All Major Browsers Now Support WebAssembly (bleepingcomputer.com)

An anonymous reader writes: "It took only two years for all browser vendors to get on the same page regarding the new WebAssembly standard, and as of October 2017, all major browsers support it," reports Bleeping Computer. Project spearheads Firefox and Chrome were the first major browsers to graduate WebAssembly from preview versions to their respective stable branches over the summer. The second wave followed in the following weeks when Chromium-based browsers like Opera and Vivaldi also rolled out the feature as soon as it was added to the Chromium stable version. The last ones to ship WebAssembly in the stable branches were Apple in Safari 11.0 and Microsoft in Microsoft Edge (EdgeHTML 16), which is the version that shipped with the Windows 10 Fall Creators Update. Both were released last month. WebAssembly, or wasm, is a bytecode format for the web, allowing developers to send JavaScript code to browsers in smaller sizes, but also to compile from C/C++/Rust to wasm directly.

Comments

Original Article

[theweatherelectric]

Better to get content from the source. BleepingComputer appears to just read Mozilla blogs and repackage them as its own. Here's the original Mozilla blog post.

Well that's unfortunate.

[Anonymous Coward]

Already about 1/2 of web pages I can only get to work by using "view source" and clipping out links from the source which for some idiotic reason the site wants to demand javascript to do something that pure HTML could do just fine, such as display an image or move to another URL when you click on the link.

Can't wait until that has yet another layer of obscuration due to WebAssem.

The modern web's idiocy only ever grows larger and larger. Can't wait for WebAssem based obscuring images over the text you're trying to read, or more obscured privacy obliterations or the like. At least firefox will have a way to shut that idiocy off.

Re:Well that's unfortunate.

[Anonymous Coward]

Just wait for WebAssembly to be the next Flash/malware ad vector.

Personally I hope it fails. The web browser should never have been an "app" ecosystem, because browsers can't keep their shit together.

Re:Well that's unfortunate.

[lucm]

Already about 1/2 of web pages I can only get to work by using "view source" and clipping out links from the source

Whatever possible damage you think javascript can cause you is tiny compared to your current nightmarish internet experience. Maybe it's time to move on.

Re:Well that's unfortunate.

[TheRaven64]

I have a colleague working on formal verification of WebAssembly. Part of this has involved fuzzing various WebAssembly implementations. There are a lot of bugs in all of them, though Edge is by far the worst (reproduceable crashes are hard, because it crashes randomly on most of his test inputs, but at different points).

It's also a pretty horrible design. It's replaced HSAIL as my go-to example for how not to design a good IR.

Re:Well that's unfortunate.

[TheRaven64]

If you send a lot of random shit at something, of course it's going to crash.

If your thread model for something that is expected to accept random crap from the Internet is 'it's fine as long as input is well formed', then you are going to have a lot of fun dealing with security vulnerabilities. Contrary to your assertion, well-written code does not crash when you send it a lot of random shit, it gracefully handles errors.

Re:Chrome & Safari are only browsers that matt

[Anonymous Coward]

Firefox's 2% or 3% of the market doesn't matter at all.

Firefox is currently the 3rd most popular, with 13% market share. source.

This is great but.

[Mr0bvious]

It's not much use until the vast majority of users have adopted these compatible browser versions.

Not being intentionally negative, but how long will this take in reality?

Re:Chrome & Safari are only browsers that matt

[AvitarX]

Which is a shame, because webasm is what it is because of mozillas asm.js

They really had the right approach and it won.

I say this using firefox at work and often wishing it was chrome (default search and printing suck on FF).

Worst idea ever.

[Anonymous Coward]

What most people don't realize is webassembly is just a way to obfuscate the web in the same manner people already obfuscate compiler binaries.

Furthermore it will lead to integrated 'all in one' scripts that cannot be easily disentangled, making it harder for end users to filter what scripts on a website they are running.

