Live data from Hacker News

Wasmer 1.0

medium.com

51–60 of 168 posts

Re: Wasmer 1.0

#51
post #47

Earlier quoted context omitted.

Are you talking about the browser or other environments? There is a proposal [1] for adding sockets to WASI. This blog post [2] has some more background info. Outside the browsers, you can always provide extra functionality yourself though by supplying host defined functions as imports. That looses the benefit of a standard API, but is fine for custom deployments. [1] https://github.com/WebAssembly/WASI/pull/312 [2]…

Yeh, this article kinda confirms what I've been thinking the past few years: "Implementing a server requires additional API functions exposed - specifically, sock_bind, sock_listen, and sock_accept" "And while implementing them is done similarly to what was described here so far, there is an underlying issue: there is no multi-threading support in WebAssembly" Really surprised to see so many people talking this up to…

There is of course the threads proposal [1], which works in chrome with a feature flag, but most runtimes don't support it yet.

In general I have to agree that WASM needs more time. There are multiple quite crucial proposals in the pipeline (reference types, interface types, threads, tail calls and other advanced control flow, module linking, (GC), ...) which have all seen very slow progress.

Overall I'm still bullish on the potential of WASM for universal deployment, but the slow pace is a bit concerning.

[1] https://github.com/WebAssembly/threads

Re: Wasmer 1.0

#52
post #16

Earlier quoted context omitted.

The issue I see is we don't need a sandbox at all for this, we need capability based security models for applications provided by the OS vendors (like iOS, Android). Apple has taken the right steps towards such a model, yet get lambasted by developers for it. We have flatpaks and snaps for Linux, the former isn't really targeted by many and the latter is similarly lambasted by users and developers. I don't even know…

IMO iOS and Android are terrible examples of how to do this. They break decades of convention in how to write POSIX-like applications, and force developers into locked-in practices. Android gives lip service to the NDK, but in practice you can't really run many useful C/C++/Golang/Rust/etc programs on Android, because the system breaks POSIX. You can't keep a simple webserver running without starting a foreground ser…

I’m a big fan of the capability-based photo access in ios; when an app tries to access my photos it opens a system dialog which allows me to select the set of images the app can see.

Re: Wasmer 1.0

#53
post #16
post #11

Earlier quoted context omitted.

All the things you mention could be available as a shared library, to be run inside the sandbox along with the application. Let's keep the sandbox as simple as possible. We can build complexity inside it, and not make complexity part of it. This makes security guarantees much simpler.

The issue I see is we don't need a sandbox at all for this, we need capability based security models for applications provided by the OS vendors (like iOS, Android). Apple has taken the right steps towards such a model, yet get lambasted by developers for it. We have flatpaks and snaps for Linux, the former isn't really targeted by many and the latter is similarly lambasted by users and developers. I don't even know…

You're completely right, of course. Seeing the amount of effort put into virtualization, sandboxing, containers, etc. is enough to make one wonder why every enterprise is so shortsighted. Capabilities obviate all of the above, and are neither a new untested idea nor more complicated than what we have--as we clearly see in the repeated attempts to build things that approximate them with ACLs and sandboxes and seccomp rules and so on.

Linux is slowly moving toward capability-centric design with more and more comprehensive namespacing and file-descriptor-based interfaces to things like pidfd and memfd, but there's still a long way to go before we can jettison ambient authority such as the filesystem entirely. Meanwhile, Google's Fuchsia may deploy a capability-based operating system to the masses, but it will likely only be used to sandbox applications written for Android anyway. The real potential of capabilities is to simplify the interface of a power-user operating system by eliminating the race conditions, side channels, privacy leaks, firewalls, virus scanners, and unix-style permissions from developers' and users' day-to-day experience completely.

There will still be memory-safety zero days, of course, until we abandon languages where humans are statistically incapable of writing memory-safe code.

Re: Wasmer 1.0

#54
post #11
post #7

Earlier quoted context omitted.

You've just described the hardest parts of a web browser, while ignoring the necessity of a JIT compiler for your bytecode. To give proof by counterexample, the "simple wrapper" is a graphics stack like GTK alongside the POSIX APIs. It turns out this is insufficient for application development. Some things you're missing are text layout and accessibility. Neither are small or simple. The browser is the new OS and the…

All the things you mention could be available as a shared library, to be run inside the sandbox along with the application. Let's keep the sandbox as simple as possible. We can build complexity inside it, and not make complexity part of it. This makes security guarantees much simpler.

