Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web Browser Engineering

browser.engineering

Post reply on HN
Print view View original

11–20 of 64 posts

Re: Web Browser Engineering

#11

Post by simonw »

I was interested to see that this uses the DukPy wrapper around Duktape for the JavaScript interpreter: https://browser.engineering/scripts.html

This made me start digging into whether this was considered a "safe" way of executing untrusted JavaScript in a sandbox.

It's not completely clear to me if DukPy currently attempts safe evaluation - it's missing options for setting time or memory limits on executed code for example: https://github.com/amol-/dukpy

There's a QuickJS Python wrapper here which offers those limits: https://github.com/PetterS/quickjs

I'm pretty paranoid though any time it comes to security and dependencies written in C, so I'd love to see a Python wrapper around a JavaScript engine that has safe sandbox execution as a key goal plus an extensive track record to back it up!

Re: Web Browser Engineering

#13

Post by pavpanchekha »

ofou wrote: post #12

this builds a web browser like the build-your-own-x movement?

Author here—the browser the book works through is, uhh, pretty limited, so I don't imagine you'd want to actually use it for web browsing. It's more like writing your own toy compiler or operating system, to learn how they work.

Re: Web Browser Engineering

#14

Post by dgb23 »

game_the0ry wrote: post #9

As a front end developer, I am really happy to see resources like this. Developing for the browser is a real challenge. I think working with html / css /js has been a neglected skill for a long time - most software engineers look down on that type of work and its rarely covered in comp sci course work. Still, its good to see a lot of progress has been made, this book included. My only critique - why use python instea…

I agree, JS _the language_ would be a more "obvious" choice for this, since it is both generally much faster and more popular in web development. I assume they are using Python _the ecosystem_ here. It probably comes with packages better suited for rendering specifically?

I don't think either is a super compelling choice anyways for this type of work. I think you want to use a systems language here. However Python is completely fine as a teaching language. Pretty much anyone who knows a similarly structured language can read it. And there is very little noise. So it can serve as a good reference if you want to follow along with a different language.

Re: Web Browser Engineering

#15

Post by ameliaquining »

simonw wrote: post #11

I was interested to see that this uses the DukPy wrapper around Duktape for the JavaScript interpreter: https://browser.engineering/scripts.html This made me start digging into whether this was considered a "safe" way of executing untrusted JavaScript in a sandbox. It's not completely clear to me if DukPy currently attempts safe evaluation - it's missing options for setting time or memory limits on executed code for…

If you want battle-hardened, I figure you can't do better than V8. Here's a Python wrapper that I've poked at a bit (it's not quite 100% feature-complete but it seems to essentially work): https://github.com/sqreen/PyMiniRacer

Re: Web Browser Engineering

#16

Post by devwastaken »

simonw wrote: post #11

I was interested to see that this uses the DukPy wrapper around Duktape for the JavaScript interpreter: https://browser.engineering/scripts.html This made me start digging into whether this was considered a "safe" way of executing untrusted JavaScript in a sandbox. It's not completely clear to me if DukPy currently attempts safe evaluation - it's missing options for setting time or memory limits on executed code for…

I don't see any specific claims on isolation/memory safety or safety in general on duktapes page. Both V8 and spider monkey actively fix new JS vulnerabilities, and V8 isolates are used in the wild to success. Cloudflare workers is an example.

Re: Web Browser Engineering

#17

Post by game_the0ry »

pavpanchekha wrote: post #10
game_the0ry wrote: post #9

As a front end developer, I am really happy to see resources like this. Developing for the browser is a real challenge. I think working with html / css /js has been a neglected skill for a long time - most software engineers look down on that type of work and its rarely covered in comp sci course work. Still, its good to see a lot of progress has been made, this book included. My only critique - why use python instea…

Author here. I wrote up my answer here: http://browser.engineering/blog/why-python.html Basically: server-side JavaScript is just not as widely known as Python, and it'd be additionally confusing when our browser starts running JavaScript. And in-browser JavaScript is a bit too restricted (by things like the same-origin policy) to do the whole thing inside a browser.

I see. I tried searching the table of contents as to "why python" and could not find it, but that link does more than enough to explain the "why."

I am resisting the urge to disagree, but since you did (literally) write a book about building a browser, I will defer to your expertise and try to learn from you :)

Re: Web Browser Engineering

#19

Post by simonw »

ameliaquining wrote: post #15
simonw wrote: post #11

I was interested to see that this uses the DukPy wrapper around Duktape for the JavaScript interpreter: https://browser.engineering/scripts.html This made me start digging into whether this was considered a "safe" way of executing untrusted JavaScript in a sandbox. It's not completely clear to me if DukPy currently attempts safe evaluation - it's missing options for setting time or memory limits on executed code for…

If you want battle-hardened, I figure you can't do better than V8. Here's a Python wrapper that I've poked at a bit (it's not quite 100% feature-complete but it seems to essentially work): https://github.com/sqreen/PyMiniRacer

That looks really good - especially how they've managed to bundle a pre-compiled v8 into a 4MB Python wheel: https://blog.sqreen.com/embedding-javascript-into-python/

The time limit and memory limit support looks good too: https://github.com/sqreen/PyMiniRacer/blob/f7b9da0d4987ca7d1...

Re: Web Browser Engineering

#20

Post by ofou »

pavpanchekha wrote: post #13
ofou wrote: post #12

this builds a web browser like the build-your-own-x movement?

Author here—the browser the book works through is, uhh, pretty limited, so I don't imagine you'd want to actually use it for web browsing. It's more like writing your own toy compiler or operating system, to learn how they work.

It's perfect then! I'll read and work the exercises.

Thanks for answer!

Post reply on HN