One weakness in Java was JNI because at some point...

One weakness in Java was JNI because at some point you have to get data in/out of real devices. If my webcam is some janky Costco $6 special, with a buggy, vulnerable terrible driver, does WASM protect me from malicious web pages that want to tickle my vulnerable webcam driver? Or is it just orthogonal? I.e. not WASM’s circus, so not WASM’s monkeys?

@anildash @simon @ncweaver

Like 20 Jan 2023 at 3:24 | Wall-to-wall | Open on infosec.exchange

2 comments

Nicholas Weaver

@paco @anildash @simon

I think they handle that by basically EVERY bit of I/O has to go through the JavaScript, so it isn't adding to that problem space.

20 Jan 2023 at 3:28 | Open on thecooltable.wtf

Simon Willison

@paco @anildash @ncweaver WASM can only access your webcam via the existing browser APIs for webcam access, through a JavaScript bridge - so it's no less safe than if you were running regular JavaScript that could access the webcam

20 Jan 2023 at 3:28 | Open on fedi.simonwillison.net

Go Up