Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Announcing WCGI: WebAssembly and CGI

wasmer.io

Post reply on HN
Print view View original

51–60 of 121 posts

Re: Announcing WCGI: WebAssembly and CGI

#51

Post by wwweston »

syrusakbary wrote: post #12
pookeh wrote: post #11

Earlier quoted context omitted.

There was a time when JVM ran in the browsers.

Yup, via Java Applets. But they were a pain to use, that's why I intentionally wrote "seamlessly" :P

As far as I could tell, the big pain point was performance -- they were just too slow on median machines during the late 90s/early 00s window they had mindshare.

I actually enjoyed using them to get around a few browser limitations around the mid-to-late 00s, and they seemed feature/performance competitive with Flash unless what you were doing fit the media authoring model closely. But by then people were skeptical about Java and if you had to do anything to get it installed they wouldn't, and the direction was native web.

Re: Announcing WCGI: WebAssembly and CGI

#52

Post by throwaway50609 »

ThePhysicist wrote: post #31
syrusakbary wrote: post #10

Earlier quoted context omitted.

Indeed. The JVM did a lot of things right, however they missed three that are now solved with Wasm: * Completely tied to an ecosystem, and incompatible with another (you could not run C programs in the JVM) * Proprietary (vs based on an open standard) * They couldn't run in the browser seamlessly

Funny that most people seem to have forgotten that browsers used to ship with Java support. Not saying that was a good thing, but 20 years ago you could run JVM apps in the browser without issues. Also, there are dozens of language runtimes for the JVM, e.g. Ruby, Python, Golang, Javascript, Scheme, .... And regarding proprietary software, Wasmer is a for-profit startup that seems to offer open-source tooling with th…

Funny that you forgot about all the security issues of JVM applets that Wasm finally solved

Re: Announcing WCGI: WebAssembly and CGI

#53

Post by baq »

throwaway50609 wrote: post #52
ThePhysicist wrote: post #31

Earlier quoted context omitted.

Funny that most people seem to have forgotten that browsers used to ship with Java support. Not saying that was a good thing, but 20 years ago you could run JVM apps in the browser without issues. Also, there are dozens of language runtimes for the JVM, e.g. Ruby, Python, Golang, Javascript, Scheme, .... And regarding proprietary software, Wasmer is a for-profit startup that seems to offer open-source tooling with th…

Funny that you forgot about all the security issues of JVM applets that Wasm finally solved

And now you can run a wasm jvm: https://leaningtech.com/cheerpj/ (there are others, too)

Re: Announcing WCGI: WebAssembly and CGI

#54

Post by pjmlp »

throwaway12245 wrote: post #49
pjmlp wrote: post #48

Earlier quoted context omitted.

Nobody sane should be running C, regardless of the target platform.

You'd have to delete your operating system and most of your libraries.

Thankfully not all OS are written in C, and many are making efforts to fix that mistake created by UNIX release into the industry.

Similarly, many managed compiled languages don't depend on C.

Finally, cybersecurity legislation will speed those efforts.

Re: Announcing WCGI: WebAssembly and CGI

#55

Post by eyberg »

throwaway50609 wrote: post #52
ThePhysicist wrote: post #31

Earlier quoted context omitted.

Funny that most people seem to have forgotten that browsers used to ship with Java support. Not saying that was a good thing, but 20 years ago you could run JVM apps in the browser without issues. Also, there are dozens of language runtimes for the JVM, e.g. Ruby, Python, Golang, Javascript, Scheme, .... And regarding proprietary software, Wasmer is a for-profit startup that seems to offer open-source tooling with th…

Funny that you forgot about all the security issues of JVM applets that Wasm finally solved

Like this one?

  #include 
  #include 

  int main() {
    char *s = "world";

    s[0] = 'o';
    s[1] = 'w';
    s[2] = 'n';
    s[3] = 'e';
    s[4] = 'd';

    printf("Hello, %s\n", s);
  }

Re: Announcing WCGI: WebAssembly and CGI

#56

Post by akira2501 »

ThePhysicist wrote: post #31
syrusakbary wrote: post #10

Earlier quoted context omitted.

