Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Shopify Uses WebAssembly Outside of the Browser

shopify.engineering

Post reply on HN
Print view View original

81–90 of 135 posts

Re: How Shopify Uses WebAssembly Outside of the Browser

#81

Post by eloff »

CyberRabbi wrote: post #15
feanaro wrote: post #9

Earlier quoted context omitted.

Shopify is already a known seccomp user (for running Ruby in the mruby VM), so I think there's no reason to assume the WebAssembly runtime is not in a seccomp jail too.

That’s just redundant

I don't think you get security. It's about threat mitigation. There is nothing secure, including seccomp jails.

You want defence in depth - that is using multiple layers of defence to reduce the risk. You can never get it to 0, but if you combine two mechanisms that are each 99% effective, then your risk is now 0.01% instead of 1%. That's obviously an improvement.

You don't run your database without a password (hopefully) just because its behind a firewall. You want to have the password as well in case an attacker finds a way around your firewall (compromises a system on the inside) or you misconfigure your firewall.

Security in the physical world works the same way. You don't turn off the alarm and leave the bank doors open at the end of the day just because your vault is quite secure.

Re: How Shopify Uses WebAssembly Outside of the Browser

#82

Post by sradman »

colesantiago wrote: post #2

What does this mean for Shopify merchants? Is it all just faster apps? I'm still at a loss that Shopify still does not have a subscriptions product. :/

The article ends with:

> As we tear down the boundaries between Partners and Merchants, we connect merchants with the entrepreneurs ready to solve their problems.

"Partners" are a key part here, I think. Merchants can run their own code or possibly install 3rd party partner plugins. This is similar to the way 3rd party Wordpress Plugins work except, unlike PHP, they are small, fast, and safe. They can also run in a multi-tenant Shopify environment that scales safely.

As far as I can tell, the use case is similar to database triggers or custom web request filters: enhance the standard request flow with custom actions.

Re: How Shopify Uses WebAssembly Outside of the Browser

#83

Post by gravitas »

jeromegv wrote: post #73
gravitas wrote: post #58

Earlier quoted context omitted.

Losing years worth of order history with that vendor? Having ghost accounts in a vendor database you can't delete, which has your previous order's PII (home address, etc.) tied to? The problem is not making a new account, it's appropriately dealing with the one containing personal information you're leaving behind.

You can’t change the email on existing accounts however you can definitely delete it. See the docs https://help.shopify.com/en/manual/your-account/privacy/GDPR... Their account management is definitely poor. But you seem to make it a bigger deal than it is. You don’t have to lose the order history, even if you don’t have access to the email anymore nothing would prevent you from logging again with the user/pass. And…

> You can’t change the email on existing accounts however you can definitely delete it.

I am an end user and cannot do anything other than email the shop support and hope. I am not a resident of EU or California, you might be surprised at the vast number of websites which tell you to go pound sand if you try and delete your account. As a user, you can do nothing but hope someone deletes something for you if they feel like it; not all shop owners bother to respond as well, adding another layer of consternation.

> But you seem to make it a bigger deal than it is.

You seem to lack empathy for how other people are sensitive to their PII (which in this case may and does include credit card purchase information, shipping addresses and other "I really don't want this floating around more than I need it to be" information about my life) being retained by Shopify based stores.

The GDPR you keep leaning on to support your reply means nothing to a vast majority of the world and many sites happily only perform the minimum required actions required by law for those to whom it does apply.

Re: How Shopify Uses WebAssembly Outside of the Browser

#84

Post by azakai »

twic wrote: post #78
__s wrote: post #62

Earlier quoted context omitted.

https://github.com/WebAssembly/gc/blob/master/proposals/gc/O...

Something like this seems really important to (some branches of) the future of WASM, but this is still just a proposal, right?

It is still a proposal, but it's one of the proposals most worked on atm, there's a lot of activity.

