Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JavaScript engines zoo – Compare every JavaScript engine

zoo.js.org

Post reply on HN
Print view View original

41–50 of 97 posts

Re: JavaScript engines zoo – Compare every JavaScript engine

#41

Post by simonw »

All these JavaScript engines and it's still remarkably hard to find a robust solution for executing JavaScript from untrusted sources inside my own server-side applications.

Every time I look I find repos that look promising at first but are either unmaintained or have a team or just one or two maintainers running them as a side project.

I want my sandbox to be backed by a large, well funded security team working for a product with real money on the line if there are any holes!

(Playing with Cloudflare workerd this morning, which seems like it should cover my organizational requirements at least.)

Update: Classic, even Cloudflare workerd has "WARNING: workerd is not a hardened sandbox" in the README! https://github.com/cloudflare/workerd?tab=readme-ov-file#war...

Re: JavaScript engines zoo – Compare every JavaScript engine

#43

Post by pastage »

simonw wrote: post #41

All these JavaScript engines and it's still remarkably hard to find a robust solution for executing JavaScript from untrusted sources inside my own server-side applications. Every time I look I find repos that look promising at first but are either unmaintained or have a team or just one or two maintainers running them as a side project. I want my sandbox to be backed by a large, well funded security team working for…

One process per sandbox will get you far, if all you want is to execute something. I would go as far as say it is pretty easy.

Re: JavaScript engines zoo – Compare every JavaScript engine

#44

Post by simonw »

pastage wrote: post #43
simonw wrote: post #41

All these JavaScript engines and it's still remarkably hard to find a robust solution for executing JavaScript from untrusted sources inside my own server-side applications. Every time I look I find repos that look promising at first but are either unmaintained or have a team or just one or two maintainers running them as a side project. I want my sandbox to be backed by a large, well funded security team working for…

One process per sandbox will get you far, if all you want is to execute something. I would go as far as say it is pretty easy.

I want to execute untrusted code. This makes it very difficult indeed.

Re: JavaScript engines zoo – Compare every JavaScript engine

#45

Post by mike_hearn »

simonw wrote: post #44
pastage wrote: post #43

Earlier quoted context omitted.

One process per sandbox will get you far, if all you want is to execute something. I would go as far as say it is pretty easy.

I want to execute untrusted code. This makes it very difficult indeed.

What's wrong with V8?

You could also look at GraalJS. It's shipped as part of the Oracle Database, there's a security team, patching process etc. It's used in production by Amazon amongst others. It's got flexible sandbox features too.

https://www.graalvm.org/latest/reference-manual/embed-langua...

The way it's written is good for security as well:

https://medium.com/graalvm/writing-truly-memory-safe-jit-com...

Disclosure: I sit next to the GraalVM team.

Re: JavaScript engines zoo – Compare every JavaScript engine

#46

Post by simonw »

mike_hearn wrote: post #45
simonw wrote: post #44

Earlier quoted context omitted.

I want to execute untrusted code. This makes it very difficult indeed.

What's wrong with V8? You could also look at GraalJS. It's shipped as part of the Oracle Database, there's a security team, patching process etc. It's used in production by Amazon amongst others. It's got flexible sandbox features too. https://www.graalvm.org/latest/reference-manual/embed-langua... The way it's written is good for security as well: https://medium.com/graalvm/writing-truly-memory-safe-jit-com... Discl…

The challenge with V8 is finding a wrapper for it that doesn't come with a big warning NOT to use it as a sandbox for untrusted code - here's the workerd one https://github.com/cloudflare/workerd?tab=readme-ov-file#war... and here's the PyMiniRacer section: https://bpcreech.com/PyMiniRacer/architecture/#security-goal...

I looked at GraalVM but was put off by the licensing situation: https://www.graalvm.org/22.3/reference-manual/embed-language...

> GraalVM Enterprise provides the experimental Sandbox Resource Limits feature that allows for the limiting of resources used by guest applications. These resource limits are not available in the Community Edition of GraalVM.

Part of my requirements for a sandbox are strong guarantees against memory or CPU exhaustion from poorly written or malicious code.

Re: JavaScript engines zoo – Compare every JavaScript engine

#47

Post by HatchedLake721 »

simonw wrote: post #41

All these JavaScript engines and it's still remarkably hard to find a robust solution for executing JavaScript from untrusted sources inside my own server-side applications. Every time I look I find repos that look promising at first but are either unmaintained or have a team or just one or two maintainers running them as a side project. I want my sandbox to be backed by a large, well funded security team working for…

Not a silver bullet, but did you look into isolated-vm? https://github.com/laverdet/isolated-vm

But generally, I think best bet is to offload such things to e.g. Lambda per tenant.

Re: JavaScript engines zoo – Compare every JavaScript engine

#48

Post by ivankra »

pastage wrote: post #42

Now run the "Which programming language is fastest?" Benchmark on all of them. https://benchmarksgame-team.pages.debian.net/benchmarksgame/...

You can use this docker image with all the pre-built binaries as a starting point: https://hub.docker.com/r/ivankra/javascript-zoo

Just keep benchmark code limited to standard ECMAScript, don't expect any browser or Node APIs besides console.log() or print().

Re: JavaScript engines zoo – Compare every JavaScript engine

#49

Post by senfiaj »

pygy_ wrote: post #36
senfiaj wrote: post #31

Earlier quoted context omitted.

I don't know fast it would be if it was done iteratively. But Apple's implementation has negative implications for debuggability: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe... https://webkit.org/blog/6240/ecmascript-6-proper-tail-calls-... . V8 team decided that it's not worth it, since proper stack traces (such as Error.stack) are essential for some libraries, such as Sentry (!). Removing some stac…

That argument was vaguely plausible until WebKit/JavaScriptCore shipped PTC and literally no one bat an eye. Bun users don’t care either. At this point it is pure BS.

> Bun users don’t care either.

Most Bun users don't even know about this (unless they are bitten by this). That doesn't mean absolutely no one cares or would not care even though such complaints might be uncommon.

Re: JavaScript engines zoo – Compare every JavaScript engine

#50

Post by 15155 »

simonw wrote: post #41

All these JavaScript engines and it's still remarkably hard to find a robust solution for executing JavaScript from untrusted sources inside my own server-side applications. Every time I look I find repos that look promising at first but are either unmaintained or have a team or just one or two maintainers running them as a side project. I want my sandbox to be backed by a large, well funded security team working for…

https://github.com/bellard/mquickjs

Featured recently on HN.

Post reply on HN