Hacker News Reader

Comment by FastEatSlow | Hacker News Reader

Web assembly is extra code and complexity in a web browser compared to one without, so there are more potential vulnerabilities

View on HN

I don't buy it because you can apply same reasoning to every new / changed line of code, yet it ain't always true

The question is,

is WASM's security model / sandbox "safer" / "easier to actually execute" than JS'?

It does not matter because JS is not going anywhere. Whether it’s more secure or not, it’s still additional attack surface.

I believe it does

Of course JS ain't gonna go anywhere now, but if popular JS frameworks started emitting WebAssembly behind the scenes, so devs could still write their JS(and C++/C#/etc) code, but it'd use WASM under the hood then that'd start process of the deprecation of JS.

Which would mean that after all popular JS frameworks managed to migrate and popular sites adopted to this, then in ideal world you'd be able to turn off javascript and still use those sites/apps via WASM, not by default for everyone, but at least users that care would have an option to do so while still being able to use the web.

You gotta start somewhere

I'm wrong somewhere? or out of the touch with reality?

Perhaps, you can start by learning what WASM is:

https://developer.mozilla.org/en-US/docs/WebAssembly

As for vulnerabilities, here are nccgroup's slides about WASM explots:

https://i.blackhat.com/us-18/Thu-August-9/us-18-Lukasiewicz-...

Here's an example vulnerability in WASM parsing leading to RCE:

https://labs.f-secure.com/assets/BlogFiles/apple-safari-wasm...

If we're talking about 20 years from now, nobody cares about popular frameworks. Huge majority of websites use old code and they must not break. Backwards compatibility of web is a huge deal. So deprecation of JS just will not happen in that period of time.

What could happen is that browsers will support wasm natively and they'll translate JS into wasm. I'm not qualified enough to judge whether it would be possible to achieve current levels of JS performance with that approach, but theoretically it could be possible. In this case only wasm security will matter.

But I did not hear about any kinds of those plans, those are just my wild speculations. So deprecating of JS is not going to happen anytime soon. Wasm will accompany JS and that's about it for the foreseeable future.

WASM _IS_ JS. Some browsers do things to make it run faster. JS runs in its own security sandbox and is already suppose to be safe. Browsers get exploited in all kinds of ways, and IIRC, there have been WASM-specific exploits as well in the past.

Your question is non-sensical as is. I think you need to expand it to have people be less confused as to what you’re asking.

Reply on news.ycombinator.com