Half of the websites using WebAssembly use it for malicious purposes

This is not fundamentally different than the previous generation of JS miners. The root cause is "people who's websites serve miners", not WASM per se.

It's depressing that the web has become such a race-to-the-bottom, but here we are. Maybe we need a WASM permission opt-in like what we have for notifications, geolocation, etc.? It'll be hard to communicate what it means to regular users, but I don't see another solution.

What wide and varied legitimate use cases did we honestly expect to see? What wide and varied legitimate uses to we see for JS now?

I guess the uMatrix and NoScript will add an option to block/unblock WebAssembly.

That didn't take long. Anyone know how to disable it in the major browsers?

WASM is the new ActiveX. People were warned