Re: How Shopify Uses WebAssembly Outside of the Browser

#85

Post by pangoraw »

xg15 wrote: post #6
colesantiago wrote: post #2

What does this mean for Shopify merchants? Is it all just faster apps? I'm still at a loss that Shopify still does not have a subscriptions product. :/

Pro: You don't need server infrastructure to customise a Shopify flow. Con: You need coders knowledgeable in WASM. However, I could imagine that an ecosystem of "plugins" could emerge, i.e. ready-made WASM apps that merchants could plug into their stores. There might be more security issues though, if the developer of the WASM and the merchant using it aren't the same party. I think it will be interesting to see how…

I think it is why they have gone with AssemblyScript as the main supported language. Since it is similar to Typescript, Web developers will likely have a easier time learning it.

Re: How Shopify Uses WebAssembly Outside of the Browser

#86

Post by discreteevent »

MaxBarraclough wrote: post #80
jariel wrote: post #69

Earlier quoted context omitted.

? Those are reasons to use JS not WASM. "A wide ecosystem of mature language toolchains." - yes, for Javascript, not for WASM, which isn't deployed really anywhere in production and there aren't even best practices for it. What language are devs going to even write these scripts in? That's not clear. "Simplicity" - nothing is more 'simple' than JS, which is why it's used the world over. "Portability" - again, nothing…

> "Simplicity" - nothing is more 'simple' than JS, which is why it's used the world over. Not in terms of implementing the language.

Not in terms of using the language either. And the reason it is used the world over is because it was dictated to developers by browser makers. That's the single and only reason.

Re: How Shopify Uses WebAssembly Outside of the Browser

#87

Post by gfxgirl »

marcosdumay wrote: post #63
gfxgirl wrote: post #30

Earlier quoted context omitted.

Why do you need coders knowledgeable in WASM? The majority of coders will use something else (C, C++, Rust, C#, etc.) The majority of them don't need to know the details of the processor their compiler is targeting.

At the moment, knowing how to compile X to WASM and have it run is a kind of expertise. I hope that changes, the sooner the better, but right now it's not trivial.

The Blazor tutorials just run (C#). It is trivial

Same with Unity. Click build. Trivial

I suspect others are similarly trivial

Re: How Shopify Uses WebAssembly Outside of the Browser

#88

Post by lsaferite »

azangru wrote: post #50

The article starts with "what is webassembly", but doesn't breathe the keyword WASI [0], although they are using a service that's implementing it? [0] https://hacks.mozilla.org/2019/03/standardizing-wasi-a-webas...

The linked page on Lucet does call out WASI if that make it any better.

Re: How Shopify Uses WebAssembly Outside of the Browser

#89

Post by coding_lobster »

johnnycerberus wrote: post #77
sradman wrote: post #67

The underlying platform is ahead-of-time compiled WebAssembly but AssemblyScript, a variant of TypeScript, will be the only supported language: > Theoretically any language with a Wasm target can be supported, but the effort developers spend to conform to our API is better focused on solving problems for merchants. That’s why we’ve chosen to provide first class support to a single language that includes tools that ge…

Like always, browsers are a funny ecosystem and very unpredictable. In all this time I thought that I could see a rise in the adoption of C and Rust libs by the community through WASM but now instead we are building around AssemblyScript. Touche.

It's interesting that this seems on one hand "unpredictable" while also being logical. If a company has employees familiar with TypeScript (or even JS) and they have to make a choice between yet another flavor of that or a new language like C/Rust... well the choice is understandable. Once again the path of least resistance to a new web technology ended up being JavaScript - it just wasn't immediately obvious when WASM first emerged.

Re: How Shopify Uses WebAssembly Outside of the Browser

#90

Post by CyberRabbi »

eloff wrote: post #81
CyberRabbi wrote: post #15

Earlier quoted context omitted.

That’s just redundant

I don't think you get security. It's about threat mitigation. There is nothing secure, including seccomp jails. You want defence in depth - that is using multiple layers of defence to reduce the risk. You can never get it to 0, but if you combine two mechanisms that are each 99% effective, then your risk is now 0.01% instead of 1%. That's obviously an improvement. You don't run your database without a password (hopef…

I don’t think you get the difference between seccomp and seccomp-bpf
Post reply on HN