Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Shopify Uses WebAssembly Outside of the Browser

shopify.engineering

Post reply on HN
Print view View original

21–30 of 135 posts

Re: How Shopify Uses WebAssembly Outside of the Browser

#21

Post by CyberRabbi »

the_mitsuhiko wrote: post #18
CyberRabbi wrote: post #13

Earlier quoted context omitted.

> Having people compile code to WASM to execute it in a sandbox is becoming quite widespread. Shopify is not the first company to do that. Whether or not a technical solution is good is not dependent on it being employed by other companies. Using seccomp to run untrusted code is a better solution than wasm because it’s less code and more efficient.

> Whether or not a technical solution is good is not dependent on it being employed by other companies You said it's state of the art and simpler as WASM. I'm not actually aware of a single company using seccomp for what Shopify is doing (letting people upload custom code) so I would be quite curious to hear who does.

I never said anything was “state of the art” or made any claim that any company is using seccomp to accomplish what Shopify is doing.

I said that companies typically run third party native code, e.g. imagemagick, in seccomp to process untrusted data, e.g. user-uploaded image files.

If I were tasked with doing what Shopify is doing with wasm here, I would employ the seccomp-based solution since it’s equally applicable, it requires less code, and it’s more efficient. Whether or not other companies use a seccomp solution for this particular use case has no technical basis in determining its applicability for this use case. Seccomp was specifically designed for running untrusted code on your infrastructure, this exact use case.

Re: How Shopify Uses WebAssembly Outside of the Browser

#22

Post by CyberRabbi »

devwastaken wrote: post #19
CyberRabbi wrote: post #13

Earlier quoted context omitted.

> Having people compile code to WASM to execute it in a sandbox is becoming quite widespread. Shopify is not the first company to do that. Whether or not a technical solution is good is not dependent on it being employed by other companies. Using seccomp to run untrusted code is a better solution than wasm because it’s less code and more efficient.

That's a pretty bold statement. I'd like to see an in depth analysis between the two before supporting that.

It’s readily apparent:

More efficient: using wasm has a necessary compilation or interpretation overheard. Seccomp doesn’t.

Simpler: wasm requires deploying running an entire wasm runtime, likely >= 50K LOC in additional complexity and attack surface. Seccomp uses a small 100 line shim.

Re: How Shopify Uses WebAssembly Outside of the Browser

#23

Post by garethrowlands »

CyberRabbi wrote: post #15
feanaro wrote: post #9

Earlier quoted context omitted.

Shopify is already a known seccomp user (for running Ruby in the mruby VM), so I think there's no reason to assume the WebAssembly runtime is not in a seccomp jail too.

That’s just redundant

Redundancy is sometimes good. When it comes to containing exploits, surely it's better to be safe than sorry.

Re: How Shopify Uses WebAssembly Outside of the Browser

#24

Post by alquemist »

CyberRabbi wrote: post #5

Technically you can accomplish the same thing using seccomp, I.e. the way most services run third party native code to process untrusted data, e.g. imagemagick. That’s what I would probably do since it’s more efficient and simpler. No need for a compilation step or an interpreter. No need to trust the (likely complex) webassembly runtime to be bug free. Edit: most responses are being made under the assumption that se…

It's not an either/or. Most likely Shopify runs WASM inside an seccomp enclosure. Possibly inside a VM as well. Defense in depth.

Re: How Shopify Uses WebAssembly Outside of the Browser

#25

Post by CyberRabbi »

alquemist wrote: post #24
CyberRabbi wrote: post #5

Technically you can accomplish the same thing using seccomp, I.e. the way most services run third party native code to process untrusted data, e.g. imagemagick. That’s what I would probably do since it’s more efficient and simpler. No need for a compilation step or an interpreter. No need to trust the (likely complex) webassembly runtime to be bug free. Edit: most responses are being made under the assumption that se…

It's not an either/or. Most likely Shopify runs WASM inside an seccomp enclosure. Possibly inside a VM as well. Defense in depth.