I like this vision of shared libraries sandboxed inside a minimal runtime to replace the browser. But there are some serious problems with it (that I hope can be resolved somehow).

Replicating a significant fraction of the functionality of a browser ends up being a lot of code and data. For a web-like experience with instant navigation between apps it will be necessary for these shared libraries to be really shared, as in almost all apps use the same libraries and the same version of those libraries. Otherwise you'd be downloading and unpacking and JIT compiling dozens or hundreds of megabytes of code and data before you could display a single line of text, every time you click a link to a new site. The linkable nature of the web would be lost. (Yes, many websites are dozens of megabytes already, but the bulk of that is delay-loaded and happens in the background after the initial content is displayed).

In order for the standard libraries to be actually shared, everyone would have to agree on the standard libraries to use, and the standard libraries would have to be designed to be backwards compatible so that older sites could be force-upgraded to use newer versions. This is essentially the role that browser updates play today. But the browser evolved over decades and it's not clear how you'd get everyone to adopt a new set of standard libraries today, nor how you'd get everyone to agree on what functionality to add over time (the role that W3C plays today).

For libraries outside of the standard set, it sounds tempting to allow them to be shared too. But this is actually an unavoidable privacy violation. If you have a shared cache, then any app can discover the set of previously loaded libraries with a timing attack, thus revealing information about the user's browsing history. This is why all browsers are now moving to partition all caches by site: https://www.jefftk.com/p/shared-cache-is-going-away. Even if multiple sites reference the same wasm blob, it must be downloaded and JITed separately with no sharing.

As I said, I like the vision of a tiny low-level runtime executing shared libraries inside a sandbox. But I'm not sure how it could be done in an efficient and privacy-respecting way if you want to replace the Web with it.

Re: Wasmer 1.0

#55
post #36

Earlier quoted context omitted.

First, Stockholm syndrome isn't a thing. Second, there were a bunch of alternatives and the Web won instead of them and not just because they weren't there. I know, some people like running around telling everybody Qt, GTK, Swing or whatever were or even are better, but they are seemingly not for the points that matter for most of GUI apps. But yes, we should make something better going forward.

> First, Stockholm syndrome isn't a thing. Have you ever had a useful conversation by starting with this?

Many.

Re: Wasmer 1.0

#56

Earlier quoted context omitted.

IMO iOS and Android are terrible examples of how to do this. They break decades of convention in how to write POSIX-like applications, and force developers into locked-in practices. Android gives lip service to the NDK, but in practice you can't really run many useful C/C++/Golang/Rust/etc programs on Android, because the system breaks POSIX. You can't keep a simple webserver running without starting a foreground ser…

I’m a big fan of the capability-based photo access in ios; when an app tries to access my photos it opens a system dialog which allows me to select the set of images the app can see.

Have you ever tried to build a cross-platform photo app that works on iOS and regular computers?

Re: Wasmer 1.0

#58
post #2

Browsers are not the right tool for sandboxing applications. I don't think it was a mistake, but it's time to take what we've learned and move to the next level. With a bytecode like wasm, you can create an "app runner" program that's at least an order of magnitude less complicated than current browsers. Just ship apps as wasm binaries with a simple interface (maybe WASI, haven't taken the time to dig into it yet) fo…

>> Browsers are not the right tool for sandboxing applications.

Browsers have been picking up the slack where OS and desktop developers have fallen down. The OS is supposed to handle process isolation and resource access, but here we are. Tabbed browsing became a thing because GUI toolkits didn't do multiple app instances (or MDI) in a way people liked.

Re: Wasmer 1.0

#59
post #32

Earlier quoted context omitted.

IMO iOS and Android are terrible examples of how to do this. They break decades of convention in how to write POSIX-like applications, and force developers into locked-in practices. Android gives lip service to the NDK, but in practice you can't really run many useful C/C++/Golang/Rust/etc programs on Android, because the system breaks POSIX. You can't keep a simple webserver running without starting a foreground ser…

I think proper sandboxing on a traditional Unix is hard enough that ~nobody does it right; you can't let any apps run as the user if you want to prevent them from snooping on each others' files, but the user needs to be able to control all of them. I don't know of a justification for removing /etc/resolv.conf, but I guess "applications' networking should be under the control of the user" is sorta necessary; I think i…

>> you can't let any apps run as the user if you want to prevent them from snooping on each others' files, but the user needs to be able to control all of them.

