Email or username:

Password:

Forgot your password?
Top-level
Simon Willison

@ncweaver @anildash I find it very reassuring that the browser security engineering teams at Google, Apple, Mozilla and Microsoft all felt WebAssembly was a solid enough spec that they were willing to ship it - and quite a few years ago at this point

4 comments
Clark W Griswold until 25-Dec

One weakness in Java was JNI because at some point you have to get data in/out of real devices. If my webcam is some janky Costco $6 special, with a buggy, vulnerable terrible driver, does WASM protect me from malicious web pages that want to tickle my vulnerable webcam driver? Or is it just orthogonal? I.e. not WASM’s circus, so not WASM’s monkeys?

@anildash @simon @ncweaver

Nicholas Weaver

@paco @anildash @simon

I think they handle that by basically EVERY bit of I/O has to go through the JavaScript, so it isn't adding to that problem space.

Simon Willison

@paco @anildash @ncweaver WASM can only access your webcam via the existing browser APIs for webcam access, through a JavaScript bridge - so it's no less safe than if you were running regular JavaScript that could access the webcam

Fabrice Desré

@simon @ncweaver @anildash

I've been playing with safe WASM plugins for resource edition in @capyloon and one super-power is that the "host" code can check which functions are imported by plugins. That makes it possible to enforce eg. privacy policies or permission models.

Go Up