Turtles all the way down
One assumes the JavaScript engine is just "eval(...)".
Nope! It uses Wasm (really WASI) builds of existing JS engines ;)
Shadow: New browser engine made almost entirely in JavaScript
61–70 of 303 posts
Re: Shadow: New browser engine made almost entirely in JavaScript
#62Opening up not just a can but a whole writhing pit of worms with regard to security vulnerabilities.
Re: Shadow: New browser engine made almost entirely in JavaScript
#63Nice. But I would have preferred if he had worked on Uzbl https://en.wikipedia.org/wiki/Uzbl
I don't get it. Uzbl is a webkit-based browser. Can you expand on this? It's not like one of those browser engines that are promising but not quite there yet, like NetSurf, Servo or Ladybird.
"The core component of Uzbl is written in C, but other languages are also used, most notably Python."
Man, this thing was small and fast
Re: Shadow: New browser engine made almost entirely in JavaScript
#64There's a product here that's been waiting to happen for awhile. I've been anticipating somebody cross-compiling another browser engine to WASM but this works, too. Deliver your site only to the "inner browser" (that the user has no control over because it's heavily obfuscated and tricked-out with anti-debugging code) and you eliminate all ad blockers. Throw some DNS-over-HTTPS w/ certificate pinning in for good meas…
I was worried from the very start of the WASM tech, that it would lead to the end of the user-controlled client. You don't even really need an embedded browser, a motivated provider could create a completely proprietary protocol for rendering their pages.
That you can do trivially even today. Just show your web site using in-browser VNC client.
Re: Shadow: New browser engine made almost entirely in JavaScript
#65There's a product here that's been waiting to happen for awhile. I've been anticipating somebody cross-compiling another browser engine to WASM but this works, too. Deliver your site only to the "inner browser" (that the user has no control over because it's heavily obfuscated and tricked-out with anti-debugging code) and you eliminate all ad blockers. Throw some DNS-over-HTTPS w/ certificate pinning in for good meas…
The internet advertising industry needs to move past insisting that user machines have to be involved in a business relationship they have nothing to do with and no legal, or ethical, obligation to uphold. All other forms of advertising work that way. The advertiser and host need to figure out how to keep each other honest without involving passers-by.
Re: Shadow: New browser engine made almost entirely in JavaScript
#66When desktop applications running in electron, just doesnt have enough web abstraction to keep up with mores law, a hero comes along, to ensure there can always be one more level of java script between you and a responsive UI.
Speaking of Electron... when I start my Slack client for work, there are a series of processes where at least one reports 1.130 terabytes of virtual memory. (Shown in top as "VIRT".)
Now, maybe that's just a potential usage that trust-me-bro it'll never actually try to use or access in RAM or on disk... but how on earth is that number for a chat client so much bigger than either Firefox with 100+ tabs or even Java-based IDEs like Webstorm?
Re: Shadow: New browser engine made almost entirely in JavaScript
#67There's a product here that's been waiting to happen for awhile. I've been anticipating somebody cross-compiling another browser engine to WASM but this works, too. Deliver your site only to the "inner browser" (that the user has no control over because it's heavily obfuscated and tricked-out with anti-debugging code) and you eliminate all ad blockers. Throw some DNS-over-HTTPS w/ certificate pinning in for good meas…
Certificate pinning is easy to work around if you know which bytes to change, so that's what adblocking will be
Re: Shadow: New browser engine made almost entirely in JavaScript
#68Earlier quoted context omitted.
People could have been doing this with JS for a long time. This is hardly the first virtual machine in JS and it seems like overkill. The far more likely way we'll see push back against Ad Blockers is by simply detecting that an Ad did not play and then refusing to display content until it does.
How about reversing the idea? Play the ad in the WASM browser and not pass it on to the outer instance.
the outer instance is still needed for http requests, so it can still block ads
Re: Shadow: New browser engine made almost entirely in JavaScript
#69Re: Shadow: New browser engine made almost entirely in JavaScript
#70Opening up not just a can but a whole writhing pit of worms with regard to security vulnerabilities.
It is technically memory safe :^)