Live data from Hacker News

Pyodide 314.0: Python packages can now publish WebAssembly wheels to PyPI

blog.pyodide.org

11–20 of 44 posts

Re: Pyodide 314.0: Python packages can now publish WebAssembly wheels to PyPI

#11

Executing normal python programs inside a cpython vm inside a wasm context inside a javascript process inside a sandbox inside a browser is - genuinely - extremely exciting! (Might as well run the browser inside a container inside a VM while you're at it though.)

This sounds like a solution looking for an unnecessary security nightmare.

Something as little as the runtime can just get exploited (which that as happened.) and cause a sandbox escape on the client side. There was a Chrome 0day at the runtime level which allowed untrusted code to run and escape the sandbox in the WASM runtime.

This complete worship of WASM (and their runtimes) as this magical silver bullet reminds me of the days and failures of Native Client (NaCL), Java Applets and Flash all over again.

Re: Pyodide 314.0: Python packages can now publish WebAssembly wheels to PyPI

#12
post #9
post #3

I've been looking forward to this for ages! This means we can now take any C/Rust/whatever extension for Python, compile that as a `.wasm` extension, and then load it directly in browser Pyodide projects using: await micropip.install("package-on-pypi") import package_name Here's how to try the new feature out. Visit https://pyodide.org/en/stable/console.html and type: import micropip await micropip.install("pydantic_…

I had an older experimental Pyodide WASM project lying around (a packaging of the Luau language by Roblox) so I had Codex package that up for me and pushed it to PyPI. Here's the package: https://pypi.org/project/luau-wasm/ import micropip await micropip.install("luau-wasm") import luau_wasm print(luau_wasm.execute(r''' local animals = {"fox", "owl", "frog", "rabbit"} table.sort(animals, function(a, b) return #a And…

[deleted]

Re: Pyodide 314.0: Python packages can now publish WebAssembly wheels to PyPI

#13

Executing normal python programs inside a cpython vm inside a wasm context inside a javascript process inside a sandbox inside a browser is - genuinely - extremely exciting! (Might as well run the browser inside a container inside a VM while you're at it though.)

[flagged]

Re: Pyodide 314.0: Python packages can now publish WebAssembly wheels to PyPI

#14
post #3

I've been looking forward to this for ages! This means we can now take any C/Rust/whatever extension for Python, compile that as a `.wasm` extension, and then load it directly in browser Pyodide projects using: await micropip.install("package-on-pypi") import package_name Here's how to try the new feature out. Visit https://pyodide.org/en/stable/console.html and type: import micropip await micropip.install("pydantic_…

[flagged]

Re: Pyodide 314.0: Python packages can now publish WebAssembly wheels to PyPI

#16
post #11

Executing normal python programs inside a cpython vm inside a wasm context inside a javascript process inside a sandbox inside a browser is - genuinely - extremely exciting! (Might as well run the browser inside a container inside a VM while you're at it though.)

This sounds like a solution looking for an unnecessary security nightmare. Something as little as the runtime can just get exploited (which that as happened.) and cause a sandbox escape on the client side. There was a Chrome 0day at the runtime level which allowed untrusted code to run and escape the sandbox in the WASM runtime. This complete worship of WASM (and their runtimes) as this magical silver bullet reminds…

You mean this one? https://theori.io/blog/a-deep-dive-into-v8-sandbox-escape-te...

I dunno, one sandbox escape in nine years is a pretty solid track record IMO.

Any reason WASM is more dangerous than regular JavaScript?

Re: Pyodide 314.0: Python packages can now publish WebAssembly wheels to PyPI

#19
I've been working on a server-side wasm impl of cpython called boomslang [1] and have been thinking a lot lately about packaging, one of the downsides of my current impl is the need to statically link all c/rust extensions. Its too bad IMO how much of the wasm ecosystem targets/depends on emscripten directly. It'd be interesting to see if a more generic ABI could be provided for non emscripten/js based wasm runtimes.

[1] https://github.com/HubSpot/boomslang

Re: Pyodide 314.0: Python packages can now publish WebAssembly wheels to PyPI

#20
post #19

I've been working on a server-side wasm impl of cpython called boomslang [1] and have been thinking a lot lately about packaging, one of the downsides of my current impl is the need to statically link all c/rust extensions. Its too bad IMO how much of the wasm ecosystem targets/depends on emscripten directly. It'd be interesting to see if a more generic ABI could be provided for non emscripten/js based wasm runtimes.…

I think one of the issues is that WASM is notoriously hard to generate code for because they decided to use an IR that's fundamentally incompatible with literally any existing native compiler backend's IR (not counting very specialized ones or toy direct-ast-to-machine-code compilers).

It feels like nobody actually consulted actual compiler writers when designing this. I'm sure that isn't true, but it definitely feels that way. (I suspect the truth is that they were consulted, but ignored.)

It means codegen needs to resort to all sorts of hacks (like the relooper) in order to target WASM, a property not shared by any other target.

And apparently, the way they handle variables also results in deoptimization, though I don't recall the details of that.

Add the fact that interacting with the browser on the web still has to go via JavaScript to this day (for the most part, at least), and, well.

---

TL;DR a combination of poor IR design that has a massive impedance mismatch with pre-existing compilers (and most new ones, because it turns out there's a reason the WASM approach isn't standard) plus WASM still being a second-class citizen in its supposed primary environment (the 'W' in WASM) --- the former ensures targeting it consumes a lot of resources/time, the latter ensures the bar for that to be worth it is much higher.

You can target most architectures with little trouble (at least a a baseline --- optimization's a hard problem regardless of target, except maybe SPIR-V due to the recommendation that pre-optimization is limited in scope). But WASM is completely out there, it's closer to trying to target e.g. Java (not JVM!) at the backend instead of machine code or some other IR.

You don't make an IR intended to be targeted by existing/native compilers by making it completely different to anything they had to target before and completely different to their own IRs and representations ... unless you're the guys behind WASM.

Post reply on HN