How Shopify Uses WebAssembly Outside of the Browser • Hacker News Board

Re: How Shopify Uses WebAssembly Outside of the Browser

#51

Post by officialchicken » Sat, Dec 19, 2020, 1:45 PM UTC

nih0 wrote: post #27

bagels wrote: post #20

Earlier quoted context omitted.

Sounds like the promises made about the jvm.

can u elaborate on these jvm promises?

The "sandbox" promise was/is still offered as the primary line of defense for Java.

"The first version of Java was released by Sun Microsystems in 1995 [2]. One year later, researchers at Princeton University identified multiple flaws enabling an analyst to bypass the sandbox [3]. The authors identified weaknesses in the language, bytecode and object initialization, to name a few, some of them still present in Java at the time of writing."[0]

[0] https://www.exploit-db.com/papers/45517

[2] http://www.oracle.com/technetwork/java/javase/overview

[3] Drew Dean, Edward W. Felten, Dan S. Wallach. "Java security: From HotJava to Netscape and beyond." In Security & Privacy, IEEE, 1996

Re: How Shopify Uses WebAssembly Outside of the Browser

#52

Post by louis-paul » Sat, Dec 19, 2020, 1:46 PM UTC

xtiansimon wrote: post #31

This is PR about Shopify’s use/promise of WebAssembly—cool. I get WebAssembly tech is cool. I’m interested why Shopify is practically the only sales platform that gets ‘airtime’ at HN. Is this because partner apps are using Ruby? Does it have something to do with the governance of Shopify? Community of Canadians on HN? I have some experience with Square, and a few others. I’m an interested party.

Do Shopify's competitors produce similarly high-quality engineering content? (if you know some, please link!)

Re: How Shopify Uses WebAssembly Outside of the Browser

#53

Post by sradman » Sat, Dec 19, 2020, 1:48 PM UTC

martin_drapeau wrote: post #14

Could someone eligthen me. Why not just use JavaScript? It is being used by Cloudflare on the edge, and AWS lambda. Why need to go to WASM?

We are talking about two alternative architectures, Cloudflare Workers and Fastly Compute@Edge, solving the same problem: how to run server-side untrusted code. Cloudflare runs a sandboxed V8 runtime in-process with its Nginx servers while Fastly chose a Function-as-Service platform using Lucet compiled WebAssembly modules with minimal runtime and fast startup. Fastly’s Varnish servers invoke FaaS modules and it sounds like Shopify's Ruby centric platform is better suited to this architecture.

Re: How Shopify Uses WebAssembly Outside of the Browser

#54

Post by gravitas » Sat, Dec 19, 2020, 1:55 PM UTC

Since we're here talking about Shopify - nearly every small shop (1-10 person makers) I buy from who uses the platform could not (in the past 30 days):

(a) change the email address associated with an existing account with history, and

(b) could not delete or change or transfer the orders from the old account to the new

I'm working through an email change and have discovered the above via hundreds of my logins - Shopify by far is the largest defunct platform which locks your account in using an email address, neither the user nor admins can "fix" it. All shop owners indicate to me they've emailed Support and gotten no help, every solution has been "just make a new account".

Re: How Shopify Uses WebAssembly Outside of the Browser

#55

Post by christophilus » Sat, Dec 19, 2020, 1:59 PM UTC

xtiansimon wrote: post #31

This is PR about Shopify’s use/promise of WebAssembly—cool. I get WebAssembly tech is cool. I’m interested why Shopify is practically the only sales platform that gets ‘airtime’ at HN. Is this because partner apps are using Ruby? Does it have something to do with the governance of Shopify? Community of Canadians on HN? I have some experience with Square, and a few others. I’m an interested party.

Amazon gets lots of airtime and is a Shopify competitor. Stripe gets lots of airtime and is a Shopify competitor.

Anyway, Shopify’s engineering blogs can be worthwhile, so they make it to the front page. They do interesting work at pretty big scale, provide in depth writeups from time to time, and folks like me enjoy reading them. I see nothing suspicious about it.

Re: How Shopify Uses WebAssembly Outside of the Browser

#56

Post by twic » Sat, Dec 19, 2020, 1:59 PM UTC

So how about garbage collection?

WASM doesn't have GC in the machine model, right? So either customers have to use a language with manual memory management, which is hard work, or use one with GC and then compile the collector into their binaries, which means bloat, and possibly a sub-par GC.

I guess what I'm saying is that it seems like it would have been better to have used a JVM.

Re: How Shopify Uses WebAssembly Outside of the Browser

#57

Post by tuwtuwtuwtuw » Sat, Dec 19, 2020, 2:02 PM UTC

gravitas wrote: post #54

Since we're here talking about Shopify - nearly every small shop (1-10 person makers) I buy from who uses the platform could not (in the past 30 days): (a) change the email address associated with an existing account with history, and (b) could not delete or change or transfer the orders from the old account to the new I'm working through an email change and have discovered the above via hundreds of my logins - Shopi…

What's the problem with making a new account? Should take a few minutes at most?

Re: How Shopify Uses WebAssembly Outside of the Browser

#58

Post by gravitas » Sat, Dec 19, 2020, 2:03 PM UTC

tuwtuwtuwtuw wrote: post #57

gravitas wrote: post #54

Since we're here talking about Shopify - nearly every small shop (1-10 person makers) I buy from who uses the platform could not (in the past 30 days): (a) change the email address associated with an existing account with history, and (b) could not delete or change or transfer the orders from the old account to the new I'm working through an email change and have discovered the above via hundreds of my logins - Shopi…

What's the problem with making a new account? Should take a few minutes at most?

Losing years worth of order history with that vendor? Having ghost accounts in a vendor database you can't delete, which has your previous order's PII (home address, etc.) tied to? The problem is not making a new account, it's appropriately dealing with the one containing personal information you're leaving behind.

Re: How Shopify Uses WebAssembly Outside of the Browser

#59

Post by tuwtuwtuwtuw » Sat, Dec 19, 2020, 2:05 PM UTC

CyberRabbi wrote: post #42

feanaro wrote: post #39

Earlier quoted context omitted.

seccomp escapes are a thing and if you're inside a restrictive environment such as WASM, it is harder to achieve it.

I think you’re referring to seccomp-bpf. seccomp has never been escaped and it is unlikely such a bug could happen due its simplicity. If you do not know the difference between seccomp and seccomp-bpf, please check references: https://en.wikipedia.org/wiki/Seccomp

Unlikely? Sounds like you think it could happen.

Re: How Shopify Uses WebAssembly Outside of the Browser

#60

Post by sradman » Sat, Dec 19, 2020, 2:12 PM UTC

xtiansimon wrote: post #31

This is PR about Shopify’s use/promise of WebAssembly—cool. I get WebAssembly tech is cool. I’m interested why Shopify is practically the only sales platform that gets ‘airtime’ at HN. Is this because partner apps are using Ruby? Does it have something to do with the governance of Shopify? Community of Canadians on HN? I have some experience with Square, and a few others. I’m an interested party.

Maybe because it is the largest platform alternative to Amazon [1]:

> The company reported that it had more than 1,000,000 businesses in approximately 175 countries using its platform as of June 2019. The total gross merchandise volume exceeded US$61 billion for calendar 2019.

[1] https://en.wikipedia.org/wiki/Shopify