Miguel de Icaza Talks Up WebAssembly Greatness

[cjcox]

As a FOSS developer, I guess I'm ok with WebAssembly if and only if the source code is provided so we aren't just randomly downloading and executing binary blobs from the Internet (which we all know is an incredibly safe place of noble do gooders).

Edit: Maybe what is needed is a way of downloading the blob and executable with source in a way that they are signed and associated so that in a browser debugger you could trace through the program and know what it's doing, etc...

In short, the obvious goals of WebAssembly seem nefarious. Need a way to fix that.

Edit 2: I'd turn off wasm in your browser. Just saying. And I'd recommend running one of the many Javascript blockers so that you're not just willy nilly running untrusted code on your machine.

[pabloski]

This adds complications of its own. You no longer have a single WASM file, you now have to manage the runtime and your code separately. And then what do you do if the compiler smartens up and doesn't include the whole runtime, but just the parts you actually use? How many runtimes do you keep around (I'm looking at you, Windows with a bazillion MSVC runtimes that no one dares touch).

Yes and no. What they are trying to do, is to make wasm a sort of default cross-platform bytecode, available everywhere. This means that we will see operating systems shipping with integrated wasm virtual machines. Wasm VMs will be updated by the OS vendor and, I suppose, will be strictly retrocompatible. This way it is simple to remove the dll hell and the infamous winsxs directory.

It would be a stupid thing to charge browsers for handling the Wasm VM. It is better to let the OS do it.

[bug77]

Maybe web browsers could implement a shared cache for runtimes.

This adds complications of its own. You no longer have a single WASM file, you now have to manage the runtime and your code separately. And then what do you do if the compiler smartens up and doesn't include the whole runtime, but just the parts you actually use? How many runtimes do you keep around (I'm looking at you, Windows with a bazillion MSVC runtimes that no one dares touch).

[kpedersen]

wasm-decompile produces fairly readable code compared to obfuscated javascript.

wasm-decompile probably produces a more readable output than plain Javascript

Maybe web browsers could implement a shared cache for runtimes.

Yes, or at the very least we can try to agree on versions so that parts of the runtime can be friendly to caching proxies.

At the moment in Emscripten it gets bundled into a single .wasm or .js file by default but there is no reason why it cannot be separated.

[c117152]

WASM is no worse. It can be decompiled and read about the same as obfuscated Javascript. At least it can't do x86 assembly tricks like computing a jump into unaligned code at a +1 byte offset or using Windows SEH to execute the real code during division by zero.

wasm-decompile produces fairly readable code compared to obfuscated javascript.

[uid313]

The problem is these languages need a runtime and that will make your WASM code quite big (e.g. ~5MB for a simple "hello world" written in Go). That'll wreak havoc with download speeds and data caps. The only language I know of that is up to the task is Rust. And I'm assuming C/C++, but I haven't checked.
But the spec and tooling are coming along nicely, it's no longer super-tedious to pass around things more complex than an int, we got support for multi-threading...

Maybe web browsers could implement a shared cache for runtimes.

[bug77]

Yeah, WebAssembly is really cool. Microsoft use it for Blazor which is a framework which allows the developer to write code in C# then it gets executed on the client side in the web browser.

The problem is these languages need a runtime and that will make your WASM code quite big (e.g. ~5MB for a simple "hello world" written in Go). That'll wreak havoc with download speeds and data caps. The only language I know of that is up to the task is Rust. And I'm assuming C/C++, but I haven't checked.
But the spec and tooling are coming along nicely, it's no longer super-tedious to pass around things more complex than an int, we got support for multi-threading...

[Zan Lynx]

The answer to one question that I have about WebAssembly can determine if I like it or not...
Can the code that the browser run be seen like for HTML, CSS and Javascript ?
I don't want my browser to run any binary only code!

It has been a long time since you could read the Javascript code and have it make any sense. First it's compile to JS from Typescript, then it is compressed and obfuscated so every function is called "f" or "g". CSS is often done in a similar way with all of the classes and object IDs named junk like "c1" and done half in CSS text and half in Javascript.

WASM is no worse. It can be decompiled and read about the same as obfuscated Javascript. At least it can't do x86 assembly tricks like computing a jump into unaligned code at a +1 byte offset or using Windows SEH to execute the real code during division by zero.

[andrei_me]

Michael time to try this wasmer for the WASM tests from previous week

Bonus point for wasmer being made with Rust haha

[kpedersen]

Another crap like mono from Icaza?

At least we have a C/C++ compiler this time from the start that can generate WebAssembly and ASM.js (as a fallback) so we don't need to rewrite our software in crap like Microsoft Cool or VB.NET.