It is actually a pretty good article and I learnt quite a bit. Thanks for taking the time to write it. The only two things I would add are that, unlike Java, the industry has rallied unanimously behind it (in the 90s it was Java vs .NET and Applets vs ActiveX, etc.) and the big difference that Wasm comes pre-integrated in the browser, has a focus on security and is a proper W3C standard. Everything else that came before it felt like some after-the-fact bolt-on (Flash, Applets, etc.) and had big security issues and often got out of sync with browser releases
There was no .NET in the 90's. It was Java vs. ActiveX vs. Flash. I agree that Java support in browsers was never as good as it could have been. Sun never had direct control over a mainstream browser, and the companies that did each had other technologies that they preferred (Microsoft - ActiveX, Netscape - Javascript).
I mean, Applets are just really old, security itself wasn’t considered all that “important” at the time. There is no real difference on a purely runtime level between wasm and the JVM to make one safer than the other. And regarding release strategy, that’s just politics.
Wasm could start out as a "function runner" box with no outside interface at all besides arguments and return value, with everything UI, storage or networking conveniently out of scope. Applet, in its day, had to be so much more than just the bytecode VM...
That were applets (used for a very different web than today). The JVM format/vm itself can also work as a simple “function runner”, hell, without adding actual functionality you pretty much get this automatically from any runtime. Most brainfuck interpreters are trivially safe from deleting your hard drive, they simply don’t have fs access.
Security was considered just as important as it is today, in fact probably more because the default attitude towards the internet was not to trust anything. At this time the only relevant browser was IE, which was hostile to everything not MS and they would kneecap anything they could.
Come on, there was basically no concern for privacy for a very long time. The whole IT were built upon “no bad actors” assumption. It turned out to be a deeply flawed assumption and we try to fix it, but desktop OSs are still insanely unsafe.
There was enough concern for privacy that browsers were set up to warn for each and every cookie by default, and prompt the user before running any JavaScript on the page.
