Ask HN: Anyone else worried about WebAssembly? | Hacker News Reader

Ask HN: Anyone else worried about WebAssembly?

3 pointsowenshen242 comments

Okay, I realize I might be late to the party here. I just read up about WebAssembly recently, and my understanding of the pros are: - can be compiled from many languages - improved performance

But the cons seem pretty problematic: - binary format seems harder for content blockers to work effectively - binary format seems easier to hide malware and other bad scripts - binary format seems to make the web less open; novice web developers can't just fire up the console anymore to see what makes something work.

I know I've seen previous sentiments of this sort expressed on here before (If anyone can link me to other critiques of this kind, that'd be awesome). It just seems unfortunate that the web is becoming more opaque with this change.

View on HN

The cons are legitimate concerns, but compared to the plausible alternatives I still don't think they're too bad.

Assuming a reasonable implementation in browsers, WA code should still be significantly safer to run than installing native applications locally on almost any major desktop OS, since there is a sandbox model in place for the in-browser code but the desktop OSes all have relatively open and crude security models that are 20+ years past their use-by date.

We already have plenty of malware-like scripts written in JS trying to fingerprint you, steal your processing power to mine Bitcoin, trick you into entering sensitive data in the wrong place or otherwise exploit you, so I don't see that WA is particularly likely to be worse in that respect. It's not great, but we should fix these things by tightening the security models for all downloaded code; it's not a problem specific to one language.

The barrier to exploration by curious learners is a significant drawback, for sure. Plenty of people have learned basic programming skills by examining interesting websites over the years. But again, even in JS, usually you just get some obfuscated, minified bundle these days unless a site is specifically leaving natural JS for visitors to read as tutorial sites sometimes do, so again I'm not sure we're losing anything that wasn't already getting lost anyway.

Gotcha. Thanks for addressing the concerns. Can't say I'm fully relieved by them, but they do give some partial answers to things I was confused about.

Reply on news.ycombinator.com