Because it wouldn't be HN if someone didn't: https://www.destroyallsoftware.com/talks/the-birth-and-death...
QuickJS Running in WebAssembly
21–28 of 28 posts
Re: QuickJS Running in WebAssembly
#22Would you use this to run untrusted JS on the server?
Not sure if I'd trust the wasm runtime. If someone breaks out of that it's game over. QuickJS in a unikernel in something like Firecracker VM would be the most secure approach and still provide good performance and startup time.
Another thing is resource consumption where you likely want to limit cpu- and mem-usage.
Re: QuickJS Running in WebAssembly
#23Would you use this to run untrusted JS on the server?
I use it on both client and server. A easy way to get excellent security in the server is to run inside AWS Lambda or similar FaaS that uses strong VM isolation; ideally with a lambda instance per user.
Re: QuickJS Running in WebAssembly
#24Would you use this to run untrusted JS on the server?
Not sure if I'd trust the wasm runtime. If someone breaks out of that it's game over. QuickJS in a unikernel in something like Firecracker VM would be the most secure approach and still provide good performance and startup time. Another thing is resource consumption where you likely want to limit cpu- and mem-usage.
I recommend Lambda as an easy way to create ephemeral Firecracker VMs and set overall limits on host + guest. For casual use, the memory and CPU limits available in the library should be enough.
Re: QuickJS Running in WebAssembly
#25Imagine something like "base system" with WebAssembly, bare bones HTML engine with canvas support and no CSS. So now you can just download your favourite JS engine, your favourite HTML, CSS engines. But browser does not necessarily need to sheep those. It would allow to lower the bar for entry into browser market. I think that even a single person could implement that kind of base browser. Of course there're many har…
Ah yes, Java applets.
Re: QuickJS Running in WebAssembly
#26Hello, library author here. Happy to answer whatever questions you have.
Re: QuickJS Running in WebAssembly
#27Would you use this to run untrusted JS on the server?
You can just run QuickJS (without std lib) as a separate process running as an unprivileged user with seccomp rules.
WASM probably doesn't add much there.
Re: QuickJS Running in WebAssembly
#28Hello, library author here. Happy to answer whatever questions you have.
The npm package isn't working in the browser. I get `process is not defined`. There is a commit that fixes that issue, but no npm publish was made after that.