I'm interested in this but I would be even more so if there was source so I can audit. Since it's running locally in my browser anyway.
always ironic when ppl say this on websites hosted in the us, a country with the most documented cases of governmental organisation backdooring/spying :/
That is because other countries do not let you document/publish this information. :-)
https://www.nytimes.com/2022/03/04/world/europe/russia-censo...
https://www.eff.org/deeplinks/2022/08/uks-online-safety-bill...
At least not as much as American courts will allow. The US has it's own censorship laws, but American resistance/choosing to ignore, is quite strong.
Parent poster talked about backdooring being documented in the US, not comparing the two in general. I posted links about non-US governments making it illegal to document the backdooring or other things the government may worry about an unpopular reaction to. The practice of the 1st amendment in the US offers very strong, but not absolute, protections against this.
> In its release, WikiLeaks said "Marble" was used to insert foreign language text into the malware to mask viruses, trojans and hacking attacks, making it more difficult for them to be tracked to the CIA and to cause forensic investigators to falsely attribute code to the wrong nation. The source code revealed that Marble had examples in Chinese, Russian, Korean, Arabic and Persian.
https://en.wikipedia.org/wiki/Vault_7
The government and media pretends that attribution is a slam-dunk when it virtually never is. On the other hand, there are big career benefits to discovering the next "Chinese" malware vs. stumbling upon some US/EU script kiddy nonsense that included Chinese characters as a prank/red herring. There is incentive to misattribute & sensationalize.
I would wager that ~100% of CIA/NSA malware (or any state actor, really) has a plausible red herring cover. It would be foolish not to.
(once again, it's a combination of current technical capability, concentration of current and early important technologies being developed in your jurisdiction, concentration of current and popular technologies being developed in your jurisdiction, etc)
WebAssembly has no implicit access to browser APIs so I wouldn't think so.
How is checking a web page's network connection, WebAssembly or not, harder than reading ALL the source code (if you don't read them all you can't be sure!) of a non-trivial app?
Edit: After some consideration, maybe they're worried that someone else would create a service using their work.