WebAssembly: a binary format for the web • Hacker News Board

Re: WebAssembly: a binary format for the web

#101

Post by netheril96 » Mon, Nov 02, 2015, 1:46 AM UTC

hannob wrote: post #55

I haven't looked at WebAssembly in Detail, but my feeling and worry is that this is a can of worms for security issues. Javascript wasn't designed with security in mind and it has taken us decades to understand what implications that had (and we haven't really fixed them yet). The security implications for WebAssembly will be different, but I'm almost certain there will be a lot. (pnacl already introduced some quite…

With all the lessons learned, I would think that a completely new implementation would have less security issues.

Re: WebAssembly: a binary format for the web

#102

Post by hackcasual » Mon, Nov 02, 2015, 1:47 AM UTC

pcwalton wrote: post #66

hannob wrote: post #55

I haven't looked at WebAssembly in Detail, but my feeling and worry is that this is a can of worms for security issues. Javascript wasn't designed with security in mind and it has taken us decades to understand what implications that had (and we haven't really fixed them yet). The security implications for WebAssembly will be different, but I'm almost certain there will be a lot. (pnacl already introduced some quite…

> The security implications for WebAssembly will be different, but I'm almost certain there will be a lot. What can you do today in Web Assembly that you can't already do in asm.js?

Nothing. WebAssembly in its current implementation is basically a binary representation of asm.js.

Re: WebAssembly: a binary format for the web

#103

Post by pekk » Mon, Nov 02, 2015, 1:47 AM UTC

zobzu wrote: post #72

The future! serve binaries instead of web pages!

Web pages are already a far cry from human-readable semantic markup. That's not a hill worth dying on.

Re: WebAssembly: a binary format for the web

#104

Post by asdfologist » Mon, Nov 02, 2015, 1:48 AM UTC

zmmmmm wrote: post #97

As laudable as the goal of improving performance is, I hope this never takes off. Why? Because it will take about 5 minutes from 90% of the web to go from open, transparent, easily reverse engineerable source code to essentially giant blobs of secret binary code. People will pay lip service to performance but 99% of the reason that web sites will implement this will be to cover up their code, keep secret their implem…

https://github.com/WebAssembly/design/blob/master/TextFormat...

Re: WebAssembly: a binary format for the web

#105

Post by luhn » Mon, Nov 02, 2015, 1:58 AM UTC

zmmmmm wrote: post #97

As laudable as the goal of improving performance is, I hope this never takes off. Why? Because it will take about 5 minutes from 90% of the web to go from open, transparent, easily reverse engineerable source code to essentially giant blobs of secret binary code. People will pay lip service to performance but 99% of the reason that web sites will implement this will be to cover up their code, keep secret their implem…

> I honestly think that one of the key ingredients to the success of the web is that just about any web page you can see, just about anyone with modest knowledge can trivially work out how it was done.

Not really. Almost all websites obfuscate/minify their Javascript now, making manually interpreting the code much less than "trivial." I think WebAssembly will be no worse to figure out than obfuscated Javascript.

Re: WebAssembly: a binary format for the web

#106

Post by jtwebman » Mon, Nov 02, 2015, 2:01 AM UTC

I hope to see so the developers that don't like JavaScript stop writing bad JavaScript and just write it in whatever class based type based system they want instead of adding classes and types to Javascript.

Re: WebAssembly: a binary format for the web

#107

Post by 13years » Mon, Nov 02, 2015, 2:02 AM UTC

zmmmmm wrote: post #97

As laudable as the goal of improving performance is, I hope this never takes off. Why? Because it will take about 5 minutes from 90% of the web to go from open, transparent, easily reverse engineerable source code to essentially giant blobs of secret binary code. People will pay lip service to performance but 99% of the reason that web sites will implement this will be to cover up their code, keep secret their implem…

Yet, isn't much of the web already unreadable due to minification of JS source?

Re: WebAssembly: a binary format for the web

#108

Post by luhn » Mon, Nov 02, 2015, 2:03 AM UTC

dbpokorny wrote: post #83

lambdapie wrote: post #74

Earlier quoted context omitted.

You can run untrusted code in an iframe (possibly with the sandbox attribute set). I think this would be what you're looking for.

Go to http://www.html5rocks.com/static/demos/evalbox/index.html type in console.log("foo") and click either button. It has access to the console even from the sandbox. Is there a way to say: I want this iframe to run a script, but don't give the script access to the console?

That seems a contrived example. The console is invisible to the end-user, why does it matter if an application can output to it?

Re: WebAssembly: a binary format for the web

#109

Post by hencq » Mon, Nov 02, 2015, 2:05 AM UTC

nickpsecurity wrote: post #26

Animats wrote: post #12

From Java applets to Java applets in twenty years.

Smaller than JS, faster, uses Abstract Syntax Trees... sounds like the Juice project. Oh, how much better web apps could've been. https://web.archive.org/web/20000830093908/http://caesar.ics...

Wow, I never heard of Juice before. It sounds really interesting. Sort of a shame how things turned out in hindsight.

Re: WebAssembly: a binary format for the web

#110

Post by runn1ng » Mon, Nov 02, 2015, 2:09 AM UTC

jtwebman wrote: post #106

I hope to see so the developers that don't like JavaScript stop writing bad JavaScript and just write it in whatever class based type based system they want instead of adding classes and types to Javascript.

But adding type system to JavaScript - as Facebook has done with Flow - and class system - as in ES6 - actually makes complex JavaScript better and easier...