Running untrusted code in a wasm vm doesn’t add any extra defense over just using seccomp. It just adds unnecessary overhead and increases attack surface.

Re: How Shopify Uses WebAssembly Outside of the Browser

#26

Post by alquemist »

martin_drapeau wrote: post #14

Could someone eligthen me. Why not just use JavaScript? It is being used by Cloudflare on the edge, and AWS lambda. Why need to go to WASM?

* Predictable performance.

* A wide ecosystem of mature language toolchains.

* Simplicity: JS implementation contain sophisticated JITs, which are harder to prove correct compared to a simple ASM translator.

* Portability: not tied to a specific HW architecture.

Re: How Shopify Uses WebAssembly Outside of the Browser

#27

Post by nih0 »

bagels wrote: post #20
peteretep wrote: post #16

> you cannot express anything malicious in Wasm This feels like a comment that will as age as badly as “you can’t get a virus just from looking at an email”

Sounds like the promises made about the jvm.

can u elaborate on these jvm promises?

Re: How Shopify Uses WebAssembly Outside of the Browser

#28

Post by alquemist »

CyberRabbi wrote: post #25
alquemist wrote: post #24

Earlier quoted context omitted.

It's not an either/or. Most likely Shopify runs WASM inside an seccomp enclosure. Possibly inside a VM as well. Defense in depth.

Running untrusted code in a wasm vm doesn’t add any extra defense over just using seccomp. It just adds unnecessary overhead and increases attack surface.

Assuming that Intel / ARM microarch implementations are bug free, that is correct. In the real world there are no bug free implementations.

Edit. This is the strategy Chrome sandboxing uses: a hardened runtime (JS/WASM) inside a seccomp enclosure. https://chromium.googlesource.com/chromiumos/docs/+/master/s...

Re: How Shopify Uses WebAssembly Outside of the Browser

#29

Post by tpetry »

CyberRabbi wrote: post #21
the_mitsuhiko wrote: post #18

Earlier quoted context omitted.

> Whether or not a technical solution is good is not dependent on it being employed by other companies You said it's state of the art and simpler as WASM. I'm not actually aware of a single company using seccomp for what Shopify is doing (letting people upload custom code) so I would be quite curious to hear who does.

I never said anything was “state of the art” or made any claim that any company is using seccomp to accomplish what Shopify is doing. I said that companies typically run third party native code, e.g. imagemagick, in seccomp to process untrusted data, e.g. user-uploaded image files. If I were tasked with doing what Shopify is doing with wasm here, I would employ the seccomp-based solution since it’s equally applicable…

And i would run wasm with a seccomp profile: You have the benefit of language designed which is hard to not do anything malicious (i guess theres still some possibility) and harden the execution environment (wasm runner) within a rootless pofman/docker container with a seccomp profile and restrictive selinux labels.

The world is not black and white, you can mix multiple solutions for more security. For what shopify is doing you need the most security you can get. Your example running a trusted application (imagemagick) with untrusted input is a lot easier to make secure than running untrusted binaries.

Re: How Shopify Uses WebAssembly Outside of the Browser

#30

Post by gfxgirl »

xg15 wrote: post #6
colesantiago wrote: post #2

What does this mean for Shopify merchants? Is it all just faster apps? I'm still at a loss that Shopify still does not have a subscriptions product. :/

Pro: You don't need server infrastructure to customise a Shopify flow. Con: You need coders knowledgeable in WASM. However, I could imagine that an ecosystem of "plugins" could emerge, i.e. ready-made WASM apps that merchants could plug into their stores. There might be more security issues though, if the developer of the WASM and the merchant using it aren't the same party. I think it will be interesting to see how…

Why do you need coders knowledgeable in WASM? The majority of coders will use something else (C, C++, Rust, C#, etc.) The majority of them don't need to know the details of the processor their compiler is targeting.
Post reply on HN