Additionally it no doubt has engineered defects in it to help national intelligence apparatus' to more easily exploit target browsers, while also providing fingerprint opportunities far more opaque than even current browsers capabilities to deanonymize you.

Think twice before you let webassembly ruin the web for you!

Re:Does WASM support general execution?

[nateman1352]

In general, yes you can. One important thing to keep in mind is that not all libraries are available in wasm. Obviously win32 won't work, and most C++ GUI toolkits have not been posted to render to a HTML 5 canvas yet.

Another big hole IMHO is there is no native support for garbage collected languages yet. The thing that excites me the most about this is once GC is enabled we could potentially see a Python implementation that runs in the browser (without having to recompile CPython to wasm, which would be huge and slow.) You could also do stuff like compile Java/C#/Adobe Flash directly to wasm and completely eliminate the terrible Flash/Silverlight/Java plugins.

Tremendous mistake

[Okian Warrior]

I think Web Assembly is a tremendous mistake.

This will end up being nothing more than an insecure vector for people you don't know to run programs on your computer.

1) It claims to be secure by only executing in a sandbox. Have other attempts at sandboxing had security flaws?
2) Assuming the sandboxing works as advertized, is there a way for the sandboxing to break the sandbox in ways the coders hadn't considered? (Such as periodically using a lot/little CPU time or memory as a way to communicate to a different tab?)
3) Can Web Assembly be used to steal CPU cycles, so your computer can be used for BitCoin mining or anything else while visiting a web page? (And no, that they can do this already doesn't invalidate the argument.)
4) Does Web Assembly add a level of obfuscation to the code, making it harder to see what it's doing?

We once had a period where E-mail attachments were automatically opened and run, where Excel macros activate when a spreadsheet is viewed, and where myriad ActiveX libraries were available for use by anyone.

Anyone remember that era?

We've locked down the ability to install and run programs on our computers, but now we've moved the goalposts. Our browser will now download and run programs for us from any random website, any website that contracts out to an agency to supply advertizing, and and website advertizing contractor who doesn't vet his clients.

"Oh, we're so sorry! That malware delivery got through our vetting process. We've terminated that one client, please feel safe downloading the ads from all of our other clients - they're clean. Pinky swear! :-)"

For the next 10 years expect to see a steady stream of exploits and patches. A mini industry will crop up selling antivirus checkers for web pages, and AdBlock extensions for browsers.

It's deja vu all over again.

Re:Tremendous mistake

[ByteSlicer]

I think Web Assembly is a tremendous mistake. This will end up being nothing more than an insecure vector for people you don't know to run programs on your computer.

Not to spoil a good rant, but Web Assembly is just a more compact serialization (binary instead of text) of a subset of EcmaScript/JavaScript.
Everything you can do with it, you could already do with normal scripts, and it was already very common to "minify"/obfuscate these scripts into an unreadable mess.

So, if there are security issues with WAsm, they're also present in plain JS, and were already present a couple of years ago.
The only thing that changes is that your browser now doesn't need to download as much data for scripts, since the binary format acts as a compression.

Re:Tremendous mistake

[nateman1352]

No doubt about it, wasm has all the problems that all other prior attempts at sand-boxing binary blobs of code in the web browser have had. You hit the major ones.

Here's the thing though, the web circa 10 years ago had 3 competing mechanisms to implement sand-boxed binary blobs:

1. Adobe Flash
2. Java
3. Silverlight
Prototypes for Google NaCl were starting to show up around this time too.

All of these had their own sand-box implementation, and they were not sand-boxed themselves, so the surface area for attack was much higher. So HTML 5 tried to do away with that, but then PNaCl and asm.js show us that no matter how hard we try to get rid of binary blobs of code on the web, someone implements it anyway. So, given that there have been persistent attempts by the various large web players for the past 20 years to build binary code blobs in to web pages, and that there is no sign of it slowing down, the most sensible compromise to me is basically what wasm has become... a standardized mechanism for building those binary blobs that can be directly integrated in to the browser.

