google would say this is from the DPRK government without also saying it had has been verified by US federal government authorities. Usually they leave it for others to deal with statements at that level.
I think you’ll find TAG regularly gives assessment on attribution at least at the country level. Iran, China, Russia, Belarus and North Korea at least have been named in the last few years. (Disclaimer: I am head of TAG)