I was thinking about that recently and my conclusion will be highly controversial.

In the same way Wayland implements security that X never could, I think the GUI might be a place to implement file and folder access permissions. If the user does not grant access to a file through a dialog, the app couldn't read it. Same for folder access, which would grant an application access to an entire folder or perhaps an entire hierarchy.

Obviously this would break some things, but real change may require some of that. How much, I don't know.

Re: Wasmer 1.0

#60

Earlier quoted context omitted.

> but I am saying we had decades to do better and didn't If you ignore everything outside the web, sure. Games routinely render thousands of extremely complex objects at over 60 fps. The browser cannot animate a `height: auto` element or display more than a few thousand simple elements without stuttering. Clearly we have done better. Just not on the web. And don't get me started on actual complex UIs. TurboVision fro…

You're talking purely about performance. Sure, you can do whatever you want in a game UI, and it will probably outperform a web UI. But there's a reason game UIs often scale/function badly as soon as you change the screen size or the input type: they aren't built on a platform that has flexibility baked into its bones. In many cases they aren't build on any kind of platform at all. They often have element/text positi…

> You're talking purely about performance.

Not just about performance.

> Sure, you can do whatever you want in a game UI, and it will probably outperform a web UI.

Not probably, but definitely

> But there's a reason game UIs often scale/function badly as soon as you change the screen size or the input type: they aren't built on a platform that has flexibility baked into its bones.

Yeah, no. Games have had UI scaling since monitors got more resolutions than 640x480.

The reason why the web is horrible at UI performance is simple: it was never built for UIs. It is, at its core, a system to display simple texts with a few images in between, and that's it.

Look at the sad state over at https://csstriggers.com. Setting text shadow will cause a full-screen reflow. What does this have to do with "flexibility baked into its bones"?Nothing. If anything, it's entirely inflexible. Same for any type of animation apart from a handful of css transforms: touching any part of an element will cause a full-age reflow (and that's why animating `height: auto` is one of the web's holy grails). This has nothing to do with "changing screen size or the input type". The web was never built for this, and anything outside simple-text-plus-a-few-images is just a bolted-on hack that barely works.

> all sizing and positioning is determined automatically based on rules, which can be expensive to calculate, but is what makes it so robust.

iOS uses a significantly more complex system layout constraints not dissimilar to Cassowary. Cassowary was proposed for the web in the late 1990s and was rejected because it was considered to be too expensive to calculate on the hardware of the times. The vast majority of the web was designed with one goal in mind: avoid expensive calculations. To the point that the actual algorithms to decide how to layout and draw stuff are specified in the standards. And the core of the web is designed around ... a single pass. The first time an allowance for two passes appears is for some stuff in tables (was it vertical alignment?) in early 00s.

And the actual complexity on the web comes from the fact that it was never designed for any of this stuff. And, of course, there's no robustness to speak off. Even looking at the web sideways will break it in innumerable ways: from the fact that just asking for an element's size will cause a full-page reflow to inability to properly encapsulate anything.

> Qt still exists. It's still being actively developed and still gets used for some modern software.

I know it still exists. What I was saying that Qt and Delphi in early 00s and TurboVision in 1990s had tools that surpass anything the web has to offer today. Which is not unusual, because they were developed as UI frameworks/libs/tools. Unlike the web. It can barely display a simple page with text and images, and now we've built an unholy mountain of hacks on top of it.

The web is the first and only UI system that lacks any and all tools to actually build and customise a UI beyond a very restricted set of badly interconnected very rigidly defined primitives. Where any UI lib/framework gives you a rich set of complex controls, the web gives you a few form elements with little to no functionality. Where any UI lib/framework gives you a plethora of tools to design/change any control or primitive you want (going as far as letting you redefine your own paint functions), the web gives you nothing.

I keep repeating this in various comments, but: there's a reason why most CSS/UI frameworks on the web repeat the same handful of primitive elements: a badge, a text input, a button, a breadcrumb, an avatar. Because that's all you can do in any reasonable amount of time. Very very very few attempt a date picker or a complex dropdown (inevitable with significant a11y issues). More complex UI elements like virtual lists, tree views, master-detail sheets, proper data tables, truly complex layouts where you can actually mix and match any and all components? Ahahahahahaha. And of course, nothing even approaching visual editors of early 00s because they are simply impossible on the web.

> But the web works pretty well for all types of applications.

The web performs poorly for any type of application and performs barely well enough for pages.

Post reply on HN