It does have its problems like you note, but its better that we only have 1 standardized sand-box implementation, and that sand-box implementation is bundled in with a bunch of other high risk code as part of the browser package, which is easy to keep vigilantly updated. Even before wasm, gone were the days of the web browser being a simple document layout renderer. The web browser is basically a visualized operating system... Google has taken this to IHMO a very dangerous extreme, see the Javascript USB API for example. The web browser is basically a run time for USB device drivers at this point. To me wasm seems like the inevitable end result of the path that HTML 5 started us down.

Re:Tremendous mistake

[garethjrowlands]

... Web Assembly is just a more compact serialization (binary instead of text) of a subset of EcmaScript/JavaScript.....

Much of what you say is morally true. But it's not technically true.

It's true that wasm is a binary serialisation of an abstract syntax tree (AST) but that AST is defined _without reference to JavaScript_, see https://github.com/WebAssembly... . In contrast, the asm.js spec is genuinely a subset of JavaScript.

You're right that wasm doesn't introduce new capabilities to the browser as such. In the current 'MVP' version of wasm, the only way to invoke web assembly is via JavaScript, and the only way for wasm code to interact with the browser is via JavaScript.

But it does make certain scenarios, such as running large compiled C programs, much more practical. It is, by design, a far more efficient compilation target than JavaScript or asm.js, see https://github.com/WebAssembly... . For example, we can expect Unity running on wasm to become commonplace, see http://webassembly.org/demo/ .

...if there are security issues with WAsm, they're also present in plain JS,...

You can't be sure of that. The wasm codepaths will reuse much of the existing JavaScript execution engine but there will be new code and that new code could - and probably will - have security vulnerabilities. But probably no more than any other major browser feature.

Re:Tremendous mistake

[AmiMoJo]

The Javascript USB API is actually a good idea. It's better than the current situation with binary drivers, especially on Linux where they run in the kernel.

For safe operation of USB you need the low level stack only in the kernel, the part that does the low level I/O and is extremely robust. Then there is a userland USB stack that sits on top of it, handling descriptors and I/O functions for userland drivers/applications.

The Javascript USB API adds some extra protection. Firstly, instead of having a bunch of random drivers with near zero quality control, you have just the browser. A browser that is security hardened and well tested. And all the browser does is provide some simple access mechanisms to various USB features like pipes and descriptors. The code that actually talks to the device, the place where most of the vulnerabilities are, is now sandboxed Javascript.

Even better, the browser prints you for permission to access the device. USB was designed around an insecure plug-and-play model, deliberately not requiring any user interaction for devices to start working. With the Javascript USB API, the user has to give explicit permission.

The main issue I have with the Javascript USB API is the same one as I have with all web applications - loss of freedom. I can't run old versions, I can't do much if they make changes I don't like, I probably can't fork it. But security-wise it's actually a good idea, it adds more layers of security.

Re:Chrome & Safari are only browsers that matt

[darkain]

Because Opera is 1) more stable, 2) has more features. Built in ad-block without any add-ons. Built in VPN without any add-ons. Built in communication tools without any add-ons.

Google shoves blind A/B tests to live end-user clients without any notification or sign-ups whatsoever. I've had this break countless times in a corporate environment and spent days debugging this shit. One time they changed the DNS resolver code on a hand full of "test" users to an implementation that took 60+ seconds to resolve DNS addresses. Luckily, I found a buried post on the Google Help forums which described this broken behavior and which setting to disable in the chrome://flags window. But even that window just lists things as "default", not "FORCED ENABLED FOR A/B TESTING". There is literally no way to tell if you're in a test or not. And more recently, they absolutely broke printer support for a month or two, killing all web based invoicing one of my clients was doing.

Opera? They wait for things to stabilize, then port them over to their browser. Its literally just been night and day in terms of stability switching off of Chrome and moving 100% full time over to Opera.