WAVM: standalone WebAssembly VM prototype
1–10 of 30 posts
Re: WAVM: standalone WebAssembly VM prototype
#2Am I correct that WebAssembly is the first browser language VM (like JVM, Flash, etc) that is developed as a specification and not an implementation? If so, I wonder how security will fare in comparison to JVM/Flash/etc, I imagine it'll be much better. WebAssembly is gonna be huge, esp. with languages like Rust supporting it!
Re: WAVM: standalone WebAssembly VM prototype
#3Am I correct that WebAssembly is the first browser language VM (like JVM, Flash, etc) that is developed as a specification and not an implementation? If so, I wonder how security will fare in comparison to JVM/Flash/etc, I imagine it'll be much better. WebAssembly is gonna be huge, esp. with languages like Rust supporting it!
I assume there will be no more security holes than there are in javascript, since it's effectively a sibling to it, implementing the exact same APIs
Re: WAVM: standalone WebAssembly VM prototype
#4Am I correct that WebAssembly is the first browser language VM (like JVM, Flash, etc) that is developed as a specification and not an implementation? If so, I wonder how security will fare in comparison to JVM/Flash/etc, I imagine it'll be much better. WebAssembly is gonna be huge, esp. with languages like Rust supporting it!
If there are N implementations, there are N times more chance for a security vulnerability. Roughly, anyway. I don't think the reference material matters as much as the rigor that goes into defining it.
Re: WAVM: standalone WebAssembly VM prototype
#5Am I correct that WebAssembly is the first browser language VM (like JVM, Flash, etc) that is developed as a specification and not an implementation? If so, I wonder how security will fare in comparison to JVM/Flash/etc, I imagine it'll be much better. WebAssembly is gonna be huge, esp. with languages like Rust supporting it!
I assume there will be no more security holes than there are in javascript, since it's effectively a sibling to it, implementing the exact same APIs
It's also being run using the same VMs as JavaScript. There is some new code, but overall it's the same JITs, so similar security risks.
Re: WAVM: standalone WebAssembly VM prototype
#6Am I correct that WebAssembly is the first browser language VM (like JVM, Flash, etc) that is developed as a specification and not an implementation? If so, I wonder how security will fare in comparison to JVM/Flash/etc, I imagine it'll be much better. WebAssembly is gonna be huge, esp. with languages like Rust supporting it!
If there are N implementations, there are N times more chance for a security vulnerability. Roughly, anyway. I don't think the reference material matters as much as the rigor that goes into defining it.
>If there are N implementations, there are N times more chance for a security vulnerability.
I don't even understand what this is supposed to mean. Do you mean that a hole in the spec means that a sec vuln would occur in every implementation? Or that 5 implementations means 5 code bases to review?
Either way, it seems like a sentence that is meant to carry weight but is ultimately nearly completely meaningless. N different desktop apps on my computer have N chances for sec vulns. I don't see what that statement is supposed to mean regarding WebAssembly.
Re: WAVM: standalone WebAssembly VM prototype
#7Earlier quoted context omitted.
If there are N implementations, there are N times more chance for a security vulnerability. Roughly, anyway. I don't think the reference material matters as much as the rigor that goes into defining it.
>If there are N implementations, there are N times more chance for a security vulnerability. I don't even understand what this is supposed to mean. Do you mean that a hole in the spec means that a sec vuln would occur in every implementation? Or that 5 implementations means 5 code bases to review? Either way, it seems like a sentence that is meant to carry weight but is ultimately nearly completely meaningless. N dif…
Implementation level bugs dominate, not spec bugs.
Re: WAVM: standalone WebAssembly VM prototype
#8Earlier quoted context omitted.
>If there are N implementations, there are N times more chance for a security vulnerability. I don't even understand what this is supposed to mean. Do you mean that a hole in the spec means that a sec vuln would occur in every implementation? Or that 5 implementations means 5 code bases to review? Either way, it seems like a sentence that is meant to carry weight but is ultimately nearly completely meaningless. N dif…
Implementation level bugs dominate, not spec bugs.
In this instance, WASM shares JS' sandbox and security model down to the implementation, so the added risk is extremely limited. The only part that could be dangerous is the parser.
Re: WAVM: standalone WebAssembly VM prototype
#9Am I correct that WebAssembly is the first browser language VM (like JVM, Flash, etc) that is developed as a specification and not an implementation? If so, I wonder how security will fare in comparison to JVM/Flash/etc, I imagine it'll be much better. WebAssembly is gonna be huge, esp. with languages like Rust supporting it!
If there are N implementations, there are N times more chance for a security vulnerability. Roughly, anyway. I don't think the reference material matters as much as the rigor that goes into defining it.
N different implementations can also mean that any single implementation vulnerability will only affect 1/N of the total user base. Using a single implementation isn't always the best way to achieve security (cf OpenSSL).
Re: WAVM: standalone WebAssembly VM prototype
#10Earlier quoted context omitted.
Implementation level bugs dominate, not spec bugs.
In this instance, WASM shares JS' sandbox and security model down to the implementation , so the added risk is extremely limited. The only part that could be dangerous is the parser.
From WAVM's Github README: "This is a prototype of a simple standalone VM for WebAssembly"
So it doesn't share code with a JS implementation in this case.