Wednesday, 22 April 2026
Compile to WASM - The Emscripten Toolchain
WebAssembly Not Automatically Blocked by Browsers
WebAssembly is a type of code designed to run in modern web browsers. It is designed to run alongside JavaScript using WebAssembly JavaScript APIs - creating an option for performance critical functionality.
As WebAssembly increases the browser's attack surface, so browsers contain WASM inside the browser's sandbox and restricts system access.
A risk maybe breaking out of the sandbox. Adobe Flash was a product sandboxed after a bunch of exploits, and after sandboxing exploits still occurred.
Transmission of WASM does not require TLS, HSTS or any other transport layer security mechanism making it susceptible to man-in-the-middle attacks.
Integrity checking is also impossible as WASM modules need not be signed by the author.
Some security-focused browser configurations can block WASM.
An Insider Look at CPython: The "Compiler-Interpreter"
Thursday, 27 November 2025
The Same Origin Policy (SOP) on Modern Web Browsers
The Same Origin Policy (SOP) is a browser-enforced security rule that prevents scripts from one "origin" (PDP -> protocol + domain + port) from accessing resources from another origin.
The SOP prevents cookies, DOM and local storage from being read by malicious cross-site scripts.
The SOP does not just apply to web browsers. For example, Electron apps (desktop apps built with web tech) enforce SOP because they embed Chromium.
The Same Origin Policy is an "isolation model" designed to ensure "secure workflow".
Technology designed to integrate into browsers (e.g. WebAssembly) generally respect the existing SOP.