search

stevespringett / disable-webassembly

Browser hacks to disable WebAssembly (WASM)
114 stars 7 forks source link

disabling it in Firecrap, err Firefox, doesn't seem to work #1

Closed calestyo closed 6 years ago

calestyo commented 6 years ago

Even when the respective about:config option is set to false, the example at http://webassembly.org/demo/ runs "normal".

stevespringett commented 6 years ago

I cannot replicate. Using FireFox 58.0, these are the results I'm seeings with the setting enabled and disabled.

wasm-enabled wasm-disabled

I noticed the demo had a fallback option. I tried disabling javascript.options.asmjs, but that did not work for me. The demo continued to work.

calestyo commented 6 years ago

I think you're right... I must have gotten into the fallback demo and haven't noticed this.

ghost commented 6 years ago

On FF, you also need: javascript.options.asmjs -> false.

When Firefox Firecrap⇙︎ ha! meets a WebAssembly code,
it first tries to translate it to native-instructions,
and then it runs it through the wasm-engine, for speed,
but if translating is not possible, or the wasm-engine isn't available,
FF can still run the code plainly, as a non-optimized JavaScript-code. ...so disable both wasm and asmjs

https://hg.mozilla.org/releases/mozilla-release/file/tip/modules/libpref/init/all.js#l1338 https://hg.mozilla.org/releases/mozilla-release/file/02a265554b08/js/xpconnect/src/XPCJSContext.cpp#l686

calestyo commented 6 years ago

@eladkarako But AFAIU asmjs is just a subset of JS, isn't it? So if that would be true, than any harm that asmjs could to could already be done by plain JS and as such, disabling asmjs should only improve security, if one also disables JS itself completely,...

Right?