On: The Bytecode Alliance: Building a secure, composab...

[AgentME]

WebAssembly strongly sandboxes the module from affecting the world outside of it, not from affecting itself. Isn't that the usual use of the word sandbox? The sandbox imposes a boundary between the inside and outside, but it doesn't directly change how things work on the inside.

It might be nice to have features for enforcing memory bounds within a module, but I wouldn't call those sandboxing, or call the lack of those features a deficit of the sandbox.

[rini17 → AgentME]

To do anything useful across the boundaries, parsing will be involved. Parsing without bounds checking is insecure and will be exploited, period.

[pjmlp → AgentME]

It is a security deficiency, hence why MSIL that contains certain C++ features is tainted as unsafe by the security verifier.

Some other bytecodes like Unisys ClearPath mainframes follow the same approach when using unchecked bounds access.

WebAssembly folks just hand wave it as not an issue.