Earlier quoted context omitted.
Java only had one closed source implementation and had many security issues during its life. It wasn't designed for proper sandboxing and for having multiple implementations in the first place. And its communication with the rest of the browser was done through a slow and ugly channel (IIRC everything had to be sent around as strings).
> Java only had one closed source implementation... This is not true. There were alternative implementations from very early on, most notably the Microsoft one. > ...and had many security issues during its life. True, but WASM hadn't had much of a life so far, so we will see. > And its communication with the rest of the browser was done through a slow and ugly channel (IIRC everything had to be sent around as strings…
My bad. However it was closed source too, and abandoned rather quickly.
> True but WASM hadn't had much of a life so far, so we will see.
It uses the same security model as JS, which is much more mature than VMs not designed for so much exposure to random third party code.
> from what I see I think it's ugly as well
Ugly but not slow. WASM memory can be read and written directly from/to a typed array, instead of converting strings. Since it's fast enough, one can make less ugly APIs wrapping that behaviour.
> Java was designed with a sandbox and a bytecode verifier from very early on.
They probably protected the code itself from escaping the sandbox, but not the environment (all the API in its complex glory). WASM on the other side is exclusively allowed to talk with JS (for now, at least), therefore the only API level bugs are in JS, not in WASM.