Indeed. The JVM did a lot of things right, however they missed three that are now solved with Wasm: * Completely tied to an ecosystem, and incompatible with another (you could not run C programs in the JVM) * Proprietary (vs based on an open standard) * They couldn't run in the browser seamlessly

Funny that most people seem to have forgotten that browsers used to ship with Java support. Not saying that was a good thing, but 20 years ago you could run JVM apps in the browser without issues. Also, there are dozens of language runtimes for the JVM, e.g. Ruby, Python, Golang, Javascript, Scheme, .... And regarding proprietary software, Wasmer is a for-profit startup that seems to offer open-source tooling with th…

> but 20 years ago you could run JVM apps in the browser without issues

That was definitely not my experience at that time using a linux desktop.

Re: Announcing WCGI: WebAssembly and CGI

#57

Post by PoignardAzur »

0xbadcafebee wrote: post #16

PHP was compiled into WASM, so now you can run PHP apps "as WASM". How is this different from just running PHP, without WASM? Apparently it's faster, but also they make this claim: "Picture running Wordpress and not having to worry about attackers breaking into your system" uh, so, you sprinkled some WASM magic on some code and suddenly several decades worth of security research is obsolete? .....yeah, I'm gonna call…

Compiling a service to wasm to protect it "from itself" (ie from untrusted data) has trade-offs.

On the one hand, you lose ASLR and other security features designed for native code. On the other hand, your program becomes immune to stack smashing, so arbitrary code execution becomes a lot harder for an attacker (at least that's my understanding).

Re: Announcing WCGI: WebAssembly and CGI

#58

Post by eyberg »

PoignardAzur wrote: post #57
0xbadcafebee wrote: post #16

PHP was compiled into WASM, so now you can run PHP apps "as WASM". How is this different from just running PHP, without WASM? Apparently it's faster, but also they make this claim: "Picture running Wordpress and not having to worry about attackers breaking into your system" uh, so, you sprinkled some WASM magic on some code and suddenly several decades worth of security research is obsolete? .....yeah, I'm gonna call…

Compiling a service to wasm to protect it "from itself" (ie from untrusted data) has trade-offs. On the one hand, you lose ASLR and other security features designed for native code. On the other hand, your program becomes immune to stack smashing, so arbitrary code execution becomes a lot harder for an attacker (at least that's my understanding).

Does it become harder or easier?

  #include 
  #include 

  int bad(char* src) {
    int admin = 0;
    char buf[2];

    strcpy(buf, src);

    printf("%d\n", admin);

    return admin;
  }

  int main() {
    if (bad("ADMIN!!!")) {
      printf("we're admin!\n");
    } else {
      printf("we are not admin\n");
    }

  }

Re: Announcing WCGI: WebAssembly and CGI

#59

Post by pjmlp »

wwweston wrote: post #51
syrusakbary wrote: post #12

Earlier quoted context omitted.

Yup, via Java Applets. But they were a pain to use, that's why I intentionally wrote "seamlessly" :P

As far as I could tell, the big pain point was performance -- they were just too slow on median machines during the late 90s/early 00s window they had mindshare. I actually enjoyed using them to get around a few browser limitations around the mid-to-late 00s, and they seemed feature/performance competitive with Flash unless what you were doing fit the media authoring model closely. But by then people were skeptical a…

The Java Kernel project sorted that out.

Re: Announcing WCGI: WebAssembly and CGI

#60

Post by pjmlp »

yazzku wrote: post #36
syrusakbary wrote: post #10

Earlier quoted context omitted.

Indeed. The JVM did a lot of things right, however they missed three that are now solved with Wasm: * Completely tied to an ecosystem, and incompatible with another (you could not run C programs in the JVM) * Proprietary (vs based on an open standard) * They couldn't run in the browser seamlessly

Memory usage too, right? A C++/Rust wasm won't consume a hundredth of the memory a JVM application typically uses. I like getting the job done on a 512MB RAM VPS. JVM the language might be cool; the bloat and forced-GC can be spared.

Just like a JVM for embedded development won't.
Post reply on HN